@prism-d1/cli 1.0.79 → 1.0.80

package/dist/src/utils/region.js

@@ -0,0 +1,62 @@
+/**
+ * Region templating for bootstrapper assets.
+ *
+ * The shipped workflow assets are authored against DEFAULT_REGION. Every
+ * installer that copies one into a user's repo must run the content through
+ * applyRegion() so the whole file targets a single region.
+ *
+ * Why a bare-token replace rather than per-syntax rules:
+ *
+ * The workflows spell the region three different ways -- `aws-region:` (the
+ * configure-aws-credentials input), `--region` (an AWS CLI flag), and
+ * `AWS_REGION:` / `AWS_DEFAULT_REGION:` (step-level env vars). The installers
+ * previously matched a subset each: install-github-workflows handled
+ * `aws-region:` and `--region` but not the env form, install-gitlab-workflows
+ * handled only the env form, and install-eval-harness did a raw copyFileSync
+ * with no substitution at all.
+ *
+ * A partial rewrite is worse than none. It vends OIDC credentials for the
+ * requested region while leaving the AWS Continuum scan and event-emission
+ * calls pointed at DEFAULT_REGION, so those calls run against a region where
+ * the agent space, scan bucket, and SSM parameters were never created. The
+ * eval gate then fails closed and the merge blocks -- a symptom several steps
+ * removed from a region string the installer claimed to template.
+ *
+ * Matching the bare token means a fourth spelling cannot silently escape.
+ * This is safe here because no asset embeds the region inside an ARN, Bedrock
+ * model id, or endpoint hostname -- verified by assertNoDefaultRegion() in the
+ * test suite. If that ever changes, this function needs an exclusion list
+ * rather than a looser regex.
+ *
+ * Keeping every call in one region also satisfies the regional isolation
+ * requirement that credentials and the resources they touch stay within a
+ * single region boundary (SAX-03 Outcome 3), whose named pitfall is exactly
+ * a credential in one region reaching a resource in another.
+ */
+/** The region the bootstrapper assets are authored against. */
+export const DEFAULT_REGION = 'us-west-2';
+/**
+ * Rewrites every occurrence of the authored region to `region`.
+ *
+ * Word-boundary anchored so a longer region name that merely contains the
+ * token cannot be partially rewritten.
+ */
+export function applyRegion(content, region) {
+    if (!region || region === DEFAULT_REGION)
+        return content;
+    return content.replace(new RegExp(`\\b${DEFAULT_REGION}\\b`, 'g'), region);
+}
+/**
+ * Returns the `file:line` of every surviving reference to the authored region.
+ * Used by installers to warn, and by tests to assert a clean rewrite.
+ */
+export function findDefaultRegionRefs(content, label = '') {
+    const hits = [];
+    content.split('\n').forEach((line, i) => {
+        if (new RegExp(`\\b${DEFAULT_REGION}\\b`).test(line)) {
+            hits.push(`${label}${label ? ':' : ''}${i + 1}: ${line.trim()}`);
+        }
+    });
+    return hits;
+}
+//# sourceMappingURL=region.js.map

package/dist/src/utils/region.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"region.js","sourceRoot":"","sources":["../../../src/utils/region.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,MAAc;IACzD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,cAAc;QAAE,OAAO,OAAO,CAAC;IACzD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,cAAc,KAAK,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,KAAK,GAAG,EAAE;IAC/D,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,IAAI,MAAM,CAAC,MAAM,cAAc,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prism-d1/cli",
-  "version": "1.0.79",
+  "version": "1.0.80",
   "description": "PRISM D1 Velocity CLI — AI development lifecycle assessment tool",
   "author": "andklee",
   "engines": {
@@ -22,7 +22,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "npx tsc && mkdir -p dist/assets/infra && cp -r ../bootstrapper/metric-hooks ../bootstrapper/eval-harness ../bootstrapper/github-workflows ../bootstrapper/gitlab-workflows dist/assets/ && cp -r ../infra/bin ../infra/lib ../infra/package.json ../infra/tsconfig.json ../infra/cdk.json dist/assets/infra/",
+    "build": "npx tsc && rm -rf dist/assets && mkdir -p dist/assets/infra && cp -r ../bootstrapper/metric-hooks ../bootstrapper/eval-harness ../bootstrapper/github-workflows ../bootstrapper/gitlab-workflows dist/assets/ && cp -r ../infra/bin ../infra/lib ../infra/package.json ../infra/tsconfig.json ../infra/cdk.json dist/assets/infra/",
     "prepublishOnly": "npm run build",
     "start": "tsx bin/prism-cli.ts",
     "dev": "tsx bin/prism-cli.ts"

package/dist/assets/eval-harness/README.md

@@ -1,144 +0,0 @@
-# Eval Harness
-
-Evaluate code quality in CI using either **kiro-cli headless mode** (recommended) or Amazon Bedrock rubrics.
-
-## Modes
-
-| Mode | Install Command | How It Works |
-|---|---|---|
-| **Kiro** (recommended) | `prism-cli bootstrapper install-eval-harness --mode kiro` | kiro-cli reads files, follows `.kiro/steering/code-review.md`, outputs structured JSON findings |
-| **Bedrock** (legacy) | `prism-cli bootstrapper install-eval-harness --with-rubrics` | Per-file rubric scoring via Bedrock API, weighted average client-side |
-
-## Kiro Mode
-
-```bash
-prism-cli bootstrapper install-eval-harness --mode kiro
-```
-
-This installs:
-- `.kiro/steering/code-review.md` — review rules (plain English)
-- `.github/workflows/prism-eval-gate.yml` — kiro-cli headless CI workflow
-
-**Requirements:**
-- `KIRO_API_KEY` repository secret (generate at https://app.kiro.dev → Settings → API Keys)
-- (Optional) `PRISM_METRICS_ROLE_ARN` for EventBridge metrics + AWS Continuum security scanning
-
-**How it works:**
-1. PR opened → workflow triggers
-2. kiro-cli reads changed files + the diff via `--trust-all-tools`
-3. Outputs structured JSON: findings with file/line, severity, score
-4. Gate fails if any high-severity finding or score < 0.82
-5. PR comment posted with findings table
-
-## Bedrock Mode (Legacy)
-
-## Bedrock Mode (Legacy) — Install
-
-```bash
-# Workshop mode — empty rubrics, create your own
-bash prism-cli bootstrapper install-eval-harness
-
-# Production mode — includes all 5 rubrics
-bash prism-cli bootstrapper install-eval-harness --with-rubrics
-
-# Non-interactive
-bash prism-cli bootstrapper install-eval-harness --model us.anthropic.claude-haiku-4-5-20251001-v1:0 --threshold 0.82 --with-rubrics
-```
-
-This installs into your repo:
-- `.prism/.prism/eval-harness/run-eval.sh` — evaluation script
-- `.prism/.prism/eval-harness/eval-config.json` — model, threshold, region
-- `.prism/.prism/eval-harness/rubrics/` — rubric JSON files
-- `.github/workflows/prism-eval-gate.yml` — CI workflow
-
-## Usage
-
-```bash
-# Evaluate a single file
-./.prism/.prism/eval-harness/run-eval.sh .prism/.prism/eval-harness/rubrics/code-quality.json src/handler.ts
-
-# With a spec file (for spec-compliance rubric)
-./.prism/.prism/eval-harness/run-eval.sh .prism/.prism/eval-harness/rubrics/spec-compliance.json src/api.ts --spec specs/api.md
-```
-
-### Output
-
-```
-correctness: 0.9 — Handles all inputs correctly including edge cases
-readability: 0.85 — Clear naming, minor style inconsistency in helper
-...
-
-Score: 0.8720
-Result: PASS
-Hallucinations: 0
-```
-
-Exit codes: `0` = pass, `1` = fail, `2` = error.
-
-## Configuration
-
-`eval-config.json`:
-
-| Field | Description | Default |
-|---|---|---|
-| `pass_threshold` | Minimum score to pass (0-1) | `0.82` |
-| `eval_model_id` | Bedrock model for evaluation | `us.anthropic.claude-haiku-4-5-20251001-v1:0` |
-| `aws_region` | AWS region | `us-west-2` |
-| `event_bus` | EventBridge bus name | `prism-d1-metrics` |
-| `emit_to_eventbridge` | Emit events (workflow handles this) | `true` |
-
-## Rubrics
-
-Five production rubrics are available:
-
-| Rubric | Auto-selected when file path matches |
-|---|---|
-| `code-quality.json` | Default fallback |
-| `api-response-quality.json` | `api`, `handler`, `route`, `controller` |
-| `agent-quality.json` | `agent`, `assistant`, `orchestrat`, `workflow`, `chain` |
-| `security-compliance.json` | `auth`, `security`, `guard`, `policy`, `iam`, `crypto` |
-| `spec-compliance.json` | Used when commit has `Spec-Ref:` trailer |
-
-### Creating a Custom Rubric
-
-```json
-{
-  "rubric_name": "my-rubric",
-  "criteria": [
-    {
-      "name": "criterion_name",
-      "weight": 0.30,
-      "description": "What this measures",
-      "scoring": "How to score 0.0-1.0"
-    }
-  ]
-}
-```
-
-Weights must sum to 1.0. The script calculates the weighted average client-side (does not trust the LLM to do math).
-
-## CI Workflow
-
-The `prism-eval-gate.yml` workflow:
-
-1. Detects commits with `AI-Origin:` trailers
-2. Identifies changed source files from those commits
-3. Auto-selects a rubric per file based on path
-4. Runs `run-eval.sh` per file
-5. Posts a PR comment with per-file scores
-6. Waits for AWS Security Agent review (if installed)
-7. Emits `prism.d1.eval` event to EventBridge
-8. Fails the check if any file scores below threshold or Security Agent finds issues
-
-### Requirements
-
-- OIDC provider configured for GitHub Actions
-- IAM role with `bedrock:InvokeModel` + `events:PutEvents`
-- Repository secret `PRISM_METRICS_ROLE_ARN`
-- `.prism/config.json` with `team_id`
-
-## Uninstall
-
-```bash
-bash prism-cli bootstrapper install-eval-harness --uninstall
-```

package/dist/assets/github-workflows/README.md

@@ -1,110 +0,0 @@
-# GitHub Actions Workflows
-
-Reusable GitHub Actions workflows for PRISM D1 Velocity metric collection.
-
-## Workflows
-
-| Workflow | Trigger | Purpose |
-|---|---|---|
-| `prism-ai-metrics.yml` | PR merge to main | Calculates AI-to-merge ratio, token usage, lead time. Emits `prism.d1.pr` + `prism.d1.deploy` events |
-| `prism-eval-gate.yml` | PR open/update | Evaluates AI-generated code per-file with auto-selected rubrics, waits for Security Agent, blocks merge on failure |
-| `prism-agent-eval.yml` | PR modifying agent code | Runs agent in mock mode, evaluates output with agent-quality rubric |
-| `prism-dora-weekly.yml` | Weekly (Monday 09:00 UTC) | Calculates DORA + AI-DORA metrics, emits to EventBridge + CloudWatch |
-
-## Setup
-
-### 1. Configure AWS OIDC
-
-```bash
-bash prism-cli bootstrapper setup-github-oidc
-```
-
-This interactively creates:
-- OIDC identity provider for `token.actions.githubusercontent.com`
-- IAM role `GitHubActions-<repo>` with trust policy scoped to your repo
-- Inline policy with `events:PutEvents` and `bedrock:InvokeModel`
-
-For the weekly workflow, manually add `cloudwatch:PutMetricData` to the role policy.
-
-### 2. Set Repository Secret
-
-In GitHub: Settings → Secrets and variables → Actions → New repository secret:
-
-| Secret | Value |
-|---|---|
-| `PRISM_METRICS_ROLE_ARN` | ARN printed by `setup-github-oidc` |
-
-### 3. Install Git Hooks + Config
-
-```bash
-bash prism-cli bootstrapper install-git-hooks
-```
-
-Creates `.prism/config.json` with your team ID (read by all workflows).
-
-### 4. Install Eval Harness
-
-```bash
-# Workshop mode — bring your own rubric
-bash prism-cli bootstrapper install-eval-harness
-
-# Production mode — includes all 5 rubrics
-bash prism-cli bootstrapper install-eval-harness --with-rubrics
-```
-
-This copies `.prism/eval-harness/`, `eval-config.json`, rubrics, and the `prism-eval-gate.yml` workflow.
-
-### 5. Copy Remaining Workflows
-
-```bash
-mkdir -p .github/workflows
-cp bootstrapper/github-workflows/prism-ai-metrics.yml .github/workflows/
-cp bootstrapper/github-workflows/prism-dora-weekly.yml .github/workflows/
-# Optional — only if you have agents with --mock support:
-cp bootstrapper/github-workflows/prism-agent-eval.yml .github/workflows/
-```
-
-## IAM Permissions
-
-The OIDC role needs:
-
-| Permission | Used by |
-|---|---|
-| `events:PutEvents` | All workflows |
-| `bedrock:InvokeModel` | eval-gate, agent-eval |
-| `cloudwatch:PutMetricData` | dora-weekly |
-
-## Customization
-
-| Setting | How |
-|---|---|
-| Branch | Edit `branches` in each workflow |
-| AWS region | Edit `aws-region` field + EventBridge commands |
-| Eval threshold | Edit `.prism/.prism/eval-harness/eval-config.json` → `pass_threshold` |
-| Eval model | Edit `.prism/.prism/eval-harness/eval-config.json` → `eval_model_id` |
-| Weekly schedule | Edit cron in `prism-dora-weekly.yml` (default: `0 9 * * 1`) |
-
-## Events Emitted
-
-| Detail Type | Source Workflow | Destination |
-|---|---|---|
-| `prism.d1.pr` | ai-metrics | EventBridge |
-| `prism.d1.deploy` | ai-metrics | EventBridge |
-| `prism.d1.eval` | eval-gate | EventBridge |
-| `prism.d1.agent.eval` | agent-eval | EventBridge |
-| `prism.d1.assessment` | dora-weekly | EventBridge |
-| `prism.d1.security.code_review` | eval-gate (Security Agent) | EventBridge |
-| `AIAdoptionRate`, `SpecCoverage`, tool counts | dora-weekly | CloudWatch |
-
-All EventBridge events use source `prism.d1.velocity` and bus `prism-d1-metrics`.
-
-## Troubleshooting
-
-| Issue | Solution |
-|---|---|
-| OIDC auth fails | Verify trust policy `sub` matches `repo:org/repo:*` |
-| EventBridge put fails | Check `events:PutEvents` on bus ARN |
-| Eval gate always skips | Ensure commits have `AI-Origin:` trailers (install git hooks) |
-| Weekly not running | Workflow must exist on default branch; test with `workflow_dispatch` |
-| Agent eval skips | No `agent/main.py` found — add `--mock` support to your agent |
-| Security Agent timeout | Agent takes 2+ min to start; workflow waits up to 12 min total |

package/dist/assets/github-workflows/prism-dora-weekly.yml

@@ -1,334 +0,0 @@
-# prism-dora-weekly.yml — Weekly DORA + AI-DORA metrics assessment.
-#
-# Copy this file to .github/workflows/prism-dora-weekly.yml in your repo.
-#
-# Methodology:
-#   - Deployment Frequency: merged PRs to main (proxy for deploys)
-#   - Lead Time: avg hours from PR open to merge
-#   - Change Failure Rate: PRs with "revert|hotfix|rollback" in title / total merged
-#   - MTTR: avg lead time of revert/hotfix PRs
-#   - AI metrics: derived from AI-Origin commit trailers
-#
-# Required setup:
-#   - OIDC provider configured for GitHub Actions in your AWS account
-#   - IAM role with events:PutEvents and cloudwatch:PutMetricData permissions
-#   - Repository secret PRISM_METRICS_ROLE_ARN set to the OIDC role ARN
-#   - .prism/config.json committed to the repo (created by: bash prism-cli bootstrapper install-git-hooks)
-
-name: PRISM DORA Weekly Assessment
-
-on:
-  schedule:
-    - cron: '0 9 * * 1'  # Every Monday at 09:00 UTC
-  workflow_dispatch:       # Allow manual trigger
-
-permissions:
-  id-token: write
-  contents: read
-  pull-requests: read
-
-jobs:
-  dora-assessment:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-
-      - name: Configure AWS credentials (OIDC)
-        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
-        with:
-          role-to-assume: ${{ secrets.PRISM_METRICS_ROLE_ARN }}
-          aws-region: us-west-2
-
-      - name: Read team ID from .prism/config.json
-        id: prism-config
-        run: |
-          if [[ -f .prism/config.json ]]; then
-            TEAM_ID=$(jq -r '.team_id' .prism/config.json)
-          else
-            echo "::error::.prism/config.json not found. Run bootstrapper/metric-hooks/install.sh first."
-            exit 1
-          fi
-          echo "team_id=${TEAM_ID}" >> "$GITHUB_OUTPUT"
-
-      - name: Calculate DORA metrics (past 7 days)
-        id: dora
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          set -o pipefail
-          SINCE=$(date -u -d '7 days ago' +"%Y-%m-%dT%H:%M:%SZ")
-          NOW=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-          REPO="${{ github.repository }}"
-
-          echo "Assessment period: ${SINCE} to ${NOW}"
-
-          # ---------------------------------------------------------------
-          # 1. Deployment Frequency — merged PRs to main (proxy for deploys)
-          # ---------------------------------------------------------------
-          MERGED_PRS=$(gh pr list --repo "${REPO}" --state merged --base main \
-            --search "merged:>=${SINCE}" --json number,title,mergedAt --limit 200 2>/dev/null || echo "[]")
-          DEPLOY_COUNT=$(echo "${MERGED_PRS}" | jq 'length')
-          DEPLOY_FREQUENCY=$(echo "scale=2; ${DEPLOY_COUNT} / 7" | bc -l | sed 's/^\./0./')
-
-          # ---------------------------------------------------------------
-          # 2. Lead Time for Changes — avg time from PR open to merge
-          # ---------------------------------------------------------------
-          LEAD_TIMES=$(gh pr list --repo "${REPO}" --state merged --base main \
-            --search "merged:>=${SINCE}" --json createdAt,mergedAt --limit 200 2>/dev/null || echo "[]")
-
-          AVG_LEAD_TIME_HOURS=$(echo "${LEAD_TIMES}" | jq '
-            if length == 0 then 0
-            else
-              [.[] |
-                (((.mergedAt | sub("\\.[0-9]+Z$"; "Z") | strptime("%Y-%m-%dT%H:%M:%SZ") | mktime) -
-                  (.createdAt | sub("\\.[0-9]+Z$"; "Z") | strptime("%Y-%m-%dT%H:%M:%SZ") | mktime)) / 3600)
-              ] | add / length | . * 100 | round / 100
-            end
-          ')
-
-          # ---------------------------------------------------------------
-          # 3. Change Failure Rate — PRs with "revert" or "hotfix" in title
-          # ---------------------------------------------------------------
-          FAILURE_PRS=$(echo "${MERGED_PRS}" | jq '[.[] | select(.title? // "" | test("revert|hotfix|rollback"; "i"))] | length' 2>/dev/null || echo "0")
-          if [[ "${DEPLOY_COUNT}" -gt 0 ]]; then
-            CHANGE_FAILURE_RATE=$(echo "scale=4; ${FAILURE_PRS} / ${DEPLOY_COUNT}" | bc -l | sed 's/^\./0./')
-          else
-            CHANGE_FAILURE_RATE="0"
-          fi
-
-          # ---------------------------------------------------------------
-          # 4. Mean Time to Recovery — avg time for hotfix/revert PRs
-          # ---------------------------------------------------------------
-          RECOVERY_TIMES=$(gh pr list --repo "${REPO}" --state merged --base main \
-            --search "merged:>=${SINCE}" --json title,createdAt,mergedAt --limit 200 2>/dev/null \
-            | jq '[.[] | select(.title | test("revert|hotfix|rollback"; "i"))]')
-
-          MTTR_HOURS=$(echo "${RECOVERY_TIMES}" | jq '
-            if length == 0 then 0
-            else
-              [.[] |
-                (((.mergedAt | sub("\\.[0-9]+Z$"; "Z") | strptime("%Y-%m-%dT%H:%M:%SZ") | mktime) -
-                  (.createdAt | sub("\\.[0-9]+Z$"; "Z") | strptime("%Y-%m-%dT%H:%M:%SZ") | mktime)) / 3600)
-              ] | add / length | . * 100 | round / 100
-            end
-          ')
-
-          echo "deploy_count=${DEPLOY_COUNT}" >> "$GITHUB_OUTPUT"
-          echo "deploy_frequency=${DEPLOY_FREQUENCY}" >> "$GITHUB_OUTPUT"
-          echo "avg_lead_time_hours=${AVG_LEAD_TIME_HOURS}" >> "$GITHUB_OUTPUT"
-          echo "change_failure_rate=${CHANGE_FAILURE_RATE}" >> "$GITHUB_OUTPUT"
-          echo "mttr_hours=${MTTR_HOURS}" >> "$GITHUB_OUTPUT"
-
-      - name: Calculate AI-DORA metrics (past 7 days)
-        id: ai-dora
-        run: |
-          set -o pipefail
-          SINCE_DATE=$(date -u -d '7 days ago' +"%Y-%m-%d")
-
-          # All commits in the past 7 days on main
-          TOTAL_COMMITS=$(git log --since="${SINCE_DATE}" --oneline main 2>/dev/null | wc -l | tr -d ' ')
-
-          # AI-origin breakdown — count per-commit to avoid overcounting
-          AI_GENERATED=0
-          AI_ASSISTED=0
-          HUMAN_ONLY=0
-          SPEC_REFS=0
-          CLAUDE_CODE_COUNT=0
-          KIRO_COUNT=0
-          Q_DEV_COUNT=0
-
-          for SHA in $(git log --since="${SINCE_DATE}" --format='%H' main 2>/dev/null); do
-            MSG=$(git log -1 --format='%B' "${SHA}")
-            if echo "${MSG}" | grep -q '^AI-Origin: ai-generated'; then
-              AI_GENERATED=$((AI_GENERATED + 1))
-            elif echo "${MSG}" | grep -q '^AI-Origin: ai-assisted'; then
-              AI_ASSISTED=$((AI_ASSISTED + 1))
-            elif echo "${MSG}" | grep -q '^AI-Origin: human'; then
-              HUMAN_ONLY=$((HUMAN_ONLY + 1))
-            fi
-            echo "${MSG}" | grep -q '^Spec-Ref:' && SPEC_REFS=$((SPEC_REFS + 1))
-            TOOL=$(echo "${MSG}" | grep -oP '(?<=^AI-Tool: ).+' || true)
-            case "${TOOL}" in
-              *claude-code*) CLAUDE_CODE_COUNT=$((CLAUDE_CODE_COUNT + 1)) ;;
-              *kiro*)        KIRO_COUNT=$((KIRO_COUNT + 1)) ;;
-              *q-developer*) Q_DEV_COUNT=$((Q_DEV_COUNT + 1)) ;;
-            esac
-          done
-
-          UNTAGGED=$((TOTAL_COMMITS - AI_GENERATED - AI_ASSISTED - HUMAN_ONLY))
-          [[ "${UNTAGGED}" -lt 0 ]] && UNTAGGED=0
-
-          AI_TOTAL=$((AI_GENERATED + AI_ASSISTED))
-          if [[ "${TOTAL_COMMITS}" -gt 0 ]]; then
-            AI_ADOPTION_RATE=$(echo "scale=4; ${AI_TOTAL} / ${TOTAL_COMMITS}" | bc -l | sed 's/^\./0./')
-          else
-            AI_ADOPTION_RATE="0"
-          fi
-
-          AI_TO_MERGE_RATIO="${AI_ADOPTION_RATE}"
-
-          if [[ "${TOTAL_COMMITS}" -gt 0 ]]; then
-            SPEC_COVERAGE=$(echo "scale=4; ${SPEC_REFS} / ${TOTAL_COMMITS}" | bc -l | sed 's/^\./0./')
-          else
-            SPEC_COVERAGE="0"
-          fi
-
-          echo "total_commits=${TOTAL_COMMITS}" >> "$GITHUB_OUTPUT"
-          echo "ai_generated=${AI_GENERATED}" >> "$GITHUB_OUTPUT"
-          echo "ai_assisted=${AI_ASSISTED}" >> "$GITHUB_OUTPUT"
-          echo "human_only=${HUMAN_ONLY}" >> "$GITHUB_OUTPUT"
-          echo "untagged=${UNTAGGED}" >> "$GITHUB_OUTPUT"
-          echo "ai_adoption_rate=${AI_ADOPTION_RATE}" >> "$GITHUB_OUTPUT"
-          echo "ai_to_merge_ratio=${AI_TO_MERGE_RATIO}" >> "$GITHUB_OUTPUT"
-          echo "spec_coverage=${SPEC_COVERAGE}" >> "$GITHUB_OUTPUT"
-          echo "claude_code_count=${CLAUDE_CODE_COUNT}" >> "$GITHUB_OUTPUT"
-          echo "kiro_count=${KIRO_COUNT}" >> "$GITHUB_OUTPUT"
-          echo "q_dev_count=${Q_DEV_COUNT}" >> "$GITHUB_OUTPUT"
-
-      - name: Emit prism.d1.assessment event
-        run: |
-          TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-
-          ASSESSMENT_EVENT=$(jq -n \
-            --arg team_id "${{ steps.prism-config.outputs.team_id }}" \
-            --arg repo "${{ github.repository }}" \
-            --arg timestamp "${TIMESTAMP}" \
-            --argjson deploy_count "${{ steps.dora.outputs.deploy_count }}" \
-            --argjson deploy_frequency "${{ steps.dora.outputs.deploy_frequency }}" \
-            --argjson avg_lead_time_hours "${{ steps.dora.outputs.avg_lead_time_hours }}" \
-            --argjson change_failure_rate "${{ steps.dora.outputs.change_failure_rate }}" \
-            --argjson mttr_hours "${{ steps.dora.outputs.mttr_hours }}" \
-            --argjson total_commits "${{ steps.ai-dora.outputs.total_commits }}" \
-            --argjson ai_generated "${{ steps.ai-dora.outputs.ai_generated }}" \
-            --argjson ai_assisted "${{ steps.ai-dora.outputs.ai_assisted }}" \
-            --argjson human_only "${{ steps.ai-dora.outputs.human_only }}" \
-            --argjson untagged "${{ steps.ai-dora.outputs.untagged }}" \
-            --argjson ai_adoption_rate "${{ steps.ai-dora.outputs.ai_adoption_rate }}" \
-            --argjson ai_to_merge_ratio "${{ steps.ai-dora.outputs.ai_to_merge_ratio }}" \
-            --argjson spec_coverage "${{ steps.ai-dora.outputs.spec_coverage }}" \
-            --argjson claude_code_count "${{ steps.ai-dora.outputs.claude_code_count }}" \
-            --argjson kiro_count "${{ steps.ai-dora.outputs.kiro_count }}" \
-            --argjson q_dev_count "${{ steps.ai-dora.outputs.q_dev_count }}" \
-            '{
-              "team_id": $team_id,
-              "repo": $repo,
-              "timestamp": $timestamp,
-              "prism_level": 2,
-              "metric": {
-                "name": "weekly_assessment",
-                "value": 1,
-                "unit": "assessment"
-              },
-              "dora": {
-                "deployment_frequency": $deploy_frequency,
-                "deployments": $deploy_count,
-                "lead_time_hours": $avg_lead_time_hours,
-                "change_failure_rate": $change_failure_rate,
-                "mttr_hours": $mttr_hours
-              },
-              "ai_dora": {
-                "ai_adoption_rate": $ai_adoption_rate,
-                "ai_to_merge_ratio": $ai_to_merge_ratio,
-                "total_commits": $total_commits,
-                "ai_generated_commits": $ai_generated,
-                "ai_assisted_commits": $ai_assisted,
-                "human_commits": $human_only,
-                "untagged_commits": $untagged,
-                "spec_coverage": $spec_coverage,
-                "tool_breakdown": {
-                  "claude_code": $claude_code_count,
-                  "kiro": $kiro_count,
-                  "q_developer": $q_dev_count
-                }
-              }
-            }')
-
-          aws events put-events \
-            --region us-west-2 \
-            --entries "[{
-              \"Source\": \"prism.d1.velocity\",
-              \"DetailType\": \"prism.d1.assessment\",
-              \"EventBusName\": \"prism-d1-metrics\",
-              \"Detail\": $(echo "${ASSESSMENT_EVENT}" | jq -c '.' | jq -Rs '.')
-            }]"
-
-          echo "Weekly DORA assessment emitted successfully."
-
-      - name: Emit tool breakdown and adoption metrics to CloudWatch
-        run: |
-          TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
-          TEAM_ID="${{ steps.prism-config.outputs.team_id }}"
-          REPO="${{ github.repository }}"
-          NAMESPACE="PRISM/D1/Velocity"
-
-          # AI Adoption Rate
-          aws cloudwatch put-metric-data \
-            --region us-west-2 \
-            --namespace "${NAMESPACE}" \
-            --metric-data "[{
-              \"MetricName\": \"AIAdoptionRate\",
-              \"Value\": ${{ steps.ai-dora.outputs.ai_adoption_rate }},
-              \"Unit\": \"Percent\",
-              \"Timestamp\": \"${TIMESTAMP}\",
-              \"Dimensions\": [
-                {\"Name\": \"TeamId\", \"Value\": \"${TEAM_ID}\"},
-                {\"Name\": \"Repository\", \"Value\": \"${REPO}\"}
-              ]
-            }]"
-
-          # Spec Coverage
-          aws cloudwatch put-metric-data \
-            --region us-west-2 \
-            --namespace "${NAMESPACE}" \
-            --metric-data "[{
-              \"MetricName\": \"SpecCoverage\",
-              \"Value\": ${{ steps.ai-dora.outputs.spec_coverage }},
-              \"Unit\": \"Percent\",
-              \"Timestamp\": \"${TIMESTAMP}\",
-              \"Dimensions\": [
-                {\"Name\": \"TeamId\", \"Value\": \"${TEAM_ID}\"},
-                {\"Name\": \"Repository\", \"Value\": \"${REPO}\"}
-              ]
-            }]"
-
-          # Tool breakdown — one metric per tool
-          for TOOL_DATA in \
-            "ClaudeCodeCommits:${{ steps.ai-dora.outputs.claude_code_count }}" \
-            "KiroCommits:${{ steps.ai-dora.outputs.kiro_count }}" \
-            "QDeveloperCommits:${{ steps.ai-dora.outputs.q_dev_count }}" \
-            "UntaggedCommits:${{ steps.ai-dora.outputs.untagged }}"; do
-
-            METRIC_NAME="${TOOL_DATA%%:*}"
-            METRIC_VALUE="${TOOL_DATA##*:}"
-
-            aws cloudwatch put-metric-data \
-              --region us-west-2 \
-              --namespace "${NAMESPACE}" \
-              --metric-data "[{
-                \"MetricName\": \"${METRIC_NAME}\",
-                \"Value\": ${METRIC_VALUE},
-                \"Unit\": \"Count\",
-                \"Timestamp\": \"${TIMESTAMP}\",
-                \"Dimensions\": [
-                  {\"Name\": \"TeamId\", \"Value\": \"${TEAM_ID}\"},
-                  {\"Name\": \"Repository\", \"Value\": \"${REPO}\"}
-                ]
-              }]"
-          done
-
-          echo "Tool breakdown and adoption metrics emitted to CloudWatch."
-          echo ""
-          echo "=== DORA Metrics ==="
-          echo "Deployment Frequency: ${{ steps.dora.outputs.deploy_frequency }}/day"
-          echo "Lead Time: ${{ steps.dora.outputs.avg_lead_time_hours }} hours"
-          echo "Change Failure Rate: ${{ steps.dora.outputs.change_failure_rate }}"
-          echo "MTTR: ${{ steps.dora.outputs.mttr_hours }} hours"
-          echo ""
-          echo "=== AI-DORA Metrics ==="
-          echo "AI Adoption Rate: ${{ steps.ai-dora.outputs.ai_adoption_rate }}"
-          echo "AI-to-Merge Ratio: ${{ steps.ai-dora.outputs.ai_to_merge_ratio }}"
-          echo "Spec Coverage: ${{ steps.ai-dora.outputs.spec_coverage }}"
-          echo "Total Commits: ${{ steps.ai-dora.outputs.total_commits }}"