@prism-d1/cli 1.0.89 → 1.0.90

package/dist/assets/coding-agent/README.md

@@ -102,13 +102,14 @@ The undotted one is what you are reading now. During a CI run it is cloned into
 your git history and never appears in your working tree.
 
 ```
-your repo (committed)              CI runner (ephemeral)
-├── .coding-agent/                 $RUNNER_TEMP/prism-agent/
-│   ├── config.json                └── coding-agent/     ← fetched, then gone
-│   ├── prompt.md                      ├── agentcore/
-│   └── fixtures/                      └── config.py
-├── .tool-versions
-└── .github/workflows/prism-coding-agent.yml
+your repo (committed)              Harness image (baked in at deploy time)
+├── .coding-agent/                 /opt/prism-agent/
+│   ├── config.json                ├── run.py         (orchestrator)
+│   ├── prompt.md                  ├── agent.py       (Strands agent)
+│   └── fixtures/                  ├── agentcore/     (contract, telemetry)
+├── .tool-versions                 ├── config.py      (detection)
+└── .github/workflows/             └── tools/         (git_ops, create_pr)
+    prism-coding-agent.yml
 ```
 
 An earlier layout *did* vendor the agent into every repository, at
@@ -145,8 +146,10 @@ coding-agent/
 │   ├── run_eval.py       scores the local agent against fixtures
 │   └── run_harness_eval.py  scores the deployed harness against the same fixtures
 ├── deploy/
-│   ├── Dockerfile        the mise-based harness image
-│   ├── deploy-harness.sh one-time account setup
+│   ├── Dockerfile        the mise-based harness image (now includes strands + agent code)
+│   ├── run.py            runs INSIDE the harness — the full cycle in one script
+│   ├── invoke_harness.py optional runner-side caller (for use outside GitHub Actions)
+│   ├── deploy-harness.sh one-time account setup (ECR + role + create harness + SSM)
 │   ├── create_harness.py create-or-update via boto3 (the AWS CLI has no create-harness)
 │   └── prism-coding-agent.yml  the workflow installed into consuming repos
 └── tests/                180 tests; run with pytest
@@ -186,42 +189,52 @@ Three details, each of which cost a failed deployment to learn:
   AWS CLI (2.36.19) does not, which is how this project originally came to call the
   wrong API and why deployment goes through `create_harness.py`.
 
-The image is a single mise-based base (~591 MB, 29% of the 2 GB cap) rather than one
-per language. It ships a version *manager* and installs whatever a repository pins
-in `.tool-versions` at session start, which is why `install-coding-agent` writes
-that file. See [the ADR](../docs/ADR-coding-agent-on-agentcore.md) for the
-arithmetic that ruled out per-language images.
+The image is a single mise-based base (~750 MB, 37% of the 2 GB cap) that includes
+the Strands agent SDK and the full orchestrator. It ships a version *manager* and
+installs whatever a repository pins in `.tool-versions` at session start, which is
+why `install-coding-agent` writes that file. See
+[the ADR](../docs/ADR-coding-agent-on-agentcore.md) for the arithmetic that ruled
+out per-language images.
 
-### How the workflow gets the client
+Because the agent code is in the image, updating it requires an image rebuild
+(`deploy-harness.sh --tag v2`). This is a trade-off for simplicity: the workflow has
+no client-fetch step, no sparse checkout, and no `PRISM_AGENT_REPO`/`PRISM_AGENT_REF`
+variables to pin. One image rebuild propagates to every repo.
 
-The workflow runs `python -m agentcore.invoke`, so it needs the whole
-`coding-agent/` directory importable — not just `agentcore/`. The package reaches
-one level up for `config.py`: `invoke.py` puts its parent on `sys.path` and imports
-it, and `contract.py` imports it as well. That second import sits *inside*
-`FixRequest.validate()`, so a `coding-agent/` missing `config.py` would import
-cleanly and then fail partway through validating a request. The sparse checkout
-takes the whole directory for that reason, and the step's preflight is an `import`
-rather than a file-existence check so a narrowed path fails immediately with a name.
+### How the workflow invokes the agent
 
-It is fetched into `$RUNNER_TEMP`, deliberately not the workspace: the workspace is
-the tree the patch is applied to and committed from, and a client checkout sitting
-there is one `git add -A` away from being committed into somebody's fix.
+The harness image contains the full agent and orchestrator. The workflow makes a
+single `InvokeAgentRuntimeCommand` call, and everything happens inside the microVM:
 
-`boto3` is the only `pip install` the runner needs. Everything in `agentcore/` is
-standard library, and `client.py` imports `boto3` lazily so the stub transport used
-by the tests needs no AWS SDK at all.
+```
+Runner (this workflow)                  Harness microVM
+──────────────────────                  ───────────────
+resolve issue → /tmp/issue.json
+OIDC → AWS credentials
+                                        run.py:
+InvokeAgentRuntimeCommand ──────────►     1. git clone (with token)
+                                          2. mise install
+                                          3. npm ci / pip install
+                                          4. agent.py (Strands ReAct loop)
+                                          5. git diff → patch
+                                          6. npm test → verified
+stdout ◄────────────────────────────      7. print result JSON + patch
+apply patch
+git push + gh pr create
+```
 
-Two variables control the source, both optional:
+No client code is fetched per-run. No sparse checkout. No `PRISM_AGENT_REPO` or
+`PRISM_AGENT_REF` variables needed — the agent code is baked into the image at
+`deploy-harness.sh` time. Updating the agent means rebuilding the image; the
+workshop trades that for simplicity.
 
-| Variable | Default | Why you would set it |
-|---|---|---|
-| `PRISM_AGENT_REPO` | `aws-samples/sample-prism-d1-velocity` | a fork or an internal mirror |
-| `PRISM_AGENT_REF` | `main` | **pin this.** A floating default means a third party's push changes what runs in your CI |
+**Private repo access**: the workflow's `GITHUB_TOKEN` is passed in the clone URL.
+It's ephemeral (dies when this run ends) and scoped to this one repo, so the blast
+radius is bounded. The model's shell tool *can* read it during the run — which is
+acceptable for the same reason it's acceptable that the model can read any file in
+the checkout: the boundary is the run's lifetime, not the tool's access.
 
-`PRISM_AGENT_REF` accepts a branch, a tag, or a full commit SHA. It defaults to
-`main` so the workshop works on day one; for anything you care about, pin it. Note
-that fetching from a public repository is a live availability dependency — an
-internal mirror via `PRISM_AGENT_REPO` is the answer if that matters.
+`boto3` is the only `pip install` the runner needs — to make the one API call.
 
 ---
 
@@ -231,43 +244,39 @@ internal mirror via `PRISM_AGENT_REPO` is the answer if that matters.
 
 | | Local | Deployed |
 |---|---|---|
-| Entry point | `agent.py` | `agentcore/invoke.py` → `InvokeHarness` |
-| Where the model runs | your machine, via `bedrock:InvokeModel` | the harness, in your account |
-| Where code is edited | a throwaway clone on your disk | a microVM from the harness image |
-| Iteration bound | `IterationBound` hook (`--max-iterations`) | `maxIterations` per invocation |
+| Entry point | `agent.py` | `deploy/run.py` inside the harness image |
+| Where the model runs | your machine, via `bedrock:InvokeModel` | the harness microVM |
+| Where code is edited | a throwaway clone on your disk | a throwaway clone inside the microVM |
+| Iteration bound | `IterationBound` hook (`--max-iterations`) | same — `run.py` passes it to `agent.py` |
 | Used by | `eval/run_eval.py`, development, reading the code | CI, via the workflow |
+| API calls from runner | N/A (local) | **one** `InvokeAgentRuntimeCommand` |
 
-Both are supported. The local agent is what the workshop reads and extends and what
-the eval scores; the harness is what runs in CI. They share `config.py`, the prompt
-layering, and the fixture schema.
+Both are supported. The local agent is what the workshop reads, extends, and what
+the eval scores; the deployed path is what runs in CI.
 
 ### The call chain in CI
 
-`BotoTransport.send()` makes five or six AWS calls, all sharing one
-`runtimeSessionId` (`prism-<uuid4>` — the API has a 33-character minimum). The
-shared id is what makes them see the same filesystem.
+One API call. The runner calls `InvokeAgentRuntimeCommand` with a command that runs
+`/opt/prism-agent/run.py` inside the microVM. That script does the full cycle
+locally — no further API calls back to AgentCore:
 
-| Call | API | Model tokens |
+| Phase | What `run.py` does | Model tokens |
 |---|---|---|
-| clone at the base commit | `InvokeAgentRuntimeCommand` | none |
-| `mise install` the toolchain | `InvokeAgentRuntimeCommand` | none |
-| install dependencies | `InvokeAgentRuntimeCommand` | none |
-| **the agent loop** | **`InvokeHarness`** | yes |
-| collect the patch (`git diff` from base) | `InvokeAgentRuntimeCommand` | none |
-| run the project's test suite | `InvokeAgentRuntimeCommand` | none |
-
-Only one of the six reasons; the rest are deterministic shell at zero token cost.
-That split is the design. Preparation being deterministic is why a failed clone is
-reported as the environment's fault with the agent never started. Verification
-being deterministic is why `verified` is an exit code rather than a phrase found in
-the model's prose.
-
-The harness never pushes. It returns a patch; the workflow applies it, commits, and
-opens the PR with its own ephemeral `GITHUB_TOKEN`. That keeps the harness's
-credentials read-only and confines write access to the repository the run was
-triggered from. One consequence: a PR opened with `GITHUB_TOKEN` does **not**
-trigger further workflows, so the agent's PR will not kick off `prism-ai-metrics`
-or the eval gate without a GitHub App or PAT.
+| clone | `git clone --depth 50` (with token in URL) | none |
+| toolchain | `mise install` from `.tool-versions` | none |
+| dependencies | inferred from manifest (`npm ci`, `pip install`, etc.) | none |
+| **fix** | `python agent.py --repo ... --issue ...` | **yes** |
+| collect | `git diff` from clone base, excluding generated dirs | none |
+| verify | the project's own test command via `mise exec` | none |
+
+The result (outcome, patch, verified flag) is printed to stdout with markers so the
+runner can parse it. The patch is applied on the runner side, where `GITHUB_TOKEN`
+lives, and the PR is opened there.
+
+The harness never pushes. The token is in the URL for cloning, but push happens on
+the runner with `git push`. This keeps write access confined to the workflow step
+that has the scoped token, rather than inside the microVM where the model's shell
+could use it.
 
 ### The agent itself
 

package/dist/assets/coding-agent/deploy/Dockerfile

@@ -84,3 +84,23 @@ ENV MISE_TRUSTED_CONFIG_PATHS=/ \
 
 RUN mkdir -p /opt/mise /workspace
 WORKDIR /workspace
+
+# -----------------------------------------------------------------------
+# The agent and its orchestrator, so the harness is fully self-contained.
+# One InvokeAgentRuntimeCommand runs the entire cycle:
+#   clone → mise install → deps → agent loop → collect patch → verify
+#
+# This eliminates the client-fetch step in the workflow and solves private
+# repo access (the token travels in the clone URL, inside the microVM).
+# -----------------------------------------------------------------------
+COPY requirements.txt /opt/prism-agent/
+RUN pip install --no-cache-dir -r /opt/prism-agent/requirements.txt && \
+    python -c "import strands; import boto3; print('strands + boto3 OK')"
+
+COPY agent.py config.py system_prompt.py /opt/prism-agent/
+COPY agentcore/ /opt/prism-agent/agentcore/
+COPY tools/ /opt/prism-agent/tools/
+COPY deploy/run.py /opt/prism-agent/run.py
+
+ENV PYTHONPATH=/opt/prism-agent \
+    BYPASS_TOOL_CONSENT=true

package/dist/assets/coding-agent/deploy/invoke_harness.py

@@ -0,0 +1,142 @@
+#!/usr/bin/env python3
+"""Invoke the harness via a single InvokeAgentRuntimeCommand.
+
+The harness image contains the full agent + orchestrator at /opt/prism-agent.
+This script just calls it and parses the structured output.
+
+Usage (from the workflow):
+    python invoke_harness.py \
+      --harness-arn $PRISM_HARNESS_ARN \
+      --repo-url "https://x-access-token:TOKEN@github.com/owner/repo.git" \
+      --ref main --subdir sample-app \
+      --issue /tmp/issue.json \
+      --patch-out /tmp/fix.patch \
+      --result-out /tmp/result.json \
+      --region us-west-2
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+import uuid
+
+import boto3
+
+RESULT_MARKER = "===PRISM_RESULT_JSON==="
+PATCH_MARKER = "===PRISM_PATCH_START==="
+PATCH_END_MARKER = "===PRISM_PATCH_END==="
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--harness-arn", required=True)
+    parser.add_argument("--repo-url", required=True)
+    parser.add_argument("--ref", default="main")
+    parser.add_argument("--subdir", default=".")
+    parser.add_argument("--issue", required=True, help="Path to issue JSON file")
+    parser.add_argument("--patch-out", required=True)
+    parser.add_argument("--result-out", required=True)
+    parser.add_argument("--region", default="us-west-2")
+    parser.add_argument("--max-iterations", type=int, default=100)
+    parser.add_argument("--model-id", default="")
+    parser.add_argument("--timeout", type=int, default=1800)
+    args = parser.parse_args()
+
+    issue_json = open(args.issue).read().strip()
+    session_id = f"prism-agent-{uuid.uuid4()}"
+
+    # Build the command that runs inside the harness microVM
+    cmd_parts = [
+        "python", "/opt/prism-agent/run.py",
+        "--repo-url", args.repo_url,
+        "--ref", args.ref,
+        "--subdir", args.subdir,
+        f"--issue", f"@/tmp/agent-issue.json",
+        "--max-iterations", str(args.max_iterations),
+        "--region", args.region,
+    ]
+    if args.model_id:
+        cmd_parts += ["--model-id", args.model_id]
+
+    # Write the issue inside the harness first, then run
+    import shlex
+    escaped_issue = issue_json.replace("'", "'\\''")
+    full_command = (
+        f"echo '{escaped_issue}' > /tmp/agent-issue.json && "
+        f"{shlex.join(cmd_parts)}"
+    )
+
+    print(f"Session: {session_id}", file=sys.stderr)
+    print(f"Harness: {args.harness_arn}", file=sys.stderr)
+    print(f"Subdir:  {args.subdir}", file=sys.stderr)
+
+    client = boto3.client("bedrock-agentcore", region_name=args.region)
+
+    try:
+        response = client.invoke_agent_runtime_command(
+            agentRuntimeArn=args.harness_arn,
+            runtimeSessionId=session_id,
+            body={"command": full_command, "timeout": args.timeout},
+        )
+    except Exception as exc:
+        print(f"InvokeAgentRuntimeCommand failed: {exc}", file=sys.stderr)
+        _write_failure(args, f"API error: {type(exc).__name__}: {exc}")
+        return 1
+
+    # Stream the response
+    stdout_parts = []
+    stderr_parts = []
+    exit_code = -1
+
+    for event in response.get("stream", []):
+        chunk = event.get("chunk", {})
+        if "contentDelta" in chunk:
+            delta = chunk["contentDelta"]
+            if delta.get("stdout"):
+                stdout_parts.append(delta["stdout"])
+            if delta.get("stderr"):
+                stderr_parts.append(delta["stderr"])
+                # Print stderr live for the workflow log
+                print(delta["stderr"], end="", file=sys.stderr)
+        elif "contentStop" in chunk:
+            exit_code = int(chunk["contentStop"].get("exitCode", -1))
+
+    stdout = "".join(stdout_parts)
+
+    # Parse the structured output
+    if RESULT_MARKER in stdout:
+        result_start = stdout.index(RESULT_MARKER) + len(RESULT_MARKER)
+        result_end = stdout.index(PATCH_MARKER) if PATCH_MARKER in stdout else len(stdout)
+        result_json = stdout[result_start:result_end].strip()
+        result = json.loads(result_json)
+    else:
+        result = {"outcome": "failed", "reason": f"no result marker in output (exit {exit_code})",
+                  "verified": False, "patch": ""}
+
+    # Extract patch
+    patch = ""
+    if PATCH_MARKER in stdout:
+        patch_start = stdout.index(PATCH_MARKER) + len(PATCH_MARKER) + 1
+        patch_end = stdout.index(PATCH_END_MARKER) if PATCH_END_MARKER in stdout else len(stdout)
+        patch = stdout[patch_start:patch_end]
+
+    # Write outputs
+    open(args.patch_out, "w").write(patch)
+    open(args.result_out, "w").write(json.dumps(result, indent=2))
+
+    print(f"\nOutcome: {result.get('outcome')} (verified={result.get('verified')})", file=sys.stderr)
+    return 0
+
+
+def _write_failure(args, reason: str) -> None:
+    open(args.patch_out, "w").write("")
+    open(args.result_out, "w").write(json.dumps(
+        {"outcome": "failed", "reason": reason, "verified": False, "patch": ""},
+        indent=2,
+    ))
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/dist/assets/coding-agent/deploy/prism-coding-agent.yml

@@ -2,56 +2,38 @@
 #
 # Installed by: prism-cli bootstrapper install-coding-agent
 #
-# This file deliberately does NOT live in bootstrapper/github-workflows/.
-# install-github-workflows copies every .yml in that directory, so putting it
-# there would hand an autonomous, Bedrock-billing, branch-pushing agent to every
-# repo that ran the workflow installer.
-#
-#
 # WHAT RUNS WHERE
 #
-# The agent runs on AgentCore, not here. This workflow is the thin client: it
-# resolves the issue, invokes the harness, applies the patch it returns, and opens
-# a pull request. That split is what keeps the harness's credentials read-only --
-# it never pushes, so it needs no write access to any repository, and the token
-# that opens the PR is this run's own ephemeral, repo-scoped GITHUB_TOKEN.
+# The agent and its full orchestration (clone, toolchain, deps, fix, verify) run
+# inside the harness microVM. This workflow is the thin client: it resolves the
+# issue, makes one API call, and applies the returned patch.
+#
+# The split is:
+#   - Inside the harness: clone → mise install → npm ci → agent loop → git diff → npm test
+#   - On this runner: read issue → call API → apply patch → push → open PR → comment
 #
-# One harness serves every toolchain. It ships mise and installs what the
-# repository declares in .tool-versions at session start, so there is no
-# per-language routing to configure here.
+# The harness image contains strands-agents + the full orchestrator. A single
+# InvokeAgentRuntimeCommand does everything. No client code is fetched per-run.
 #
 #
 # AUTHORIZATION MODEL
 #
 # The trigger is `issues: [labeled]`, gated on a specific label. That is the
-# security control, and it is load-bearing: anybody with a GitHub account can
-# open an issue in a public repo, but applying a label requires triage
-# permission or above. Triggering on `issues: [opened]` instead would let any
-# stranger spend your Bedrock budget and put a branch in your repository.
+# security control: anybody can open an issue, but applying a label requires
+# triage permission. Private repo access: the GITHUB_TOKEN is passed in the
+# clone URL, so it is visible to the model's shell tool for the duration of
+# this run (it expires when the run ends).
 #
 # NOTE: `issues` events only trigger a workflow run if this file exists on the
-# DEFAULT branch. You cannot test changes to it from a feature branch -- nothing
-# fires, and nothing reports why. Merge first.
+# DEFAULT branch. You cannot test changes from a feature branch.
 #
 #
 # REQUIRED SETUP
-#   - prism-cli bootstrapper setup-github-oidc   (grants bedrock:InvokeModel)
+#   - prism-cli bootstrapper setup-github-oidc (grants bedrock-agentcore + SSM + SM)
 #   - Repository secret PRISM_METRICS_ROLE_ARN
-#   - Repository or org variable PRISM_HARNESS_ARN (an ARN is an identifier, not
-#     a credential, so it belongs in `vars` -- and an org variable is inherited by
-#     every repo, which is what "deploy the harness once" should feel like)
-#   - A label matching AGENT_LABEL below, created in the repo
+#   - Repository or org variable PRISM_HARNESS_ARN
+#   - A label matching 'agent-fix', created in the repo
 #   - .coding-agent/config.json committed (written by install-coding-agent)
-#
-# The agent is NOT vendored into this repository. Only config.json, prompt.md,
-# fixtures/ and this file live here; the orchestrator client is fetched at run
-# time from the sample repo, and the agent itself runs in an AgentCore harness in
-# your own account. That means an agent fix reaches every repo without an N-repo
-# migration, which vendoring could not offer.
-#
-# Pin PRISM_AGENT_REF to a tag or commit SHA for anything you care about. It
-# defaults to `main` so the workshop works on day one, but a floating default
-# means a third party's push can change what runs in your CI.
 
 name: PRISM Coding Agent
 
@@ -69,26 +51,15 @@ env:
   PRISM_AWS_REGION: us-west-2
   PRISM_REPO: github.com/${{ github.repository }}
   PRISM_HARNESS_ARN: ${{ vars.PRISM_HARNESS_ARN }}
-  # Where the orchestrator client comes from. Overridable as repo/org variables so
-  # a fork, an internal mirror, or a pinned SHA needs no edit to this file.
-  PRISM_AGENT_REPO: ${{ vars.PRISM_AGENT_REPO || 'aws-samples/sample-prism-d1-velocity' }}
-  PRISM_AGENT_REF: ${{ vars.PRISM_AGENT_REF || 'main' }}
 
 permissions:
   id-token: write       # OIDC → AWS
   contents: write       # push the fix branch
   pull-requests: write  # open the PR
-  issues: write         # comment the outcome back on the issue
+  issues: write         # comment the outcome
 
 jobs:
   fix-issue:
-    # On the label path, run only for the agent label. Any other label added to
-    # any issue also fires this workflow, so this condition is what keeps the
-    # job from running on every triage action in the repository.
-    #
-    # The label is a literal here, not an env var, because the `env` context is
-    # not available in a job-level `if`. An AGENT_LABEL variable above would look
-    # configurable and change nothing — if you rename the label, edit this line.
     if: >-
       github.event_name == 'workflow_dispatch' ||
       github.event.label.name == 'agent-fix'
@@ -98,44 +69,22 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
 
-      - name: Warn if no harness variable (SSM is the fallback)
-        run: |
-          if [[ -z "${PRISM_HARNESS_ARN}" ]]; then
-            echo "::notice::PRISM_HARNESS_ARN variable is not set. Will try SSM /prism/d1/harness-arn after OIDC."
-          fi
-
-      - name: Resolve the issue to work on
+      - name: Resolve the issue
         id: issue
-        env:
-          GH_TOKEN: ${{ github.token }}
-          DISPATCH_NUMBER: ${{ inputs.issue_number }}
         run: |
-          set -euo pipefail
-
-          # Both branches write the same shape: a GitHub event payload with the
-          # issue under an `issue` key, which is what agentcore.invoke reads. The
-          # dispatch branch has to wrap it, because `gh issue view` returns a
-          # bare issue object.
           if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
-            if ! [[ "${DISPATCH_NUMBER}" =~ ^[0-9]+$ ]]; then
-              echo "::error::issue_number must be numeric, got '${DISPATCH_NUMBER}'"
-              exit 1
-            fi
-            gh issue view "${DISPATCH_NUMBER}" --json number,title,body,labels \
-              | jq '{issue: .}' > /tmp/issue.json
+            NUMBER="${{ inputs.issue_number }}"
           else
-            # Read from the payload rather than re-fetching: avoids a race where
-            # the issue is edited between the label and this step.
-            jq '{issue: (.issue | {number, title, body, labels})}' \
-              "${GITHUB_EVENT_PATH}" > /tmp/issue.json
+            NUMBER="${{ github.event.issue.number }}"
           fi
-
-          NUMBER=$(jq -r '.issue.number' /tmp/issue.json)
           echo "number=${NUMBER}" >> "$GITHUB_OUTPUT"
-          echo "Working on issue #${NUMBER}: $(jq -r '.issue.title' /tmp/issue.json)"
+          # Wrap under an `issue` key for the agent
+          gh issue view "${NUMBER}" --json number,title,body \
+            | jq '{issue: .}' > /tmp/issue.json
+          echo "Issue #${NUMBER}: $(jq -r .issue.title /tmp/issue.json)"
+        env:
+          GH_TOKEN: ${{ github.token }}
 
       - name: Acknowledge on the issue
         env:
@@ -144,140 +93,127 @@ jobs:
           gh issue comment "${{ steps.issue.outputs.number }}" \
             --body "🤖 PRISM coding agent picked this up — [run log](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})."
 
-      - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
-        with:
-          python-version: '3.12'
-
-      - name: Install runner dependencies
-        run: |
-          set -euo pipefail
-          sudo apt-get update -qq && sudo apt-get install -y -qq jq
-          # Only boto3 -- the agent's own dependencies live in the harness image,
-          # not here. This runner never loads a model.
-          pip install --quiet boto3
-
-      - name: Fetch the orchestrator client
-        id: client
-        env:
-          AGENT_REPO: ${{ env.PRISM_AGENT_REPO }}
-          AGENT_REF: ${{ env.PRISM_AGENT_REF }}
-        run: |
-          set -euo pipefail
-          # Cloned into RUNNER_TEMP, NOT the workspace. actions/checkout can only
-          # write under GITHUB_WORKSPACE, and anything there is inside the tree the
-          # agent's patch is applied to and committed from -- a client checkout
-          # sitting in the working tree is one `git add -A` away from being
-          # committed into somebody's fix.
-          DEST="${RUNNER_TEMP}/prism-agent"
-          rm -rf "${DEST}"
-          mkdir -p "${DEST}"
-
-          # init + fetch rather than `clone --branch`, because --branch takes a
-          # branch or tag and rejects a commit SHA -- which is exactly what a repo
-          # that has pinned PRISM_AGENT_REF will be passing.
-          git -C "${DEST}" init -q
-          git -C "${DEST}" remote add origin "https://github.com/${AGENT_REPO}.git"
-          git -C "${DEST}" sparse-checkout init --cone
-          git -C "${DEST}" sparse-checkout set coding-agent
-          git -C "${DEST}" fetch -q --depth 1 origin "${AGENT_REF}"
-          git -C "${DEST}" checkout -q FETCH_HEAD
-
-          CLIENT="${DEST}/coding-agent"
-          # Preflight by importing rather than by checking that files exist. The
-          # runtime dependency is the whole `coding-agent/` directory, not just the
-          # `agentcore/` package: invoke.py puts its parent on sys.path and imports
-          # `config`, and contract.py imports it too -- from inside
-          # FixRequest.validate(), so a missing config.py would not surface until a
-          # request was already being validated. An import check covers both, plus
-          # any module inside the package that a narrowed sparse path dropped.
-          #
-          # `python -c` rather than a heredoc: a heredoc terminator has to sit at
-          # column 0, which inside a YAML block scalar means breaking out of the
-          # block and invalidating the workflow file.
-          if ! ( cd "${CLIENT}" && python -c "import sys; sys.path.insert(0, '.'); import agentcore.invoke; import config" ); then
-            echo "::error::${AGENT_REPO}@${AGENT_REF} does not provide a usable" \
-                 "coding-agent/ client (agentcore/ and config.py are both required)"
-            exit 1
-          fi
-          echo "dir=${CLIENT}" >> "$GITHUB_OUTPUT"
-          echo "Client ${AGENT_REPO}@$(git -C "${DEST}" rev-parse --short FETCH_HEAD)"
-
       - name: Configure AWS credentials (OIDC)
         uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
         with:
           role-to-assume: ${{ secrets.PRISM_METRICS_ROLE_ARN }}
           aws-region: ${{ env.PRISM_AWS_REGION }}
 
-      - name: Load telemetry config from SSM
-        # One source of truth: CDK writes these at deploy time, so they cannot
-        # drift from what's actually deployed. Falls back gracefully — a missing
-        # parameter means telemetry is unconfigured, not that the run fails.
+      - name: Resolve harness ARN
+        id: harness
         run: |
-          set -euo pipefail
-          read_param() {
-            aws ssm get-parameter --name "$1" --query Parameter.Value --output text 2>/dev/null || echo ""
-          }
-          PRISM_COLLECTOR_URL=$(read_param /prism/d1/collector-url)
-          PRISM_OIDC_TOKEN_ENDPOINT=$(read_param /prism/d1/token-endpoint)
-          PRISM_AGENT_SECRET_ID=$(read_param /prism/d1/agent-secret-id)
-          echo "PRISM_COLLECTOR_URL=${PRISM_COLLECTOR_URL}" >> "$GITHUB_ENV"
-          echo "PRISM_OIDC_TOKEN_ENDPOINT=${PRISM_OIDC_TOKEN_ENDPOINT}" >> "$GITHUB_ENV"
-          echo "PRISM_AGENT_SECRET_ID=${PRISM_AGENT_SECRET_ID}" >> "$GITHUB_ENV"
-          # Harness ARN: the GitHub variable is the primary (pre-OIDC early-fail),
-          # but if it was empty (e.g. fork with no org vars), SSM is the fallback.
-          if [[ -z "${PRISM_HARNESS_ARN}" ]]; then
-            PRISM_HARNESS_ARN=$(read_param /prism/d1/harness-arn)
-            if [[ -n "${PRISM_HARNESS_ARN}" ]]; then
-              echo "PRISM_HARNESS_ARN=${PRISM_HARNESS_ARN}" >> "$GITHUB_ENV"
-              echo "Harness ARN loaded from SSM (GitHub variable was empty)"
-            fi
+          ARN="${PRISM_HARNESS_ARN}"
+          if [[ -z "${ARN}" ]]; then
+            ARN=$(aws ssm get-parameter --name /prism/d1/harness-arn \
+              --query Parameter.Value --output text 2>/dev/null || echo "")
           fi
-          if [[ -n "${PRISM_COLLECTOR_URL}" ]]; then
-            echo "Telemetry: ${PRISM_COLLECTOR_URL} (secret: ${PRISM_AGENT_SECRET_ID})"
-          else
-            echo "Telemetry: not configured (SSM params empty or missing)"
+          if [[ -z "${ARN}" ]]; then
+            echo "::error::No harness ARN (checked variable + SSM /prism/d1/harness-arn)"
+            exit 1
           fi
+          echo "arn=${ARN}" >> "$GITHUB_OUTPUT"
+          echo "Harness: ${ARN}"
+
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.12'
 
-      - name: Invoke the harness
+      - name: Invoke the agent
         id: invoke
-        env:
-          PRISM_HARNESS_ARN: ${{ env.PRISM_HARNESS_ARN }}
         run: |
-          if [[ -z "${PRISM_HARNESS_ARN}" ]]; then
-            echo "::error::No harness ARN available (checked GitHub variable AND SSM /prism/d1/harness-arn)."
-            echo "::error::Run coding-agent/deploy/deploy-harness.sh and set the org variable."
-            exit 1
-          fi
-          # GitHub runs `run:` blocks under `bash -e`, so a non-zero exit would
-          # end the step and skip straight past reporting. `set +e` keeps the exit
-          # code as data instead of as control flow.
-          set -o pipefail
-          set +e
-          # --repo is the checkout under test, which is NOT the working directory:
-          # this step runs from the client, and config.json lives in the target
-          # repo. Passing `.` here would resolve to the client and fail config
-          # loading with a confusing "no .coding-agent/config.json".
-          python -m agentcore.invoke \
-            --repo "${GITHUB_WORKSPACE}" \
-            --github-event /tmp/issue.json \
-            --patch-out /tmp/fix.patch \
-            --result-out /tmp/result.json \
-            --transcript-out /tmp/agent-transcript.log \
-            --repo-url "${{ github.server_url }}/${{ github.repository }}.git" \
-            --ref "${{ github.event.repository.default_branch }}" \
-            --region "${PRISM_AWS_REGION}" \
-            2>&1 | tee /tmp/invoke.log
-          EXIT_CODE=$?
-          set -e
-          echo "exit_code=${EXIT_CODE}" >> "$GITHUB_OUTPUT"
-
-          OUTCOME=$(jq -r '.outcome // "failed"' /tmp/result.json 2>/dev/null || echo failed)
+          pip install --quiet boto3
+
+          # Read subdir from config
+          SUBDIR=$(python -c "
+          import json, pathlib
+          cfg = pathlib.Path('.coding-agent/config.json')
+          print(json.loads(cfg.read_text()).get('subdir', '.') if cfg.exists() else '.')
+          ")
+
+          # The repo URL includes the token so the harness can clone private repos.
+          # This token is ephemeral (dies when the run ends) and scoped to this repo.
+          REPO_URL="https://x-access-token:${{ github.token }}@github.com/${{ github.repository }}.git"
+
+          python - <<'PYTHON'
+          import boto3, json, sys, uuid
+
+          RESULT_MARKER = "===PRISM_RESULT_JSON==="
+          PATCH_MARKER = "===PRISM_PATCH_START==="
+          PATCH_END_MARKER = "===PRISM_PATCH_END==="
+
+          harness_arn = "${{ steps.harness.outputs.arn }}"
+          region = "${{ env.PRISM_AWS_REGION }}"
+          repo_url = """${REPO_URL}"""
+          ref = "${{ github.event.repository.default_branch }}"
+          subdir = """${SUBDIR}"""
+          issue_json = open("/tmp/issue.json").read().strip().replace("'", "'\\''")
+          session_id = f"prism-agent-{uuid.uuid4()}"
+
+          cmd = (
+              f"echo '{issue_json}' > /tmp/agent-issue.json && "
+              f"python /opt/prism-agent/run.py "
+              f"--repo-url '{repo_url}' "
+              f"--ref '{ref}' "
+              f"--subdir '{subdir}' "
+              f"--issue @/tmp/agent-issue.json "
+              f"--region '{region}'"
+          )
+
+          print(f"Session: {session_id}", file=sys.stderr)
+          client = boto3.client("bedrock-agentcore", region_name=region)
+
+          try:
+              response = client.invoke_agent_runtime_command(
+                  agentRuntimeArn=harness_arn,
+                  runtimeSessionId=session_id,
+                  body={"command": cmd, "timeout": 1800},
+              )
+          except Exception as exc:
+              print(f"::error::InvokeAgentRuntimeCommand failed: {exc}", file=sys.stderr)
+              json.dump({"outcome": "failed", "reason": str(exc)}, open("/tmp/result.json", "w"))
+              open("/tmp/fix.patch", "w").write("")
+              sys.exit(0)
+
+          stdout_parts, exit_code = [], -1
+          for event in response.get("stream", []):
+              chunk = event.get("chunk", {})
+              if "contentDelta" in chunk:
+                  delta = chunk["contentDelta"]
+                  if delta.get("stdout"):
+                      stdout_parts.append(delta["stdout"])
+                  if delta.get("stderr"):
+                      print(delta["stderr"], end="", file=sys.stderr)
+              elif "contentStop" in chunk:
+                  exit_code = int(chunk["contentStop"].get("exitCode", -1))
+
+          stdout = "".join(stdout_parts)
+
+          # Parse structured output
+          if RESULT_MARKER in stdout:
+              start = stdout.index(RESULT_MARKER) + len(RESULT_MARKER)
+              end = stdout.index(PATCH_MARKER) if PATCH_MARKER in stdout else len(stdout)
+              result = json.loads(stdout[start:end].strip())
+          else:
+              result = {"outcome": "failed", "reason": f"no result marker (exit {exit_code})"}
+
+          patch = ""
+          if PATCH_MARKER in stdout:
+              ps = stdout.index(PATCH_MARKER) + len(PATCH_MARKER) + 1
+              pe = stdout.index(PATCH_END_MARKER) if PATCH_END_MARKER in stdout else len(stdout)
+              patch = stdout[ps:pe]
+
+          open("/tmp/fix.patch", "w").write(patch)
+          json.dump(result, open("/tmp/result.json", "w"), indent=2)
+
+          outcome = result.get("outcome", "failed")
+          verified = result.get("verified", False)
+          print(f"\nOutcome: {outcome} (verified={verified}, exit {exit_code})", file=sys.stderr)
+          PYTHON
+
+          # Export for subsequent steps
+          OUTCOME=$(python -c "import json; print(json.load(open('/tmp/result.json')).get('outcome','failed'))")
           echo "outcome=${OUTCOME}" >> "$GITHUB_OUTPUT"
-          VERIFIED=$(jq -r '.verified // false' /tmp/result.json 2>/dev/null || echo false)
-          echo "verified=${VERIFIED}" >> "$GITHUB_OUTPUT"
-          echo "Harness outcome: ${OUTCOME} (verified=${VERIFIED}, exit ${EXIT_CODE})"
-        working-directory: ${{ steps.client.outputs.dir }}
 
       - name: Apply the patch
         id: apply
@@ -287,108 +223,82 @@ jobs:
           BRANCH="agent/issue-${{ steps.issue.outputs.number }}"
           git switch -c "${BRANCH}"
 
-          # --check first so a stale or malformed patch is reported as such rather
-          # than leaving a half-applied tree behind.
           if ! git apply --check /tmp/fix.patch; then
-            echo "::error::the returned patch does not apply to this tree"
+            echo "::error::patch does not apply"
             echo "applied=false" >> "$GITHUB_OUTPUT"
             exit 1
           fi
           git apply /tmp/fix.patch
 
-          NAME=$(jq -r '.agent_name // "PRISM Coding Agent"' .coding-agent/config.json)
-          EMAIL=$(jq -r '.agent_email // "prism-agent@example.com"' .coding-agent/config.json)
-          SUMMARY=$(jq -r '.summary // "Autonomous fix"' /tmp/result.json)
+          git config user.email "prism-agent@example.com"
+          git config user.name "PRISM Coding Agent"
+
+          TITLE=$(jq -r '.issue.title' /tmp/issue.json)
+          git add -A
+          git commit -m "fix: ${TITLE}
 
-          git -c "user.name=${NAME}" -c "user.email=${EMAIL}" commit -a -m "$(printf 'fix: %s\n\n%s\n\nCloses #%s\n' \
-            "$(jq -r '.issue.title' /tmp/issue.json)" \
-            "${SUMMARY}" \
-            "${{ steps.issue.outputs.number }}")"
+          Closes #${{ steps.issue.outputs.number }}
+
+          Authored by the PRISM coding agent."
+          git push origin "${BRANCH}"
 
           echo "branch=${BRANCH}" >> "$GITHUB_OUTPUT"
           echo "applied=true" >> "$GITHUB_OUTPUT"
-          echo "files=$(git diff --name-only HEAD~1 HEAD | tr '\n' ' ')" >> "$GITHUB_OUTPUT"
           echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-          git log --oneline -1
-
-      - name: Emit commit attribution
-        # After the commit, because the SHA does not exist before it -- the harness
-        # returns a patch and this workflow makes the commit. Reuses the trace id
-        # from result.json: a fresh one would leave the commit with no correlated
-        # usage, and the receiver would freeze its origin as human-authored.
-        #
-        # continue-on-error, because a reporting gap must not fail a run that has
-        # already produced a reviewed fix.
-        if: steps.apply.outputs.applied == 'true'
-        continue-on-error: true
-        run: |
-          set -euo pipefail
-          python -m agentcore.emit_commit \
-            --result /tmp/result.json \
-            --repo "${PRISM_REPO}" \
-            --sha "${{ steps.apply.outputs.sha }}"
-        working-directory: ${{ steps.client.outputs.dir }}
+          echo "files=$(git diff --name-only HEAD~1 HEAD | tr '\n' ' ')" >> "$GITHUB_OUTPUT"
 
       - name: Open the pull request
-        id: pr
         if: steps.apply.outputs.applied == 'true'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          set -euo pipefail
-          git push -u origin "${{ steps.apply.outputs.branch }}"
-          VERIFIED=$(jq -r 'if .verified then "The agent ran this repository'"'"'s checks and they passed." else "⚠️ The agent did NOT verify this change. Review with that in mind." end' /tmp/result.json)
-          URL=$(gh pr create \
+          VERIFIED=$(python -c "import json; print(json.load(open('/tmp/result.json')).get('verified', False))")
+          BADGE=""
+          if [[ "${VERIFIED}" == "True" ]]; then
+            BADGE="✅ Tests pass in the harness"
+          else
+            BADGE="⚠️ Not independently verified"
+          fi
+
+          gh pr create \
+            --base "${{ github.event.repository.default_branch }}" \
+            --head "${{ steps.apply.outputs.branch }}" \
             --title "fix: $(jq -r '.issue.title' /tmp/issue.json)" \
-            --body "$(printf 'Closes #%s\n\n%s\n\n%s\n\nGenerated by the PRISM coding agent on AgentCore. Nothing here was merged automatically.\n\n[Run log](%s)\n' \
-                "${{ steps.issue.outputs.number }}" \
-                "$(jq -r '.summary' /tmp/result.json)" \
-                "${VERIFIED}" \
-                "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}")" \
-            --base "${{ github.event.repository.default_branch }}")
-          echo "url=${URL}" >> "$GITHUB_OUTPUT"
-
-      - name: Report the outcome on the issue
+            --body "Fixes #${{ steps.issue.outputs.number }}
+
+          ${BADGE}
+
+          **Changed files:** ${{ steps.apply.outputs.files }}
+
+          ---
+          *Authored by the [PRISM coding agent](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).*"
+
+      - name: Report outcome on the issue
         if: always()
         env:
           GH_TOKEN: ${{ github.token }}
-          OUTCOME: ${{ steps.invoke.outputs.outcome }}
-          PR_URL: ${{ steps.pr.outputs.url }}
         run: |
-          set -euo pipefail
-          RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-          REASON=$(jq -r '.reason // ""' /tmp/result.json 2>/dev/null || echo "")
+          OUTCOME=$(cat /tmp/result.json 2>/dev/null | jq -r '.outcome // "unknown"')
+          REASON=$(cat /tmp/result.json 2>/dev/null | jq -r '.reason // ""' | head -c 500)
 
-          case "${OUTCOME:-failed}" in
+          case "${OUTCOME}" in
             patched)
-              if [[ -n "${PR_URL}" ]]; then
-                BODY=$(printf '✅ **Fix proposed** — %s\n\nNothing has been merged.\n\n[Run log](%s)' "${PR_URL}" "${RUN_URL}")
-              else
-                BODY=$(printf '⚠️ **The agent produced a patch but it could not be applied or pushed.** See the run log for the reason.\n\n[Run log](%s)' "${RUN_URL}")
-              fi
-              ;;
+              MSG="✅ Fix applied and PR opened." ;;
             declined)
-              # Declining is frequently the right answer -- for an issue asking the
-              # agent to weaken a test suite, or one whose premise does not hold.
-              # Reporting it as a failure would train people to ignore the signal.
-              BODY=$(printf '🛑 **The agent declined to make a change.**\n\n> %s\n\nThis is often correct: the request may ask for something it should refuse, or rest on a premise that does not hold.\n\n[Run log](%s)' "${REASON}" "${RUN_URL}")
-              ;;
+              MSG="🛑 The agent declined to make a change. This is often correct.\n\n> ${REASON}" ;;
             *)
-              BODY=$(printf '❌ **The agent could not complete this.**\n\n> %s\n\n[Run log](%s)' "${REASON:-see the run log}" "${RUN_URL}")
-              ;;
+              MSG="❌ The agent could not fix this issue.\n\n> ${REASON}" ;;
           esac
 
-          gh issue comment "${{ steps.issue.outputs.number }}" --body "${BODY}"
+          gh issue comment "${{ steps.issue.outputs.number }}" --body "${MSG}"
 
-      - name: Upload the transcript
+      - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: agent-run-issue-${{ steps.issue.outputs.number }}
           path: |
-            /tmp/invoke.log
             /tmp/result.json
             /tmp/fix.patch
-            /tmp/agent-transcript.log
           retention-days: 14
           if-no-files-found: ignore

package/dist/assets/coding-agent/deploy/run.py

@@ -0,0 +1,262 @@
+#!/usr/bin/env python3
+"""Run the full coding agent cycle inside the harness microVM.
+
+Called by a single InvokeAgentRuntimeCommand from the workflow. Does everything:
+  clone → mise install → deps → agent loop → collect patch → verify → emit telemetry
+
+Outputs a JSON object on stdout that the workflow reads for outcome, patch, and
+telemetry correlation. The patch itself is printed as a separate clearly-delimited
+section so the workflow can extract it.
+
+Exit 0 always (the outcome is in the JSON, not the exit code). A non-zero exit
+would make the InvokeAgentRuntimeCommand report a generic failure rather than the
+structured result the workflow needs.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import shlex
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+# The image has these at /opt/prism-agent via PYTHONPATH
+from agentcore.session import (
+    WORKSPACE,
+    BASE_SHA_FILE,
+    _exclude_pathspecs,
+)
+from agentcore.telemetry import RunTelemetry, emit_run, CollectorConfig
+from config import load_config
+
+
+CLONE_TIMEOUT = 600
+TOOLCHAIN_TIMEOUT = 900
+DEPS_TIMEOUT = 1200
+AGENT_TIMEOUT = 1500
+VERIFY_TIMEOUT = 600
+
+
+def _dependency_command() -> str:
+    """Shell script that infers the install command from the manifest in cwd."""
+    return (
+        "sh -c '"
+        "if [ -f package-lock.json ]; then npm ci; "
+        "elif [ -f package.json ]; then npm install; "
+        "elif [ -f requirements.txt ]; then pip install -r requirements.txt; "
+        "elif [ -f pyproject.toml ]; then pip install -e . || true; "
+        "elif [ -f go.mod ]; then go mod download; "
+        "elif [ -f Cargo.toml ]; then cargo fetch; "
+        "elif [ -f Gemfile ]; then bundle install; "
+        "else echo \"no recognised manifest\"; fi'"
+    )
+
+
+def _fallback_toolchain() -> str:
+    """Install a toolchain when the repo pins none."""
+    checks = [
+        ("package.json", "node", "node@lts"),
+        ("pyproject.toml", "python", "python@3.12"),
+        ("requirements.txt", "python", "python@3.12"),
+        ("go.mod", "go", "go@latest"),
+        ("Cargo.toml", "cargo", "rust@latest"),
+        ("Gemfile", "ruby", "ruby@3.3"),
+    ]
+    branches = " ".join(
+        f'if [ -f {m} ] && ! command -v {b} >/dev/null 2>&1; then '
+        f'echo "UNPINNED: installing {s}"; '
+        f'mise use --global {s} >/dev/null 2>&1 || mise install {s}; fi;'
+        for m, b, s in checks
+    )
+    return f"sh -c '{branches}'"
+
+RESULT_MARKER = "===PRISM_RESULT_JSON==="
+PATCH_MARKER = "===PRISM_PATCH_START==="
+PATCH_END_MARKER = "===PRISM_PATCH_END==="
+
+
+def sh(cmd: str, timeout: int = 300, cwd: str | None = None) -> tuple[int, str, str]:
+    """Run a shell command. Returns (exit_code, stdout, stderr)."""
+    proc = subprocess.run(
+        cmd, shell=True, capture_output=True, text=True,
+        timeout=timeout, cwd=cwd,
+    )
+    return proc.returncode, proc.stdout, proc.stderr
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(prog="run.py")
+    parser.add_argument("--repo-url", required=True, help="Clone URL (may include token)")
+    parser.add_argument("--ref", default="main")
+    parser.add_argument("--subdir", default=".")
+    parser.add_argument("--issue", required=True, help="Issue JSON (inline or @filepath)")
+    parser.add_argument("--max-iterations", type=int, default=100)
+    parser.add_argument("--model-id", default="")
+    parser.add_argument("--region", default="us-west-2")
+    args = parser.parse_args()
+
+    started_at = time.time()
+    result = {"outcome": "failed", "reason": "", "verified": False,
+              "patch": "", "trace_id": "", "session_id": "",
+              "usage": {"input_tokens": 0, "output_tokens": 0}}
+
+    # Parse issue
+    if args.issue.startswith("@"):
+        issue = json.loads(Path(args.issue[1:]).read_text())
+    else:
+        issue = json.loads(args.issue)
+
+    ref = shlex.quote(args.ref)
+    url = shlex.quote(args.repo_url)
+    subdir = args.subdir.strip("/")
+    workdir = f"{WORKSPACE}/{subdir}" if subdir and subdir != "." else WORKSPACE
+
+    # ---- 1. Clone ----
+    print(f"[prepare] clone {args.ref}...", file=sys.stderr)
+    code, out, err = sh(
+        f"rm -rf {WORKSPACE} && git clone --depth 50 --branch {ref} {url} {WORKSPACE} "
+        f"&& cd {WORKSPACE} && git rev-parse HEAD > {BASE_SHA_FILE}",
+        timeout=CLONE_TIMEOUT,
+    )
+    if code != 0:
+        result["reason"] = f"clone failed (exit {code}): {err.strip()[-500:]}"
+        # Sanitize: don't leak the token in error output
+        result["reason"] = result["reason"].replace(args.repo_url, "<repo-url>")
+        _emit_result(result)
+        return 0
+
+    base_sha = Path(BASE_SHA_FILE).read_text().strip()
+    print(f"[prepare] cloned at {base_sha[:8]}", file=sys.stderr)
+
+    # ---- 2. Toolchain ----
+    print("[prepare] mise install...", file=sys.stderr)
+    fallback = _fallback_toolchain()
+    code, out, err = sh(
+        f"cd {shlex.quote(workdir)} && mise install 2>&1; {fallback} mise ls --current 2>&1 | head -20",
+        timeout=TOOLCHAIN_TIMEOUT,
+    )
+    if code != 0:
+        result["reason"] = f"toolchain install failed (exit {code}): {(out+err).strip()[-500:]}"
+        _emit_result(result)
+        return 0
+
+    # ---- 3. Dependencies ----
+    dep_cmd = _dependency_command()
+    if dep_cmd:
+        print("[prepare] installing dependencies...", file=sys.stderr)
+        code, out, err = sh(
+            f"cd {shlex.quote(workdir)} && mise exec -- {dep_cmd}",
+            timeout=DEPS_TIMEOUT,
+        )
+        if code != 0:
+            result["reason"] = f"dependency install failed (exit {code}): {(out+err).strip()[-500:]}"
+            _emit_result(result)
+            return 0
+
+    # ---- 4. Load config and run the agent ----
+    print("[agent] starting...", file=sys.stderr)
+    try:
+        cfg = load_config(Path(workdir))
+    except Exception as exc:
+        result["reason"] = f"config error: {exc}"
+        _emit_result(result)
+        return 0
+
+    model_id = args.model_id or cfg.model_id
+
+    # Write the issue to a temp file for agent.py
+    issue_path = "/tmp/agent-issue.json"
+    Path(issue_path).write_text(json.dumps(issue))
+
+    # Run agent.py as a subprocess with the iteration bound
+    agent_cmd = (
+        f"cd /opt/prism-agent && python agent.py "
+        f"--repo {shlex.quote(workdir)} "
+        f"--issue {issue_path} "
+        f"--max-iterations {args.max_iterations} "
+        f"--deadline-seconds {AGENT_TIMEOUT} "
+        f"--model-id {shlex.quote(model_id)} "
+        f"--region {shlex.quote(args.region)}"
+    )
+    code, out, err = sh(agent_cmd, timeout=AGENT_TIMEOUT + 60, cwd="/opt/prism-agent")
+    print(f"[agent] exit {code}", file=sys.stderr)
+
+    # ---- 5. Collect patch ----
+    excludes = _exclude_pathspecs()
+    code_c, patch, _ = sh(
+        f"cd {WORKSPACE} && git add -N . {excludes} >/dev/null 2>&1; "
+        f"git diff {base_sha} -- . {excludes}",
+        timeout=120,
+    )
+
+    # ---- 6. Verify ----
+    verified = False
+    if patch.strip() and cfg.test_command:
+        print(f"[verify] {cfg.test_command}...", file=sys.stderr)
+        code_v, vout, verr = sh(
+            f"cd {shlex.quote(workdir)} && mise exec -- sh -c {shlex.quote(cfg.test_command)}",
+            timeout=VERIFY_TIMEOUT,
+        )
+        verified = code_v == 0
+        if not verified:
+            print(f"[verify] FAILED (exit {code_v})", file=sys.stderr)
+
+    # ---- 7. Build result ----
+    if patch.strip():
+        result["outcome"] = "patched"
+        result["patch"] = patch
+        result["verified"] = verified
+    elif code == 0:
+        result["outcome"] = "declined"
+        result["reason"] = "agent finished without modifying any files"
+    else:
+        result["outcome"] = "failed"
+        result["reason"] = f"agent exited {code}: {err.strip()[-300:]}"
+
+    # ---- 8. Telemetry ----
+    # Parse usage from agent stderr (it prints iteration counts)
+    # For now, report 0 — the harness doesn't give us token counts when running locally
+    # TODO: parse from agent output or instrument the model wrapper
+
+    _emit_result(result)
+    return 0
+
+
+def _emit_result(result: dict) -> None:
+    """Print the structured result so the workflow can parse it."""
+    # Telemetry attempt (non-fatal)
+    try:
+        cfg = CollectorConfig.from_env()
+        if cfg and result.get("outcome") == "patched":
+            run = RunTelemetry(
+                repo=os.environ.get("PRISM_REPO", ""),
+                project=os.environ.get("PRISM_SUBDIR", "."),
+                issue_number=0,
+                model=os.environ.get("PRISM_MODEL_ID", ""),
+                input_tokens=result["usage"]["input_tokens"],
+                output_tokens=result["usage"]["output_tokens"],
+                outcome=result["outcome"],
+                verified=result["verified"],
+            )
+            trace_id = emit_run(run, cfg)
+            if trace_id:
+                result["trace_id"] = trace_id
+                result["session_id"] = run.session_id
+    except Exception as exc:
+        print(f"[telemetry] skipped: {exc}", file=sys.stderr)
+
+    # Print markers + JSON so the workflow can extract them
+    print(RESULT_MARKER)
+    print(json.dumps(result, indent=2))
+    if result.get("patch"):
+        print(PATCH_MARKER)
+        print(result["patch"])
+        print(PATCH_END_MARKER)
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prism-d1/cli",
-  "version": "1.0.89",
+  "version": "1.0.90",
   "description": "PRISM D1 Velocity CLI — AI development lifecycle assessment tool",
   "author": "andklee",
   "engines": {