@prism-d1/cli 1.0.84 → 1.0.85

package/dist/assets/infra/lib/lambda/otel-receiver.ts

@@ -33,6 +33,23 @@ const s3Client = new S3Client({});
 const AI_USAGE_TABLE = process.env.AI_USAGE_TABLE || 'prism-d1-ai-usage';
 const ARCHIVE_BUCKET = process.env.ARCHIVE_BUCKET || '';
 const IDENTITY_CLAIM = process.env.IDENTITY_CLAIM || 'username';
+
+// clientId -> identity, for machine-to-machine tokens. A Cognito
+// client-credentials access token carries no `username` and no `email`, and its
+// `sub` is the app client id -- so without a mapping the coding agent would appear
+// on every dashboard as a random opaque string.
+//
+// Deliberately deploy-time configuration rather than anything the caller sends. A
+// payload that could name its own author would let any holder of any token post as
+// anyone, which is a worse problem than an ugly label.
+const MACHINE_IDENTITIES: Record<string, string> = (() => {
+  try {
+    return JSON.parse(process.env.MACHINE_IDENTITIES || '{}');
+  } catch {
+    console.warn('MACHINE_IDENTITIES is not valid JSON; machine tokens will fall back to sub');
+    return {};
+  }
+})();
 const OIDC_ISSUER = process.env.OIDC_ISSUER || '';
 const OIDC_CLIENT_ID = process.env.OIDC_CLIENT_ID || '';
 const MAX_BATCH_SIZE = Number(process.env.MAX_BATCH_SIZE || '1000');
@@ -101,6 +118,10 @@ interface ParsedSpan {
   costUsd: number;
   project: string;
   costEstimated: boolean;
+  /** True for spans the PRISM coding agent emitted: work no human prompted. */
+  autonomous?: boolean;
+  /** The issue the agent was handed. 0 when not an agent span. */
+  issueNumber?: number;
   deviceId: string;
 }
 
@@ -118,6 +139,10 @@ interface ParsedAttributionSpan {
   deviceId: string;
   // session-specific
   commitCount?: number;
+  /** True for spans the PRISM coding agent emitted. */
+  autonomous?: boolean;
+  /** The issue handed to the agent; 0 for human spans. */
+  issueNumber?: number;
   prLinks?: string[];
   // commit-specific
   sha?: string;
@@ -184,6 +209,16 @@ function nanoToIso(nano: string | undefined): string {
 function resolveIdentity(event: HttpApiEvent): string | null {
   const claims = event.requestContext.authorizer?.jwt?.claims;
   if (!claims) return null;
+
+  // A machine token first: checked before the claim chain because its `sub` would
+  // otherwise satisfy that chain with the app client id.
+  for (const claim of ['client_id', 'sub']) {
+    const raw = claims[claim];
+    if (typeof raw === 'string' && MACHINE_IDENTITIES[raw]) {
+      return MACHINE_IDENTITIES[raw].trim().toLowerCase();
+    }
+  }
+
   for (const claim of [IDENTITY_CLAIM, 'username', 'email', 'sub']) {
     const v = claims[claim];
     if (typeof v === 'string' && v.trim()) return v.trim().toLowerCase();
@@ -243,6 +278,8 @@ export function parseOtlpSpans(payload: OtlpPayload): {
               sha: sha.slice(0, 40),
               inMain: bool(attrs.get('git.in_main')),
               wasReverted: bool(attrs.get('git.was_reverted')),
+              autonomous: bool(attrs.get('prism.autonomous')),
+              issueNumber: num(attrs.get('prism.issue_number')),
             });
           } else {
             // session attribution
@@ -267,6 +304,8 @@ export function parseOtlpSpans(payload: OtlpPayload): {
               repo,
               deviceId,
               commitCount: num(attrs.get('git.commit_count')),
+              autonomous: bool(attrs.get('prism.autonomous')),
+              issueNumber: num(attrs.get('prism.issue_number')),
               prLinks: prLinks.slice(0, 20),
             });
           }
@@ -303,6 +342,11 @@ export function parseOtlpSpans(payload: OtlpPayload): {
           project: str(attrs.get('ai.project')).slice(0, 256),
           costEstimated: bool(attrs.get('ai.cost_estimated')),
           deviceId,
+          // Emitted by the PRISM coding agent. `autonomous` separates work no human
+          // prompted from human-assisted AI use, which the PRISM levels treat as
+          // different things -- L5 is about autonomous deployments, not AI share.
+          autonomous: bool(attrs.get('prism.autonomous')),
+          issueNumber: num(attrs.get('prism.issue_number')),
         });
       }
     }
@@ -350,6 +394,7 @@ async function writeSpanIfNew(user: string, s: ParsedSpan): Promise<boolean> {
         sk: { S: `SPAN#${s.timestamp}#${s.spanId}` },
         record_type: { S: 'OTEL_SPAN' },
         trace_id: { S: s.traceId },
+        autonomous: { BOOL: s.autonomous === true },
         tool: { S: s.tool },
         model: { S: s.model },
         input_tokens: { N: String(s.inputTokens) },
@@ -371,6 +416,42 @@ async function writeSpanIfNew(user: string, s: ParsedSpan): Promise<boolean> {
   }
 }
 
+/**
+ * Record that this identity worked on one issue.
+ *
+ * One item per (user, repo, issue) rather than a counter, because "issues worked
+ * on" is a count of DISTINCT issues and an agent emits a usage span per invocation
+ * -- a re-run of the same issue would otherwise inflate the number. The dedup is
+ * the condition expression, exactly as it is for spans.
+ *
+ * A separate item rather than a field on the span so counting is a Query on an sk
+ * prefix instead of a scan-and-deduplicate over every span in the window.
+ */
+async function recordIssue(user: string, repo: string, issueNumber: number,
+                           timestamp: string, autonomous: boolean): Promise<boolean> {
+  if (!issueNumber || !repo) return false;
+  try {
+    await dynamoClient.send(new PutItemCommand({
+      TableName: AI_USAGE_TABLE,
+      Item: {
+        pk: { S: `USER#${user}` },
+        sk: { S: `ISSUE#${repo}#${issueNumber}` },
+        record_type: { S: 'OTEL_ISSUE' },
+        repo: { S: repo },
+        issue_number: { N: String(issueNumber) },
+        autonomous: { BOOL: autonomous },
+        first_seen: { S: timestamp },
+        ttl: { N: String(Math.floor(Date.now() / 1000) + COMMIT_TTL_DAYS * 86400) },
+      },
+      ConditionExpression: 'attribute_not_exists(pk)',
+    }));
+    return true;
+  } catch (e) {
+    if (e instanceof ConditionalCheckFailedException) return false;
+    throw e;
+  }
+}
+
 /** ADD-increment the daily aggregate for a newly-seen span (bucketed by SPAN date). */
 async function bumpDailyAggregate(user: string, s: ParsedSpan): Promise<void> {
   const day = s.timestamp.slice(0, 10);
@@ -421,6 +502,7 @@ async function writeSessionAttribution(user: string, s: ParsedAttributionSpan):
       timestamp: { S: s.timestamp },
       end_time: { S: s.endTimestamp },
       commit_count: { N: String(s.commitCount ?? 0) },
+      autonomous: { BOOL: s.autonomous === true },
       ttl: { N: String(ttl) },
     };
     if (s.repo) item.repo = { S: s.repo };
@@ -473,6 +555,9 @@ async function writeCommitAttribution(
   const aiModel = usage ? usage.model : '';
 
   try {
+    // Write 1: Upsert metadata + origin. Does NOT touch in_main or was_reverted
+    // to prevent codeburn (which doesn't know about merges) from downgrading
+    // CI-seeded in_main=true back to false.
     await dynamoClient.send(new UpdateItemCommand({
       TableName: AI_USAGE_TABLE,
       Key: {
@@ -482,25 +567,18 @@ async function writeCommitAttribution(
       UpdateExpression:
         'SET record_type = :rt, session_id = :sid, trace_id = :tid, ' +
         '#proj = :proj, #usr = :usr, device_id = :did, ' +
-        'in_main = :im, was_reverted = :wr, ' +
         '#ts = :ts, updated_at = :now, #ttl = :ttl, ' +
-        // Frozen origin verdict — see the note above.
         'ai_origin = :ao, ai_tool = :at, ai_model = :am, origin_source = :os, ' +
-        // Sparse by-user GSI keys: per-developer commit queries (GET
-        // /v1/productivity) without scanning the table.
-        'gsi_user = :gu, gsi_user_sk = :gusk',
-      // Write if: item is new, OR inMain/wasReverted changed, OR we can now
-      // resolve an origin we previously could not. The last clause lets a
-      // commit whose usage spans arrived in a LATER push get upgraded from
-      // human to ai-generated, instead of being frozen wrong forever.
+        'gsi_user = :gu, gsi_user_sk = :gusk, autonomous = :auto, ' +
+        // Set in_main and was_reverted ONLY on new items. Existing values are
+        // preserved — upgrades (false→true) happen in Write 2 below.
+        'in_main = if_not_exists(in_main, :im), ' +
+        'was_reverted = if_not_exists(was_reverted, :wr)',
       ConditionExpression:
-        'attribute_not_exists(pk) OR in_main <> :im OR was_reverted <> :wr ' +
+        'attribute_not_exists(pk) ' +
         'OR attribute_not_exists(ai_origin) ' +
         'OR (ai_origin = :human AND :ao = :ai)',
       ExpressionAttributeNames: {
-        // 'project', 'ttl', 'user', and 'timestamp' are all DynamoDB
-        // reserved keywords — bare use in an expression throws
-        // ValidationException at runtime.
         '#proj': 'project',
         '#ttl': 'ttl',
         '#usr': 'user',
@@ -519,6 +597,7 @@ async function writeCommitAttribution(
         ':now': { S: new Date().toISOString() },
         ':ttl': { N: String(ttl) },
         ':ao': { S: aiOrigin },
+        ':auto': { BOOL: s.autonomous === true },
         ':at': { S: aiTool },
         ':am': { S: aiModel },
         ':os': { S: 'write-time-join' },
@@ -528,11 +607,58 @@ async function writeCommitAttribution(
         ':gusk': { S: `COMMIT#${s.timestamp}` },
       },
     }));
-    return true;
   } catch (e) {
-    if (e instanceof ConditionalCheckFailedException) return false; // no-op, state unchanged
-    throw e;
+    if (!(e instanceof ConditionalCheckFailedException)) throw e;
+    // Item exists and origin is already ai-generated (or same) — no-op for Write 1.
+  }
+
+  // Write 2: Upgrade boolean state fields (false→true only). These are
+  // separate so they never downgrade: codeburn may push in_main=false before
+  // the commit merges, while CI already seeded in_main=true.
+  if (s.inMain) {
+    try {
+      await dynamoClient.send(new UpdateItemCommand({
+        TableName: AI_USAGE_TABLE,
+        Key: {
+          pk: { S: `REPO#${s.repo}` },
+          sk: { S: `COMMIT#${s.sha}` },
+        },
+        UpdateExpression: 'SET in_main = :true, updated_at = :now',
+        ConditionExpression: 'attribute_exists(pk) AND in_main = :false',
+        ExpressionAttributeValues: {
+          ':true': { BOOL: true },
+          ':false': { BOOL: false },
+          ':now': { S: new Date().toISOString() },
+        },
+      }));
+    } catch (e) {
+      if (!(e instanceof ConditionalCheckFailedException)) throw e;
+      // Already true — expected.
+    }
   }
+  if (s.wasReverted) {
+    try {
+      await dynamoClient.send(new UpdateItemCommand({
+        TableName: AI_USAGE_TABLE,
+        Key: {
+          pk: { S: `REPO#${s.repo}` },
+          sk: { S: `COMMIT#${s.sha}` },
+        },
+        UpdateExpression: 'SET was_reverted = :true, updated_at = :now',
+        ConditionExpression: 'attribute_exists(pk) AND was_reverted = :false',
+        ExpressionAttributeValues: {
+          ':true': { BOOL: true },
+          ':false': { BOOL: false },
+          ':now': { S: new Date().toISOString() },
+        },
+      }));
+    } catch (e) {
+      if (!(e instanceof ConditionalCheckFailedException)) throw e;
+      // Already true — expected.
+    }
+  }
+
+  return true;
 }
 
 /** Process attribution spans. Returns count of writes. */
@@ -553,7 +679,14 @@ async function processAttributionSpans(user: string, spans: ParsedAttributionSpa
   for (let i = 0; i < spans.length; i += CONCURRENCY) {
     const chunk = spans.slice(i, i + CONCURRENCY);
     const results = await Promise.all(chunk.map(async (s) => {
-      if (s.kind === 'session') return writeSessionAttribution(user, s);
+      if (s.kind === 'session') {
+        // Fire alongside, not instead: the issue record answers "how many
+        // issues" and the session record answers "what happened in one
+        // sitting". Failing to dedup an issue must not fail the session write.
+        await recordIssue(user, s.repo ?? '', s.issueNumber ?? 0, s.timestamp,
+                          s.autonomous === true);
+        return writeSessionAttribution(user, s);
+      }
       return writeCommitAttribution(user, s, traceMap);
     }));
     written += results.filter(Boolean).length;
@@ -692,7 +825,7 @@ export async function queryCommitAttribution(repo: string, sha: string): Promise
     traceId,
     user,
     project: item.project?.S ?? '',
-    inMain: item.in_main?.BOOL ?? false,
+    inMain: (item.in_main?.BOOL ?? false) || item.origin_source?.S === 'ci-seeded',
     wasReverted: item.was_reverted?.BOOL ?? false,
     timestamp: item.timestamp?.S ?? '',
     aiOrigin,
@@ -755,7 +888,7 @@ export async function queryRepoCommits(repo: string, limit = 50): Promise<Commit
       traceId,
       user,
       project: item.project?.S ?? '',
-      inMain: item.in_main?.BOOL ?? false,
+      inMain: (item.in_main?.BOOL ?? false) || item.origin_source?.S === 'ci-seeded',
       wasReverted: item.was_reverted?.BOOL ?? false,
       timestamp: item.timestamp?.S ?? '',
       aiOrigin,
@@ -892,6 +1025,16 @@ type UserProductivity = {
     costPerAiCommit: number | null;
     costPerShippedCommit: number | null;
   };
+  /** Distinct issues this identity worked on -- an agent metric with no human analogue. */
+  issues: number;
+  /**
+   * True when every usage span for this identity was marked prism.autonomous.
+   * Autonomous work is not human-assisted AI use, and PRISM's levels treat them as
+   * different things: L5 is about autonomous deployments, not AI share. Kept
+   * separable so it can be reported on its own rather than quietly inflating
+   * everybody's numbers.
+   */
+  autonomous: boolean;
 };
 
 function computeRatios(u: UserProductivity): void {
@@ -912,6 +1055,8 @@ function emptyUserProductivity(user: string): UserProductivity {
     user,
     usage: { inputTokens: 0, outputTokens: 0, costUsd: 0, calls: 0, byTool: {}, byModel: {} },
     commits: { total: 0, ai: 0, human: 0, mergedAi: 0, revertedAi: 0 },
+    issues: 0,
+    autonomous: false,
     ratios: { aiSharePct: null, mergeRatePct: null, defectRatePct: null, costPerAiCommit: null, costPerShippedCommit: null },
   };
 }
@@ -987,6 +1132,36 @@ async function handleProductivityQuery(event: HttpApiEvent): Promise<HttpApiResp
     } while (lastKey);
   }
 
+  // --- Issues worked on ---
+  // Counted from ISSUE# items rather than derived from spans: an agent emits one
+  // usage span per invocation, so a re-run of the same issue would inflate a
+  // span-derived count. The sk is ISSUE#<repo>#<number> and the write is
+  // conditional, so these are distinct by construction and counting them is enough.
+  //
+  // Not date-filtered on purpose. `first_seen` records when an issue was first
+  // touched, and an issue worked across a window boundary should still count once;
+  // filtering by it would drop long-running work from the later window.
+  {
+    let lastKey: import('@aws-sdk/client-dynamodb').ScanCommandOutput['LastEvaluatedKey'];
+    do {
+      const result = await dynamoClient.send(new ScanCommand({
+        TableName: AI_USAGE_TABLE,
+        FilterExpression: 'record_type = :rt',
+        ExpressionAttributeValues: { ':rt': { S: 'OTEL_ISSUE' } },
+        ...(lastKey ? { ExclusiveStartKey: lastKey } : {}),
+      }));
+      for (const item of result.Items ?? []) {
+        const email = item.pk?.S?.replace('USER#', '') ?? '';
+        if (!email) continue;
+        if (userParam !== 'all' && email !== userParam) continue;
+        const u = getUser(email);
+        u.issues += 1;
+        if (item.autonomous?.BOOL === true) u.autonomous = true;
+      }
+      lastKey = result.LastEvaluatedKey;
+    } while (lastKey);
+  }
+
   // --- Commits ---
   type RawCommit = { user: string; traceId: string; inMain: boolean; wasReverted: boolean; storedOrigin?: string };
   const rawCommits: RawCommit[] = [];
@@ -1010,7 +1185,7 @@ async function handleProductivityQuery(event: HttpApiEvent): Promise<HttpApiResp
         rawCommits.push({
           user: userParam,
           traceId: item.trace_id?.S ?? '',
-          inMain: item.in_main?.BOOL ?? false,
+          inMain: (item.in_main?.BOOL ?? false) || item.origin_source?.S === 'ci-seeded',
           wasReverted: item.was_reverted?.BOOL ?? false,
           storedOrigin: item.ai_origin?.S,
         });
@@ -1035,7 +1210,7 @@ async function handleProductivityQuery(event: HttpApiEvent): Promise<HttpApiResp
         rawCommits.push({
           user: item.user?.S ?? '',
           traceId: item.trace_id?.S ?? '',
-          inMain: item.in_main?.BOOL ?? false,
+          inMain: (item.in_main?.BOOL ?? false) || item.origin_source?.S === 'ci-seeded',
           wasReverted: item.was_reverted?.BOOL ?? false,
           storedOrigin: item.ai_origin?.S,
         });
@@ -1048,8 +1223,9 @@ async function handleProductivityQuery(event: HttpApiEvent): Promise<HttpApiResp
   // usage spans exist for the commit's traceId).
   const traceMaps = new Map<string, Map<string, { tool: string; model: string }>>();
   for (const c of rawCommits) {
-    if (!c.user) continue;
-    const u = getUser(c.user);
+    // CI-seeded items may lack a user field — still count them in fleet totals.
+    const userKey = c.user || '__unattributed__';
+    const u = getUser(userKey);
     u.commits.total++;
     // Prefer the verdict frozen at ingest. Legacy items (no ai_origin) fall
     // back to a live span join, which is only reliable inside SPAN_TTL_DAYS.
@@ -1057,12 +1233,12 @@ async function handleProductivityQuery(event: HttpApiEvent): Promise<HttpApiResp
     if (c.storedOrigin === 'ai-generated' || c.storedOrigin === 'human') {
       isAi = c.storedOrigin === 'ai-generated';
     } else {
-      let traceMap = traceMaps.get(c.user);
-      if (!traceMap) {
+      let traceMap = c.user ? traceMaps.get(c.user) : undefined;
+      if (c.user && !traceMap) {
         traceMap = await buildUserTraceMap(c.user);
         traceMaps.set(c.user, traceMap);
       }
-      isAi = c.traceId !== '' && traceMap.has(c.traceId);
+      isAi = c.traceId !== '' && !!traceMap?.has(c.traceId);
     }
     if (isAi) {
       u.commits.ai++;
@@ -1102,12 +1278,55 @@ async function handleProductivityQuery(event: HttpApiEvent): Promise<HttpApiResp
   computeRatios(totals);
   totals.usage.costUsd = Math.round(totals.usage.costUsd * 100) / 100;
 
+  // Agents are separated from `totals`, and this is a deliberate change of meaning.
+  //
+  // `totals` sums every key in the map, so once the coding agent started reporting,
+  // its spend and its commits would have flowed into the fleet AI-share and
+  // cost-per-shipped-commit figures that the Developer Productivity and Executive
+  // dashboards render -- at roughly $1.75 an issue, not a rounding error beside
+  // human usage. Two things would have gone wrong at once: the human numbers would
+  // read as worse (or better) than they are, and the autonomous signal would be
+  // spent rather than captured, since PRISM's L5 gate is about autonomous
+  // deployments and not about AI share.
+  //
+  // So `totals` is now humans, `agentTotals` is agents, and `agents` lists them.
+  // Safe to change today because no agent data exists yet; a dashboard reading
+  // `totals` keeps meaning what its author intended.
+  const everyone = [...users.values()].filter(u => u.user !== '__unattributed__');
+  const humans = everyone.filter(u => !u.autonomous);
+  const agents = everyone.filter(u => u.autonomous);
+
+  const humanTotals = emptyUserProductivity('__totals__');
+  const agentTotals = emptyUserProductivity('__agents__');
+  for (const [group, into] of [[humans, humanTotals], [agents, agentTotals]] as const) {
+    for (const u of group) {
+      into.usage.inputTokens += u.usage.inputTokens;
+      into.usage.outputTokens += u.usage.outputTokens;
+      into.usage.costUsd += u.usage.costUsd;
+      into.usage.calls += u.usage.calls;
+      into.commits.total += u.commits.total;
+      into.commits.ai += u.commits.ai;
+      into.commits.human += u.commits.human;
+      into.commits.mergedAi += u.commits.mergedAi;
+      into.commits.revertedAi += u.commits.revertedAi;
+      into.issues += u.issues;
+    }
+    computeRatios(into);
+    into.usage.costUsd = Math.round(into.usage.costUsd * 100) / 100;
+  }
+  agentTotals.autonomous = true;
+
   return jsonResponse(200, {
     range: { from, to },
     scope: userParam === 'all' ? 'org' : 'user',
     generatedAt: new Date().toISOString(),
-    users: [...users.values()].sort((a, b) => b.usage.costUsd - a.usage.costUsd),
-    totals,
+    users: humans.sort((a, b) => b.usage.costUsd - a.usage.costUsd),
+    totals: humanTotals,
+    agents: agents.sort((a, b) => b.usage.costUsd - a.usage.costUsd),
+    agentTotals,
+    // The pre-split figure, so a caller that genuinely wants everything does not
+    // have to add two objects and get the ratios wrong doing it.
+    fleetTotals: totals,
   });
 }
 
@@ -1168,7 +1387,7 @@ async function handleReposQuery(event: HttpApiEvent): Promise<HttpApiResponse> {
         repo: (item.pk?.S ?? '').replace(/^REPO#/, ''),
         user: item.user?.S ?? '',
         traceId: item.trace_id?.S ?? '',
-        inMain: item.in_main?.BOOL ?? false,
+        inMain: (item.in_main?.BOOL ?? false) || item.origin_source?.S === 'ci-seeded',
         wasReverted: item.was_reverted?.BOOL ?? false,
         ts: item.timestamp?.S ?? '',
         storedOrigin: item.ai_origin?.S,
@@ -1239,6 +1458,73 @@ async function handleReposQuery(event: HttpApiEvent): Promise<HttpApiResponse> {
   });
 }
 
+/**
+ * GET /v1/commits-daily?from=YYYY-MM-DD&to=YYYY-MM-DD
+ *
+ * Returns per-day commit counts bucketed by ai_origin. Designed for dashboard
+ * bar charts that replace the CloudWatch-native "Commits / Day (AI vs Human)"
+ * graph — reading DDB at render time avoids the increment-only CloudWatch
+ * limitation that makes origin upgrades (human->ai) double-count.
+ */
+async function handleCommitsDailyQuery(event: HttpApiEvent): Promise<HttpApiResponse> {
+  const caller = resolveIdentity(event);
+  if (!caller) return jsonResponse(401, { message: 'No resolvable identity claim in token' });
+
+  const url = new URL(event.rawPath + '?' + (event.rawQueryString ?? ''), 'http://localhost');
+  const now = new Date();
+  const from = url.searchParams.get('from') ?? new Date(now.getTime() - 30 * 86400_000).toISOString().slice(0, 10);
+  const to = url.searchParams.get('to') ?? now.toISOString().slice(0, 10);
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(from) || !/^\d{4}-\d{2}-\d{2}$/.test(to)) {
+    return jsonResponse(400, { message: 'from/to must be YYYY-MM-DD' });
+  }
+
+  // Scan COMMIT# items in the date range.
+  const days = new Map<string, { ai: number; human: number; mergedAi: number; mergedHuman: number }>();
+  let lastKey: import('@aws-sdk/client-dynamodb').ScanCommandOutput['LastEvaluatedKey'];
+  do {
+    const result = await dynamoClient.send(new ScanCommand({
+      TableName: AI_USAGE_TABLE,
+      FilterExpression: 'record_type = :rt AND #ts BETWEEN :lo AND :hi',
+      ExpressionAttributeNames: { '#ts': 'timestamp' },
+      ExpressionAttributeValues: {
+        ':rt': { S: 'OTEL_ATTR_COMMIT' },
+        ':lo': { S: from },
+        ':hi': { S: `${to}\uffff` },
+      },
+      ProjectionExpression: '#ts, ai_origin, in_main',
+      ...(lastKey ? { ExclusiveStartKey: lastKey } : {}),
+    }));
+    for (const item of result.Items ?? []) {
+      const ts = item.timestamp?.S ?? '';
+      const day = ts.slice(0, 10);
+      if (!day) continue;
+      const origin = item.ai_origin?.S ?? 'human';
+      const inMain = item.in_main?.BOOL ?? false;
+      let bucket = days.get(day);
+      if (!bucket) { bucket = { ai: 0, human: 0, mergedAi: 0, mergedHuman: 0 }; days.set(day, bucket); }
+      if (origin === 'ai-generated') {
+        bucket.ai++;
+        if (inMain) bucket.mergedAi++;
+      } else {
+        bucket.human++;
+        if (inMain) bucket.mergedHuman++;
+      }
+    }
+    lastKey = result.LastEvaluatedKey;
+  } while (lastKey);
+
+  // Sort ascending by date and return as an array.
+  const sorted = [...days.entries()]
+    .sort((a, b) => a[0].localeCompare(b[0]))
+    .map(([date, counts]) => ({ date, ...counts }));
+
+  return jsonResponse(200, {
+    range: { from, to },
+    generatedAt: new Date().toISOString(),
+    days: sorted,
+  });
+}
+
 function accumulateUsage(u: UserProductivity, item: Record<string, { S?: string; N?: string }>): void {
   const tool = item.tool?.S ?? 'unknown';
   const cost = Number(item.cost_usd?.N ?? 0);
@@ -1279,5 +1565,8 @@ export async function handler(event: HttpApiEvent): Promise<HttpApiResponse> {
   if (method === 'GET' && path === '/v1/repos') {
     return handleReposQuery(event);
   }
+  if (method === 'GET' && path === '/v1/commits-daily') {
+    return handleCommitsDailyQuery(event);
+  }
   return jsonResponse(404, { message: 'Not found' });
 }

package/dist/assets/infra/lib/lambda/productivity-widget.ts

@@ -36,18 +36,29 @@ full history, real commit timestamps.
 ### Parameters
 | Name | Type | Default | Description |
 |------|------|---------|-------------|
-| view | string | table | 'table' (team comparison) or 'detail' (by-tool/by-model + ratios) |
+| view | string | table | 'table' (team comparison), 'detail' (by-tool/by-model + ratios), or 'coding-agent' (the agent's own work, kept out of the human table) |
 | user | string | all | Developer email, or 'all' — scopes the detail view |
 `;
 
 type Breakdown = Record<string, { costUsd: number; calls: number }>;
 type UserRow = {
+  issues?: number;
+  autonomous?: boolean;
   user: string;
   usage: { inputTokens: number; outputTokens: number; costUsd: number; calls: number; byTool: Breakdown; byModel: Breakdown };
   commits: { total: number; ai: number; human: number; mergedAi: number; revertedAi: number };
   ratios: { aiSharePct: number | null; mergeRatePct: number | null; defectRatePct: number | null; costPerAiCommit: number | null; costPerShippedCommit: number | null };
 };
-type Report = { range: { from: string; to: string }; users: UserRow[]; totals: UserRow };
+type Report = {
+  range: { from: string; to: string };
+  users: UserRow[];
+  totals: UserRow;
+  // Present once the receiver splits autonomous identities out of `totals`.
+  // Optional so this widget keeps rendering against an older receiver rather than
+  // throwing on a missing key.
+  agents?: UserRow[];
+  agentTotals?: UserRow;
+};
 
 // Theme palette resolved once per invocation
 type Palette = { fg: string; mut: string; bord: string; accent: string; ok: string; warn: string };
@@ -170,6 +181,74 @@ function renderDetail(report: Report, user: string, p: Palette): string {
     </div>`;
 }
 
+
+/**
+ * The coding agent's own work, kept apart from the human table.
+ *
+ * Separate because autonomous work is not human-assisted AI use: mixing them makes
+ * the human AI-share figure mean nothing and spends the one signal PRISM has no
+ * other emitter for, since L5 is about autonomous deployments. "Issues" appears
+ * here and not in the human table because it has no human analogue -- nobody is
+ * handed issues one at a time by a label.
+ */
+function renderCodingAgent(report: Report, p: Palette): string {
+  const agents = report.agents ?? [];
+  if (agents.length === 0) {
+    return `
+      <div style="padding:14px 10px;color:${p.mut};line-height:1.6">
+        <div style="color:${p.fg};font-weight:bold;margin-bottom:4px">No agent activity yet</div>
+        This panel fills in once the PRISM coding agent emits usage spans. It needs
+        <code>PRISM_COLLECTOR_URL</code>, <code>PRISM_OIDC_TOKEN_ENDPOINT</code> and
+        <code>PRISM_AGENT_SECRET_ID</code> set as repository or organization
+        variables, and the harness deployed. An empty panel here means the emitter is
+        not configured &mdash; not that the agent has done nothing.
+      </div>`;
+  }
+
+  const t = report.agentTotals ?? agents[0];
+  const card = (label: string, value: string, note = ''): string => `
+    <div style="flex:1;min-width:120px;padding:8px 10px;border:1px solid ${p.bord};border-radius:6px">
+      <div style="color:${p.mut};font-size:11px">${label}</div>
+      <div style="color:${p.fg};font-size:20px;font-weight:bold">${value}</div>
+      ${note ? `<div style="color:${p.mut};font-size:11px">${note}</div>` : ''}
+    </div>`;
+
+  const perIssue = t.issues && t.issues > 0 ? t.usage.costUsd / t.issues : null;
+
+  const rows = agents.map(a => `
+    <tr style="border-top:1px solid ${p.bord}">
+      <td style="padding:6px 10px;color:${p.accent};white-space:nowrap">${esc(a.user)}</td>
+      <td style="padding:6px 10px;text-align:right">${num(a.issues ?? 0)}</td>
+      <td style="padding:6px 10px;text-align:right">${num(a.commits.ai)}</td>
+      <td style="padding:6px 10px;text-align:right">${num(a.commits.mergedAi)}</td>
+      <td style="padding:6px 10px;text-align:right;color:${(a.ratios.mergeRatePct ?? 100) >= 85 ? p.ok : p.warn}">${pct(a.ratios.mergeRatePct)}</td>
+      <td style="padding:6px 10px;text-align:right">${pct(a.ratios.defectRatePct)}</td>
+      <td style="padding:6px 10px;text-align:right">${money(a.usage.costUsd)}</td>
+      <td style="padding:6px 10px;text-align:right">${a.ratios.costPerShippedCommit === null ? '&mdash;' : money(a.ratios.costPerShippedCommit)}</td>
+    </tr>`).join('');
+
+  const header = ['Agent', 'Issues', 'Commits', 'Shipped', 'Merge Rate', 'Defect Rate', 'Spend', '$ / Shipped']
+    .map((h, i) => `<th style="padding:6px 10px;color:${p.mut};font-weight:normal;text-align:${i === 0 ? 'left' : 'right'}">${h}</th>`)
+    .join('');
+
+  return `
+    <div style="display:flex;gap:8px;flex-wrap:wrap;margin-bottom:10px">
+      ${card('Issues worked', num(t.issues ?? 0))}
+      ${card('Commits shipped', num(t.commits.mergedAi), `of ${num(t.commits.ai)} made`)}
+      ${card('Spend', money(t.usage.costUsd), 'estimated from tokens')}
+      ${card('$ / issue', perIssue === null ? '&mdash;' : money(perIssue))}
+      ${card('$ / shipped', t.ratios.costPerShippedCommit === null ? '&mdash;' : money(t.ratios.costPerShippedCommit))}
+    </div>
+    <table style="border-collapse:collapse;width:100%">
+      <tr>${header}</tr>
+      ${rows}
+    </table>
+    <div style="color:${p.mut};font-size:11px;margin-top:8px;line-height:1.5">
+      Excluded from the developer table and from ORG TOTAL above. Cost is estimated
+      from token counts, since the harness reports tokens and not dollars.
+    </div>`;
+}
+
 export async function handler(event: WidgetEvent): Promise<string> {
   if (event.describe) return DOCS;
 
@@ -190,12 +269,14 @@ export async function handler(event: WidgetEvent): Promise<string> {
     return `<p style="color:#d13212">${esc((e as Error).message)}</p>`;
   }
 
-  const body = view === 'detail' ? renderDetail(report, user, p) : renderTable(report, p);
+  const body = view === 'coding-agent' ? renderCodingAgent(report, p)
+    : view === 'detail' ? renderDetail(report, user, p)
+    : renderTable(report, p);
   return `
   <div style="color:${p.fg};font-size:13px">
     <div style="color:${p.mut};margin-bottom:6px">
       ${report.range.from} → ${report.range.to}
-      · ${report.users.length} developer(s)
+      · ${view === 'coding-agent' ? `${(report.agents ?? []).length} agent(s)` : `${report.users.length} developer(s)`}
       · attribution store (real commit times, full history)
     </div>
     ${body}