@prism-d1/cli 1.0.82 → 1.0.84

package/dist/assets/github-workflows/prism-agent-eval.yml

@@ -23,6 +23,10 @@ on:
       - '**/agent*.py'
       - '**/agent*.ts'
 
+
+env:
+  PRISM_AWS_REGION: us-west-2
+
 permissions:
   id-token: write
   contents: read
@@ -41,7 +45,7 @@ jobs:
         uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
         with:
           role-to-assume: ${{ secrets.PRISM_METRICS_ROLE_ARN }}
-          aws-region: us-west-2
+          aws-region: ${{ env.PRISM_AWS_REGION }}
 
       - name: Read team ID from .prism/config.json
         id: prism-config
@@ -298,7 +302,7 @@ jobs:
             }')
 
           aws events put-events \
-            --region us-west-2 \
+            --region $PRISM_AWS_REGION \
             --entries "[{
               \"Source\": \"prism.d1.velocity\",
               \"DetailType\": \"prism.d1.agent.eval\",

package/dist/assets/github-workflows/prism-ai-metrics.yml

@@ -33,6 +33,10 @@ on:
     types: [closed]
     branches: [main, master]
 
+
+env:
+  PRISM_AWS_REGION: us-west-2
+
 permissions:
   id-token: write
   contents: read
@@ -54,7 +58,7 @@ jobs:
         uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
         with:
           role-to-assume: ${{ secrets.PRISM_METRICS_ROLE_ARN }}
-          aws-region: us-west-2
+          aws-region: ${{ env.PRISM_AWS_REGION }}
 
       - name: Read team ID from .prism/config.json
         id: prism-config
@@ -86,8 +90,20 @@ jobs:
 
           # --- Commit SHAs: immutable facts for deferred origin resolution.
           # Capped at 50 to bound the event size and the render-time join.
-          COMMIT_SHAS=$(git rev-list "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null | head -50 | jq -R . | jq -sc . || echo '[]')
-          TOTAL_COMMITS=$(git rev-list --count "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null || echo 0)
+          #
+          # --no-merges matters here. HEAD_SHA is the PR's merge_commit_sha, so the
+          # range BASE..HEAD includes GitHub's own merge commit, authored by
+          # web-flow on GitHub's servers. codeburn attributes commits made on a
+          # developer's machine, so that commit can never appear in the attribution
+          # store. Counting it puts a structural ceiling on Attribution Coverage:
+          # a fully-onboarded team with 3 PRs and 9 authored commits reported
+          # 9 attributed / 12 seen = 75%, when the true coverage was 100%.
+          #
+          # Excluding every merge commit, not just GitHub's, is the right call for
+          # this pair: a merge commit introduces no authored lines, so it is not
+          # attributable content on either side of the ratio.
+          COMMIT_SHAS=$(git rev-list --no-merges "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null | head -50 | jq -R . | jq -sc . || echo '[]')
+          TOTAL_COMMITS=$(git rev-list --no-merges --count "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null || echo 0)
 
           # --- Lead time: PR open → merge. From the event payload, not git, so
           # it is unaffected by rebases and squashes.
@@ -173,7 +189,7 @@ jobs:
             }')
 
           aws events put-events \
-            --region us-west-2 \
+            --region $PRISM_AWS_REGION \
             --entries "[{
               \"Source\": \"prism.d1.velocity\",
               \"DetailType\": \"prism.d1.pr\",
@@ -213,7 +229,7 @@ jobs:
             }')
 
           aws events put-events \
-            --region us-west-2 \
+            --region $PRISM_AWS_REGION \
             --entries "[{
               \"Source\": \"prism.d1.velocity\",
               \"DetailType\": \"prism.d1.deploy\",

package/dist/assets/github-workflows/prism-eval-gate-kiro.yml

@@ -15,6 +15,10 @@ on:
     types: [opened, synchronize, reopened]
     branches: [main, master]
 
+
+env:
+  PRISM_AWS_REGION: us-west-2
+
 permissions:
   id-token: write
   contents: read
@@ -213,13 +217,13 @@ jobs:
         uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
         with:
           role-to-assume: ${{ env.METRICS_ROLE_ARN }}
-          aws-region: us-west-2
+          aws-region: ${{ env.PRISM_AWS_REGION }}
         continue-on-error: true
 
       - name: Emit prism.d1.eval event
         if: steps.aws-creds.outcome == 'success'
         env:
-          AWS_REGION: us-west-2
+          AWS_REGION: ${{ env.PRISM_AWS_REGION }}
           TEAM_ID: ${{ steps.prism-config.outputs.team_id }}
           REPO: ${{ github.repository }}
           REVIEW_SCORE: ${{ steps.review.outputs.score }}
@@ -249,27 +253,25 @@ jobs:
               eval:{score:($score|tonumber),result:$result,rubric:"kiro-headless",
                     findings:($findings|tonumber),high_findings:($high|tonumber),
                     pr_number:($pr_number|tonumber),method:"kiro-headless"}}')
-          aws events put-events --region us-west-2 --entries \
+          aws events put-events --region $PRISM_AWS_REGION --entries \
             "[{\"Source\":\"prism.d1.velocity\",\"DetailType\":\"prism.d1.eval\",\"EventBusName\":\"prism-d1-metrics\",\"Detail\":$(echo "${DETAIL}" | jq -Rs '.')}]" || true
 
       - name: AWS Continuum security scan (Tier 2 -- deterministic)
         id: security-gate
         if: steps.aws-creds.outcome == 'success'
         env:
-          AWS_REGION: us-west-2
+          AWS_REGION: ${{ env.PRISM_AWS_REGION }}
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.sha }}
           REPO: ${{ github.repository }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
-          # Pre-flight: verify the specific subcommand exists (AWS CLI v2.36+)
-          if ! aws securityagent start-code-review-job help > /dev/null 2>&1; then
-            echo "::warning::AWS CLI lacks securityagent code review commands (need v2.36+). Skipping scan."
-            echo "findings=0" >> "$GITHUB_OUTPUT"
-            echo "skipped=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
+          # Config is read FIRST, on purpose. "Continuum was never deployed" is a
+          # deployment choice and may legitimately skip the scan; "Continuum is
+          # deployed but the scan could not run" is a failure and must block the
+          # merge. Probing the CLI before knowing which case we are in cannot tell
+          # them apart, so a missing subcommand used to silently pass the gate on a
+          # repo that had opted into scanning.
           AGENT_SPACE_ID=$(aws ssm get-parameter --name /prism/continuum/agent-space-id --query Parameter.Value --output text 2>/dev/null || echo "")
           SCAN_BUCKET=$(aws ssm get-parameter --name /prism/continuum/scan-bucket --query Parameter.Value --output text 2>/dev/null || echo "")
 
@@ -280,6 +282,16 @@ jobs:
             exit 0
           fi
 
+          # Continuum IS configured from here on, so every failure below fails
+          # closed: scan_error=true and findings=-1, never findings=0.
+          if ! aws securityagent start-code-review-job help > /dev/null 2>&1; then
+            echo "::error::Continuum is configured but this AWS CLI lacks the securityagent code review commands (need v2.36+)."
+            echo "  The security scan cannot run, so this PR is not verified. Upgrade the CLI in the workflow."
+            echo "scan_error=true" >> "$GITHUB_OUTPUT"
+            echo "findings=-1" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
           REPO_SLUG=$(echo "${REPO}" | tr '/' '-')
           CODE_REVIEW_ID=$(aws ssm get-parameter --name "/prism/continuum/code-review-id/${REPO_SLUG}" --query Parameter.Value --output text 2>/dev/null || echo "")
           if [ -z "$CODE_REVIEW_ID" ]; then
@@ -307,10 +319,10 @@ jobs:
             CODE_REVIEW_ID=$(echo "$CR_OUTPUT" | jq -r '.codeReviewId // empty' 2>/dev/null)
 
             if [ -z "$CODE_REVIEW_ID" ]; then
-              echo "::warning::Bootstrap failed: ${CR_OUTPUT}"
-              echo "  Run 'sudo prism-cli securityagent setup' from your DevBox to create manually."
-              echo "findings=0" >> "$GITHUB_OUTPUT"
-              echo "skipped=true" >> "$GITHUB_OUTPUT"
+              echo "::error::Could not create the Continuum Code Review resource: ${CR_OUTPUT}"
+              echo "  Run 'prism-cli securityagent setup' to create it manually."
+              echo "scan_error=true" >> "$GITHUB_OUTPUT"
+              echo "findings=-1" >> "$GITHUB_OUTPUT"
               exit 0
             fi
 
@@ -325,7 +337,13 @@ jobs:
           # Diff must be uploaded with .patch extension (API requirement)
           git diff "${BASE_SHA}..${HEAD_SHA}" > /tmp/changes.patch
           if [ ! -s /tmp/changes.patch ]; then
+            echo "No changes to scan."
+            # critical/high must be set explicitly. The gate tests
+            # `critical != '0'`, and an unset output is '', which is != '0' in a
+            # GitHub expression -- leaving them unset failed the gate on a no-op PR.
             echo "findings=0" >> "$GITHUB_OUTPUT"
+            echo "critical=0" >> "$GITHUB_OUTPUT"
+            echo "high=0" >> "$GITHUB_OUTPUT"
             exit 0
           fi
           DIFF_KEY="diffs/${REPO_SLUG}/${PR_NUMBER}/${HEAD_SHA}.patch"
@@ -350,18 +368,26 @@ jobs:
           done
 
           if [ "$STATUS" != "COMPLETED" ]; then
-            echo "::warning::Continuum scan did not complete (status: ${STATUS}) -- treating as skipped"
-            echo "findings=0" >> "$GITHUB_OUTPUT"
-            echo "skipped=true" >> "$GITHUB_OUTPUT"
+            echo "::error::Continuum scan did not complete (status: ${STATUS})."
+            echo "  An incomplete scan is not a clean scan -- failing closed. Re-run, or check the Continuum job logs."
+            echo "scan_error=true" >> "$GITHUB_OUTPUT"
+            echo "findings=-1" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
           # NOTE: list-findings takes agent-space-id + code-review-job-id only.
           # Response field is 'findingsSummaries', risk field is 'riskLevel'.
-          FINDINGS_JSON=$(aws securityagent list-findings \
+          # No `|| echo '{"findingsSummaries":[]}'` fallback: an API error there is
+          # indistinguishable from a clean scan, so it would pass the gate.
+          if ! FINDINGS_JSON=$(aws securityagent list-findings \
             --agent-space-id "${AGENT_SPACE_ID}" \
             --code-review-job-id "${JOB_ID}" \
-            --output json 2>/dev/null || echo '{"findingsSummaries":[]}')
+            --output json 2>&1); then
+            echo "::error::Continuum scan completed but its findings could not be retrieved: ${FINDINGS_JSON}"
+            echo "scan_error=true" >> "$GITHUB_OUTPUT"
+            echo "findings=-1" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
 
           TOTAL=$(echo "$FINDINGS_JSON" | jq '.findingsSummaries | length')
           CRITICAL=$(echo "$FINDINGS_JSON" | jq '[.findingsSummaries[] | select(.riskLevel == "CRITICAL")] | length')
@@ -385,7 +411,7 @@ jobs:
         if: steps.security-gate.outputs.skipped != 'true' && steps.security-gate.outputs.findings != '0' && steps.security-gate.outputs.findings != ''
         continue-on-error: true
         env:
-          AWS_REGION: us-west-2
+          AWS_REGION: ${{ env.PRISM_AWS_REGION }}
           TEAM_ID: ${{ steps.prism-config.outputs.team_id }}
           REPO: ${{ github.repository }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
@@ -436,14 +462,14 @@ jobs:
           if [ "$TOTAL" -gt 0 ]; then
             # EventBridge accepts max 10 entries per call
             for i in $(seq 0 10 $((TOTAL - 1))); do
-              aws events put-events --region us-west-2 \
+              aws events put-events --region $PRISM_AWS_REGION \
                 --entries "$(echo "${ENTRIES}" | jq -c ".[$i:$((i+10))]")" || true
             done
             echo "Emitted ${TOTAL} Continuum finding events to EventBridge"
           fi
 
       - name: Fail on eval gate failure
-        if: ${{ steps.review.outputs.result == 'FAIL' || steps.review.outputs.result == 'ERROR' || (steps.security-gate.outputs.skipped != 'true' && (steps.security-gate.outputs.critical != '0' || steps.security-gate.outputs.high != '0')) }}
+        if: ${{ steps.review.outputs.result == 'FAIL' || steps.review.outputs.result == 'ERROR' || steps.security-gate.outputs.scan_error == 'true' || (steps.security-gate.outputs.skipped != 'true' && (steps.security-gate.outputs.critical != '0' || steps.security-gate.outputs.high != '0')) }}
         env:
           REVIEW_RESULT: ${{ steps.review.outputs.result }}
           REVIEW_HIGH: ${{ steps.review.outputs.high }}
@@ -451,6 +477,7 @@ jobs:
           REVIEW_SUMMARY: ${{ steps.review.outputs.summary }}
           SEC_CRITICAL: ${{ steps.security-gate.outputs.critical }}
           SEC_HIGH: ${{ steps.security-gate.outputs.high }}
+          SEC_SCAN_ERROR: ${{ steps.security-gate.outputs.scan_error }}
         run: |
           if [ "${REVIEW_RESULT}" = "ERROR" ]; then
             echo "❌ Eval gate failed closed: review output could not be parsed"
@@ -458,7 +485,10 @@ jobs:
             echo "❌ Kiro found ${REVIEW_HIGH:-?} high-severity issues (score: ${REVIEW_SCORE:-?})"
             echo "Summary: ${REVIEW_SUMMARY}"
           fi
-          if [ "${SEC_CRITICAL:-0}" -gt 0 ] || [ "${SEC_HIGH:-0}" -gt 0 ]; then
+          if [ "${SEC_SCAN_ERROR}" = "true" ]; then
+            echo "❌ Security gate failed closed: the Continuum scan produced no verdict."
+            echo "  This PR has NOT been security scanned. Re-run the workflow, or check the Continuum job logs."
+          elif [ "${SEC_CRITICAL:-0}" -gt 0 ] || [ "${SEC_HIGH:-0}" -gt 0 ]; then
             echo "❌ Continuum found ${SEC_CRITICAL:-0} critical, ${SEC_HIGH:-0} high security findings"
           fi
           exit 1

package/dist/assets/github-workflows/prism-eval-gate.yml

@@ -16,6 +16,10 @@ on:
     types: [opened, synchronize, reopened]
     branches: [main, master]
 
+
+env:
+  PRISM_AWS_REGION: us-west-2
+
 permissions:
   id-token: write
   contents: read
@@ -34,7 +38,7 @@ jobs:
         uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
         with:
           role-to-assume: ${{ secrets.PRISM_METRICS_ROLE_ARN }}
-          aws-region: us-west-2
+          aws-region: ${{ env.PRISM_AWS_REGION }}
 
       - name: Read team ID
         id: prism-config
@@ -217,12 +221,12 @@ jobs:
               eval: {total_files: $total_files, pass_count: $pass_count, fail_count: $fail_count,
                      result: $result, pr_number: ($pr_number | tonumber), hallucinations_caught: $hallucinations}
             }')
-          aws events put-events --region us-west-2 --entries "[{
+          aws events put-events --region $PRISM_AWS_REGION --entries "[{
             \"Source\":\"prism.d1.velocity\",\"DetailType\":\"prism.d1.eval\",
             \"EventBusName\":\"prism-d1-metrics\",
             \"Detail\":$(echo "${EVAL_EVENT}" | jq -c '.' | jq -Rs '.')}]"
 
-      - name: Upgrade AWS CLI v2 (securityagent code review requires v2.35+)
+      - name: Upgrade AWS CLI v2 (securityagent code review requires v2.36+)
         run: |
           curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip
           curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip.sha256" -o /tmp/awscliv2.zip.sha256
@@ -238,16 +242,8 @@ jobs:
       - name: AWS Continuum diff scan
         id: security-gate
         env:
-          AWS_REGION: us-west-2
+          AWS_REGION: ${{ env.PRISM_AWS_REGION }}
         run: |
-          # Pre-flight: verify AWS CLI has securityagent subcommand
-          if ! aws securityagent start-code-review-job help > /dev/null 2>&1; then
-            echo "::warning::AWS CLI does not support 'securityagent code review' commands after upgrade. Skipping scan."
-            echo "findings=0" >> "$GITHUB_OUTPUT"
-            echo "skipped=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
           echo "::group::Retrieve Continuum config from SSM"
           AGENT_SPACE_ID=$(aws ssm get-parameter --name /prism/continuum/agent-space-id --query Parameter.Value --output text 2>/dev/null || echo "")
           SCAN_BUCKET=$(aws ssm get-parameter --name /prism/continuum/scan-bucket --query Parameter.Value --output text 2>/dev/null || echo "")
@@ -262,6 +258,19 @@ jobs:
             exit 0
           fi
 
+          # Continuum IS configured from here on, so every failure below fails
+          # closed. The CLI probe runs after the config lookup on purpose: before
+          # it, "never deployed" and "deployed but cannot scan" are
+          # indistinguishable, and the old order silently passed the gate on a repo
+          # that had opted into scanning.
+          if ! aws securityagent start-code-review-job help > /dev/null 2>&1; then
+            echo "::error::Continuum is configured but this AWS CLI lacks the securityagent code review commands (need v2.36+)."
+            echo "  The security scan cannot run, so this PR is not verified."
+            echo "scan_error=true" >> "$GITHUB_OUTPUT"
+            echo "findings=-1" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
           # Fallback for service role if SSM param not yet deployed
           if [[ -z "$SERVICE_ROLE" ]]; then
             ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
@@ -296,10 +305,9 @@ jobs:
             if [[ -z "$CODE_REVIEW_ID" ]]; then
               echo "  ⚠️ Bootstrap failed:"
               echo "  $CR_OUTPUT"
-              echo "  Run 'sudo prism-cli securityagent setup' from your DevBox to create manually."
-              echo "  Skipping security scan (non-blocking)."
-              echo "findings=0" >> "$GITHUB_OUTPUT"
-              echo "skipped=true" >> "$GITHUB_OUTPUT"
+              echo "  Run 'prism-cli securityagent setup' to create it manually."
+              echo "scan_error=true" >> "$GITHUB_OUTPUT"
+              echo "findings=-1" >> "$GITHUB_OUTPUT"
               exit 0
             fi
 
@@ -377,10 +385,18 @@ jobs:
           fi
 
           echo "::group::Retrieve findings"
-          FINDINGS_JSON=$(aws securityagent list-findings \
+          # No empty-array fallback: an API error there is indistinguishable from a
+          # clean scan, so it would pass the gate.
+          if ! FINDINGS_JSON=$(aws securityagent list-findings \
             --agent-space-id "${AGENT_SPACE_ID}" \
             --code-review-job-id "${JOB_ID}" \
-            --output json 2>/dev/null || echo '{"findingsSummaries":[]}')
+            --output json 2>&1); then
+            echo "::error::Continuum scan completed but its findings could not be retrieved: ${FINDINGS_JSON}"
+            echo "scan_error=true" >> "$GITHUB_OUTPUT"
+            echo "findings=-1" >> "$GITHUB_OUTPUT"
+            echo "::endgroup::"
+            exit 0
+          fi
 
           TOTAL=$(echo "$FINDINGS_JSON" | jq '.findingsSummaries | length')
           CRITICAL=$(echo "$FINDINGS_JSON" | jq '[.findingsSummaries[] | select(.riskLevel == "CRITICAL")] | length')
@@ -402,7 +418,7 @@ jobs:
       - name: Emit Continuum findings to EventBridge
         if: steps.security-gate.outputs.findings != '0' && steps.security-gate.outputs.skipped != 'true'
         env:
-          AWS_REGION: us-west-2
+          AWS_REGION: ${{ env.PRISM_AWS_REGION }}
         run: |
           PR_NUMBER="${{ github.event.pull_request.number }}"
           REPO="${{ github.repository }}"
@@ -441,7 +457,7 @@ jobs:
           fi
 
       - name: Fail on eval or security issues
-        if: steps.eval.outputs.overall_result == 'FAIL' || (steps.security-gate.outputs.findings != '0' && steps.security-gate.outputs.skipped != 'true')
+        if: steps.eval.outputs.overall_result == 'FAIL' || steps.security-gate.outputs.scan_error == 'true' || (steps.security-gate.outputs.findings != '0' && steps.security-gate.outputs.skipped != 'true')
         run: |
           [[ "${{ steps.eval.outputs.overall_result }}" == "FAIL" ]] && echo "❌ Eval gate failed"
           if [[ "${{ steps.security-gate.outputs.scan_error }}" == "true" ]]; then

package/dist/assets/gitlab-workflows/prism-agent-eval.yml

@@ -6,7 +6,7 @@
 #
 # Required setup:
 #   - CI/CD variable PRISM_METRICS_ROLE_ARN (IAM role with bedrock:InvokeModel + events:PutEvents)
-#   - CI/CD variable AWS_REGION (default: us-west-2)
+#   - PRISM_AWS_REGION variable in the variables: block below controls the region
 #   - .prism/config.json committed to the repo
 #   - .prism/eval-harness/ installed (run: prism-cli bootstrapper install-eval-harness)
 #   - (Optional) Agent entry point supports --mock flag for dry-run execution
@@ -26,7 +26,8 @@ prism-agent-eval:
         - "**/*agent*.py"
         - "**/*agent*.ts"
   variables:
-    AWS_DEFAULT_REGION: us-west-2
+    PRISM_AWS_REGION: us-west-2
+    AWS_DEFAULT_REGION: $PRISM_AWS_REGION
   before_script:
     - apt-get update -qq && apt-get install -y -qq jq bc git curl unzip
     - curl -s "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip

package/dist/assets/gitlab-workflows/prism-ai-metrics.yml

@@ -32,7 +32,8 @@ prism-ai-metrics:
   rules:
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "push"'
   variables:
-    AWS_DEFAULT_REGION: us-west-2
+    PRISM_AWS_REGION: us-west-2
+    AWS_DEFAULT_REGION: $PRISM_AWS_REGION
   before_script:
     - yum install -y -q jq git
     - git fetch --unshallow || true
@@ -74,8 +75,15 @@ prism-ai-metrics:
       HEAD_SHA="${CI_COMMIT_SHA}"
 
       # --- Commit SHAs: immutable facts for deferred origin resolution.
-      COMMIT_SHAS=$(git rev-list "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null | head -50 | jq -R . | jq -sc . || echo '[]')
-      TOTAL_COMMITS=$(git rev-list --count "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null || echo "1")
+      #
+      # --no-merges for the same reason as the GitHub workflow: under a
+      # merge-commit strategy CI_COMMIT_SHA is the merge commit GitLab created,
+      # which no developer machine authored and codeburn can therefore never
+      # attribute. Counting it caps Attribution Coverage below 100% for a fully
+      # onboarded team. Harmless under squash or fast-forward, where the range
+      # holds no merge commits to exclude.
+      COMMIT_SHAS=$(git rev-list --no-merges "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null | head -50 | jq -R . | jq -sc . || echo '[]')
+      TOTAL_COMMITS=$(git rev-list --no-merges --count "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null || echo "1")
 
       # --- Lead time: MR open → now (this job runs on the post-merge push).
       LEAD_TIME_SECONDS=0

package/dist/assets/gitlab-workflows/prism-eval-gate.yml

@@ -6,7 +6,7 @@
 #
 # Required setup:
 #   - CI/CD variable PRISM_METRICS_ROLE_ARN (IAM role with bedrock:InvokeModel + events:PutEvents)
-#   - CI/CD variable AWS_REGION (default: us-west-2)
+#   - PRISM_AWS_REGION variable in the variables: block below controls the region
 #   - .prism/eval-harness/ directory in your repo (run: prism-cli bootstrapper install-eval-harness)
 #   - At least one rubric JSON in .prism/eval-harness/rubrics/
 
@@ -21,7 +21,8 @@ prism-eval-gate:
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
   variables:
-    AWS_DEFAULT_REGION: us-west-2
+    PRISM_AWS_REGION: us-west-2
+    AWS_DEFAULT_REGION: $PRISM_AWS_REGION
   before_script:
     - yum install -y -q jq bc git
     - git fetch --unshallow || true

package/dist/assets/infra/lib/lambda/security-agent-processor.ts

@@ -1,6 +1,6 @@
 import {
   DynamoDBClient,
-  QueryCommand,
+  GetItemCommand,
   ScanCommand,
 } from '@aws-sdk/client-dynamodb';
 import {
@@ -14,6 +14,9 @@ const eventBridgeClient = new EventBridgeClient({});
 const EVENTS_TABLE = process.env.EVENTS_TABLE!;
 const METADATA_TABLE = process.env.METADATA_TABLE!;
 const EVENT_BUS_NAME = process.env.EVENT_BUS_NAME!;
+// Optional: unset when the OTEL collector is skipped, in which case no
+// attribution exists to join against and AI origin stays 'unknown'.
+const AI_USAGE_TABLE = process.env.AI_USAGE_TABLE;
 
 interface SecurityAgentPayload {
   findings: Array<{
@@ -177,55 +180,85 @@ async function lookupTeamId(repo: string): Promise<string> {
   }
 }
 
+/**
+ * Candidate `REPO#` partition keys for one repository name.
+ *
+ * The two sides of this join spell the repo differently and nothing normalizes
+ * either. codeburn sets the `git.repo` span attribute from the git remote, so
+ * the attribution store holds a host-qualified path (`github.com/owner/name`).
+ * CI sends `GITHUB_REPOSITORY`, which is bare (`owner/name`). A single GetItem
+ * on whichever form the caller happened to pass would miss roughly half the
+ * time — and miss silently, since a missing item is indistinguishable from an
+ * unattributed commit.
+ *
+ * Rather than guess, try the value as given and then the plausible
+ * translations: add a host if it looks bare, strip one if it looks qualified.
+ */
+function repoKeyCandidates(repo: string): string[] {
+  const bare = repo.replace(/^https?:\/\//, '').replace(/\.git$/, '').replace(/\/+$/, '');
+  const candidates = [bare];
+  const segments = bare.split('/');
+  if (segments.length === 2) {
+    // owner/name → try the hosts codeburn would have recorded.
+    candidates.push(`github.com/${bare}`, `gitlab.com/${bare}`);
+  } else if (segments.length > 2) {
+    // host/owner/name → try dropping the host.
+    candidates.push(segments.slice(1).join('/'));
+  }
+  return [...new Set(candidates)];
+}
+
+/**
+ * Resolves whether the code a finding lands on was AI-written.
+ *
+ * Reads the attribution store, which is the only place that answer now lives.
+ * This previously queried the events table for `prism.d1.commit` and counted
+ * ai vs human across the last 7 days — but nothing emits `prism.d1.commit`.
+ * The git hooks that were once expected to only ever wrote commit-message
+ * trailers, so the query never matched and every finding was tagged 'unknown',
+ * silently, with the CISO dashboard's AI-code-risk panel downstream of it.
+ *
+ * The per-commit verdict is frozen onto the COMMIT# item at ingest by
+ * otel-receiver (`ai_origin`), so a point lookup is enough — no span join, and
+ * no dependence on a span TTL that is shorter than the commit TTL.
+ */
 async function lookupAiOrigin(
   teamId: string,
   repo: string,
   commitSha: string | null,
   prNumber: number | null,
 ): Promise<'ai-generated' | 'ai-assisted' | 'human' | 'unknown'> {
-  if (!commitSha && !prNumber) return 'unknown';
-
-  try {
-    // Query recent commit events for this repo to find AI origin
-    const pk = `${teamId}#${repo}`;
-    const now = new Date();
-    const lookback = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000); // 7 days
-
-    const result = await dynamoClient.send(
-      new QueryCommand({
-        TableName: EVENTS_TABLE,
-        KeyConditionExpression: 'pk = :pk AND sk >= :start',
-        FilterExpression: 'detail_type = :dt',
-        ExpressionAttributeValues: {
-          ':pk': { S: pk },
-          ':start': { S: lookback.toISOString() },
-          ':dt': { S: 'prism.d1.commit' },
-        },
-        ScanIndexForward: false, // Most recent first
-        Limit: 20,
-      }),
-    );
+  // A PR number alone cannot identify a commit in the attribution store, whose
+  // key is REPO#<repo>/COMMIT#<sha>. Returning 'unknown' is correct here rather
+  // than guessing from the repo's recent history.
+  if (!commitSha) return 'unknown';
+  if (!AI_USAGE_TABLE) return 'unknown';
 
-    if (result.Items && result.Items.length > 0) {
-      // Count AI vs human commits to determine predominant origin
-      let aiCount = 0;
-      let humanCount = 0;
-      for (const item of result.Items) {
-        const data = JSON.parse(item.data?.S ?? '{}');
-        const origin = data.ai_context?.origin ?? 'human';
-        if (origin === 'ai-generated' || origin === 'ai-assisted') {
-          aiCount++;
-        } else {
-          humanCount++;
-        }
-      }
-      if (aiCount > humanCount) return 'ai-assisted';
-      if (humanCount > aiCount) return 'human';
+  for (const candidate of repoKeyCandidates(repo)) {
+    try {
+      const result = await dynamoClient.send(
+        new GetItemCommand({
+          TableName: AI_USAGE_TABLE,
+          Key: {
+            pk: { S: `REPO#${candidate}` },
+            sk: { S: `COMMIT#${commitSha}` },
+          },
+          ProjectionExpression: 'ai_origin',
+        }),
+      );
+      const origin = result.Item?.ai_origin?.S;
+      if (origin === 'ai-generated' || origin === 'human') return origin;
+      // Item exists but carries no frozen verdict (written before write-time
+      // resolution). Treat as unresolved rather than trying another key.
+      if (result.Item) return 'unknown';
+    } catch (err) {
+      console.error(`AI origin lookup failed for REPO#${candidate}:`, err);
+      return 'unknown';
     }
-
-    return 'unknown';
-  } catch (err) {
-    console.error('Failed to look up AI origin:', err);
-    return 'unknown';
   }
+
+  // No attribution for this commit — the author's machine is not onboarded to
+  // codeburn sync. Distinct from 'human', which is a positive verdict.
+  console.log(`No attribution found for ${repo}@${commitSha} (team ${teamId}, PR ${prNumber ?? 'n/a'})`);
+  return 'unknown';
 }

package/dist/assets/infra/lib/metrics-pipeline-stack.ts

@@ -839,6 +839,10 @@ export class MetricsPipelineStack extends cdk.Stack {
         EVENTS_TABLE: this.eventsTable.tableName,
         METADATA_TABLE: this.metadataTable.tableName,
         EVENT_BUS_NAME: this.eventBus.eventBusName,
+        // Findings are tagged AI vs human by looking the commit up in the
+        // attribution store. Left unset when the OTEL collector is skipped,
+        // in which case there is no attribution and origin stays 'unknown'.
+        AI_USAGE_TABLE: this.aiUsageTable.tableName,
       },
       logRetention: logs.RetentionDays.ONE_MONTH,
       description: 'Normalizes AWS Security Agent findings and emits to PRISM pipeline',
@@ -846,6 +850,10 @@ export class MetricsPipelineStack extends cdk.Stack {
 
     this.eventsTable.grantReadData(securityAgentProcessor);
     this.metadataTable.grantReadData(securityAgentProcessor);
+    // Read-only: the processor resolves a finding's AI origin from the frozen
+    // ai_origin on the COMMIT# item. grantReadData also grants kms:Decrypt on
+    // the table's customer-managed key, which a bare IAM action would not.
+    this.aiUsageTable.grantReadData(securityAgentProcessor);
     this.eventBus.grantPutEventsTo(securityAgentProcessor);
 
     // Security Remediation Tracker

package/dist/src/commands/bootstrapper/install-eval-harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"install-eval-harness.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-eval-harness.ts"],"names":[],"mappings":";;;;;;;;;;;iBA2DqB;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;;AAVvI,wBA8CE"}
+{"version":3,"file":"install-eval-harness.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/install-eval-harness.ts"],"names":[],"mappings":";;;;;;;;;;;iBAmEqB;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE;;AAVvI,wBAwDE"}