@prism-d1/cli 1.0.83 → 1.0.85

package/dist/assets/infra/lib/constructs/otel-collector-construct.ts

@@ -27,6 +27,8 @@ import * as logs from 'aws-cdk-lib/aws-logs';
 import * as apigwv2 from 'aws-cdk-lib/aws-apigatewayv2';
 import { HttpLambdaIntegration } from 'aws-cdk-lib/aws-apigatewayv2-integrations';
 import { HttpJwtAuthorizer } from 'aws-cdk-lib/aws-apigatewayv2-authorizers';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import * as ssm from 'aws-cdk-lib/aws-ssm';
 import * as path from 'path';
 import { Construct } from 'constructs';
 import { NagSuppressions } from 'cdk-nag';
@@ -54,6 +56,10 @@ export class OtelCollectorConstruct extends Construct {
   public readonly archiveBucket: s3.Bucket;
   public readonly userPool?: cognito.UserPool;
   public readonly userPoolClient?: cognito.UserPoolClient;
+  /** Machine-to-machine client used by the coding agent's telemetry emitter. */
+  public readonly agentClient?: cognito.UserPoolClient;
+  /** Its credentials, read in CI with the ephemeral OIDC role. */
+  public readonly agentSecret?: secretsmanager.Secret;
   /** ARN of the CloudWatch custom-widget Lambda (Developer Productivity table). */
   public productivityWidgetArn?: string;
   /** The otel-receiver Lambda — other constructs may grant themselves invoke
@@ -74,6 +80,10 @@ export class OtelCollectorConstruct extends Construct {
     let issuer: string;
     let clientId: string;
     let identityClaim: string;
+    let domainPrefix = '';
+    let agentClientId = '';
+    let machineIdentities = '';
+    let tokenEndpoint = '';
 
     if (byoIdp) {
       issuer = props.externalIssuer!.replace(/\/$/, '');
@@ -102,8 +112,9 @@ export class OtelCollectorConstruct extends Construct {
       });
 
       // Hosted UI domain — prefix must be globally unique per region.
+      domainPrefix = `prism-d1-otel-${cdk.Aws.ACCOUNT_ID}`;
       this.userPool.addDomain('Domain', {
-        cognitoDomain: { domainPrefix: `prism-d1-otel-${cdk.Aws.ACCOUNT_ID}` },
+        cognitoDomain: { domainPrefix },
       });
 
       // Public client (no secret) — codeburn does Authorization Code + PKCE
@@ -131,6 +142,85 @@ export class OtelCollectorConstruct extends Construct {
       // Cognito ACCESS tokens carry `username` (no email claim) — with
       // email-alias sign-in and admin-created users, username == email.
       identityClaim = props.identityClaim ?? 'username';
+
+      // -----------------------------------------------------------------
+      // Machine-to-machine path, for the coding agent's own telemetry
+      // -----------------------------------------------------------------
+      // The agent runs in CI, so there is no human to complete an
+      // authorization-code flow. SAX-02 Outcome 3 names Cognito's
+      // client-credentials flow as the machine-to-machine pattern, with a
+      // resource server carrying fine-grained scopes; the alternative — a
+      // Cognito user password in a repository secret — is what Outcome 1 lists
+      // as "hardcoding credentials in application code or environment
+      // variables".
+      //
+      // Client credentials require a resource server: Cognito rejects the grant
+      // for a client whose only scopes are the standard openid/email/profile.
+      const resourceServer = this.userPool.addResourceServer('PrismResourceServer', {
+        identifier: 'prism',
+        scopes: [{ scopeName: 'emit', scopeDescription: 'Emit usage and attribution spans' }],
+      });
+
+      this.agentClient = this.userPool.addClient('CodingAgentClient', {
+        userPoolClientName: 'prism-coding-agent',
+        generateSecret: true,
+        // No authorization-code or SRP flow: this identity is never a person, and
+        // leaving a human flow enabled on it would be a second way in.
+        authFlows: {},
+        oAuth: {
+          flows: { clientCredentials: true, authorizationCodeGrant: false },
+          scopes: [cognito.OAuthScope.resourceServer(resourceServer, {
+            scopeName: 'emit',
+            scopeDescription: 'Emit usage and attribution spans',
+          })],
+        },
+        accessTokenValidity: cdk.Duration.hours(1),
+        enableTokenRevocation: true,
+        preventUserExistenceErrors: true,
+      });
+
+      // The credentials the CI job reads with its ephemeral OIDC role. Named
+      // under prism-d1- because setup-github-oidc grants GetSecretValue scoped
+      // to that prefix rather than to '*' — the role is assumed by a workflow
+      // that runs agent-authored code.
+      this.agentSecret = new secretsmanager.Secret(this, 'CodingAgentOidcSecret', {
+        secretName: 'prism-d1-agent-oidc',
+        description: 'Cognito client credentials for the PRISM coding agent telemetry emitter',
+        secretObjectValue: {
+          client_id: cdk.SecretValue.unsafePlainText(this.agentClient.userPoolClientId),
+          // unsafePlainText names the risk accurately and it does not apply here:
+          // the value is a CloudFormation reference resolved at deploy time, not a
+          // literal in source. The client id is not sensitive; the secret is, and
+          // it never leaves CloudFormation except into this secret.
+          client_secret: this.agentClient.userPoolClientSecret,
+        },
+        removalPolicy: cdk.RemovalPolicy.RETAIN,
+      });
+
+      // Cognito app-client secrets cannot be rotated in place — you would recreate
+      // the client, which invalidates every outstanding token and every copy of the
+      // old secret. The suppression documents why rotation is not configured rather
+      // than silently ignoring the rule.
+      NagSuppressions.addResourceSuppressions(this.agentSecret, [
+        {
+          id: 'AwsSolutions-SMG4',
+          reason:
+            'Cognito app-client secrets are immutable: rotating requires replacing the ' +
+            'client, which invalidates all outstanding tokens. Rotation would be a ' +
+            'client-replacement Lambda on a 90-day schedule, acceptable for a workshop ' +
+            'sample but not implemented here. The secret is scoped to one user pool and ' +
+            'grants only the prism/emit scope.',
+        },
+      ]);
+
+      agentClientId = this.agentClient.userPoolClientId;
+      // A client-credentials token has no username, no email, and a `sub` equal to
+      // the app client id — so identity has to be mapped rather than read. Mapped
+      // here, at deploy time, precisely so it is NOT caller-supplied: a payload
+      // that could name its own author would let any holder of any token post as
+      // anyone.
+      machineIdentities = JSON.stringify({ [agentClientId]: 'prism-coding-agent' });
+      tokenEndpoint = `https://${domainPrefix}.auth.${cdk.Aws.REGION}.amazoncognito.com/oauth2/token`;
     }
 
     // -------------------------------------------------------
@@ -191,6 +281,9 @@ export class OtelCollectorConstruct extends Construct {
         IDENTITY_CLAIM: identityClaim,
         OIDC_ISSUER: issuer,
         OIDC_CLIENT_ID: clientId,
+        // clientId -> identity, for tokens that carry no username. Deploy-time
+        // config so the author of a span is never caller-supplied.
+        MACHINE_IDENTITIES: machineIdentities,
         MAX_BATCH_SIZE: '1000',
         SPAN_TTL_DAYS: '90',
       },
@@ -271,8 +364,12 @@ export class OtelCollectorConstruct extends Construct {
 
     // HTTP API JWT authorizers validate the `aud` claim, or `client_id` for
     // Cognito access tokens — both paths work with jwtAudience = [clientId].
+    // Both client ids: API Gateway validates `aud`, or `client_id` for Cognito
+    // access tokens, and a client-credentials token carries the M2M client id.
+    // Listing only the codeburn client would reject every agent span with a 401
+    // that looks like a bad token rather than a missing audience entry.
     const authorizer = new HttpJwtAuthorizer('OtelJwtAuthorizer', issuer, {
-      jwtAudience: [clientId],
+      jwtAudience: agentClientId ? [clientId, agentClientId] : [clientId],
     });
 
     // Discovery doc — unauthenticated by design (it only exposes issuer +
@@ -365,5 +462,40 @@ export class OtelCollectorConstruct extends Construct {
       });
       poolOutput.overrideLogicalId('OtelUserPoolId');
     }
+    if (this.agentSecret) {
+      // SSM parameters: the workflow reads these at run time instead of requiring
+      // GitHub org variables. One source of truth, written by CDK at deploy time,
+      // cannot drift from what's actually deployed.
+      const ssmPrefix = '/prism/d1';
+      new ssm.StringParameter(this, 'ParamCollectorUrl', {
+        parameterName: `${ssmPrefix}/collector-url`,
+        stringValue: this.httpApi.apiEndpoint,
+        description: 'OTEL collector URL — read by the coding agent workflow',
+        tier: ssm.ParameterTier.STANDARD,
+      });
+      new ssm.StringParameter(this, 'ParamTokenEndpoint', {
+        parameterName: `${ssmPrefix}/token-endpoint`,
+        stringValue: tokenEndpoint,
+        description: 'Cognito token endpoint — read by the coding agent workflow',
+        tier: ssm.ParameterTier.STANDARD,
+      });
+      new ssm.StringParameter(this, 'ParamAgentSecretId', {
+        parameterName: `${ssmPrefix}/agent-secret-id`,
+        stringValue: this.agentSecret.secretName,
+        description: 'Secrets Manager id for the M2M client credentials',
+        tier: ssm.ParameterTier.STANDARD,
+      });
+
+      // Outputs kept for discoverability — printed by `cdk deploy`, but no longer
+      // need to be manually copied into GitHub.
+      new cdk.CfnOutput(this, 'PrismAgentTokenEndpoint', {
+        value: tokenEndpoint,
+        description: 'Also available as SSM /prism/d1/token-endpoint',
+      }).overrideLogicalId('PrismAgentTokenEndpoint');
+      new cdk.CfnOutput(this, 'PrismAgentSecretId', {
+        value: this.agentSecret.secretName,
+        description: 'Also available as SSM /prism/d1/agent-secret-id',
+      }).overrideLogicalId('PrismAgentSecretId');
+    }
   }
 }

package/dist/assets/infra/lib/dashboard-stack.ts

@@ -92,47 +92,19 @@ export class DashboardStack extends cdk.Stack {
       });
 
     teamDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Commits / Day (AI vs Human)',
-        left: [
-          dailySum('AICommits', 'AI commits'),
-          dailySum('HumanCommits', 'Human commits'),
-        ],
-        view: cloudwatch.GraphWidgetView.BAR,
-        stacked: true,
-        width: 8,
-        height: 6,
-        leftYAxis: { min: 0, label: 'Commits' },
-      }),
-      new cloudwatch.GraphWidget({
-        title: 'Merge Ratio: AI vs Human',
-        left: [
-          // Both lines from attribution spans. Divergence is the signal:
-          // AI code merging at a materially lower rate than human code means
-          // review friction or quality problems, not just "AI is used a lot".
-          new cloudwatch.MathExpression({
-            expression: 'FILL(IF(FILL(aiCommits, 0) > 0, 100 * FILL(mergedAi, 0) / FILL(aiCommits, 0)), REPEAT)',
-            usingMetrics: {
-              mergedAi: dailySum('MergedAICommits'),
-              aiCommits: dailySum('AICommits'),
-            },
-            label: 'AI merge rate (%)',
-            period: cdk.Duration.days(1),
-          }),
-          new cloudwatch.MathExpression({
-            expression: 'FILL(IF(FILL(humanCommits, 0) > 0, 100 * FILL(mergedHuman, 0) / FILL(humanCommits, 0)), REPEAT)',
-            usingMetrics: {
-              mergedHuman: dailySum('MergedHumanCommits'),
-              humanCommits: dailySum('HumanCommits'),
-            },
-            label: 'Human merge rate (%)',
-            period: cdk.Duration.days(1),
-          }),
-        ],
-        width: 8,
+      // Commits / Day and Merge Ratio replaced by DDB-backed custom widget to
+      // avoid CloudWatch increment-only double-count when CI-seeded human items
+      // are later upgraded to AI by codeburn attribution.
+      ...(props?.velocityWidgetArn ? [new cloudwatch.CustomWidget({
+        functionArn: props.velocityWidgetArn,
+        title: 'Commits & Merge Rate (AI vs Human)',
+        width: 16,
         height: 6,
-        leftYAxis: { min: 0, max: 100, label: 'Percent' },
-      }),
+        params: { view: 'commits-trend' },
+        updateOnRefresh: true,
+        updateOnResize: false,
+        updateOnTimeRangeChange: true,
+      })] : []),
       new cloudwatch.GraphWidget({
         title: 'AI Defect Trend (reverted / merged)',
         left: [
@@ -232,18 +204,17 @@ export class DashboardStack extends cdk.Stack {
       });
 
     execDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'AI vs Human Commits (Weekly)',
-        left: [
-          weeklySum('AICommits', 'AI commits'),
-          weeklySum('HumanCommits', 'Human commits'),
-        ],
-        view: cloudwatch.GraphWidgetView.BAR,
-        stacked: true,
+      // AI vs Human Commits (Weekly) replaced by DDB-backed custom widget.
+      ...(props?.velocityWidgetArn ? [new cloudwatch.CustomWidget({
+        functionArn: props.velocityWidgetArn,
+        title: 'AI vs Human Commits & Merge Rate',
         width: 8,
         height: 6,
-        leftYAxis: { min: 0, label: 'Commits' },
-      }),
+        params: { view: 'commits-trend' },
+        updateOnRefresh: true,
+        updateOnResize: false,
+        updateOnTimeRangeChange: true,
+      })] : []),
       new cloudwatch.GraphWidget({
         title: 'AI Spend Trend (Weekly)',
         left: [weeklySum('AICostUSD', 'Spend ($)')],
@@ -273,27 +244,11 @@ export class DashboardStack extends cdk.Stack {
     );
 
     // Row 4: quality — "is AI code as reliable as human code?"
+    // Merge Rate: AI vs Human is already included in the commits-trend custom
+    // widget above (DDB-backed, avoids CloudWatch double-count). Only the AI
+    // Defect Trend (RevertedAICommits / MergedAICommits) remains as CloudWatch
+    // native because it uses AI-only metrics with no upgrade double-count issue.
     execDashboard.addWidgets(
-      new cloudwatch.GraphWidget({
-        title: 'Merge Rate: AI vs Human (Weekly)',
-        left: [
-          new cloudwatch.MathExpression({
-            expression: 'FILL(IF(FILL(xAi, 0) > 0, 100 * FILL(xMergedAi, 0) / FILL(xAi, 0)), REPEAT)',
-            usingMetrics: { xMergedAi: weeklySum('MergedAICommits'), xAi: weeklySum('AICommits') },
-            label: 'AI merge rate (%)',
-            period: cdk.Duration.days(7),
-          }),
-          new cloudwatch.MathExpression({
-            expression: 'FILL(IF(FILL(xHuman, 0) > 0, 100 * FILL(xMergedHuman, 0) / FILL(xHuman, 0)), REPEAT)',
-            usingMetrics: { xMergedHuman: weeklySum('MergedHumanCommits'), xHuman: weeklySum('HumanCommits') },
-            label: 'Human merge rate (%)',
-            period: cdk.Duration.days(7),
-          }),
-        ],
-        width: 12,
-        height: 6,
-        leftYAxis: { min: 0, max: 100, label: 'Percent' },
-      }),
       new cloudwatch.GraphWidget({
         title: 'AI Defect Trend (Weekly)',
         left: [
@@ -739,11 +694,26 @@ export class DashboardStack extends cdk.Stack {
         });
 
       devDashboard.addWidgets(
-        ratioKpi('AI Share of Commits (%)', 'IF(FILL(kTotal, 0) > 0, 100 * FILL(kAi, 0) / FILL(kTotal, 0))', {
-          kAi: dailyMetric('AICommits', 'kAi'), kTotal: dailyMetric('CommitsTotal', 'kTotal'),
+        // AI Share and AI Merge Rate are DDB-backed (accurate, no CloudWatch delay)
+        new cloudwatch.CustomWidget({
+          functionArn: props.velocityWidgetArn ?? '',
+          title: 'AI Share of Commits',
+          width: 6,
+          height: 4,
+          params: { view: 'ai-share-kpi' },
+          updateOnRefresh: true,
+          updateOnResize: false,
+          updateOnTimeRangeChange: true,
         }),
-        ratioKpi('AI Merge Rate (%)', 'IF(FILL(kAi2, 0) > 0, 100 * FILL(kMerged, 0) / FILL(kAi2, 0))', {
-          kMerged: dailyMetric('MergedAICommits', 'kMerged'), kAi2: dailyMetric('AICommits', 'kAi2'),
+        new cloudwatch.CustomWidget({
+          functionArn: props.velocityWidgetArn ?? '',
+          title: 'AI Merge Rate',
+          width: 6,
+          height: 4,
+          params: { view: 'merge-rate-kpi' },
+          updateOnRefresh: true,
+          updateOnResize: false,
+          updateOnTimeRangeChange: true,
         }),
         ratioKpi('Cost per Shipped Commit ($)', 'IF(FILL(kMerged2, 0) > 0, FILL(kCost, 0) / FILL(kMerged2, 0))', {
           kCost: dailyMetric('AICostUSD', 'kCost'), kMerged2: dailyMetric('MergedAICommits', 'kMerged2'),
@@ -757,19 +727,18 @@ export class DashboardStack extends cdk.Stack {
         }),
       );
 
-      // --- Row 2: Org trends (native interactive charts) ---
+      // --- Row 2: Org trends ---
       devDashboard.addWidgets(
-        new cloudwatch.GraphWidget({
+        // Commits bar chart — just AI vs Human stacked bars, no KPIs or merge rate
+        new cloudwatch.CustomWidget({
+          functionArn: props.velocityWidgetArn ?? '',
           title: 'Commits / Day (AI vs Human)',
-          left: [
-            dailyMetric('AICommits', 'AI commits'),
-            dailyMetric('HumanCommits', 'Human commits'),
-          ],
-          view: cloudwatch.GraphWidgetView.BAR,
-          stacked: true,
           width: 8,
           height: 6,
-          leftYAxis: { min: 0, label: 'Commits' },
+          params: { view: 'commits-bar' },
+          updateOnRefresh: true,
+          updateOnResize: false,
+          updateOnTimeRangeChange: true,
         }),
         new cloudwatch.GraphWidget({
           title: 'AI Spend / Day',
@@ -778,23 +747,38 @@ export class DashboardStack extends cdk.Stack {
           height: 6,
           leftYAxis: { min: 0, label: 'USD' },
         }),
-        new cloudwatch.GraphWidget({
-          title: 'AI Merge Ratio Trend',
-          left: [
-            new cloudwatch.MathExpression({
-              expression: 'FILL(IF(FILL(tAi, 0) > 0, 100 * FILL(tMerged, 0) / FILL(tAi, 0)), REPEAT)',
-              usingMetrics: { tMerged: dailyMetric('MergedAICommits', 'tMerged'), tAi: dailyMetric('AICommits', 'tAi') },
-              label: 'Merge ratio (%)',
-              period: cdk.Duration.days(1),
-            }),
-          ],
+        // Merge Rate Trend — DDB-backed line chart replacing CloudWatch AI Merge Ratio Trend
+        new cloudwatch.CustomWidget({
+          functionArn: props.velocityWidgetArn ?? '',
+          title: 'Merge Rate Trend (AI vs Human)',
           width: 8,
           height: 6,
-          leftYAxis: { min: 0, max: 100, label: 'Percent' },
+          params: { view: 'merge-rate-trend' },
+          updateOnRefresh: true,
+          updateOnResize: false,
+          updateOnTimeRangeChange: true,
+        }),
+      );
+
+      // --- Row 3: The coding agent's own work ---
+      // Its own row rather than a column in the team table: autonomous work is not
+      // human-assisted AI use, and the receiver keeps it out of `totals` for the
+      // same reason. Placed above the human table because an agent that ships more
+      // than a developer should not be discovered by scrolling.
+      devDashboard.addWidgets(
+        new cloudwatch.CustomWidget({
+          functionArn: props.productivityWidgetArn,
+          title: 'PRISM Coding Agent — issues, commits and spend',
+          width: 24,
+          height: 7,
+          params: { view: 'coding-agent' },
+          updateOnRefresh: true,
+          updateOnResize: false,
+          updateOnTimeRangeChange: true,
         }),
       );
 
-      // --- Row 3: Team comparison table (custom widget, view=table) ---
+      // --- Row 4: Team comparison table (custom widget, view=table) ---
       devDashboard.addWidgets(
         new cloudwatch.CustomWidget({
           functionArn: props.productivityWidgetArn,

package/dist/assets/infra/lib/lambda/metrics-processor.ts

@@ -196,6 +196,11 @@ const cloudwatchClient = new CloudWatchClient({});
 const EVENTS_TABLE = process.env.EVENTS_TABLE!;
 const METADATA_TABLE = process.env.METADATA_TABLE!;
 const METRIC_NAMESPACE = process.env.METRIC_NAMESPACE ?? 'PRISM/D1/Velocity';
+// Optional: when set, PR events seed the attribution store with default-human
+// COMMIT# items so that commits not yet pushed by codeburn are visible as human
+// rather than absent. The otel-receiver's condition expression allows a later
+// codeburn push to upgrade human → ai-generated, so ordering does not matter.
+const AI_USAGE_TABLE = process.env.AI_USAGE_TABLE;
 
 
 // ---- Handler ----
@@ -220,9 +225,10 @@ export async function handler(event: EventBridgeEvent): Promise<void> {
     writeEventToDynamo(detailType, detail),
     writeMetadataToDynamo(detailType, detail),
     publishCloudWatchMetrics(detailType, detail),
+    seedCommitAttribution(detailType, detail),
   ]);
 
-  const labels = ['writeEventToDynamo', 'writeMetadataToDynamo', 'publishCloudWatchMetrics'];
+  const labels = ['writeEventToDynamo', 'writeMetadataToDynamo', 'publishCloudWatchMetrics', 'seedCommitAttribution'];
   results.forEach((result, idx) => {
     if (result.status === 'rejected') {
       console.error(`[metrics-processor] ${labels[idx]} FAILED:`, result.reason);
@@ -844,3 +850,95 @@ function mapUnit(unit: string): StandardUnit {
   };
   return unitMap[unit?.toLowerCase()] ?? StandardUnit.None;
 }
+
+
+// ---- Commit attribution seeding ----
+
+/**
+ * When a prism.d1.pr event arrives with commit_shas, seed a COMMIT# item for
+ * each SHA in the attribution store with ai_origin=human and in_main=true.
+ *
+ * This ensures human commits are explicitly represented rather than invisible.
+ * The otel-receiver's condition expression allows a later codeburn push to
+ * upgrade human → ai-generated:
+ *
+ *   OR (ai_origin = :human AND :ao = :ai)
+ *
+ * So ordering between PR merge and codeburn sync does not matter:
+ * - If codeburn pushed first: item already has ai_origin=ai-generated, this
+ *   write is rejected by the condition (never downgrade ai→human). ✓
+ * - If PR merges first: item is written as human, codeburn upgrades later. ✓
+ * - Simultaneous: DDB conditional write is atomic, one wins. ✓
+ *
+ * The repo format from the CI workflow is bare (owner/name), but codeburn
+ * stores with a host prefix (github.com/owner/name). We write under the bare
+ * form because the /v1/repos and /v1/productivity endpoints scan ALL COMMIT#
+ * items regardless of repo format, and repoKeyCandidates() in the security
+ * processor already handles both forms for point lookups.
+ */
+async function seedCommitAttribution(detailType: string, detail: any): Promise<void> {
+  // Only process prism.d1.pr events that carry commit SHAs
+  if (detailType !== 'prism.d1.pr') return;
+  if (!AI_USAGE_TABLE) return;
+
+  const pr = detail.pr as PrDetail | undefined;
+  const shas = pr?.commit_shas;
+  if (!shas || shas.length === 0) return;
+
+  const authors: string[] = (pr as any)?.commit_authors ?? [];
+  const repo = detail.repo as string;
+  // CI workflows now emit fully-qualified repo names (github.com/owner/repo
+  // or gitlab.com/group/project) matching codeburn's convention. No
+  // normalization needed — the ConditionExpression hits existing items directly.
+  const timestamp = detail.timestamp as string ?? new Date().toISOString();
+  const ttl = Math.floor(Date.now() / 1000) + 365 * 86400; // 1 year
+
+  let seeded = 0;
+  for (let i = 0; i < shas.length; i++) {
+    const sha = shas[i];
+    const author = authors[i] ?? ''; // parallel array; may be shorter or absent
+    try {
+      await dynamoClient.send(new PutItemCommand({
+        TableName: AI_USAGE_TABLE,
+        Item: {
+          pk: { S: `REPO#${repo}` },
+          sk: { S: `COMMIT#${sha}` },
+          record_type: { S: 'OTEL_ATTR_COMMIT' },
+          ai_origin: { S: 'human' },
+          ai_tool: { S: 'none' },
+          ai_model: { S: '' },
+          origin_source: { S: 'ci-seeded' },
+          in_main: { BOOL: true },
+          was_reverted: { BOOL: false },
+          timestamp: { S: timestamp },
+          updated_at: { S: new Date().toISOString() },
+          ttl: { N: String(ttl) },
+          // Author email from git log --format='%ae'. Enables per-developer
+          // attribution in /v1/productivity even before codeburn syncs.
+          ...(author ? {
+            user: { S: author },
+            gsi_user: { S: `USER#${author}` },
+            gsi_user_sk: { S: `COMMIT#${timestamp}` },
+          } : {}),
+        },
+        // Only write if the item does NOT already exist. If codeburn already
+        // pushed this commit (with ai_origin=ai-generated), do not overwrite.
+        // If the metrics-processor already seeded it on a prior invocation
+        // (retry), this is idempotent.
+        ConditionExpression: 'attribute_not_exists(pk)',
+      }));
+      seeded++;
+    } catch (err: any) {
+      // ConditionalCheckFailedException means item already exists — expected
+      // when codeburn pushed first or on retry. Not an error.
+      if (err.name !== 'ConditionalCheckFailedException') {
+        console.error(`[seedCommitAttribution] Failed to seed ${sha}:`, err);
+        throw err;
+      }
+    }
+  }
+
+  if (seeded > 0) {
+    console.log(`[seedCommitAttribution] Seeded ${seeded}/${shas.length} commits as human for ${repo}`);
+  }
+}