@prism-d1/cli 1.0.84 → 1.0.86

package/dist/assets/coding-agent/tools/git_ops.py

@@ -0,0 +1,197 @@
+"""Git operations exposed to the agent as a single Strands tool.
+
+Every git invocation goes through `subprocess.run` with an argv list and never
+`shell=True`. The agent supplies branch names and commit messages, so treating
+them as shell strings would let a crafted issue body run arbitrary commands.
+
+`push` is deliberately absent. Pushing is a privileged step that belongs to the
+PR-creation path where credentials live, not to a general-purpose git tool the
+model can call at will.
+"""
+
+from __future__ import annotations
+
+import re
+import subprocess
+from pathlib import Path
+
+from strands import tool
+
+# Branch names: git's own rules, tightened. No leading/trailing dots or slashes,
+# no '..', no characters git rejects, nothing that could be read as a flag.
+_BRANCH_OK = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._/-]{0,99}$")
+_TIMEOUT_SECONDS = 60
+
+
+class GitError(RuntimeError):
+    """A git command failed or was rejected before running."""
+
+
+def _run(args: list[str], cwd: Path) -> str:
+    """Run a git command and return stdout, raising GitError on failure."""
+    try:
+        proc = subprocess.run(
+            ["git", *args],
+            cwd=str(cwd),
+            capture_output=True,
+            text=True,
+            timeout=_TIMEOUT_SECONDS,
+            check=False,
+        )
+    except subprocess.TimeoutExpired as exc:
+        raise GitError(f"git {args[0]} timed out after {_TIMEOUT_SECONDS}s") from exc
+    except FileNotFoundError as exc:
+        raise GitError("git is not installed or not on PATH") from exc
+
+    if proc.returncode != 0:
+        detail = (proc.stderr or proc.stdout).strip()
+        raise GitError(f"git {' '.join(args)} failed: {detail}")
+    return proc.stdout.strip()
+
+
+def _validate_branch(name: str) -> str:
+    name = name.strip()
+    if not _BRANCH_OK.match(name) or ".." in name or name.endswith((".", "/", ".lock")):
+        raise GitError(
+            f"Invalid branch name {name!r}. Use letters, digits, dot, dash, "
+            "underscore and slash; start with a letter or digit."
+        )
+    return name
+
+
+def _validate_paths(paths: list[str], repo_path: Path) -> list[str]:
+    """Resolve each path and confirm it stays inside the repository.
+
+    Rejects absolute paths, traversal, and symlinks that point outside the repo.
+    """
+    resolved: list[str] = []
+    repo_real = repo_path.resolve()
+    for raw in paths:
+        candidate = (repo_real / raw).resolve()
+        try:
+            candidate.relative_to(repo_real)
+        except ValueError as exc:
+            raise GitError(f"Path escapes the repository: {raw!r}") from exc
+        if not candidate.exists():
+            raise GitError(f"Path does not exist: {raw!r}")
+        resolved.append(str(candidate.relative_to(repo_real)))
+    return resolved
+
+
+
+def _resolve_repo(path: Path) -> Path | None:
+    """Return the git repository enclosing `path`, or None if there is none.
+
+    Uses git's own answer rather than walking for a `.git` directory, so
+    worktrees and submodules resolve the way git itself sees them.
+    """
+    try:
+        proc = subprocess.run(
+            ["git", "rev-parse", "--show-toplevel"],
+            cwd=str(path), capture_output=True, text=True,
+            timeout=_TIMEOUT_SECONDS, check=False,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return None
+    if proc.returncode != 0 or not proc.stdout.strip():
+        return None
+    return Path(proc.stdout.strip())
+
+
+@tool
+def git_ops(
+    action: str,
+    repo_path: str,
+    branch: str | None = None,
+    message: str | None = None,
+    paths: list[str] | None = None,
+) -> str:
+    """Perform a git operation in the target repository.
+
+    Use this to create a working branch, inspect what you have changed, stage
+    specific files, and commit. Pushing is handled separately by create_pr.
+
+    Args:
+        action: One of "status", "diff", "current_branch", "create_branch",
+            "stage", "commit", "log".
+        repo_path: Absolute path to the repository working tree.
+        branch: Branch name. Required for "create_branch".
+        message: Commit message. Required for "commit".
+        paths: Repository-relative file paths. Required for "stage". Name each
+            file explicitly; there is no "stage everything" option.
+
+    Returns:
+        Command output, or a short confirmation for actions with no output.
+    """
+    repo = Path(repo_path)
+    # Resolved rather than tested for a `.git` child, because a target is often a
+    # subdirectory of its repository -- PRISM's own sample-app sits inside a
+    # monorepo, and customer monorepos are the same shape.
+    #
+    # Requiring `.git` here caused a genuinely bad failure, observed rather than
+    # imagined: this tool refused with "not a git repository", and the agent --
+    # which also has a shell -- routed around the refusal by running `git init`
+    # and committing all 54 files as "Initial commit". A refusing tool is not a
+    # constraint on something that can run arbitrary commands; it is only a
+    # suggestion. So the tool has to be able to do the right thing rather than
+    # merely decline to do the wrong one.
+    resolved = _resolve_repo(repo)
+    if resolved is None:
+        return (
+            f"ERROR: {repo_path} is not inside a git repository. Do NOT run "
+            f"`git init` -- that would create a new repository and commit "
+            f"everything, which is never the fix. Report the problem instead."
+        )
+    repo = resolved
+
+    try:
+        if action == "status":
+            out = _run(["status", "--porcelain=v1"], repo)
+            return out or "(working tree clean)"
+
+        if action == "diff":
+            out = _run(["diff", "--stat", "HEAD"], repo)
+            return out or "(no changes against HEAD)"
+
+        if action == "current_branch":
+            return _run(["rev-parse", "--abbrev-ref", "HEAD"], repo)
+
+        if action == "log":
+            return _run(["log", "--oneline", "-10"], repo)
+
+        if action == "create_branch":
+            if not branch:
+                return "ERROR: create_branch requires a branch name"
+            safe = _validate_branch(branch)
+            _run(["checkout", "-b", safe], repo)
+            return f"Created and switched to branch {safe}"
+
+        if action == "stage":
+            if not paths:
+                return (
+                    "ERROR: stage requires an explicit list of paths. "
+                    "Name each file you changed."
+                )
+            safe_paths = _validate_paths(paths, repo)
+            _run(["add", "--", *safe_paths], repo)
+            return f"Staged {len(safe_paths)} file(s): {', '.join(safe_paths)}"
+
+        if action == "commit":
+            if not message or not message.strip():
+                return "ERROR: commit requires a non-empty message"
+            staged = _run(["diff", "--cached", "--name-only"], repo)
+            if not staged:
+                return "ERROR: nothing staged. Stage your changed files first."
+            # -m takes the message as a separate argv element, so newlines and
+            # quotes in the message are data, not shell syntax.
+            _run(["commit", "-m", message], repo)
+            sha = _run(["rev-parse", "HEAD"], repo)
+            return f"Committed {sha[:8]} with files:\n{staged}"
+
+        return (
+            f"ERROR: unknown action {action!r}. Valid actions: status, diff, "
+            "current_branch, create_branch, stage, commit, log"
+        )
+
+    except GitError as exc:
+        return f"ERROR: {exc}"

package/dist/assets/github-workflows/prism-agent-eval.yml

@@ -26,6 +26,7 @@ on:
 
 env:
   PRISM_AWS_REGION: us-west-2
+  PRISM_REPO: github.com/${{ github.repository }}
 
 permissions:
   id-token: write
@@ -267,7 +268,7 @@ jobs:
 
           EVAL_EVENT=$(jq -n \
             --arg team_id "${{ steps.prism-config.outputs.team_id }}" \
-            --arg repo "${{ github.repository }}" \
+            --arg repo "${PRISM_REPO}" \
             --arg timestamp "${TIMESTAMP}" \
             --argjson score "${SCORE:-0}" \
             --arg result "${{ steps.eval.outputs.result }}" \

package/dist/assets/github-workflows/prism-ai-metrics.yml

@@ -36,6 +36,7 @@ on:
 
 env:
   PRISM_AWS_REGION: us-west-2
+  PRISM_REPO: github.com/${{ github.repository }}
 
 permissions:
   id-token: write
@@ -105,6 +106,11 @@ jobs:
           COMMIT_SHAS=$(git rev-list --no-merges "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null | head -50 | jq -R . | jq -sc . || echo '[]')
           TOTAL_COMMITS=$(git rev-list --no-merges --count "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null || echo 0)
 
+          # Per-commit author emails (parallel array to COMMIT_SHAS). Used by
+          # the metrics-processor to seed COMMIT# items with the correct user
+          # field so /v1/productivity can attribute human commits per-developer.
+          COMMIT_AUTHORS=$(git rev-list --no-merges "${BASE_SHA}..${HEAD_SHA}" 2>/dev/null | head -50 | while read sha; do git log -1 --format='%ae' "$sha"; done | jq -R . | jq -sc . || echo '[]')
+
           # --- Lead time: PR open → merge. From the event payload, not git, so
           # it is unaffected by rebases and squashes.
           CREATED_TS=$(date -d "${CREATED_AT}" +%s 2>/dev/null || date -jf "%Y-%m-%dT%H:%M:%SZ" "${CREATED_AT}" +%s)
@@ -123,6 +129,7 @@ jobs:
           fi
 
           echo "commit_shas=${COMMIT_SHAS}" >> "$GITHUB_OUTPUT"
+          echo "commit_authors=${COMMIT_AUTHORS}" >> "$GITHUB_OUTPUT"
           echo "total_commits=${TOTAL_COMMITS}" >> "$GITHUB_OUTPUT"
           echo "lead_time_seconds=${LEAD_TIME_SECONDS}" >> "$GITHUB_OUTPUT"
           echo "is_failure_fix=${IS_FAILURE_FIX}" >> "$GITHUB_OUTPUT"
@@ -154,12 +161,13 @@ jobs:
 
           PR_EVENT=$(jq -n \
             --arg team_id "${{ steps.prism-config.outputs.team_id }}" \
-            --arg repo "${{ github.repository }}" \
+            --arg repo "${PRISM_REPO}" \
             --arg timestamp "${TIMESTAMP}" \
             --argjson lead_time_seconds "${{ steps.facts.outputs.lead_time_seconds }}" \
             --argjson is_failure_fix "${{ steps.facts.outputs.is_failure_fix }}" \
             --argjson total_commits "${{ steps.facts.outputs.total_commits }}" \
             --argjson commit_shas '${{ steps.facts.outputs.commit_shas }}' \
+            --argjson commit_authors '${{ steps.facts.outputs.commit_authors }}' \
             --arg pr_number "${{ github.event.pull_request.number }}" \
             --arg pr_author "${{ github.event.pull_request.user.login }}" \
             --argjson approved "${{ steps.reviews.outputs.approved }}" \
@@ -184,7 +192,8 @@ jobs:
                 "reviews_approved": $approved,
                 "reviews_changes_requested": $changes_requested,
                 "total_commits": $total_commits,
-                "commit_shas": $commit_shas
+                "commit_shas": $commit_shas,
+                "commit_authors": $commit_authors
               }
             }')
 
@@ -211,7 +220,7 @@ jobs:
           # carrying it on both double-counted the DeploymentFrequency metric.
           DEPLOY_EVENT=$(jq -n \
             --arg team_id "${{ steps.prism-config.outputs.team_id }}" \
-            --arg repo "${{ github.repository }}" \
+            --arg repo "${PRISM_REPO}" \
             --arg timestamp "${TIMESTAMP}" \
             '{
               "team_id": $team_id,

package/dist/assets/github-workflows/prism-eval-gate-kiro.yml

@@ -18,6 +18,7 @@ on:
 
 env:
   PRISM_AWS_REGION: us-west-2
+  PRISM_REPO: github.com/${{ github.repository }}
 
 permissions:
   id-token: write
@@ -225,7 +226,7 @@ jobs:
         env:
           AWS_REGION: ${{ env.PRISM_AWS_REGION }}
           TEAM_ID: ${{ steps.prism-config.outputs.team_id }}
-          REPO: ${{ github.repository }}
+          REPO: ${{ env.PRISM_REPO }}
           REVIEW_SCORE: ${{ steps.review.outputs.score }}
           REVIEW_RESULT: ${{ steps.review.outputs.result }}
           REVIEW_FINDINGS: ${{ steps.review.outputs.findings }}
@@ -263,7 +264,7 @@ jobs:
           AWS_REGION: ${{ env.PRISM_AWS_REGION }}
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.sha }}
-          REPO: ${{ github.repository }}
+          REPO: ${{ env.PRISM_REPO }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
           # Config is read FIRST, on purpose. "Continuum was never deployed" is a
@@ -413,7 +414,7 @@ jobs:
         env:
           AWS_REGION: ${{ env.PRISM_AWS_REGION }}
           TEAM_ID: ${{ steps.prism-config.outputs.team_id }}
-          REPO: ${{ github.repository }}
+          REPO: ${{ env.PRISM_REPO }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.sha }}

package/dist/assets/github-workflows/prism-eval-gate.yml

@@ -19,6 +19,7 @@ on:
 
 env:
   PRISM_AWS_REGION: us-west-2
+  PRISM_REPO: github.com/${{ github.repository }}
 
 permissions:
   id-token: write
@@ -205,7 +206,7 @@ jobs:
           TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
           EVAL_EVENT=$(jq -n \
             --arg team_id "${{ steps.prism-config.outputs.team_id }}" \
-            --arg repo "${{ github.repository }}" \
+            --arg repo "${PRISM_REPO}" \
             --arg timestamp "${TIMESTAMP}" \
             --argjson score "${{ steps.eval.outputs.avg_score }}" \
             --arg result "${{ steps.eval.outputs.overall_result }}" \
@@ -421,7 +422,7 @@ jobs:
           AWS_REGION: ${{ env.PRISM_AWS_REGION }}
         run: |
           PR_NUMBER="${{ github.event.pull_request.number }}"
-          REPO="${{ github.repository }}"
+          REPO="${PRISM_REPO}"
           TEAM_ID="${{ steps.prism-config.outputs.team_id }}"
           FINDINGS='${{ steps.security-gate.outputs.findings_json }}'
 

package/dist/assets/gitlab-workflows/prism-agent-eval.yml

@@ -28,6 +28,7 @@ prism-agent-eval:
   variables:
     PRISM_AWS_REGION: us-west-2
     AWS_DEFAULT_REGION: $PRISM_AWS_REGION
+    PRISM_REPO: ${CI_SERVER_HOST}/${CI_PROJECT_PATH}
   before_script:
     - apt-get update -qq && apt-get install -y -qq jq bc git curl unzip
     - curl -s "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip
@@ -134,7 +135,7 @@ prism-agent-eval:
       # Emit event
       TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
       EVAL_EVENT=$(jq -n \
-        --arg team_id "${TEAM_ID}" --arg repo "${CI_PROJECT_PATH}" --arg timestamp "${TIMESTAMP}" \
+        --arg team_id "${TEAM_ID}" --arg repo "${PRISM_REPO}" --arg timestamp "${TIMESTAMP}" \
         --argjson score "${SCORE:-0}" --arg result "${RESULT}" --argjson file_count "${FILE_COUNT}" \
         --arg mr_iid "${CI_MERGE_REQUEST_IID}" --arg mock_ran "${MOCK_RAN}" \
         '{team_id:$team_id, repo:$repo, timestamp:$timestamp, prism_level:3,

package/dist/assets/gitlab-workflows/prism-ai-metrics.yml

@@ -34,6 +34,7 @@ prism-ai-metrics:
   variables:
     PRISM_AWS_REGION: us-west-2
     AWS_DEFAULT_REGION: $PRISM_AWS_REGION
+    PRISM_REPO: ${CI_SERVER_HOST}/${CI_PROJECT_PATH}
   before_script:
     - yum install -y -q jq git
     - git fetch --unshallow || true
@@ -114,7 +115,7 @@ prism-ai-metrics:
       # shape — the processor only persists a known section list.
       PR_EVENT=$(jq -n \
         --arg team_id "${TEAM_ID}" \
-        --arg repo "${CI_PROJECT_PATH}" \
+        --arg repo "${PRISM_REPO}" \
         --arg timestamp "${TIMESTAMP}" \
         --argjson lead_time_seconds "${LEAD_TIME_SECONDS}" \
         --argjson is_failure_fix "${IS_FAILURE_FIX}" \
@@ -141,7 +142,7 @@ prism-ai-metrics:
 
       # Sole deployment signal — deployment_frequency lives ONLY on this event.
       # Carrying it on prism.d1.pr as well double-counted the metric.
-      DEPLOY_EVENT=$(jq -n --arg team_id "${TEAM_ID}" --arg repo "${CI_PROJECT_PATH}" --arg timestamp "${TIMESTAMP}" \
+      DEPLOY_EVENT=$(jq -n --arg team_id "${TEAM_ID}" --arg repo "${PRISM_REPO}" --arg timestamp "${TIMESTAMP}" \
         '{team_id: $team_id, repo: $repo, timestamp: $timestamp, prism_level: 2,
          metric: {name: "deployment", value: 1, unit: "count"},
          dora: {deployment_frequency: 1}}')

package/dist/assets/gitlab-workflows/prism-eval-gate.yml

@@ -23,6 +23,7 @@ prism-eval-gate:
   variables:
     PRISM_AWS_REGION: us-west-2
     AWS_DEFAULT_REGION: $PRISM_AWS_REGION
+    PRISM_REPO: ${CI_SERVER_HOST}/${CI_PROJECT_PATH}
   before_script:
     - yum install -y -q jq bc git
     - git fetch --unshallow || true
@@ -140,7 +141,7 @@ prism-eval-gate:
       # Emit event
       TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
       EVAL_EVENT=$(jq -n \
-        --arg team_id "${TEAM_ID}" --arg repo "${CI_PROJECT_PATH}" --arg timestamp "${TIMESTAMP}" \
+        --arg team_id "${TEAM_ID}" --arg repo "${PRISM_REPO}" --arg timestamp "${TIMESTAMP}" \
         --argjson score "${AVG_SCORE}" --arg result "${OVERALL}" \
         --argjson total_files "${TOTAL_FILES}" --argjson pass_count "${PASS_COUNT}" \
         --argjson fail_count "${FAIL_COUNT}" --argjson hallucinations "${TOTAL_HALLUCINATIONS}" \

package/dist/assets/infra/lib/constructs/otel-collector-construct.ts

@@ -27,6 +27,8 @@ import * as logs from 'aws-cdk-lib/aws-logs';
 import * as apigwv2 from 'aws-cdk-lib/aws-apigatewayv2';
 import { HttpLambdaIntegration } from 'aws-cdk-lib/aws-apigatewayv2-integrations';
 import { HttpJwtAuthorizer } from 'aws-cdk-lib/aws-apigatewayv2-authorizers';
+import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
+import * as ssm from 'aws-cdk-lib/aws-ssm';
 import * as path from 'path';
 import { Construct } from 'constructs';
 import { NagSuppressions } from 'cdk-nag';
@@ -54,6 +56,10 @@ export class OtelCollectorConstruct extends Construct {
   public readonly archiveBucket: s3.Bucket;
   public readonly userPool?: cognito.UserPool;
   public readonly userPoolClient?: cognito.UserPoolClient;
+  /** Machine-to-machine client used by the coding agent's telemetry emitter. */
+  public readonly agentClient?: cognito.UserPoolClient;
+  /** Its credentials, read in CI with the ephemeral OIDC role. */
+  public readonly agentSecret?: secretsmanager.Secret;
   /** ARN of the CloudWatch custom-widget Lambda (Developer Productivity table). */
   public productivityWidgetArn?: string;
   /** The otel-receiver Lambda — other constructs may grant themselves invoke
@@ -74,6 +80,10 @@ export class OtelCollectorConstruct extends Construct {
     let issuer: string;
     let clientId: string;
     let identityClaim: string;
+    let domainPrefix = '';
+    let agentClientId = '';
+    let machineIdentities = '';
+    let tokenEndpoint = '';
 
     if (byoIdp) {
       issuer = props.externalIssuer!.replace(/\/$/, '');
@@ -102,8 +112,9 @@ export class OtelCollectorConstruct extends Construct {
       });
 
       // Hosted UI domain — prefix must be globally unique per region.
+      domainPrefix = `prism-d1-otel-${cdk.Aws.ACCOUNT_ID}`;
       this.userPool.addDomain('Domain', {
-        cognitoDomain: { domainPrefix: `prism-d1-otel-${cdk.Aws.ACCOUNT_ID}` },
+        cognitoDomain: { domainPrefix },
       });
 
       // Public client (no secret) — codeburn does Authorization Code + PKCE
@@ -131,6 +142,85 @@ export class OtelCollectorConstruct extends Construct {
       // Cognito ACCESS tokens carry `username` (no email claim) — with
       // email-alias sign-in and admin-created users, username == email.
       identityClaim = props.identityClaim ?? 'username';
+
+      // -----------------------------------------------------------------
+      // Machine-to-machine path, for the coding agent's own telemetry
+      // -----------------------------------------------------------------
+      // The agent runs in CI, so there is no human to complete an
+      // authorization-code flow. SAX-02 Outcome 3 names Cognito's
+      // client-credentials flow as the machine-to-machine pattern, with a
+      // resource server carrying fine-grained scopes; the alternative — a
+      // Cognito user password in a repository secret — is what Outcome 1 lists
+      // as "hardcoding credentials in application code or environment
+      // variables".
+      //
+      // Client credentials require a resource server: Cognito rejects the grant
+      // for a client whose only scopes are the standard openid/email/profile.
+      const resourceServer = this.userPool.addResourceServer('PrismResourceServer', {
+        identifier: 'prism',
+        scopes: [{ scopeName: 'emit', scopeDescription: 'Emit usage and attribution spans' }],
+      });
+
+      this.agentClient = this.userPool.addClient('CodingAgentClient', {
+        userPoolClientName: 'prism-coding-agent',
+        generateSecret: true,
+        // No authorization-code or SRP flow: this identity is never a person, and
+        // leaving a human flow enabled on it would be a second way in.
+        authFlows: {},
+        oAuth: {
+          flows: { clientCredentials: true, authorizationCodeGrant: false },
+          scopes: [cognito.OAuthScope.resourceServer(resourceServer, {
+            scopeName: 'emit',
+            scopeDescription: 'Emit usage and attribution spans',
+          })],
+        },
+        accessTokenValidity: cdk.Duration.hours(1),
+        enableTokenRevocation: true,
+        preventUserExistenceErrors: true,
+      });
+
+      // The credentials the CI job reads with its ephemeral OIDC role. Named
+      // under prism-d1- because setup-github-oidc grants GetSecretValue scoped
+      // to that prefix rather than to '*' — the role is assumed by a workflow
+      // that runs agent-authored code.
+      this.agentSecret = new secretsmanager.Secret(this, 'CodingAgentOidcSecret', {
+        secretName: 'prism-d1-agent-oidc',
+        description: 'Cognito client credentials for the PRISM coding agent telemetry emitter',
+        secretObjectValue: {
+          client_id: cdk.SecretValue.unsafePlainText(this.agentClient.userPoolClientId),
+          // unsafePlainText names the risk accurately and it does not apply here:
+          // the value is a CloudFormation reference resolved at deploy time, not a
+          // literal in source. The client id is not sensitive; the secret is, and
+          // it never leaves CloudFormation except into this secret.
+          client_secret: this.agentClient.userPoolClientSecret,
+        },
+        removalPolicy: cdk.RemovalPolicy.RETAIN,
+      });
+
+      // Cognito app-client secrets cannot be rotated in place — you would recreate
+      // the client, which invalidates every outstanding token and every copy of the
+      // old secret. The suppression documents why rotation is not configured rather
+      // than silently ignoring the rule.
+      NagSuppressions.addResourceSuppressions(this.agentSecret, [
+        {
+          id: 'AwsSolutions-SMG4',
+          reason:
+            'Cognito app-client secrets are immutable: rotating requires replacing the ' +
+            'client, which invalidates all outstanding tokens. Rotation would be a ' +
+            'client-replacement Lambda on a 90-day schedule, acceptable for a workshop ' +
+            'sample but not implemented here. The secret is scoped to one user pool and ' +
+            'grants only the prism/emit scope.',
+        },
+      ]);
+
+      agentClientId = this.agentClient.userPoolClientId;
+      // A client-credentials token has no username, no email, and a `sub` equal to
+      // the app client id — so identity has to be mapped rather than read. Mapped
+      // here, at deploy time, precisely so it is NOT caller-supplied: a payload
+      // that could name its own author would let any holder of any token post as
+      // anyone.
+      machineIdentities = JSON.stringify({ [agentClientId]: 'prism-coding-agent' });
+      tokenEndpoint = `https://${domainPrefix}.auth.${cdk.Aws.REGION}.amazoncognito.com/oauth2/token`;
     }
 
     // -------------------------------------------------------
@@ -191,6 +281,9 @@ export class OtelCollectorConstruct extends Construct {
         IDENTITY_CLAIM: identityClaim,
         OIDC_ISSUER: issuer,
         OIDC_CLIENT_ID: clientId,
+        // clientId -> identity, for tokens that carry no username. Deploy-time
+        // config so the author of a span is never caller-supplied.
+        MACHINE_IDENTITIES: machineIdentities,
         MAX_BATCH_SIZE: '1000',
         SPAN_TTL_DAYS: '90',
       },
@@ -271,8 +364,12 @@ export class OtelCollectorConstruct extends Construct {
 
     // HTTP API JWT authorizers validate the `aud` claim, or `client_id` for
     // Cognito access tokens — both paths work with jwtAudience = [clientId].
+    // Both client ids: API Gateway validates `aud`, or `client_id` for Cognito
+    // access tokens, and a client-credentials token carries the M2M client id.
+    // Listing only the codeburn client would reject every agent span with a 401
+    // that looks like a bad token rather than a missing audience entry.
     const authorizer = new HttpJwtAuthorizer('OtelJwtAuthorizer', issuer, {
-      jwtAudience: [clientId],
+      jwtAudience: agentClientId ? [clientId, agentClientId] : [clientId],
     });
 
     // Discovery doc — unauthenticated by design (it only exposes issuer +
@@ -365,5 +462,40 @@ export class OtelCollectorConstruct extends Construct {
       });
       poolOutput.overrideLogicalId('OtelUserPoolId');
     }
+    if (this.agentSecret) {
+      // SSM parameters: the workflow reads these at run time instead of requiring
+      // GitHub org variables. One source of truth, written by CDK at deploy time,
+      // cannot drift from what's actually deployed.
+      const ssmPrefix = '/prism/d1';
+      new ssm.StringParameter(this, 'ParamCollectorUrl', {
+        parameterName: `${ssmPrefix}/collector-url`,
+        stringValue: this.httpApi.apiEndpoint,
+        description: 'OTEL collector URL — read by the coding agent workflow',
+        tier: ssm.ParameterTier.STANDARD,
+      });
+      new ssm.StringParameter(this, 'ParamTokenEndpoint', {
+        parameterName: `${ssmPrefix}/token-endpoint`,
+        stringValue: tokenEndpoint,
+        description: 'Cognito token endpoint — read by the coding agent workflow',
+        tier: ssm.ParameterTier.STANDARD,
+      });
+      new ssm.StringParameter(this, 'ParamAgentSecretId', {
+        parameterName: `${ssmPrefix}/agent-secret-id`,
+        stringValue: this.agentSecret.secretName,
+        description: 'Secrets Manager id for the M2M client credentials',
+        tier: ssm.ParameterTier.STANDARD,
+      });
+
+      // Outputs kept for discoverability — printed by `cdk deploy`, but no longer
+      // need to be manually copied into GitHub.
+      new cdk.CfnOutput(this, 'PrismAgentTokenEndpoint', {
+        value: tokenEndpoint,
+        description: 'Also available as SSM /prism/d1/token-endpoint',
+      }).overrideLogicalId('PrismAgentTokenEndpoint');
+      new cdk.CfnOutput(this, 'PrismAgentSecretId', {
+        value: this.agentSecret.secretName,
+        description: 'Also available as SSM /prism/d1/agent-secret-id',
+      }).overrideLogicalId('PrismAgentSecretId');
+    }
   }
 }