@prism-d1/cli 1.0.79 → 1.0.81

package/dist/assets/infra/lib/dashboard-stack.ts

@@ -9,6 +9,8 @@ const DEFAULT_PERIOD = cdk.Duration.hours(1);
 export interface DashboardStackProps extends cdk.StackProps {
   /** ARN of the productivity custom-widget Lambda (from the OTEL collector construct). */
   readonly productivityWidgetArn?: string;
+  /** ARN of the Team Velocity custom-widget Lambda (DDB-backed panels). */
+  readonly velocityWidgetArn?: string;
 }
 
 export class DashboardStack extends cdk.Stack {
@@ -36,1243 +38,433 @@ export class DashboardStack extends cdk.Stack {
       defaultInterval: cdk.Duration.days(7),
     });
 
-    // --- AI Acceptance Rate (time series) ---
-    const aiAcceptanceMetric = new cloudwatch.Metric({
-      namespace: METRIC_NAMESPACE,
-      metricName: 'AIAcceptanceRate',
-      statistic: 'Average',
-      period: DEFAULT_PERIOD,
-      label: 'AI Acceptance Rate (%)',
-    });
+    // --- Hybrid layout ---
+    // KPI and detail panels are DDB-backed custom widgets (velocity-widget
+    // Lambda) reading the events table via the by-detail-type GSI: full
+    // 365-day history, real event timestamps, no CloudWatch metric-dimension
+    // matching, and honest empty states naming the missing emitter. Native
+    // graphs are retained only for attribution/OTEL-fed series, which are
+    // dimensionless and verified live. Access to panel data is gated by
+    // lambda:InvokeFunction on the widget Lambda (viewer's IAM creds).
+    const velocityPanel = (title: string, view: string, height: number): cloudwatch.CustomWidget =>
+      new cloudwatch.CustomWidget({
+        functionArn: props?.velocityWidgetArn ?? '',
+        title,
+        width: 24,
+        height,
+        params: { view },
+        updateOnRefresh: true,
+        updateOnResize: false,
+        updateOnTimeRangeChange: true,
+      });
 
     teamDashboard.addWidgets(
       new cloudwatch.TextWidget({
-        markdown: '# PRISM D1 - Team Velocity Dashboard\nReal-time AI-enhanced DORA metrics for engineering teams.',
+        markdown:
+          '# PRISM D1 - Team Velocity Dashboard\n' +
+          'Delivery health: DORA proxies, AI-DORA quality, eval gates, governance, security. ' +
+          'Spend and per-developer output live on **PRISM-D1-Developer-Productivity**.',
         width: 24,
-        height: 1,
+        height: 2,
       }),
     );
 
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'AI Acceptance Rate',
-        left: [aiAcceptanceMetric],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, max: 100, label: 'Percent' },
-        statistic: 'Average',
-        period: DEFAULT_PERIOD,
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Deployment Frequency',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'DeploymentFrequency',
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: 'Deploys / Day',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        view: cloudwatch.GraphWidgetView.BAR,
-        leftYAxis: { min: 0, label: 'Deployments' },
-      }),
-    );
+    if (props?.velocityWidgetArn) {
+      // Row 1: DORA proxy KPIs (merge frequency, PR cycle time, revert rate/turnaround)
+      teamDashboard.addWidgets(velocityPanel('Delivery KPIs (DORA proxies)', 'dora', 4));
+      // Row 2: AI-DORA KPIs (attribution store + eval events, L2/L4 coloring)
+      teamDashboard.addWidgets(velocityPanel('AI-DORA KPIs', 'aidora', 4));
+    }
 
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Lead Time for Changes',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'LeadTimeForChanges',
-            statistic: 'Average',
-            period: DEFAULT_PERIOD,
-            label: 'Lead Time (seconds)',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Seconds' },
-      }),
-      new cloudwatch.GaugeWidget({
-        title: 'Eval Gate Pass Rate',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'EvalGatePassRate',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Eval Pass Rate (%)',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, max: 100 },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'AI Test Coverage Delta',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AITestCoverageDelta',
-            statistic: 'Average',
-            period: DEFAULT_PERIOD,
-            label: 'Coverage Delta (%)',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { label: 'Percent' },
-      }),
-    );
+    // Row 3: native graphs — attribution/OTEL-fed series only. These are the
+    // dimensionless series published by the attribution/OTEL publishers, so
+    // plain (dimensionless) metric queries match. FILL/IF guards throughout:
+    // commit data is sparse and an unguarded ratio renders NaN on empty
+    // buckets; FILL(..., REPEAT) carries the last value through gap days so
+    // the series draws a line instead of invisible isolated dots.
+    const dailySum = (metricName: string, label?: string): cloudwatch.Metric =>
+      new cloudwatch.Metric({
+        namespace: METRIC_NAMESPACE,
+        metricName,
+        statistic: 'Sum',
+        period: cdk.Duration.days(1),
+        ...(label ? { label } : {}),
+      });
 
-    // --- Additional team metrics row ---
     teamDashboard.addWidgets(
       new cloudwatch.GraphWidget({
-        title: 'Change Failure Rate',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'ChangeFailureRate',
-            statistic: 'Average',
-            period: DEFAULT_PERIOD,
-            label: 'Change Failure Rate (%)',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, max: 100, label: 'Percent' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Mean Time to Recovery',
+        title: 'Commits / Day (AI vs Human)',
         left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'MTTR',
-            statistic: 'Average',
-            period: DEFAULT_PERIOD,
-            label: 'MTTR (seconds)',
-          }),
+          dailySum('AICommits', 'AI commits'),
+          dailySum('HumanCommits', 'Human commits'),
         ],
+        view: cloudwatch.GraphWidgetView.BAR,
+        stacked: true,
         width: 8,
         height: 6,
-        leftYAxis: { min: 0, label: 'Seconds' },
+        leftYAxis: { min: 0, label: 'Commits' },
       }),
       new cloudwatch.GraphWidget({
-        title: 'AI to Merge Ratio',
+        title: 'Merge Ratio: AI vs Human',
         left: [
-          // Line 1: CI-fed metric (git trailers, computed per PR at merge time
-          // by prism-ai-metrics.yml). Requires an instrumented repo.
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AIToMergeRatio',
-            statistic: 'Average',
-            period: DEFAULT_PERIOD,
-            label: 'CI (git trailers, per-PR)',
-          }),
-          // Line 2: attribution-derived (codeburn spans, fleet aggregate).
-          // Populates for any user running `codeburn sync --attribution`.
-          // Divergence from line 1 indicates attribution coverage gaps.
-          // Inner FILL/IF: avoid NaN on empty buckets (gap, not 0). Outer
-          // FILL(..., REPEAT): carry the last ratio forward through gap days —
-          // commit data is sparse, and CloudWatch renders an isolated
-          // datapoint between gaps as an invisible dot, not a line.
+          // Both lines from attribution spans. Divergence is the signal:
+          // AI code merging at a materially lower rate than human code means
+          // review friction or quality problems, not just "AI is used a lot".
           new cloudwatch.MathExpression({
             expression: 'FILL(IF(FILL(aiCommits, 0) > 0, 100 * FILL(mergedAi, 0) / FILL(aiCommits, 0)), REPEAT)',
             usingMetrics: {
-              mergedAi: new cloudwatch.Metric({
-                namespace: METRIC_NAMESPACE,
-                metricName: 'MergedAICommits',
-                statistic: 'Sum',
-                period: cdk.Duration.days(1),
-              }),
-              aiCommits: new cloudwatch.Metric({
-                namespace: METRIC_NAMESPACE,
-                metricName: 'AICommits',
-                statistic: 'Sum',
-                period: cdk.Duration.days(1),
-              }),
+              mergedAi: dailySum('MergedAICommits'),
+              aiCommits: dailySum('AICommits'),
             },
-            label: 'Attribution (codeburn spans)',
+            label: 'AI merge rate (%)',
             period: cdk.Duration.days(1),
           }),
-        ],
-        width: 6,
-        height: 6,
-        leftYAxis: { min: 0, max: 100, label: 'Percent' },
-      }),
-      // KPI card: the aggregate ratio over the whole displayed time range.
-      // Always shows a number regardless of how sparse the daily series is —
-      // the graph next door can render near-empty when the range holds only
-      // isolated datapoints.
-      new cloudwatch.SingleValueWidget({
-        title: 'AI Merge Rate (range)',
-        metrics: [
           new cloudwatch.MathExpression({
-            expression: 'IF(FILL(aiCommitsKpi, 0) > 0, 100 * FILL(mergedAiKpi, 0) / FILL(aiCommitsKpi, 0))',
+            expression: 'FILL(IF(FILL(humanCommits, 0) > 0, 100 * FILL(mergedHuman, 0) / FILL(humanCommits, 0)), REPEAT)',
             usingMetrics: {
-              mergedAiKpi: new cloudwatch.Metric({
-                namespace: METRIC_NAMESPACE,
-                metricName: 'MergedAICommits',
-                statistic: 'Sum',
-                period: cdk.Duration.days(1),
-              }),
-              aiCommitsKpi: new cloudwatch.Metric({
-                namespace: METRIC_NAMESPACE,
-                metricName: 'AICommits',
-                statistic: 'Sum',
-                period: cdk.Duration.days(1),
-              }),
+              mergedHuman: dailySum('MergedHumanCommits'),
+              humanCommits: dailySum('HumanCommits'),
             },
-            label: 'Merged AI / AI commits (%)',
-            period: cdk.Duration.days(1),
-          }),
-        ],
-        setPeriodToTimeRange: true,
-        width: 2,
-        height: 6,
-      }),
-    );
-
-    // --- Agent Metrics Row ---
-    const teamId = 'ALL';
-    const repository = 'ALL';
-
-    teamDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### AI Token Usage & Cost',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'AI Input Tokens',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AIInputTokens',
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: 'Input Tokens',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Tokens' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'AI Output Tokens',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AIOutputTokens',
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: 'Output Tokens',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Tokens' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'AI Cost (USD)',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AICostUSD',
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: 'Cost (USD)',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, label: 'USD' },
-      }),
-    );
-
-    // Cost breakdowns by Tool and Model. SEARCH expressions auto-discover
-    // every dimension value, so new tools/models appear without dashboard
-    // changes. These series are populated by the otel-metrics-publisher
-    // (deployed by default; skip with -c skipOtelCollector=true); the trailer
-    // path has no per-tool/per-model breakdown and leaves these widgets empty.
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'AI Cost by Tool (USD)',
-        left: [
-          new cloudwatch.MathExpression({
-            expression: `SEARCH('{${METRIC_NAMESPACE},Tool} MetricName="AICostUSD"', 'Sum')`,
-            usingMetrics: {},
-            // Dynamic label: each discovered series is legend-labeled with
-            // its Tool dimension value (e.g. "claude-code").
-            label: "${PROP('Dim.Tool')}",
-            period: cdk.Duration.days(1),
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'USD' },
-        legendPosition: cloudwatch.LegendPosition.RIGHT,
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'AI Cost by Model (USD)',
-        left: [
-          new cloudwatch.MathExpression({
-            expression: `SEARCH('{${METRIC_NAMESPACE},Model} MetricName="AICostUSD"', 'Sum')`,
-            usingMetrics: {},
-            // Dynamic label: each discovered series is legend-labeled with
-            // its Model dimension value (e.g. "claude-sonnet-4-5-20250929").
-            label: "${PROP('Dim.Model')}",
-            period: cdk.Duration.days(1),
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'USD' },
-        legendPosition: cloudwatch.LegendPosition.RIGHT,
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### Agent Operations',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Agent Invocations',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AgentInvocationCount',
-            dimensionsMap: { TeamId: teamId, Repository: repository },
-            statistic: 'Sum',
-            period: DEFAULT_PERIOD,
-            label: 'Invocations',
-          }),
-        ],
-        width: 8,
-        height: 6,
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Agent Success Rate',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AgentSuccessRate',
-            dimensionsMap: { TeamId: teamId, Repository: repository },
-            statistic: 'Average',
-            period: DEFAULT_PERIOD,
-            label: 'Success Rate (%)',
-          }),
-        ],
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, max: 100, label: 'Percent' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Agent Avg Duration',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AgentDurationMs',
-            dimensionsMap: { TeamId: teamId, Repository: repository },
-            statistic: 'Average',
-            period: DEFAULT_PERIOD,
-            label: 'Duration (ms)',
-          }),
-        ],
-        width: 8,
-        height: 6,
-      }),
-    );
-
-    // =======================================================
-    // Dashboard 2: Executive Readout
-    // =======================================================
-    const execDashboard = new cloudwatch.Dashboard(this, 'ExecutiveReadoutDashboard', {
-      dashboardName: 'PRISM-D1-Executive-Readout',
-      defaultInterval: cdk.Duration.days(30),
-    });
-
-    execDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '# PRISM D1 - Executive Readout\nLeadership view of AI-assisted engineering velocity and DORA performance.',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    // --- PRISM Level Progress + Enhanced DORA Summary row ---
-    execDashboard.addWidgets(
-      new cloudwatch.SingleValueWidget({
-        title: 'PRISM Level Progress',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'PRISMLevel',
-            statistic: 'Maximum',
-            period: cdk.Duration.days(1),
-            label: 'Current PRISM Level',
-          }),
-        ],
-        width: 6,
-        height: 4,
-      }),
-      new cloudwatch.SingleValueWidget({
-        title: 'Enhanced DORA Summary',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'DeploymentFrequency',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Deploy Freq (7d)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'LeadTimeForChanges',
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'Avg Lead Time (s)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'ChangeFailureRate',
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'Change Fail Rate (%)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'MTTR',
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'Avg MTTR (s)',
-          }),
-        ],
-        width: 12,
-        height: 4,
-      }),
-      new cloudwatch.SingleValueWidget({
-        title: 'AI Cost & Cycle Time',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AICostUSD',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Total AI Cost (7d, USD)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SpecToCodeHours',
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'Avg Spec-to-Code (hrs)',
-          }),
-        ],
-        width: 6,
-        height: 4,
-      }),
-    );
-
-    // --- AI Contribution Trend + Feature Cycle Time Trend ---
-    execDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'AI Contribution Trend',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AIAcceptanceRate',
-            statistic: 'Average',
+            label: 'Human merge rate (%)',
             period: cdk.Duration.days(1),
-            label: 'AI Acceptance Rate (%)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AIToMergeRatio',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'AI-to-Merge Ratio (CI, %)',
-          }),
-          new cloudwatch.MathExpression({
-            expression: 'IF(FILL(execAiCommits, 0) > 0, 100 * FILL(execMergedAi, 0) / FILL(execAiCommits, 0))',
-            usingMetrics: {
-              execMergedAi: new cloudwatch.Metric({
-                namespace: METRIC_NAMESPACE,
-                metricName: 'MergedAICommits',
-                statistic: 'Sum',
-                period: cdk.Duration.days(1),
-              }),
-              execAiCommits: new cloudwatch.Metric({
-                namespace: METRIC_NAMESPACE,
-                metricName: 'AICommits',
-                statistic: 'Sum',
-                period: cdk.Duration.days(1),
-              }),
-            },
-            label: 'AI-to-Merge Ratio (Attribution, %)',
-            period: cdk.Duration.days(1),
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AITestCoverageDelta',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'AI Test Coverage Delta (%)',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, max: 100, label: 'Percent' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Feature Cycle Time Trend',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SpecToCodeHours',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Spec-to-Code (hrs)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'LeadTimeForChanges',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Lead Time (seconds)',
-          }),
-        ],
-        width: 12,
-        height: 6,
-      }),
-    );
-
-    // --- Eval gate, quality, and cost trend row ---
-    execDashboard.addWidgets(
-      new cloudwatch.GaugeWidget({
-        title: 'Eval Gate Pass Rate',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'EvalGatePassRate',
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'Eval Pass Rate (%)',
-          }),
-        ],
-        width: 6,
-        height: 6,
-        leftYAxis: { min: 0, max: 100 },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Post-Merge Defect Rate',
-        left: [
-          // CI-fed (git trailers + revert scan in prism-ai-metrics.yml)
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'PostMergeDefectRate',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'CI (per-PR)',
-          }),
-          // Attribution-derived: reverted AI commits over merged AI commits.
-          // FILL guards both series: RevertedAICommits may not exist AT ALL
-          // until the first revert is published (a metric with zero datums is
-          // missing, not zero — unguarded math renders NaN). The IF guard
-          // gaps buckets with no merged commits instead of dividing by zero.
-          new cloudwatch.MathExpression({
-            expression: 'IF(FILL(mergedAi, 0) > 0, 100 * FILL(revertedAi, 0) / FILL(mergedAi, 0))',
-            usingMetrics: {
-              revertedAi: new cloudwatch.Metric({
-                namespace: METRIC_NAMESPACE,
-                metricName: 'RevertedAICommits',
-                statistic: 'Sum',
-                period: cdk.Duration.days(1),
-              }),
-              mergedAi: new cloudwatch.Metric({
-                namespace: METRIC_NAMESPACE,
-                metricName: 'MergedAICommits',
-                statistic: 'Sum',
-                period: cdk.Duration.days(1),
-              }),
-            },
-            label: 'Attribution (codeburn spans)',
-            period: cdk.Duration.days(1),
-          }),
-        ],
-        width: 6,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Percent' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'AI Cost Trend (Weekly)',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'AICostUSD',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Total Cost (USD)',
-          }),
-        ],
-        width: 6,
-        height: 6,
-        leftYAxis: { min: 0, label: 'USD' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Deployment Frequency (Weekly)',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'DeploymentFrequency',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Deploys / Week',
-          }),
-        ],
-        width: 6,
-        height: 6,
-        view: cloudwatch.GraphWidgetView.BAR,
-        leftYAxis: { min: 0, label: 'Deployments' },
-      }),
-    );
-
-    // =======================================================
-    // CloudWatch Alarms
-    // =======================================================
-
-    // Alarm: AI acceptance rate dropping below 20%
-    new cloudwatch.Alarm(this, 'AiAcceptanceRateLowAlarm', {
-      alarmName: 'PRISM-D1-AIAcceptanceRate-Low',
-      alarmDescription: 'AI acceptance rate has dropped below 20%, indicating potential issues with AI-generated code quality or review friction.',
-      metric: new cloudwatch.Metric({
-        namespace: METRIC_NAMESPACE,
-        metricName: 'AIAcceptanceRate',
-        statistic: 'Average',
-        period: cdk.Duration.hours(6),
-      }),
-      threshold: 20,
-      evaluationPeriods: 3,
-      datapointsToAlarm: 2,
-      comparisonOperator: cloudwatch.ComparisonOperator.LESS_THAN_THRESHOLD,
-      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
-    });
-
-    // Alarm: Eval gate pass rate dropping below 70%
-    new cloudwatch.Alarm(this, 'EvalGatePassRateLowAlarm', {
-      alarmName: 'PRISM-D1-EvalGatePassRate-Low',
-      alarmDescription: 'Eval gate pass rate has dropped below 70%, indicating degraded quality in AI-generated outputs.',
-      metric: new cloudwatch.Metric({
-        namespace: METRIC_NAMESPACE,
-        metricName: 'EvalGatePassRate',
-        statistic: 'Average',
-        period: cdk.Duration.hours(6),
-      }),
-      threshold: 70,
-      evaluationPeriods: 3,
-      datapointsToAlarm: 2,
-      comparisonOperator: cloudwatch.ComparisonOperator.LESS_THAN_THRESHOLD,
-      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
-    });
-
-    // Alarm: Change failure rate exceeding 20%
-    new cloudwatch.Alarm(this, 'ChangeFailureRateHighAlarm', {
-      alarmName: 'PRISM-D1-ChangeFailureRate-High',
-      alarmDescription: 'Change failure rate exceeds 20%, indicating deployment quality regression.',
-      metric: new cloudwatch.Metric({
-        namespace: METRIC_NAMESPACE,
-        metricName: 'ChangeFailureRate',
-        statistic: 'Average',
-        period: cdk.Duration.hours(6),
-      }),
-      threshold: 20,
-      evaluationPeriods: 3,
-      datapointsToAlarm: 2,
-      comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
-      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
-    });
-
-    // =======================================================
-    // Team Dashboard: Eval Gate by Rubric (Pillar 2)
-    // =======================================================
-    teamDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### Eval Gate Quality by Rubric',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    const rubricNames = ['code-quality', 'api-response-quality', 'agent-quality', 'security-compliance', 'spec-compliance'];
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Eval Pass Rate by Rubric',
-        left: rubricNames.map((rubric) =>
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'EvalGatePassRateByRubric',
-            dimensionsMap: { RubricName: rubric },
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: rubric,
-          }),
-        ),
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, max: 100, label: 'Pass Rate (%)' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Eval Score Trend',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'EvalScore',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Avg Eval Score',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, max: 1, label: 'Score (0-1)' },
-      }),
-    );
-
-    // =======================================================
-    // Team Dashboard: Guardrails & Safety (Pillar 4)
-    // =======================================================
-    teamDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### Guardrails & Safety',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    const guardrailCategories = ['CONTENT_FILTER', 'DENIED_TOPIC', 'SENSITIVE_INFO', 'WORD_FILTER'];
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Guardrail Triggers by Category',
-        left: guardrailCategories.map((category) =>
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'GuardrailTriggerCount',
-            dimensionsMap: { TriggerCategory: category },
-            statistic: 'Sum',
-            period: DEFAULT_PERIOD,
-            label: category,
-          }),
-        ),
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Triggers' },
-        view: cloudwatch.GraphWidgetView.BAR,
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Guardrail Actions: Block vs Anonymize',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'GuardrailBlockCount',
-            statistic: 'Sum',
-            period: DEFAULT_PERIOD,
-            label: 'Blocked',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'GuardrailAnonymizeCount',
-            statistic: 'Sum',
-            period: DEFAULT_PERIOD,
-            label: 'Anonymized',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Count' },
-      }),
-    );
-
-    // =======================================================
-    // Team Dashboard: MCP Tool Governance (Pillar 3)
-    // =======================================================
-    teamDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### MCP Tool Governance',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'MCP Tool Call Volume',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'MCPToolCallCount',
-            statistic: 'Sum',
-            period: DEFAULT_PERIOD,
-            label: 'Tool Calls',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Calls' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'MCP Auth Denied Rate',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'MCPAuthDeniedCount',
-            statistic: 'Sum',
-            period: DEFAULT_PERIOD,
-            label: 'Denied Calls',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Denied' },
-      }),
-    );
-
-    // =======================================================
-    // Team Dashboard: Cost Intelligence (Pillar 5)
-    // =======================================================
-    teamDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### Cost Intelligence',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Bedrock Cost (USD)',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'BedrockCostUSD',
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: 'Daily Cost ($)',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'USD' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Token Efficiency',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'TokenEfficiency',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Tokens per Line Changed',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Tokens/Line' },
-      }),
-    );
-
-    // =======================================================
-    // Team Dashboard: AI Attribution (Pillar 7)
-    // =======================================================
-    teamDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### AI Attribution & Quality',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Defect Rate: AI vs Human Code',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'PostMergeDefectRateAI',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'AI Code Defect Rate (%)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'PostMergeDefectRateHuman',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Human Code Defect Rate (%)',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Defect Rate (%)' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Spec-to-Code Hours',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SpecToCodeHours',
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Avg Hours',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Hours' },
-      }),
-    );
-
-    // =======================================================
-    // Team Dashboard: Security Agent Findings
-    // =======================================================
-    teamDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### Security Agent Findings',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.SingleValueWidget({
-        title: 'Open Critical/High Findings',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityCriticalFindingCount',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Critical + High',
-          }),
-        ],
-        width: 6,
-        height: 4,
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Finding Trend by Severity',
-        left: ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW'].map((severity) =>
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityFindingCount',
-            dimensionsMap: { Severity: severity },
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: severity,
-          }),
-        ),
-        width: 8,
-        height: 4,
-        leftYAxis: { min: 0, label: 'Findings' },
-      }),
-      new cloudwatch.SingleValueWidget({
-        title: 'Avg Remediation (hrs)',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityRemediationTimeHours',
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'Hours',
-          }),
-        ],
-        width: 4,
-        height: 4,
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Findings: AI vs Human Code',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityFindingByOrigin',
-            dimensionsMap: { AIOrigin: 'ai-assisted' },
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: 'AI Code',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityFindingByOrigin',
-            dimensionsMap: { AIOrigin: 'human' },
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: 'Human Code',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Findings' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Remediation Time: AI vs Human',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityRemediationTimeHours',
-            dimensionsMap: { AIOrigin: 'ai-assisted' },
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'AI Code Fix Time (hrs)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityRemediationTimeHours',
-            dimensionsMap: { AIOrigin: 'human' },
-            statistic: 'Average',
-            period: cdk.Duration.days(1),
-            label: 'Human Code Fix Time (hrs)',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Hours' },
-      }),
-    );
-
-    teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Findings by Phase',
-        left: ['design_review', 'code_review', 'pen_test'].map((phase) =>
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityFindingCount',
-            dimensionsMap: { Phase: phase },
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: phase.replace('_', ' '),
           }),
-        ),
-        width: 12,
+        ],
+        width: 8,
         height: 6,
-        leftYAxis: { min: 0, label: 'Findings' },
-        view: cloudwatch.GraphWidgetView.BAR,
+        leftYAxis: { min: 0, max: 100, label: 'Percent' },
       }),
       new cloudwatch.GraphWidget({
-        title: 'Security Scan Volume',
+        title: 'AI Defect Trend (reverted / merged)',
         left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityScanCount',
-            statistic: 'Sum',
+          // RevertedAICommits may not exist at all until the first revert is
+          // published — a metric with zero datums is MISSING, not zero, so the
+          // inner FILL is required or the whole expression renders NaN.
+          new cloudwatch.MathExpression({
+            expression: 'FILL(IF(FILL(mergedAi2, 0) > 0, 100 * FILL(revertedAi, 0) / FILL(mergedAi2, 0)), REPEAT)',
+            usingMetrics: {
+              revertedAi: dailySum('RevertedAICommits'),
+              mergedAi2: dailySum('MergedAICommits'),
+            },
+            label: 'AI defect rate (%)',
             period: cdk.Duration.days(1),
-            label: 'Scans / Day',
           }),
         ],
-        width: 12,
+        right: [dailySum('RevertedAICommits', 'Reverted AI commits')],
+        width: 8,
         height: 6,
-        leftYAxis: { min: 0, label: 'Scans' },
+        leftYAxis: { min: 0, label: 'Percent' },
+        rightYAxis: { min: 0, label: 'Count' },
+      }),
+    );
+
+    if (props?.velocityWidgetArn) {
+      // Row 4: per-repo drill-down — bridges org-level trends above to the
+      // per-concern detail panels below. Attribution store, full history.
+      teamDashboard.addWidgets(velocityPanel('Repository Breakdown (attribution, full history)', 'repos', 7));
+      // Rows 5-8: DDB-backed detail panels
+      teamDashboard.addWidgets(velocityPanel('Eval Gates (auto-discovers rubrics, incl. kiro-headless)', 'eval', 9));
+      teamDashboard.addWidgets(velocityPanel('Governance — Guardrails & MCP (populates during sample-app runs)', 'governance', 7));
+      teamDashboard.addWidgets(velocityPanel('Agent Operations (populates during sample-app runs)', 'agents', 7));
+      teamDashboard.addWidgets(velocityPanel('Security — Continuum Findings & Remediation SLA', 'security', 10));
+    }
+
+    teamDashboard.addWidgets(
+      new cloudwatch.TextWidget({
+        markdown:
+          `Spend, tokens, and per-developer breakdowns: [PRISM-D1-Developer-Productivity](https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-Developer-Productivity)`,
+        width: 24,
+        height: 1,
       }),
     );
 
     // =======================================================
-    // Executive Dashboard: Security & Compliance section
+    // Dashboard 2: Executive Readout
     // =======================================================
+    // Same hybrid approach as Team Velocity, with a stricter bar: this is the
+    // highest-stakes audience, so every widget must be backed by a real
+    // emitter, units are humanized (hours, not seconds), and proxies say so.
+    // Deleted in the rebuild: PRISM Level Progress, AI Cost & Cycle Time,
+    // Feature Cycle Time Trend, Weekly Bedrock Cost, and AI vs Human Defect
+    // Rate — all fed only by `prism-cli workshop generate-demo-data`. Security
+    // collapsed from 7 widgets to 1 panel; CISO Compliance owns the depth.
+    const execDashboard = new cloudwatch.Dashboard(this, 'ExecutiveReadoutDashboard', {
+      dashboardName: 'PRISM-D1-Executive-Readout',
+      defaultInterval: cdk.Duration.days(30),
+    });
+
+    const execPanel = (title: string, view: string, height: number): cloudwatch.CustomWidget =>
+      new cloudwatch.CustomWidget({
+        functionArn: props?.velocityWidgetArn ?? '',
+        title,
+        width: 24,
+        height,
+        params: { view },
+        updateOnRefresh: true,
+        updateOnResize: false,
+        updateOnTimeRangeChange: true,
+      });
+
     execDashboard.addWidgets(
       new cloudwatch.TextWidget({
-        markdown: '### Security & Compliance',
+        markdown:
+          '# PRISM D1 - Executive Readout\n' +
+          'AI adoption, unit economics, delivery health, and security posture. ' +
+          'Delivery figures are merge-based proxies, labeled as such.',
         width: 24,
-        height: 1,
+        height: 2,
       }),
     );
 
+    if (props?.velocityWidgetArn) {
+      // Rows 1-2: observed PRISM level + business KPIs + delivery proxies
+      execDashboard.addWidgets(execPanel('Business Outcomes & Observed Maturity', 'exec', 9));
+    }
+
+    // Row 3: adoption and cost trends (native, attribution/OTEL-fed).
+    // Weekly periods — an exec view wants the trend, not daily noise.
+    const weeklySum = (metricName: string, label?: string): cloudwatch.Metric =>
+      new cloudwatch.Metric({
+        namespace: METRIC_NAMESPACE,
+        metricName,
+        statistic: 'Sum',
+        period: cdk.Duration.days(7),
+        ...(label ? { label } : {}),
+      });
+
     execDashboard.addWidgets(
-      new cloudwatch.SingleValueWidget({
-        title: 'Guardrail Blocks (7d)',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'GuardrailBlockCount',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Blocks',
-          }),
+      new cloudwatch.GraphWidget({
+        title: 'AI vs Human Commits (Weekly)',
+        left: [
+          weeklySum('AICommits', 'AI commits'),
+          weeklySum('HumanCommits', 'Human commits'),
         ],
-        width: 6,
-        height: 4,
+        view: cloudwatch.GraphWidgetView.BAR,
+        stacked: true,
+        width: 8,
+        height: 6,
+        leftYAxis: { min: 0, label: 'Commits' },
+      }),
+      new cloudwatch.GraphWidget({
+        title: 'AI Spend Trend (Weekly)',
+        left: [weeklySum('AICostUSD', 'Spend ($)')],
+        width: 8,
+        height: 6,
+        leftYAxis: { min: 0, label: 'USD' },
       }),
       new cloudwatch.GraphWidget({
-        title: 'Guardrail Trigger Trend',
+        title: 'Cost per Shipped Commit (Weekly)',
         left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'GuardrailTriggerCount',
-            statistic: 'Sum',
-            period: cdk.Duration.days(1),
-            label: 'Daily Triggers',
+          // The ROI narrative: spend can rise while this falls, which means AI
+          // is getting more efficient per unit of shipped work.
+          new cloudwatch.MathExpression({
+            expression: 'FILL(IF(FILL(execMerged, 0) > 0, FILL(execCost, 0) / FILL(execMerged, 0)), REPEAT)',
+            usingMetrics: {
+              execCost: weeklySum('AICostUSD'),
+              execMerged: weeklySum('MergedAICommits'),
+            },
+            label: '$ / shipped AI commit',
+            period: cdk.Duration.days(7),
           }),
         ],
-        width: 9,
-        height: 4,
-        leftYAxis: { min: 0, label: 'Count' },
+        width: 8,
+        height: 6,
+        leftYAxis: { min: 0, label: 'USD' },
       }),
-      new cloudwatch.SingleValueWidget({
-        title: 'MCP Auth Denied (7d)',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'MCPAuthDeniedCount',
-            statistic: 'Sum',
+    );
+
+    // Row 4: quality — "is AI code as reliable as human code?"
+    execDashboard.addWidgets(
+      new cloudwatch.GraphWidget({
+        title: 'Merge Rate: AI vs Human (Weekly)',
+        left: [
+          new cloudwatch.MathExpression({
+            expression: 'FILL(IF(FILL(xAi, 0) > 0, 100 * FILL(xMergedAi, 0) / FILL(xAi, 0)), REPEAT)',
+            usingMetrics: { xMergedAi: weeklySum('MergedAICommits'), xAi: weeklySum('AICommits') },
+            label: 'AI merge rate (%)',
+            period: cdk.Duration.days(7),
+          }),
+          new cloudwatch.MathExpression({
+            expression: 'FILL(IF(FILL(xHuman, 0) > 0, 100 * FILL(xMergedHuman, 0) / FILL(xHuman, 0)), REPEAT)',
+            usingMetrics: { xMergedHuman: weeklySum('MergedHumanCommits'), xHuman: weeklySum('HumanCommits') },
+            label: 'Human merge rate (%)',
             period: cdk.Duration.days(7),
-            label: 'Denied',
           }),
         ],
-        width: 3,
-        height: 4,
+        width: 12,
+        height: 6,
+        leftYAxis: { min: 0, max: 100, label: 'Percent' },
       }),
-      new cloudwatch.SingleValueWidget({
-        title: 'Exfiltration Alerts (7d)',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'ExfiltrationAlertCount',
-            statistic: 'Sum',
+      new cloudwatch.GraphWidget({
+        title: 'AI Defect Trend (Weekly)',
+        left: [
+          // RevertedAICommits may not exist at all until the first revert is
+          // published — a metric with zero datums is missing, not zero, so the
+          // inner FILL is required to avoid a NaN series.
+          new cloudwatch.MathExpression({
+            expression: 'FILL(IF(FILL(xMergedAi2, 0) > 0, 100 * FILL(xReverted, 0) / FILL(xMergedAi2, 0)), REPEAT)',
+            usingMetrics: { xReverted: weeklySum('RevertedAICommits'), xMergedAi2: weeklySum('MergedAICommits') },
+            label: 'AI defect rate (%)',
             period: cdk.Duration.days(7),
-            label: 'Alerts',
           }),
         ],
-        width: 6,
-        height: 4,
+        width: 12,
+        height: 6,
+        leftYAxis: { min: 0, label: 'Percent' },
       }),
     );
 
-    // =======================================================
-    // Executive Dashboard: Cost Intelligence
-    // =======================================================
+    if (props?.velocityWidgetArn) {
+      // Row 5: condensed security posture (CISO dashboard has the breakdowns)
+      execDashboard.addWidgets(execPanel('Security & Governance Posture', 'exec-security', 5));
+    }
+
     execDashboard.addWidgets(
       new cloudwatch.TextWidget({
-        markdown: '### Cost Intelligence',
+        markdown:
+          `Drill down: [Team Velocity](https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-Team-Velocity) (delivery detail) · ` +
+          `[Developer Productivity](https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-Developer-Productivity) (per-developer spend) · ` +
+          `[CISO Compliance](https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-CISO-Compliance) (full security posture)`,
         width: 24,
         height: 1,
       }),
     );
 
-    execDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Weekly Bedrock Cost',
-        left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'BedrockCostUSD',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Weekly Cost ($)',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'USD' },
-        view: cloudwatch.GraphWidgetView.BAR,
+    // =======================================================
+    // CloudWatch Alarms
+    // =======================================================
+
+    // NOTE: the PRISM-D1-AIAcceptanceRate-Low alarm was removed along with the
+    // AIAcceptanceRate metric. It could not fire in either direction: the
+    // workflow defaulted a review-less PR to 100% acceptance (so healthy repos
+    // without mandatory review pinned the metric at 100), and the metric's AI
+    // gate was trailer-derived, so it stopped emitting entirely once git hooks
+    // were removed. "Does AI code pass review as well as human code?" is a
+    // comparative question and belongs on a dashboard panel, not an absolute
+    // threshold alarm.
+
+    // Alarm: Eval gate pass rate dropping below 70%
+    new cloudwatch.Alarm(this, 'EvalGatePassRateLowAlarm', {
+      alarmName: 'PRISM-D1-EvalGatePassRate-Low',
+      alarmDescription: 'Eval gate pass rate has dropped below 70%, indicating degraded quality in AI-generated outputs.',
+      metric: new cloudwatch.Metric({
+        namespace: METRIC_NAMESPACE,
+        metricName: 'EvalGatePassRate',
+        statistic: 'Average',
+        period: cdk.Duration.hours(6),
       }),
-      new cloudwatch.SingleValueWidget({
-        title: 'AI vs Human Defect Rate',
-        metrics: [
-          new cloudwatch.Metric({
+      threshold: 70,
+      evaluationPeriods: 3,
+      datapointsToAlarm: 2,
+      comparisonOperator: cloudwatch.ComparisonOperator.LESS_THAN_THRESHOLD,
+      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+    });
+
+    // Alarm: Change failure rate exceeding 20%.
+    //
+    // Computed as a ratio of two per-merge counters rather than reading a
+    // pre-computed ChangeFailureRate metric. The old source was the weekly
+    // assessment, which baked in a fixed 7-day window and stopped existing when
+    // prism-dora-weekly.yml was removed. Deriving it here means the ratio is
+    // evaluated over the alarm's own window, and both counters are emitted on
+    // every merged PR so a healthy period reads as a real 0% rather than
+    // INSUFFICIENT_DATA.
+    new cloudwatch.Alarm(this, 'ChangeFailureRateHighAlarm', {
+      alarmName: 'PRISM-D1-ChangeFailureRate-High',
+      alarmDescription: 'Change failure rate exceeds 20% (revert/hotfix-titled PRs / merged PRs), indicating deployment quality regression.',
+      metric: new cloudwatch.MathExpression({
+        expression: 'IF(deploys > 0, 100 * fixes / deploys, 0)',
+        usingMetrics: {
+          fixes: new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
-            metricName: 'PostMergeDefectRateAI',
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'AI Defect Rate (%)',
+            metricName: 'ChangeFailureCount',
+            statistic: 'Sum',
+            period: cdk.Duration.days(1),
           }),
-          new cloudwatch.Metric({
+          deploys: new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
-            metricName: 'PostMergeDefectRateHuman',
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'Human Defect Rate (%)',
+            metricName: 'DeploymentFrequency',
+            statistic: 'Sum',
+            period: cdk.Duration.days(1),
           }),
-        ],
-        width: 6,
-        height: 6,
+        },
+        label: 'Change Failure Rate %',
+        period: cdk.Duration.days(1),
       }),
-    );
+      threshold: 20,
+      evaluationPeriods: 3,
+      datapointsToAlarm: 2,
+      comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
+      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+    });
 
     // =======================================================
     // Dashboard 3: CISO Compliance
+    //
+    // This dashboard is DEPTH. The Executive Readout owns the headline
+    // posture strip; everything past Row 2 here is detail the exec view
+    // deliberately omits.
+    //
+    // Rows 1-5 are DDB-backed custom widgets rather than metric graphs. The
+    // previous build used metric graphs and three of them could never render:
+    // the metrics publisher emits either the FULL dimension set
+    // ([TeamId, Repository, Phase, Severity, AIOrigin]) or a dimensionless
+    // aggregate copy — never a subset. Widgets querying a partial set
+    // ({AIOrigin} or {Phase} alone) silently matched nothing. Reading events
+    // directly sidesteps dimension matching, and is the only way to surface
+    // compliance_mappings, which is a string array and therefore cannot be a
+    // CloudWatch dimension at all.
     // =======================================================
     const cisoDashboard = new cloudwatch.Dashboard(this, 'CISOComplianceDashboard', {
       dashboardName: 'PRISM-D1-CISO-Compliance',
       defaultInterval: cdk.Duration.days(30),
     });
 
+    const cisoPanel = (title: string, view: string, height: number): cloudwatch.CustomWidget =>
+      new cloudwatch.CustomWidget({
+        functionArn: props?.velocityWidgetArn ?? '',
+        title,
+        width: 24,
+        height,
+        params: { view },
+        updateOnRefresh: true,
+        updateOnResize: false,
+        updateOnTimeRangeChange: true,
+      });
+
     cisoDashboard.addWidgets(
       new cloudwatch.TextWidget({
-        markdown: '# PRISM D1 - CISO Compliance Dashboard\nSecurity posture, remediation SLAs, and AI code risk profile across all teams.',
+        markdown:
+          '# PRISM D1 - CISO Compliance Dashboard\n' +
+          'Security depth: exposure, remediation SLA compliance, AI code risk normalized by ' +
+          'commit volume, shift-left effectiveness, and vulnerability classes. ' +
+          'Headline posture is on **PRISM-D1-Executive-Readout**.',
         width: 24,
-        height: 1,
+        height: 2,
       }),
     );
 
-    cisoDashboard.addWidgets(
-      new cloudwatch.SingleValueWidget({
-        title: 'Open Critical Findings',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityCriticalFindingCount',
-            statistic: 'Sum',
-            period: cdk.Duration.days(30),
-            label: 'Critical + High (30d)',
-          }),
-        ],
-        width: 6,
-        height: 4,
-      }),
-      new cloudwatch.SingleValueWidget({
-        title: 'Avg Remediation Time',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityRemediationTimeHours',
-            statistic: 'Average',
-            period: cdk.Duration.days(30),
-            label: 'Hours (30d avg)',
-          }),
-        ],
-        width: 6,
-        height: 4,
-      }),
-      new cloudwatch.SingleValueWidget({
-        title: 'Security Scans Run',
-        metrics: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityScanCount',
-            statistic: 'Sum',
-            period: cdk.Duration.days(30),
-            label: 'Scans (30d)',
-          }),
-        ],
-        width: 6,
-        height: 4,
-      }),
-    );
+    // Row 1 — current exposure
+    cisoDashboard.addWidgets(cisoPanel('Current Exposure', 'ciso-exposure', 5));
+
+    // Row 2 — remediation SLA compliance (SECURITY-09 budgets)
+    cisoDashboard.addWidgets(cisoPanel('Remediation SLA Compliance', 'ciso-sla', 8));
+
+    // Row 3 — AI code risk, normalized. Raw finding counts are not comparable
+    // across origins; this joins findings to attribution commit volume.
+    cisoDashboard.addWidgets(cisoPanel('AI Code Risk Profile (per 100 commits)', 'ciso-risk', 10));
 
+    // Row 4 — shift-left effectiveness, incl. computed finding survival rate
+    cisoDashboard.addWidgets(cisoPanel('Shift-Left Effectiveness', 'ciso-shiftleft', 10));
+
+    // Row 5 — vulnerability classes + compliance framework coverage
+    cisoDashboard.addWidgets(cisoPanel('Vulnerability Classes & Compliance Coverage', 'ciso-classes', 12));
+
+    // Row 6 — runtime governance. These stay native graphs: the guardrail /
+    // MCP / exfiltration metrics are published with a dimensionless copy and
+    // these widgets query dimensionlessly, so they match correctly.
     cisoDashboard.addWidgets(
       new cloudwatch.TextWidget({
-        markdown: '### AI Code Risk Profile',
+        markdown: '### Runtime Governance',
         width: 24,
         height: 1,
       }),
@@ -1280,112 +472,69 @@ export class DashboardStack extends cdk.Stack {
 
     cisoDashboard.addWidgets(
       new cloudwatch.GraphWidget({
-        title: 'Security Findings: AI vs Human Code',
+        title: 'Guardrail Triggers vs Blocks',
         left: [
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityFindingByOrigin',
-            dimensionsMap: { AIOrigin: 'ai-assisted' },
+            metricName: 'GuardrailTriggerCount',
             statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'AI Code Findings',
+            period: cdk.Duration.days(1),
+            label: 'Triggers',
           }),
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityFindingByOrigin',
-            dimensionsMap: { AIOrigin: 'human' },
+            metricName: 'GuardrailBlockCount',
             statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Human Code Findings',
+            period: cdk.Duration.days(1),
+            label: 'Blocks',
           }),
         ],
-        width: 12,
+        width: 8,
         height: 6,
-        leftYAxis: { min: 0, label: 'Findings' },
+        leftYAxis: { min: 0, label: 'Count' },
       }),
       new cloudwatch.GraphWidget({
-        title: 'Remediation Time by Code Origin',
+        title: 'MCP Authorization Denials',
         left: [
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityRemediationTimeHours',
-            dimensionsMap: { AIOrigin: 'ai-assisted' },
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'AI Code (hrs)',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityRemediationTimeHours',
-            dimensionsMap: { AIOrigin: 'human' },
-            statistic: 'Average',
-            period: cdk.Duration.days(7),
-            label: 'Human Code (hrs)',
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Hours' },
-      }),
-    );
-
-    cisoDashboard.addWidgets(
-      new cloudwatch.TextWidget({
-        markdown: '### Shift-Left Effectiveness',
-        width: 24,
-        height: 1,
-      }),
-    );
-
-    cisoDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Findings by Phase (Monthly Trend)',
-        left: ['design_review', 'code_review', 'pen_test'].map((phase) =>
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'SecurityFindingCount',
-            dimensionsMap: { Phase: phase },
+            metricName: 'MCPAuthDeniedCount',
             statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: phase.replace('_', ' '),
+            period: cdk.Duration.days(1),
+            label: 'Out-of-scope tool calls',
           }),
-        ),
-        width: 12,
+        ],
+        width: 8,
         height: 6,
-        leftYAxis: { min: 0, label: 'Findings' },
-        view: cloudwatch.GraphWidgetView.BAR,
+        leftYAxis: { min: 0, label: 'Count' },
       }),
       new cloudwatch.GraphWidget({
-        title: 'Guardrail + Exfiltration Trends',
+        title: 'Exfiltration Alerts',
         left: [
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'GuardrailBlockCount',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Guardrail Blocks',
-          }),
           new cloudwatch.Metric({
             namespace: METRIC_NAMESPACE,
             metricName: 'ExfiltrationAlertCount',
             statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'Exfiltration Alerts',
-          }),
-          new cloudwatch.Metric({
-            namespace: METRIC_NAMESPACE,
-            metricName: 'MCPAuthDeniedCount',
-            statistic: 'Sum',
-            period: cdk.Duration.days(7),
-            label: 'MCP Auth Denied',
+            period: cdk.Duration.days(1),
+            label: 'Alerts',
           }),
         ],
-        width: 12,
+        width: 8,
         height: 6,
         leftYAxis: { min: 0, label: 'Count' },
       }),
     );
 
+    cisoDashboard.addWidgets(
+      new cloudwatch.TextWidget({
+        markdown:
+          `**Related:** [Executive Readout](https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-Executive-Readout) (headline posture) · ` +
+          `[Team Velocity](https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-Team-Velocity) (per-repo delivery and security)`,
+        width: 24,
+        height: 2,
+      }),
+    );
+
     new cdk.CfnOutput(this, 'CISODashboardUrl', {
       value: `https://${this.region}.console.aws.amazon.com/cloudwatch/home?region=${this.region}#dashboards:name=PRISM-D1-CISO-Compliance`,
       description: 'CISO Compliance Dashboard URL',
@@ -1461,13 +610,17 @@ export class DashboardStack extends cdk.Stack {
       treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
     });
 
-    // Alarm: Daily Bedrock cost exceeding budget
+    // Alarm: Daily AI cost exceeding budget.
+    // Watches AICostUSD (real — otel-metrics-publisher from codeburn usage
+    // spans) rather than BedrockCostUSD, which has no emitter outside
+    // `prism-cli workshop generate-demo-data` and left this alarm permanently
+    // in INSUFFICIENT_DATA.
     new cloudwatch.Alarm(this, 'BedrockDailyCostHighAlarm', {
-      alarmName: 'PRISM-D1-BedrockDailyCost-High',
-      alarmDescription: 'Daily Bedrock cost exceeds $100 threshold.',
+      alarmName: 'PRISM-D1-AIDailyCost-High',
+      alarmDescription: 'Daily AI tooling cost exceeds the $100 threshold.',
       metric: new cloudwatch.Metric({
         namespace: METRIC_NAMESPACE,
-        metricName: 'BedrockCostUSD',
+        metricName: 'AICostUSD',
         statistic: 'Sum',
         period: cdk.Duration.days(1),
       }),
@@ -1477,22 +630,10 @@ export class DashboardStack extends cdk.Stack {
       treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
     });
 
-    // Alarm: Token efficiency below threshold
-    new cloudwatch.Alarm(this, 'TokenEfficiencyLowAlarm', {
-      alarmName: 'PRISM-D1-TokenEfficiency-Low',
-      alarmDescription: 'Token efficiency is low — high token consumption relative to code output.',
-      metric: new cloudwatch.Metric({
-        namespace: METRIC_NAMESPACE,
-        metricName: 'TokenEfficiency',
-        statistic: 'Average',
-        period: cdk.Duration.hours(6),
-      }),
-      threshold: 500,
-      evaluationPeriods: 3,
-      datapointsToAlarm: 2,
-      comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
-      treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
-    });
+    // NOTE: a TokenEfficiency alarm was removed here. The metric (tokens per
+    // line changed) has no emitter — the only source is `prism-cli workshop
+    // generate-demo-data` — so the alarm sat in INSUFFICIENT_DATA permanently.
+    // Reinstate it if/when a real emitter computes tokens-per-line.
 
     // Alarm: Exfiltration detection
     new cloudwatch.Alarm(this, 'ExfiltrationAlertAlarm', {
@@ -1511,11 +652,13 @@ export class DashboardStack extends cdk.Stack {
     });
 
     // Alarm: Agent success rate dropping below 80%
+    // Uses the dimensionless aggregate series (dual-published by the
+    // processor). The previous TeamId=ALL/Repository=ALL dimensions never
+    // matched real events, so the alarm sat in INSUFFICIENT_DATA forever.
     new cloudwatch.Alarm(this, 'AgentSuccessRateAlarm', {
       metric: new cloudwatch.Metric({
         namespace: METRIC_NAMESPACE,
         metricName: 'AgentSuccessRate',
-        dimensionsMap: { TeamId: teamId, Repository: repository },
         statistic: 'Average',
         period: cdk.Duration.hours(1),
       }),
@@ -1523,7 +666,7 @@ export class DashboardStack extends cdk.Stack {
       evaluationPeriods: 3,
       comparisonOperator: cloudwatch.ComparisonOperator.LESS_THAN_THRESHOLD,
       alarmDescription: 'Agent success rate below 80% for 3 consecutive hours',
-      alarmName: `prism-d1-${teamId}-agent-success-rate`,
+      alarmName: 'prism-d1-agent-success-rate',
     });
 
     // -------------------------------------------------------