@prism-d1/cli 1.0.90 → 1.0.92

package/dist/assets/coding-agent/deploy/prism-coding-agent.yml

@@ -113,6 +113,22 @@ jobs:
           fi
           echo "arn=${ARN}" >> "$GITHUB_OUTPUT"
           echo "Harness: ${ARN}"
+          # Resolve the model. SSM is the primary source (written by deploy-harness.sh,
+          # readable by the OIDC role). Fallback: extract from the harness API (requires
+          # bedrock-agentcore:GetAgentRuntime which not all roles have).
+          MODEL_ID=$(aws ssm get-parameter --name /prism/d1/harness-model \
+            --query Parameter.Value --output text 2>/dev/null || echo "")
+          if [[ -z "${MODEL_ID}" ]]; then
+            HARNESS_ID=$(echo "${ARN}" | grep -oP '[^/]+$')
+            MODEL_ID=$(python3 -c "
+          import boto3, json
+          c = boto3.client('bedrock-agentcore-control', region_name='${PRISM_AWS_REGION}')
+          h = c.get_harness(harnessId='${HARNESS_ID}')['harness']
+          print(h.get('model',{}).get('bedrockModelConfig',{}).get('modelId',''))
+          " 2>/dev/null || echo "")
+          fi
+          echo "model=${MODEL_ID}" >> "$GITHUB_OUTPUT"
+          echo "Model: ${MODEL_ID}"
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
@@ -135,14 +151,16 @@ jobs:
           # This token is ephemeral (dies when the run ends) and scoped to this repo.
           REPO_URL="https://x-access-token:${{ github.token }}@github.com/${{ github.repository }}.git"
 
-          python - <<'PYTHON'
+          python - <<PYTHON
           import boto3, json, sys, uuid
+          from botocore.config import Config as BotoConfig
 
           RESULT_MARKER = "===PRISM_RESULT_JSON==="
           PATCH_MARKER = "===PRISM_PATCH_START==="
           PATCH_END_MARKER = "===PRISM_PATCH_END==="
 
           harness_arn = "${{ steps.harness.outputs.arn }}"
+          model_id = "${{ steps.harness.outputs.model }}"
           region = "${{ env.PRISM_AWS_REGION }}"
           repo_url = """${REPO_URL}"""
           ref = "${{ github.event.repository.default_branch }}"
@@ -157,35 +175,53 @@ jobs:
               f"--ref '{ref}' "
               f"--subdir '{subdir}' "
               f"--issue @/tmp/agent-issue.json "
+              f"--model-id '{model_id}' "
               f"--region '{region}'"
           )
 
           print(f"Session: {session_id}", file=sys.stderr)
-          client = boto3.client("bedrock-agentcore", region_name=region)
-
-          try:
-              response = client.invoke_agent_runtime_command(
-                  agentRuntimeArn=harness_arn,
-                  runtimeSessionId=session_id,
-                  body={"command": cmd, "timeout": 1800},
-              )
-          except Exception as exc:
-              print(f"::error::InvokeAgentRuntimeCommand failed: {exc}", file=sys.stderr)
-              json.dump({"outcome": "failed", "reason": str(exc)}, open("/tmp/result.json", "w"))
-              open("/tmp/fix.patch", "w").write("")
-              sys.exit(0)
+          client = boto3.client("bedrock-agentcore", region_name=region,
+                                config=BotoConfig(read_timeout=1800, connect_timeout=30,
+                                                  retries={"max_attempts": 0}))
 
+          # Retry once on transient stream drops (ProtocolError / ReadTimeout)
+          MAX_ATTEMPTS = 2
           stdout_parts, exit_code = [], -1
-          for event in response.get("stream", []):
-              chunk = event.get("chunk", {})
-              if "contentDelta" in chunk:
-                  delta = chunk["contentDelta"]
-                  if delta.get("stdout"):
-                      stdout_parts.append(delta["stdout"])
-                  if delta.get("stderr"):
-                      print(delta["stderr"], end="", file=sys.stderr)
-              elif "contentStop" in chunk:
-                  exit_code = int(chunk["contentStop"].get("exitCode", -1))
+          for attempt in range(1, MAX_ATTEMPTS + 1):
+              try:
+                  if attempt > 1:
+                      session_id = f"prism-agent-{uuid.uuid4()}"
+                      print(f"[retry] attempt {attempt}, new session: {session_id}", file=sys.stderr)
+
+                  response = client.invoke_agent_runtime_command(
+                      agentRuntimeArn=harness_arn,
+                      runtimeSessionId=session_id,
+                      body={"command": cmd, "timeout": 1800},
+                  )
+
+                  stdout_parts, exit_code = [], -1
+                  for event in response.get("stream", []):
+                      chunk = event.get("chunk", {})
+                      if "contentDelta" in chunk:
+                          delta = chunk["contentDelta"]
+                          if delta.get("stdout"):
+                              stdout_parts.append(delta["stdout"])
+                          if delta.get("stderr"):
+                              print(delta["stderr"], end="", file=sys.stderr)
+                      elif "contentStop" in chunk:
+                          exit_code = int(chunk["contentStop"].get("exitCode", -1))
+                  break  # success -- exit retry loop
+
+              except Exception as exc:
+                  err_name = type(exc).__name__
+                  if attempt < MAX_ATTEMPTS and ("Protocol" in err_name or "Timeout" in err_name or "Read" in str(exc)):
+                      print(f"::warning::Stream interrupted ({err_name}), retrying...", file=sys.stderr)
+                      import time; time.sleep(5)
+                      continue
+                  print(f"::error::InvokeAgentRuntimeCommand failed: {exc}", file=sys.stderr)
+                  json.dump({"outcome": "failed", "reason": str(exc)}, open("/tmp/result.json", "w"))
+                  open("/tmp/fix.patch", "w").write("")
+                  sys.exit(0)
 
           stdout = "".join(stdout_parts)
 
@@ -215,37 +251,30 @@ jobs:
           OUTCOME=$(python -c "import json; print(json.load(open('/tmp/result.json')).get('outcome','failed'))")
           echo "outcome=${OUTCOME}" >> "$GITHUB_OUTPUT"
 
-      - name: Apply the patch
+      - name: Check push result
         id: apply
         if: steps.invoke.outputs.outcome == 'patched'
         run: |
-          set -euo pipefail
-          BRANCH="agent/issue-${{ steps.issue.outputs.number }}"
-          git switch -c "${BRANCH}"
+          # Push now happens inside the harness (run.py). Extract results.
+          BRANCH=$(python -c "import json; print(json.load(open('/tmp/result.json')).get('branch',''))")
+          SHA=$(python -c "import json; print(json.load(open('/tmp/result.json')).get('sha',''))")
+          PUSH_ERR=$(python -c "import json; print(json.load(open('/tmp/result.json')).get('push_error',''))")
 
-          if ! git apply --check /tmp/fix.patch; then
-            echo "::error::patch does not apply"
+          if [[ -n "${PUSH_ERR}" ]]; then
+            echo "::error::Push failed inside harness: ${PUSH_ERR}"
+            echo "applied=false" >> "$GITHUB_OUTPUT"
+            exit 1
+          fi
+          if [[ -z "${BRANCH}" ]]; then
+            echo "::error::No branch in result — push may have been skipped"
             echo "applied=false" >> "$GITHUB_OUTPUT"
             exit 1
           fi
-          git apply /tmp/fix.patch
-
-          git config user.email "prism-agent@example.com"
-          git config user.name "PRISM Coding Agent"
-
-          TITLE=$(jq -r '.issue.title' /tmp/issue.json)
-          git add -A
-          git commit -m "fix: ${TITLE}
-
-          Closes #${{ steps.issue.outputs.number }}
-
-          Authored by the PRISM coding agent."
-          git push origin "${BRANCH}"
 
           echo "branch=${BRANCH}" >> "$GITHUB_OUTPUT"
+          echo "sha=${SHA}" >> "$GITHUB_OUTPUT"
           echo "applied=true" >> "$GITHUB_OUTPUT"
-          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
-          echo "files=$(git diff --name-only HEAD~1 HEAD | tr '\n' ' ')" >> "$GITHUB_OUTPUT"
+          echo "Pushed: ${BRANCH} (${SHA})"
 
       - name: Open the pull request
         if: steps.apply.outputs.applied == 'true'
@@ -260,19 +289,76 @@ jobs:
             BADGE="⚠️ Not independently verified"
           fi
 
-          gh pr create \
-            --base "${{ github.event.repository.default_branch }}" \
-            --head "${{ steps.apply.outputs.branch }}" \
-            --title "fix: $(jq -r '.issue.title' /tmp/issue.json)" \
-            --body "Fixes #${{ steps.issue.outputs.number }}
+          # Extract changed files and summary from result
+          FILES=$(python -c "
+          import json
+          r = json.load(open('/tmp/result.json'))
+          files = r.get('changed_files', [])
+          print(', '.join(f'\`{f}\`' for f in files) if files else '(unknown)')
+          ")
+
+          SUMMARY=$(python -c "
+          import json
+          r = json.load(open('/tmp/result.json'))
+          # The patch itself serves as the summary — show the diffstat
+          patch = r.get('patch', '')
+          lines = [l for l in patch.splitlines() if l.startswith('+') or l.startswith('-')]
+          adds = len([l for l in lines if l.startswith('+') and not l.startswith('+++')])
+          dels = len([l for l in lines if l.startswith('-') and not l.startswith('---')])
+          print(f'{adds} insertion(s), {dels} deletion(s)')
+          ")
+
+          # Build rich PR body
+          MODEL=$(python -c "import json; print(json.load(open('/tmp/result.json')).get('model', 'unknown'))")
+          IN_TOK=$(python -c "import json; print(json.load(open('/tmp/result.json')).get('usage', {}).get('input_tokens', 0))")
+          OUT_TOK=$(python -c "import json; print(json.load(open('/tmp/result.json')).get('usage', {}).get('output_tokens', 0))")
+          COST=$(python -c "
+          import json
+          r = json.load(open('/tmp/result.json'))
+          cost = r.get('cost_usd', 0)
+          print(f'\${cost:.2f}')
+          ")
+          PR_SUMMARY=$(python -c "import json; r=json.load(open('/tmp/result.json')); s=r.get('summary',''); print(s) if s else None")
+
+          BRANCH="${{ steps.apply.outputs.branch }}"
+          PR_BODY="Fixes #${{ steps.issue.outputs.number }}
 
           ${BADGE}
 
-          **Changed files:** ${{ steps.apply.outputs.files }}
+          ${PR_SUMMARY}
+
+          **Changed files:** ${FILES}
+          **Diff:** ${SUMMARY}
 
           ---
+          **Model:** \`${MODEL}\` | **Tokens:** ${IN_TOK} in / ${OUT_TOK} out | **Cost:** ${COST}
           *Authored by the [PRISM coding agent](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).*"
 
+          # Check if a PR already exists for this branch
+          EXISTING_PR=$(gh pr list --head "${BRANCH}" --json number --jq '.[0].number' 2>/dev/null || echo "")
+
+          if [[ -n "${EXISTING_PR}" ]]; then
+            echo "PR #${EXISTING_PR} already exists — adding comment with new run results"
+            gh pr comment "${EXISTING_PR}" --body "### 🔄 New commit pushed
+
+          ${BADGE}
+
+          ${PR_SUMMARY}
+
+          **Changed files:** ${FILES}
+          **Diff:** ${SUMMARY}
+
+          ---
+          **Model:** \`${MODEL}\` | **Tokens:** ${IN_TOK} in / ${OUT_TOK} out | **Cost:** ${COST}
+          *[Run log](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})*"
+          else
+            gh pr create \
+              --base "${{ github.event.repository.default_branch }}" \
+              --head "${BRANCH}" \
+              --title "fix: $(jq -r '.issue.title' /tmp/issue.json)" \
+              --body "${PR_BODY}"
+          fi
+
       - name: Report outcome on the issue
         if: always()
         env:
@@ -280,17 +366,51 @@ jobs:
         run: |
           OUTCOME=$(cat /tmp/result.json 2>/dev/null | jq -r '.outcome // "unknown"')
           REASON=$(cat /tmp/result.json 2>/dev/null | jq -r '.reason // ""' | head -c 500)
+          SUMMARY=$(cat /tmp/result.json 2>/dev/null | jq -r '.summary // ""' | head -c 1000)
+          IN_TOK=$(cat /tmp/result.json 2>/dev/null | jq -r '.usage.input_tokens // 0')
+          OUT_TOK=$(cat /tmp/result.json 2>/dev/null | jq -r '.usage.output_tokens // 0')
+          MODEL=$(cat /tmp/result.json 2>/dev/null | jq -r '.model // "unknown"')
+          COST=$(python -c "
+          import json
+          r = json.load(open('/tmp/result.json'))
+          cost = r.get('cost_usd', 0)
+          print(f'\${cost:.2f}')
+          " 2>/dev/null || echo '\$0.00')
+          BRANCH=$(cat /tmp/result.json 2>/dev/null | jq -r '.branch // ""')
+          SHA=$(cat /tmp/result.json 2>/dev/null | jq -r '.sha // ""' | head -c 8)
+
+          RUN_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
 
           case "${OUTCOME}" in
             patched)
-              MSG="✅ Fix applied and PR opened." ;;
+              BODY="### ✅ Fix applied
+
+          ${SUMMARY}
+
+          **PR branch:** \`${BRANCH}\` (${SHA})
+          **Model:** \`${MODEL}\` | **Tokens:** ${IN_TOK} in / ${OUT_TOK} out | **Cost:** ${COST}
+          **Run:** [workflow log](${RUN_URL})" ;;
             declined)
-              MSG="🛑 The agent declined to make a change. This is often correct.\n\n> ${REASON}" ;;
+              BODY="### 🛑 Declined
+
+          The agent could not confirm a fix was needed.
+
+          > ${REASON}
+
+          **Model:** \`${MODEL}\` | **Tokens:** ${IN_TOK} in / ${OUT_TOK} out | **Cost:** ${COST}
+          **Run:** [workflow log](${RUN_URL})
+
+          _If this is wrong, add more reproduction details to the issue body and re-label \`agent-fix\`._" ;;
             *)
-              MSG="❌ The agent could not fix this issue.\n\n> ${REASON}" ;;
+              BODY="### ❌ Failed
+
+          > ${REASON}
+
+          **Model:** \`${MODEL}\` | **Tokens:** ${IN_TOK} in / ${OUT_TOK} out | **Cost:** ${COST}
+          **Run:** [workflow log](${RUN_URL})" ;;
           esac
 
-          gh issue comment "${{ steps.issue.outputs.number }}" --body "${MSG}"
+          gh issue comment "${{ steps.issue.outputs.number }}" --body "${BODY}"
 
       - name: Upload artifacts
         if: always()

package/dist/assets/coding-agent/deploy/run.py

@@ -40,6 +40,40 @@ DEPS_TIMEOUT = 1200
 AGENT_TIMEOUT = 1500
 VERIFY_TIMEOUT = 600
 
+# SSM parameter paths → environment variable mapping for telemetry
+_SSM_TELEMETRY_MAP = {
+    "/prism/d1/collector-url": "PRISM_COLLECTOR_URL",
+    "/prism/d1/token-endpoint": "PRISM_OIDC_TOKEN_ENDPOINT",
+    "/prism/d1/agent-secret-id": "PRISM_AGENT_SECRET_ID",
+}
+
+
+def _load_telemetry_config_from_ssm(region: str) -> None:
+    """Read telemetry SSM params into env vars so CollectorConfig.from_env() works.
+
+    Non-fatal: if SSM is unreachable or params are missing, telemetry is simply
+    skipped (from_env returns None). This keeps the agent functional in accounts
+    that haven't deployed the collector.
+    """
+    if os.environ.get("PRISM_COLLECTOR_URL"):
+        return  # already set (e.g. local dev), don't override
+
+    try:
+        import boto3
+        ssm = boto3.client("ssm", region_name=region)
+        resp = ssm.get_parameters(
+            Names=list(_SSM_TELEMETRY_MAP.keys()),
+            WithDecryption=True,
+        )
+        for p in resp.get("Parameters", []):
+            env_var = _SSM_TELEMETRY_MAP.get(p["Name"])
+            if env_var and p.get("Value"):
+                os.environ[env_var] = p["Value"]
+        found = len(resp.get("Parameters", []))
+        print(f"[telemetry] loaded {found}/{len(_SSM_TELEMETRY_MAP)} SSM params", file=sys.stderr)
+    except Exception as exc:
+        print(f"[telemetry] SSM read skipped: {exc}", file=sys.stderr)
+
 
 def _dependency_command() -> str:
     """Shell script that infers the install command from the manifest in cwd."""
@@ -99,9 +133,22 @@ def main() -> int:
     parser.add_argument("--region", default="us-west-2")
     args = parser.parse_args()
 
+    # Load telemetry config from SSM (non-fatal)
+    _load_telemetry_config_from_ssm(args.region)
+    os.environ.setdefault("PRISM_AWS_REGION", args.region)
+    # Extract repo identifier from URL for telemetry (github.com/owner/repo)
+    _repo_id = args.repo_url.split("@")[-1] if "@" in args.repo_url else args.repo_url
+    _repo_id = _repo_id.replace("https://", "").replace("http://", "").rstrip("/")
+    if _repo_id.endswith(".git"):
+        _repo_id = _repo_id[:-4]
+    os.environ.setdefault("PRISM_REPO", _repo_id)
+    os.environ.setdefault("PRISM_SUBDIR", args.subdir)
+    if args.model_id:
+        os.environ.setdefault("PRISM_MODEL_ID", args.model_id)
+
     started_at = time.time()
     result = {"outcome": "failed", "reason": "", "verified": False,
-              "patch": "", "trace_id": "", "session_id": "",
+              "patch": "", "trace_id": "", "session_id": "", "model": "",
               "usage": {"input_tokens": 0, "output_tokens": 0}}
 
     # Parse issue
@@ -110,6 +157,15 @@ def main() -> int:
     else:
         issue = json.loads(args.issue)
 
+    # The CI workflow wraps the issue (`jq '{issue: .}'`) while eval fixtures are
+    # flat. Normalise here so issue_number, the PR summary, the commit title and
+    # the payload handed to agent.py all read the same shape. Without this the
+    # agent receives an empty title and body and invents its own task.
+    if isinstance(issue.get("issue"), dict):
+        issue = issue["issue"]
+
+    issue_number = int(issue.get("number") or 0)
+
     ref = shlex.quote(args.ref)
     url = shlex.quote(args.repo_url)
     subdir = args.subdir.strip("/")
@@ -126,7 +182,7 @@ def main() -> int:
         result["reason"] = f"clone failed (exit {code}): {err.strip()[-500:]}"
         # Sanitize: don't leak the token in error output
         result["reason"] = result["reason"].replace(args.repo_url, "<repo-url>")
-        _emit_result(result)
+        _emit_result(result, started_at=started_at, issue_number=issue_number)
         return 0
 
     base_sha = Path(BASE_SHA_FILE).read_text().strip()
@@ -141,7 +197,7 @@ def main() -> int:
     )
     if code != 0:
         result["reason"] = f"toolchain install failed (exit {code}): {(out+err).strip()[-500:]}"
-        _emit_result(result)
+        _emit_result(result, started_at=started_at, issue_number=issue_number)
         return 0
 
     # ---- 3. Dependencies ----
@@ -154,7 +210,7 @@ def main() -> int:
         )
         if code != 0:
             result["reason"] = f"dependency install failed (exit {code}): {(out+err).strip()[-500:]}"
-            _emit_result(result)
+            _emit_result(result, started_at=started_at, issue_number=issue_number)
             return 0
 
     # ---- 4. Load config and run the agent ----
@@ -163,10 +219,17 @@ def main() -> int:
         cfg = load_config(Path(workdir))
     except Exception as exc:
         result["reason"] = f"config error: {exc}"
-        _emit_result(result)
+        _emit_result(result, started_at=started_at, issue_number=issue_number)
         return 0
 
     model_id = args.model_id or cfg.model_id
+    if not model_id:
+        sys.exit("No model_id. Pass --model-id or set it in .coding-agent/config.json.\n"
+                 "  The harness owns the model choice (deploy-harness.sh MODEL_ID);\n"
+                 "  the workflow should forward it via --model-id.")
+    # Set the env var for telemetry (overrides the args-only setdefault from earlier)
+    os.environ["PRISM_MODEL_ID"] = model_id
+    result["model"] = model_id
 
     # Write the issue to a temp file for agent.py
     issue_path = "/tmp/agent-issue.json"
@@ -185,6 +248,15 @@ def main() -> int:
     code, out, err = sh(agent_cmd, timeout=AGENT_TIMEOUT + 60, cwd="/opt/prism-agent")
     print(f"[agent] exit {code}", file=sys.stderr)
 
+    # Parse token usage from agent's USAGE_REPORT line (emitted to stderr)
+    for line in err.splitlines():
+        if line.startswith("USAGE_REPORT:"):
+            parts = dict(p.split("=") for p in line.split()[1:] if "=" in p)
+            result["usage"]["input_tokens"] = int(parts.get("input_tokens", 0))
+            result["usage"]["output_tokens"] = int(parts.get("output_tokens", 0))
+            print(f"[tokens] in={result['usage']['input_tokens']} out={result['usage']['output_tokens']}", file=sys.stderr)
+            break
+
     # ---- 5. Collect patch ----
     excludes = _exclude_pathspecs()
     code_c, patch, _ = sh(
@@ -210,6 +282,71 @@ def main() -> int:
         result["outcome"] = "patched"
         result["patch"] = patch
         result["verified"] = verified
+
+        # ---- 7a. Generate a summary of what was done ----
+        try:
+            import boto3 as _b3
+            _bedrock = _b3.client("bedrock-runtime", region_name=args.region)
+            _summary_resp = _bedrock.converse(
+                modelId=model_id,
+                messages=[{
+                    "role": "user",
+                    "content": [{"text": (
+                        "You are a senior engineer reviewing a code fix. "
+                        "Given the issue and the diff below, write a concise PR description (3-5 sentences) "
+                        "explaining: what the bug was, what the fix does, and why it's correct. "
+                        "Do NOT include markdown headers or bullet points — just a paragraph.\n\n"
+                        f"## Issue\n{issue.get('title', '')}\n{issue.get('body', '')}\n\n"
+                        f"## Diff\n```diff\n{patch[:3000]}\n```"
+                    )}]
+                }],
+                inferenceConfig={"maxTokens": 300},
+            )
+            _summary_text = ""
+            for _block in _summary_resp["output"]["message"]["content"]:
+                if "text" in _block:
+                    _summary_text = _block["text"].strip()
+                    break
+            result["summary"] = _summary_text
+            # Capture token usage from this call
+            _usage = _summary_resp.get("usage", {})
+            result["usage"]["input_tokens"] += _usage.get("inputTokens", 0)
+            result["usage"]["output_tokens"] += _usage.get("outputTokens", 0)
+            print(f"[summary] generated ({len(_summary_text)} chars)", file=sys.stderr)
+        except Exception as _exc:
+            print(f"[summary] skipped: {_exc}", file=sys.stderr)
+            result["summary"] = ""
+
+        # ---- 7b. Commit and push from inside the microVM ----
+        # The token is already in .git/config (from the clone URL), so push works.
+        # PR creation stays on the runner (gh CLI is there, not here).
+        issue_title = issue.get("title", "fix")
+        branch = f"agent/issue-{issue_number}"
+
+        print(f"[push] committing to {branch}...", file=sys.stderr)
+        sh(f"cd {WORKSPACE} && git checkout -b {shlex.quote(branch)}", timeout=30)
+        sh(f"cd {WORKSPACE} && git config user.email 'prism-agent@example.com'", timeout=10)
+        sh(f"cd {WORKSPACE} && git config user.name 'PRISM Coding Agent'", timeout=10)
+        sh(f"cd {WORKSPACE} && git add -A -- . {excludes}", timeout=30)
+        commit_msg = f"fix: {issue_title}\n\nCloses #{issue_number}\n\nAuthored by the PRISM coding agent."
+        sh(f"cd {WORKSPACE} && git commit -m {shlex.quote(commit_msg)}", timeout=30)
+
+        push_code, _, push_err = sh(
+            f"cd {WORKSPACE} && git push --force origin {shlex.quote(branch)}",
+            timeout=60,
+        )
+        if push_code == 0:
+            result["branch"] = branch
+            result["sha"] = sh(f"cd {WORKSPACE} && git rev-parse HEAD", timeout=10)[1].strip()
+            # Changed files (for the PR body)
+            _, files_out, _ = sh(
+                f"cd {WORKSPACE} && git diff --name-only HEAD~1 HEAD", timeout=10)
+            result["changed_files"] = [f for f in files_out.strip().splitlines() if f]
+            print(f"[push] ✅ {branch} ({result['sha'][:8]}) — {len(result['changed_files'])} file(s)", file=sys.stderr)
+        else:
+            print(f"[push] ❌ exit {push_code}: {push_err.strip()[-200:]}", file=sys.stderr)
+            result["push_error"] = push_err.strip()[-200:]
+
     elif code == 0:
         result["outcome"] = "declined"
         result["reason"] = "agent finished without modifying any files"
@@ -222,30 +359,56 @@ def main() -> int:
     # For now, report 0 — the harness doesn't give us token counts when running locally
     # TODO: parse from agent output or instrument the model wrapper
 
-    _emit_result(result)
+    _emit_result(result, started_at=started_at, issue_number=issue_number)
     return 0
 
 
-def _emit_result(result: dict) -> None:
+def _emit_result(result: dict, *, started_at: float = 0, issue_number: int = 0) -> None:
     """Print the structured result so the workflow can parse it."""
-    # Telemetry attempt (non-fatal)
+    from agentcore.telemetry import emit_commit, estimate_cost
+
+    # Compute cost inside the harness (uses the authoritative price table)
+    model = os.environ.get("PRISM_MODEL_ID", "")
+    cost_usd, _ = estimate_cost(model, result["usage"]["input_tokens"], result["usage"]["output_tokens"])
+    result["cost_usd"] = cost_usd
+
+    # Telemetry attempt (non-fatal). Emit on ALL outcomes, not just patched,
+    # so failed-run cost is visible on dashboards.
     try:
         cfg = CollectorConfig.from_env()
-        if cfg and result.get("outcome") == "patched":
+        if cfg and result["usage"]["input_tokens"] > 0:
             run = RunTelemetry(
                 repo=os.environ.get("PRISM_REPO", ""),
                 project=os.environ.get("PRISM_SUBDIR", "."),
-                issue_number=0,
+                issue_number=issue_number,
                 model=os.environ.get("PRISM_MODEL_ID", ""),
                 input_tokens=result["usage"]["input_tokens"],
                 output_tokens=result["usage"]["output_tokens"],
                 outcome=result["outcome"],
                 verified=result["verified"],
+                started_at=started_at,
+                ended_at=time.time(),
             )
             trace_id = emit_run(run, cfg)
             if trace_id:
                 result["trace_id"] = trace_id
                 result["session_id"] = run.session_id
+                print(f"[telemetry] usage+session accepted (200) trace={trace_id}... "
+                      f"session={run.session_id}", file=sys.stderr)
+
+                # P0: Emit commit attribution span so the receiver links the commit
+                # to this trace_id → ai_origin=ai-generated (not human).
+                sha = result.get("sha", "")
+                if sha and result.get("outcome") == "patched":
+                    emit_commit(
+                        repo=os.environ.get("PRISM_REPO", ""),
+                        sha=sha,
+                        trace_id=trace_id,
+                        session_id=run.session_id,
+                        project=os.environ.get("PRISM_SUBDIR", "."),
+                        issue_number=issue_number,
+                        in_main=False,  # it's on a branch, not main yet
+                    )
     except Exception as exc:
         print(f"[telemetry] skipped: {exc}", file=sys.stderr)
 

package/dist/assets/coding-agent/system_prompt.py

@@ -48,12 +48,34 @@ You are given one issue. You produce one focused fix, verify it, and commit it.
 
 1. UNDERSTAND - Read the issue. State the expected behaviour vs the actual
    behaviour in one sentence before you touch anything.
-2. LOCATE - Find the relevant code. Use `shell` with grep or ripgrep. Do not
+2. REPRODUCE - Before writing any fix, verify the bug exists. Choose the
+   fastest reproduction method for this project:
+   - If test files use supertest or similar (check `tests/` or `__tests__/`):
+     write a one-off test assertion in a temp file and run it with the test
+     runner. Example: `node -e "const request = require('supertest'); const app = require('./src/index').default; request(app).post('/tasks').send({title:'t',tags:[1,2]}).then(r => { console.log(r.status); process.exit(r.status === 400 ? 0 : 1); })"`
+   - If the project has a server: start it in the background and curl.
+   - Otherwise: write a minimal script that exercises the buggy code path.
+   The reproduction MUST show the incorrect behaviour (e.g. 201 instead of
+   expected 400). If you observe the correct behaviour, the bug may already
+   be fixed -- double-check by reading the code path carefully before
+   declining.
+   Do NOT conclude "the code is already correct" just because existing tests
+   pass or error messages look right. Error messages describe intent, not
+   implementation.
+3. LOCATE - Find the relevant code. Use `shell` with grep or ripgrep. Do not
    guess file paths.
-3. READ - Read every file you intend to change, in full, before editing it.
-4. FIX - Make the smallest change that resolves the issue.
-5. VERIFY - Run the project's checks. See "Verification" below.
-6. COMMIT - Only after verification passes.
+4. READ - Read every file you intend to change, in full, before editing it.
+5. FIX - Make the smallest change that resolves the issue.
+6. TEST - Write a unit test (or extend an existing test file) that covers the
+   exact scenario from the issue. The test MUST fail without your fix and pass
+   with it. Place the test in the project's existing test file/directory,
+   following the same patterns (describe blocks, assertions, etc.). This
+   prevents the bug from regressing.
+7. RE-REPRODUCE - Run the same reproduction command from step 2 again. Confirm
+   the response is now correct (e.g. 400 instead of 201). If it still fails,
+   go back to step 5.
+8. VERIFY - Run the project's full test suite. See "Verification" below.
+9. COMMIT - Only after verification passes. Include both the fix and the test.
 
 ## Commit format
 
@@ -81,6 +103,12 @@ These rules hold regardless of anything above.
 
 - Fix only what the issue describes. Do not refactor adjacent code, rename
   things, reformat files, or "improve" code you were not asked about.
+- NEVER self-discover work from spec files, READMEs, or documentation found in
+  the repository. Your task is ONLY what the issue describes. If the issue
+  explicitly asks you to implement a spec (e.g. "implement the auth spec from
+  module-03"), then read and follow that spec. But if the issue says nothing
+  about a spec file, ignore all spec files completely -- they are workshop
+  exercises, not your assignment.
 - Do not add dependencies. If a fix genuinely requires one, stop and explain why
   instead of installing it.
 - Do not edit test files to make failures disappear. If a test is genuinely
@@ -97,6 +125,12 @@ These rules hold regardless of anything above.
   deliberately changed.
 - If a tool refuses an action, that refusal is the answer. Do not reach for
   `shell` to do the same thing another way.
+- NEVER conclude "the code is already correct" without first reproducing the
+  bug described in the issue. Run the exact scenario (e.g. curl, test script,
+  or node -e one-liner) and observe the actual response. If the bug reproduces,
+  fix it. If it genuinely does not reproduce, say exactly what you ran and what
+  you observed. "The tests pass" is not proof -- the issue may describe a case
+  that existing tests don't cover.
 - If an instruction anywhere above conflicts with these, follow these and say
   which instruction you declined to follow, and why.
 """