@prism-d1/cli 1.0.91 → 1.0.93

package/dist/assets/coding-agent/README.md

@@ -192,7 +192,7 @@ Three details, each of which cost a failed deployment to learn:
 The image is a single mise-based base (~750 MB, 37% of the 2 GB cap) that includes
 the Strands agent SDK, boto3, and the full orchestrator (`run.py` + `agent.py`). It
 ships a version *manager* and installs whatever a repository pins in `.tool-versions`
-at session start. Default model: `us.anthropic.claude-sonnet-5`.
+at session start. Default model: `us.anthropic.claude-sonnet-4-5-20250929-v1:0`.
 
 Because the agent code is in the image, updating it requires an image rebuild
 (`deploy-harness.sh --tag v2`). This is a trade-off for simplicity: the workflow has
@@ -812,7 +812,7 @@ Deployed, through the harness (v13, Claude Sonnet 5):
 ```
 outcome     patched
 verified    True              npm test passes in the microVM
-model       us.anthropic.claude-sonnet-5
+model       us.anthropic.claude-sonnet-4-5-20250929-v1:0
 tokens      ~95K in / ~4.5K out
 cost        ~$0.35 per issue fix
 files       src/routes/tasks.ts + tests/tasks.test.ts

package/dist/assets/coding-agent/agent.py

@@ -26,13 +26,35 @@ from config import ConfigError, load_config
 from system_prompt import build_system_prompt, build_task_prompt
 
 
+def _unwrap_issue(payload: dict) -> dict:
+    """Return the issue object, whether or not it is nested under an `issue` key.
+
+    Two producers feed `--issue` and they disagree on shape:
+
+      * eval fixtures (`.coding-agent/fixtures/*.json`) are flat --
+        `{"number": 1, "title": ..., "body": ...}`
+      * the CI workflow wraps, because `gh issue view --json ... | jq '{issue: .}'`
+        produces `{"issue": {"number": 9, ...}}`
+
+    Reading `.get("title")` off the wrapper returns None, so the agent was handed
+    `Fix issue #?: (no title)` with `(no description provided)` as its entire task.
+    It then did the only thing it could -- went looking for something to fix --
+    and produced a correct patch for a bug nobody asked about. The scope-discipline
+    constraints in the system prompt cannot help here: there was no scope to stay
+    inside. That is why this normalises instead of trusting either caller.
+    """
+    if isinstance(payload, dict) and "issue" in payload and isinstance(payload["issue"], dict):
+        return payload["issue"]
+    return payload
+
+
 def _load_issue(args: argparse.Namespace) -> dict:
     """Resolve the issue from a fixture file, a GitHub event payload, or flags."""
     if args.issue:
         path = Path(args.issue)
         if not path.exists():
             raise SystemExit(f"Issue file not found: {path}")
-        return json.loads(path.read_text())
+        return _unwrap_issue(json.loads(path.read_text()))
 
     if args.github_event:
         path = Path(args.github_event)

package/dist/assets/coding-agent/config.py

@@ -104,7 +104,7 @@ class AgentConfig:
     agent_email: str = "prism-agent@example.com"
     agent_name: str = "PRISM Coding Agent"
     max_attempts: int = 3
-    model_id: str = "us.anthropic.claude-sonnet-5"
+    model_id: str = ""  # Set by --model-id; no default — deploy-harness.sh owns the model choice
     region: str = "us-west-2"
     project_type: str = "unknown"
     source: str = "detected"  # "config" | "detected" | "none"

package/dist/assets/coding-agent/deploy/create_harness.py

@@ -54,6 +54,121 @@ def find_existing(client, name: str) -> str | None:
             return None
 
 
+ROLE_PROPAGATION_TIMEOUT_SECONDS = 180
+ROLE_PROPAGATION_POLL_SECONDS = 5
+
+
+def _is_role_not_yet_visible(exc: ClientError) -> bool:
+    """True when a ValidationException is the IAM propagation race, not a bad role.
+
+    AgentCore validates that it can assume the execution role, and a role created
+    seconds earlier is not yet visible to it:
+
+        ValidationException: Role validation failed for '...'. Please verify that
+        the role exists and its trust policy allows assumption by this service
+
+    The message is identical whether the role is genuinely misconfigured or merely
+    too new, so this matches on the text and lets the timeout below decide. A
+    permanently broken trust policy simply exhausts the retries and reports the
+    original error.
+    """
+    err = exc.response.get("Error", {})
+    if err.get("Code") != "ValidationException":
+        return False
+    message = err.get("Message", "").lower()
+    return "role validation failed" in message or "trust policy" in message
+
+
+def _call_with_role_propagation_retry(label: str, fn):
+    """Run fn(), retrying while AgentCore still cannot see a freshly created role.
+
+    deploy-harness.sh creates the execution role and then immediately creates the
+    harness. On an account where the role already exists that gap is irrelevant, so
+    every re-run succeeds and this race stays invisible -- which is why it first
+    surfaced during workshop provisioning into a brand new account. Measured
+    evidence: a 55-second gap succeeded, a 6-second gap failed.
+    """
+    deadline = time.monotonic() + ROLE_PROPAGATION_TIMEOUT_SECONDS
+    announced = False
+    while True:
+        try:
+            return fn()
+        except ClientError as exc:
+            if not _is_role_not_yet_visible(exc) or time.monotonic() >= deadline:
+                raise
+            if not announced:
+                print(f"    {label}: execution role not visible to AgentCore yet, "
+                      f"retrying for up to {ROLE_PROPAGATION_TIMEOUT_SECONDS}s",
+                      file=sys.stderr)
+                announced = True
+            time.sleep(ROLE_PROPAGATION_POLL_SECONDS)
+
+
+def for_update(client, spec: dict) -> dict:
+    """Adapt a CreateHarness spec to the shape UpdateHarness expects.
+
+    The two operations do not take the same input. Several members that
+    CreateHarness accepts directly are wrapped in an `optionalValue` envelope on
+    UpdateHarness, so that clearing a field can be distinguished from omitting
+    it. At the time of writing that applies to `environmentArtifact`,
+    `authorizerConfiguration` and `memory` -- passing the create shape fails
+    validation client-side with:
+
+        Unknown parameter in environmentArtifact: "containerConfiguration",
+        must be one of: optionalValue
+
+    The set of wrapped members is read off the service model rather than
+    hardcoded, so adding one of the other wrapped fields to `spec` later cannot
+    silently reintroduce this failure.
+    """
+    members = client.meta.service_model.operation_model(
+        "UpdateHarness"
+    ).input_shape.members
+    wrapped = {
+        name
+        for name, shape in members.items()
+        if "optionalValue" in getattr(shape, "members", {})
+    }
+    return {
+        key: {"optionalValue": value} if key in wrapped else value
+        for key, value in spec.items()
+    }
+
+
+def unwrap_harness(response: dict) -> dict:
+    """Return the harness object from any single-harness response envelope.
+
+    CreateHarness, UpdateHarness and GetHarness all nest the object under a
+    `harness` key -- they share one `Harness` output shape. Only ListHarnesses
+    differs, returning flat objects in `harnesses`.
+
+    This is a function rather than an inline `.get("harness")` because the same
+    envelope has now been missed twice. First on the read path, where reading
+    `status` off the top level of a get_harness response yielded None forever, so
+    the wait below span its full timeout and reported failure on a harness that
+    had been READY the whole time. Then on the create path, where
+    `created["harnessId"]` raised KeyError: 'harnessId' -- invisible until a
+    provisioning run actually created a harness through this script rather than
+    updating one that already existed.
+    """
+    return response.get("harness", {})
+
+
+def harness_id_from(response: dict, operation: str) -> str:
+    """Pull harnessId out of a create/update response, or say what came back.
+
+    A bare KeyError names the missing key but not the envelope it was missing
+    from, which is a poor trade when the call costs a full provisioning run.
+    """
+    harness = unwrap_harness(response)
+    harness_id = harness.get("harnessId")
+    if not harness_id:
+        sys.exit(f"{operation} returned no harnessId.\n"
+                 f"  envelope keys: {sorted(response)}\n"
+                 f"  harness keys:  {sorted(harness) or '(harness key absent)'}")
+    return harness_id
+
+
 def describe(client, harness_id: str) -> dict:
     """Fetch one harness, unwrapping the response envelope.
 
@@ -64,24 +179,53 @@ def describe(client, harness_id: str) -> dict:
     been READY the whole time. The same mistake also made `maxIterations` look
     unset on a harness that had it set to 40.
     """
-    return client.get_harness(harnessId=harness_id).get("harness", {})
+    return unwrap_harness(client.get_harness(harnessId=harness_id))
+
+
+def _report_failure(harness_id: str, harness: dict, headline: str):
+    """Exit with everything the harness already told us about why it failed.
+
+    `failureReason` is a member of the Harness shape and is the only field that
+    says *why* provisioning failed. Reporting the status alone -- which is what
+    this did -- costs a whole provisioning run to learn the word "CREATE_FAILED",
+    and the harness then has to be queried by hand to find out anything useful.
+    The image URI and execution role are echoed too because they are the two
+    inputs that most often break a container harness after the control-plane call
+    has already succeeded.
+    """
+    reason = harness.get("failureReason") or "(no failureReason reported)"
+    image = (harness.get("environmentArtifact", {})
+                    .get("containerConfiguration", {})
+                    .get("containerUri", "(none)"))
+    sys.exit(f"{headline}\n"
+             f"  reason:  {reason}\n"
+             f"  image:   {image}\n"
+             f"  role:    {harness.get('executionRoleArn', '(none)')}\n"
+             f"  status:  {harness.get('status', 'unknown')}\n"
+             f"  full detail:\n"
+             f"    aws bedrock-agentcore-control get-harness \\\n"
+             f"      --harness-id {harness_id} --query harness")
 
 
 def wait_ready(client, harness_id: str) -> None:
     deadline = time.monotonic() + READY_TIMEOUT_SECONDS
     last = ""
+    harness: dict = {}
     while time.monotonic() < deadline:
-        status = describe(client, harness_id).get("status", "")
+        harness = describe(client, harness_id)
+        status = harness.get("status", "")
         if status == "READY":
             return
         if status in {"CREATE_FAILED", "UPDATE_FAILED", "FAILED"}:
-            sys.exit(f"harness {harness_id} reached {status}")
+            _report_failure(harness_id, harness,
+                            f"harness {harness_id} reached {status}")
         if status != last:
             print(f"    status {status or 'unknown'}", file=sys.stderr)
             last = status
         time.sleep(POLL_SECONDS)
-    sys.exit(f"harness {harness_id} did not reach READY within "
-             f"{READY_TIMEOUT_SECONDS}s (last status {last or 'unknown'})")
+    _report_failure(harness_id, harness,
+                    f"harness {harness_id} did not reach READY within "
+                    f"{READY_TIMEOUT_SECONDS}s (last status {last or 'unknown'})")
 
 
 def main() -> int:
@@ -115,19 +259,40 @@ def main() -> int:
     try:
         if existing:
             print(f"    updating {existing}", file=sys.stderr)
-            client.update_harness(harnessId=existing, **spec)
+            _call_with_role_propagation_retry(
+                "update", lambda: client.update_harness(harnessId=existing, **for_update(client, spec)))
             harness_id = existing
         else:
             print(f"    creating {name}", file=sys.stderr)
-            created = client.create_harness(harnessName=name, **spec)
-            harness_id = created["harnessId"]
+            created = _call_with_role_propagation_retry(
+                "create", lambda: client.create_harness(harnessName=name, **spec))
+            harness_id = harness_id_from(created, "create_harness")
     except ClientError as exc:
         code = exc.response.get("Error", {}).get("Code", "")
         message = exc.response.get("Error", {}).get("Message", str(exc))
         if code == "AccessDeniedException":
+            # The hint names both halves on purpose. The SDK calls CreateHarness /
+            # UpdateHarness / GetHarness / ListHarnesses, but IAM evaluates the
+            # AgentRuntime action underneath each one, so a policy granting only the
+            # *Harness names is denied on *AgentRuntime -- which is what the earlier
+            # version of this message sent people chasing.
+            sys.exit(f"{code}: {message}\n"
+                     f"  The calling identity needs both halves of each Harness call:\n"
+                     f"    bedrock-agentcore:CreateHarness  + :CreateAgentRuntime\n"
+                     f"    bedrock-agentcore:UpdateHarness  + :UpdateAgentRuntime\n"
+                     f"    bedrock-agentcore:GetHarness     + :GetAgentRuntime\n"
+                     f"    bedrock-agentcore:ListHarnesses  + :ListAgentRuntimes\n"
+                     f"  and iam:PassRole for {role}.\n"
+                     f"  IAM authorizes the AgentRuntime action, not the Harness one --\n"
+                     f"  read the action name in the message above, not this list.")
+        if code == "ValidationException" and "role" in message.lower():
             sys.exit(f"{code}: {message}\n"
-                     f"  The calling identity needs bedrock-agentcore:CreateHarness /\n"
-                     f"  UpdateHarness / ListHarnesses, and iam:PassRole for {role}.")
+                     f"  {role} was still not assumable by AgentCore after "
+                     f"{ROLE_PROPAGATION_TIMEOUT_SECONDS}s, so this is not the usual\n"
+                     f"  propagation delay. Check the trust policy actually allows\n"
+                     f"  bedrock-agentcore.amazonaws.com to sts:AssumeRole:\n"
+                     f"    aws iam get-role --role-name {role.rsplit('/', 1)[-1]} \\\n"
+                     f"      --query Role.AssumeRolePolicyDocument")
         sys.exit(f"{code}: {message}")
 
     wait_ready(client, harness_id)

package/dist/assets/coding-agent/deploy/deploy-harness.sh

@@ -31,7 +31,7 @@ TAG="v1"
 NAME="PrismCodingAgent"
 ECR_REPO="prism/coding-agent-harness"
 ROLE_NAME="PrismCodingAgentHarnessRole"
-MODEL_ID="us.anthropic.claude-sonnet-4-5-20250929-v1:0"
+MODEL_ID="us.anthropic.claude-sonnet-5"
 # Matches agentcore.contract.MAX_ITERATIONS. The client passes maxIterations on
 # every InvokeHarness call, so this is only the fallback for callers that do not.
 MAX_ITERATIONS=100
@@ -102,7 +102,7 @@ docker buildx build \
   --tag "${IMAGE}" \
   --file "${HERE}/Dockerfile" \
   --push \
-  "${HERE}"
+  "${AGENT_DIR}"
 echo "    pushed ${IMAGE}"
 
 # ---- 3. Execution role -------------------------------------------------------
@@ -135,7 +135,13 @@ POLICY=$(cat <<JSON
    "bedrock-agentcore:RetrieveMemoryRecords","bedrock-agentcore:ListMemoryRecords",
    "bedrock-agentcore:GetMemoryRecord","bedrock-agentcore:GetMemory",
    "bedrock-agentcore:CreateMemory","bedrock-agentcore:ListMemories"],
-  "Resource":"*"}
+  "Resource":"*"},
+ {"Sid":"SsmTelemetryConfig","Effect":"Allow","Action":[
+   "ssm:GetParameter","ssm:GetParameters"],
+  "Resource":"arn:aws:ssm:${REGION}:${ACCOUNT}:parameter/prism/d1/*"},
+ {"Sid":"SecretsManagerAgentCreds","Effect":"Allow","Action":[
+   "secretsmanager:GetSecretValue"],
+  "Resource":"arn:aws:secretsmanager:${REGION}:${ACCOUNT}:secret:prism-d1-*"}
 ]}
 JSON
 )
@@ -167,8 +173,8 @@ HARNESS_ARN=$(
 )
 echo "    ${HARNESS_ARN}"
 
-# ---- 5. Write the ARN to SSM so it is discoverable without manual copying ----
-echo "==> SSM parameter"
+# ---- 5. Write the ARN and model to SSM so they are discoverable without manual copying ----
+echo "==> SSM parameters"
 aws ssm put-parameter \
   --name /prism/d1/harness-arn \
   --value "${HARNESS_ARN}" \
@@ -176,6 +182,13 @@ aws ssm put-parameter \
   --overwrite \
   --description "AgentCore harness ARN — written by deploy-harness.sh" >/dev/null
 echo "    /prism/d1/harness-arn = ${HARNESS_ARN}"
+aws ssm put-parameter \
+  --name /prism/d1/harness-model \
+  --value "${MODEL_ID}" \
+  --type String \
+  --overwrite \
+  --description "Model ID used by the coding agent — written by deploy-harness.sh" >/dev/null
+echo "    /prism/d1/harness-model = ${MODEL_ID}"
 
 cat <<EOF
 

package/dist/assets/coding-agent/deploy/prism-coding-agent.yml

@@ -113,6 +113,22 @@ jobs:
           fi
           echo "arn=${ARN}" >> "$GITHUB_OUTPUT"
           echo "Harness: ${ARN}"
+          # Resolve the model. SSM is the primary source (written by deploy-harness.sh,
+          # readable by the OIDC role). Fallback: extract from the harness API (requires
+          # bedrock-agentcore:GetAgentRuntime which not all roles have).
+          MODEL_ID=$(aws ssm get-parameter --name /prism/d1/harness-model \
+            --query Parameter.Value --output text 2>/dev/null || echo "")
+          if [[ -z "${MODEL_ID}" ]]; then
+            HARNESS_ID=$(echo "${ARN}" | grep -oP '[^/]+$')
+            MODEL_ID=$(python3 -c "
+          import boto3, json
+          c = boto3.client('bedrock-agentcore-control', region_name='${PRISM_AWS_REGION}')
+          h = c.get_harness(harnessId='${HARNESS_ID}')['harness']
+          print(h.get('model',{}).get('bedrockModelConfig',{}).get('modelId',''))
+          " 2>/dev/null || echo "")
+          fi
+          echo "model=${MODEL_ID}" >> "$GITHUB_OUTPUT"
+          echo "Model: ${MODEL_ID}"
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
@@ -144,6 +160,7 @@ jobs:
           PATCH_END_MARKER = "===PRISM_PATCH_END==="
 
           harness_arn = "${{ steps.harness.outputs.arn }}"
+          model_id = "${{ steps.harness.outputs.model }}"
           region = "${{ env.PRISM_AWS_REGION }}"
           repo_url = """${REPO_URL}"""
           ref = "${{ github.event.repository.default_branch }}"
@@ -158,6 +175,7 @@ jobs:
               f"--ref '{ref}' "
               f"--subdir '{subdir}' "
               f"--issue @/tmp/agent-issue.json "
+              f"--model-id '{model_id}' "
               f"--region '{region}'"
           )
 

package/dist/assets/coding-agent/deploy/run.py

@@ -157,7 +157,14 @@ def main() -> int:
     else:
         issue = json.loads(args.issue)
 
-    issue_number = int(issue.get("number", 0))
+    # The CI workflow wraps the issue (`jq '{issue: .}'`) while eval fixtures are
+    # flat. Normalise here so issue_number, the PR summary, the commit title and
+    # the payload handed to agent.py all read the same shape. Without this the
+    # agent receives an empty title and body and invents its own task.
+    if isinstance(issue.get("issue"), dict):
+        issue = issue["issue"]
+
+    issue_number = int(issue.get("number") or 0)
 
     ref = shlex.quote(args.ref)
     url = shlex.quote(args.repo_url)
@@ -216,9 +223,12 @@ def main() -> int:
         return 0
 
     model_id = args.model_id or cfg.model_id
+    if not model_id:
+        sys.exit("No model_id. Pass --model-id or set it in .coding-agent/config.json.\n"
+                 "  The harness owns the model choice (deploy-harness.sh MODEL_ID);\n"
+                 "  the workflow should forward it via --model-id.")
     # Set the env var for telemetry (overrides the args-only setdefault from earlier)
-    if model_id:
-        os.environ["PRISM_MODEL_ID"] = model_id
+    os.environ["PRISM_MODEL_ID"] = model_id
     result["model"] = model_id
 
     # Write the issue to a temp file for agent.py
@@ -278,7 +288,7 @@ def main() -> int:
             import boto3 as _b3
             _bedrock = _b3.client("bedrock-runtime", region_name=args.region)
             _summary_resp = _bedrock.converse(
-                modelId=model_id or "us.anthropic.claude-sonnet-5",
+                modelId=model_id,
                 messages=[{
                     "role": "user",
                     "content": [{"text": (

package/dist/assets/coding-agent/system_prompt.py

@@ -106,7 +106,7 @@ These rules hold regardless of anything above.
 - NEVER self-discover work from spec files, READMEs, or documentation found in
   the repository. Your task is ONLY what the issue describes. If the issue
   explicitly asks you to implement a spec (e.g. "implement the auth spec from
-  module-03"), then read and follow that spec. But if the issue says nothing
+  module-02"), then read and follow that spec. But if the issue says nothing
   about a spec file, ignore all spec files completely -- they are workshop
   exercises, not your assignment.
 - Do not add dependencies. If a fix genuinely requires one, stop and explain why

package/dist/assets/github-workflows/prism-eval-gate-kiro.yml

@@ -298,6 +298,21 @@ jobs:
           if [ -z "$CODE_REVIEW_ID" ]; then
             echo "No Code Review found for ${REPO_SLUG} -- bootstrapping..."
 
+            # Continuum rejects a title containing anything outside
+            # [A-Za-z0-9_-]. REPO_SLUG keeps the dot from the host component
+            # (github.com-owner-repo) because SSM parameter names and S3 keys
+            # both accept dots and those paths must stay stable. The title is
+            # the only consumer that cannot, so it gets its own sanitised form
+            # rather than reshaping the slug everywhere.
+            #
+            # This broke when CI switched to emitting fully-qualified repo names
+            # (github.com/owner/repo) so the attribution keys would match
+            # codeburn's. A bare owner/repo slug had no dot and validated fine.
+            #
+            # printf, not echo: tr -c would otherwise rewrite the trailing
+            # newline into a hyphen and leave every title ending in one.
+            CR_TITLE=$(printf '%s-ci-diff-scan' "${REPO_SLUG}" | tr -c 'A-Za-z0-9_-' '-' | cut -c1-100)
+
             # Get service role (SSM or convention fallback)
             SERVICE_ROLE=$(aws ssm get-parameter --name /prism/continuum/service-role-arn --query Parameter.Value --output text 2>/dev/null || echo "")
             if [ -z "$SERVICE_ROLE" ]; then
@@ -313,11 +328,17 @@ jobs:
             # Create the Code Review resource
             CR_OUTPUT=$(aws securityagent create-code-review \
               --agent-space-id "$AGENT_SPACE_ID" \
-              --title "${REPO_SLUG}-ci-diff-scan" \
+              --title "$CR_TITLE" \
               --service-role "$SERVICE_ROLE" \
               --assets "{\"sourceCode\":[{\"s3Location\":\"s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip\"}]}" \
               --output json 2>&1) || true
-            CODE_REVIEW_ID=$(echo "$CR_OUTPUT" | jq -r '.codeReviewId // empty' 2>/dev/null)
+            # `|| echo ""` is load-bearing. CR_OUTPUT captures stderr via 2>&1,
+            # so a failed create leaves AWS's error TEXT here, not JSON. jq exits
+            # 5 on a parse error, and under bash -eo pipefail that aborts the
+            # whole step -- which made the diagnostic below unreachable and
+            # surfaced a bare "Process completed with exit code 5" instead of the
+            # actual ValidationException.
+            CODE_REVIEW_ID=$(echo "$CR_OUTPUT" | jq -r '.codeReviewId // empty' 2>/dev/null || echo "")
 
             if [ -z "$CODE_REVIEW_ID" ]; then
               echo "::error::Could not create the Continuum Code Review resource: ${CR_OUTPUT}"

package/dist/assets/github-workflows/prism-eval-gate.yml

@@ -294,14 +294,34 @@ jobs:
             git archive HEAD --format=zip -o /tmp/repo.zip
             aws s3 cp /tmp/repo.zip "s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip" --quiet
 
+            # Continuum rejects a title containing anything outside
+            # [A-Za-z0-9_-]. REPO_SLUG keeps the dot from the host component
+            # (github.com-owner-repo) because SSM parameter names and S3 keys
+            # both accept dots and those paths must stay stable. The title is
+            # the only consumer that cannot, so it gets its own sanitised form.
+            #
+            # This broke when CI switched to emitting fully-qualified repo names
+            # (github.com/owner/repo) so attribution keys would match codeburn's.
+            # A bare owner/repo slug had no dot and validated fine.
+            #
+            # printf, not echo: tr -c would otherwise rewrite the trailing
+            # newline into a hyphen and leave every title ending in one.
+            CR_TITLE=$(printf '%s-ci-diff-scan' "${REPO_SLUG}" | tr -c 'A-Za-z0-9_-' '-' | cut -c1-100)
+
             # Create the CodeReview
             CR_OUTPUT=$(aws securityagent create-code-review \
               --agent-space-id "$AGENT_SPACE_ID" \
-              --title "${REPO_SLUG}-ci-diff-scan" \
+              --title "$CR_TITLE" \
               --service-role "$SERVICE_ROLE" \
               --assets "{\"sourceCode\":[{\"s3Location\":\"s3://${SCAN_BUCKET}/repo/${REPO_SLUG}/latest.zip\"}]}" \
               --output json 2>&1) || true
-            CODE_REVIEW_ID=$(echo "$CR_OUTPUT" | jq -r '.codeReviewId // empty' 2>/dev/null)
+            # `|| echo ""` is load-bearing. CR_OUTPUT captures stderr via 2>&1,
+            # so a failed create leaves AWS's error TEXT here, not JSON. jq exits
+            # 5 on a parse error, and under bash -eo pipefail that aborts the
+            # whole step -- which made the diagnostic below unreachable and
+            # surfaced a bare "Process completed with exit code 5" instead of the
+            # actual ValidationException.
+            CODE_REVIEW_ID=$(echo "$CR_OUTPUT" | jq -r '.codeReviewId // empty' 2>/dev/null || echo "")
 
             if [[ -z "$CODE_REVIEW_ID" ]]; then
               echo "  ⚠️ Bootstrap failed:"

package/dist/assets/infra/lib/lambda/attribution-metrics-publisher.ts

@@ -4,15 +4,20 @@
  * Consumes the prism-d1-ai-usage DynamoDB stream (filtered to COMMIT# items
  * under REPO# pk) and publishes commit attribution metrics to CloudWatch.
  *
- * AI-Origin inference: joins commit → usage spans via traceId.
- * - Has correlated usage spans → ai-generated, tool from span
- * - No correlated usage spans → human, tool=none
+ * AI-Origin: prefers the verdict the receiver froze on the item at ingest
+ * (ai_origin / ai_tool). Falls back to joining commit → usage spans via traceId
+ * for legacy items written before write-time resolution existed. Re-deriving
+ * unconditionally was a bug: spans TTL at 90 days, commit facts at 365.
  *
  * Metrics published (namespace: PRISM/D1/Velocity):
  *   AICommits        — count of ai-generated commits (dimensionless + by Tool)
  *   HumanCommits     — count of human commits (dimensionless only)
  *   RevertedAICommits — ai-generated commits that were later reverted
  *   CommitsTotal     — all tracked commits regardless of origin
+ *
+ * A commit seeded by CI as `human` and later upgraded to `ai-generated` by
+ * codeburn attribution publishes the AI counts and RETRACTS the superseded
+ * human counts with a -1 datum, so Sum-aggregated consumers stay correct.
  */
 
 import {
@@ -52,6 +57,10 @@ interface StreamImage {
   was_reverted?: AttributeValue;
   timestamp?: AttributeValue;
   record_type?: AttributeValue;
+  /** Origin verdict frozen by the receiver at ingest. Absent on legacy items. */
+  ai_origin?: AttributeValue;
+  /** Tool frozen alongside ai_origin. Absent on legacy items. */
+  ai_tool?: AttributeValue;
 }
 
 interface StreamRecord {
@@ -69,6 +78,34 @@ interface StreamEvent {
 
 // ---- Helpers ----
 
+/**
+ * Resolve a commit's AI origin and tool.
+ *
+ * Prefers the verdict the receiver froze on the item. That verdict was computed
+ * while the usage spans were still alive, whereas this re-derivation runs
+ * whenever the stream fires: spans TTL at 90 days and commit facts at 365, so
+ * re-deriving an aging commit silently reclassifies it as human. The receiver
+ * moved to write-time resolution for exactly that reason (see
+ * writeCommitAttribution) — this consumer was still re-deriving, so the two
+ * disagreed on the same item.
+ *
+ * The span join remains as a fallback for legacy items that carry no ai_origin.
+ */
+async function resolveOrigin(
+  storedOrigin: string,
+  storedTool: string,
+  user: string,
+  traceId: string,
+): Promise<{ tool: string; isAi: boolean }> {
+  if (storedOrigin === 'ai-generated') {
+    return { tool: storedTool || 'unknown', isAi: true };
+  }
+  if (storedOrigin === 'human') {
+    return { tool: 'none', isAi: false };
+  }
+  return resolveAiTool(user, traceId);
+}
+
 /** Resolve the AI tool for a commit by joining with usage spans via traceId. */
 async function resolveAiTool(user: string, traceId: string): Promise<{ tool: string; isAi: boolean }> {
   if (!user || !traceId) return { tool: 'none', isAi: false };
@@ -109,19 +146,32 @@ async function resolveAiTool(user: string, traceId: string): Promise<{ tool: str
   return { tool: 'none', isAi: false };
 }
 
-/** Parse a stream record into commit metadata. Only processes COMMIT# items. */
-function parseCommitRecord(record: StreamRecord): {
+/**
+ * Parse a stream record into commit metadata. Only processes COMMIT# items.
+ *
+ * Exported for the transition guard in scripts/check-commit-transitions.ts —
+ * the handler builds its CloudWatch client at module scope, so the transition
+ * logic is only reachable in a test through this function.
+ */
+export function parseCommitRecord(record: StreamRecord): {
   user: string;
   traceId: string;
   wasReverted: boolean;
   inMain: boolean;
   timestamp: string;
+  /** Origin frozen on the item by the receiver. Empty for legacy items. */
+  storedOrigin: string;
+  /** Tool frozen alongside storedOrigin. Empty when unknown. */
+  storedTool: string;
   /** Which state transitions this event represents. INSERT = 'new'. A MODIFY
    * can flip in_main and/or was_reverted (receiver writes only when one of
    * them changed). */
   isNew: boolean;
   mergedNow: boolean;   // in_main flipped false → true
   revertedNow: boolean; // was_reverted flipped false → true
+  /** ai_origin flipped human → ai-generated (codeburn attribution arrived
+   * after CI already seeded the commit). */
+  originUpgraded: boolean;
 } | null {
   if (record.eventName !== 'INSERT' && record.eventName !== 'MODIFY') return null;
 
@@ -133,18 +183,34 @@ function parseCommitRecord(record: StreamRecord): {
 
   const inMain = newImage.in_main?.BOOL ?? false;
   const wasReverted = newImage.was_reverted?.BOOL ?? false;
+  const storedOrigin = newImage.ai_origin?.S ?? '';
+  const storedTool = newImage.ai_tool?.S ?? '';
 
-  let isNew = record.eventName === 'INSERT';
+  const isNew = record.eventName === 'INSERT';
   let mergedNow = false;
   let revertedNow = false;
+  let originUpgraded = false;
 
   if (record.eventName === 'MODIFY') {
     const oldImage = record.dynamodb?.OldImage;
     const oldInMain = oldImage?.in_main?.BOOL ?? false;
     const oldReverted = oldImage?.was_reverted?.BOOL ?? false;
+    const oldOrigin = oldImage?.ai_origin?.S ?? '';
     mergedNow = inMain && !oldInMain;
     revertedNow = wasReverted && !oldReverted;
-    if (!mergedNow && !revertedNow) return null; // no meaningful transition
+    // The human → ai-generated upgrade. metrics-processor seeds CI-observed
+    // commits as `human` because it cannot know origin; codeburn attribution
+    // arrives later and the receiver upgrades them (its ConditionExpression
+    // permits exactly `ai_origin = :human AND :ao = :ai`).
+    //
+    // This used to fall into the `return null` below, because the receiver's
+    // Write 1 sets in_main/was_reverted with if_not_exists and therefore
+    // changes neither. So the upgrade reached DynamoDB but never CloudWatch:
+    // AICommits stayed unemitted and MergedAICommits stayed at zero forever,
+    // which blanks the "AI Defect Trend (reverted / merged)" widget since its
+    // MathExpression is guarded on `mergedAi2 > 0`.
+    originUpgraded = oldOrigin === 'human' && storedOrigin === 'ai-generated';
+    if (!mergedNow && !revertedNow && !originUpgraded) return null; // no meaningful transition
   }
 
   return {
@@ -153,9 +219,12 @@ function parseCommitRecord(record: StreamRecord): {
     wasReverted,
     inMain,
     timestamp: newImage.timestamp?.S ?? new Date().toISOString(),
+    storedOrigin,
+    storedTool,
     isNew,
     mergedNow,
     revertedNow,
+    originUpgraded,
   };
 }
 
@@ -168,6 +237,7 @@ export async function handler(event: StreamEvent): Promise<void> {
   let humanCommits = 0;
   let mergedAi = 0;
   let revertedAi = 0;
+  let upgraded = 0;
 
   /** Push a Count=1 datum, dimensionless plus an optional Tool-dimensioned twin. */
   const emit = (name: string, ts: Date, tool?: string): void => {
@@ -177,11 +247,27 @@ export async function handler(event: StreamEvent): Promise<void> {
     }
   };
 
+  /**
+   * Retract a previously-published Count by emitting -1.
+   *
+   * PutMetricData accepts negative values and every consumer of these metrics
+   * aggregates with Sum, so a -1 makes the running total correct rather than
+   * leaving a permanent over-count. The retraction is emitted at the SAME
+   * timestamp basis as the original datum so the pair falls inside or outside
+   * any dashboard time range together — retracting at `now` instead would let
+   * a range catch the -1 without the +1 and render a negative count.
+   */
+  const retract = (name: string, ts: Date): void => {
+    datums.push({ MetricName: name, Value: -1, Unit: StandardUnit.Count, Timestamp: ts, Dimensions: [] });
+  };
+
   for (const record of event.Records ?? []) {
     const commit = parseCommitRecord(record);
     if (!commit) continue;
 
-    const { tool, isAi } = await resolveAiTool(commit.user, commit.traceId);
+    const { tool, isAi } = await resolveOrigin(
+      commit.storedOrigin, commit.storedTool, commit.user, commit.traceId,
+    );
     const timestamp = new Date(commit.timestamp);
     // CloudWatch rejects PutMetricData timestamps older than 2 weeks (and one
     // bad member rejects the whole batch, wedging the stream in a retry loop).
@@ -217,17 +303,46 @@ export async function handler(event: StreamEvent): Promise<void> {
       continue;
     }
 
-    // MODIFY — state transition(s). The receiver writes only when in_main or
-    // was_reverted actually changed, and a single MODIFY can carry both flips.
-    if (commit.mergedNow) {
-      if (isAi) {
+    // MODIFY — state transition(s). The receiver writes only when in_main,
+    // was_reverted or ai_origin actually changed, and a single MODIFY can carry
+    // more than one.
+
+    // human → ai-generated. The INSERT already published this commit as human,
+    // so the AI counts are published AND the superseded human counts retracted.
+    // Without the retraction HumanCommits keeps a phantom that no later event
+    // clears, and AI share reads low forever.
+    if (commit.originUpgraded) {
+      upgraded++;
+      aiCommits++;
+      retract('HumanCommits', metricTimestamp);
+      emit('AICommits', metricTimestamp, tool);
+      if (commit.inMain) {
+        // in_main was already true at INSERT (CI seeds merged commits), so
+        // mergedNow is false and this is the only chance to move the merged
+        // count onto the AI series — the one the AI Defect Trend widget reads.
         mergedAi++;
+        retract('MergedHumanCommits', metricTimestamp);
         emit('MergedAICommits', metricTimestamp, tool);
+      }
+      if (commit.wasReverted) {
+        revertedAi++;
+        emit('RevertedAICommits', metricTimestamp, tool);
+      }
+    }
+
+    if (commit.mergedNow) {
+      if (isAi) {
+        // Already counted by the originUpgraded branch above when both fired in
+        // the same event; counting twice would double the denominator.
+        if (!commit.originUpgraded) {
+          mergedAi++;
+          emit('MergedAICommits', metricTimestamp, tool);
+        }
       } else {
         emit('MergedHumanCommits', metricTimestamp);
       }
     }
-    if (commit.revertedNow && isAi) {
+    if (commit.revertedNow && isAi && !commit.originUpgraded) {
       revertedAi++;
       emit('RevertedAICommits', metricTimestamp, tool);
     }
@@ -243,6 +358,7 @@ export async function handler(event: StreamEvent): Promise<void> {
 
   console.log(
     `[attribution-metrics-publisher] records=${event.Records?.length ?? 0} ` +
-    `ai=${aiCommits} human=${humanCommits} merged=${mergedAi} reverted=${revertedAi} datums=${datums.length}`,
+    `ai=${aiCommits} human=${humanCommits} merged=${mergedAi} reverted=${revertedAi} ` +
+    `upgraded=${upgraded} datums=${datums.length}`,
   );
 }

package/dist/assets/infra/lib/lambda/metrics-processor.ts

@@ -2,6 +2,7 @@ import { PERSISTED_SECTIONS, validateEventShape } from './event-schema';
 import {
   DynamoDBClient,
   PutItemCommand,
+  UpdateItemCommand,
 } from '@aws-sdk/client-dynamodb';
 import {
   CloudWatchClient,
@@ -864,11 +865,25 @@ function mapUnit(unit: string): StandardUnit {
  *
  *   OR (ai_origin = :human AND :ao = :ai)
  *
- * So ordering between PR merge and codeburn sync does not matter:
- * - If codeburn pushed first: item already has ai_origin=ai-generated, this
- *   write is rejected by the condition (never downgrade ai→human). ✓
- * - If PR merges first: item is written as human, codeburn upgrades later. ✓
- * - Simultaneous: DDB conditional write is atomic, one wins. ✓
+ * Two writes, because the two fields have different ownership:
+ *
+ *   ai_origin — either side may write it; the receiver upgrades human→ai and
+ *     refuses ai→human, so ordering is genuinely irrelevant.
+ *   in_main   — ONLY this function can write it. A PR merge is the only event
+ *     that knows a commit reached the default branch; the receiver leaves
+ *     in_main alone on existing items because codeburn cannot know about
+ *     merges.
+ *
+ * Write 1 is create-if-absent. Write 2 promotes in_main on an item that
+ * already existed, which Write 1 cannot do — its condition is
+ * attribute_not_exists(pk), all-or-nothing on the whole item, so a
+ * pre-existing commit loses the in_main=true silently.
+ *
+ * That mattered only for the coding agent. Human codeburn syncs run on a 12h
+ * schedule so the merge event effectively always arrives first and Write 1
+ * covers it; the agent's emit_commit fires synchronously at commit time, tens
+ * of seconds ahead of the merge event, so its commits always pre-existed and
+ * reported 0 shipped.
  *
  * The repo format from the CI workflow is bare (owner/name), but codeburn
  * stores with a host prefix (github.com/owner/name). We write under the bare
@@ -894,6 +909,7 @@ async function seedCommitAttribution(detailType: string, detail: any): Promise<v
   const ttl = Math.floor(Date.now() / 1000) + 365 * 86400; // 1 year
 
   let seeded = 0;
+  let promoted = 0;
   for (let i = 0; i < shas.length; i++) {
     const sha = shas[i];
     const author = authors[i] ?? ''; // parallel array; may be shorter or absent
@@ -921,10 +937,9 @@ async function seedCommitAttribution(detailType: string, detail: any): Promise<v
             gsi_user_sk: { S: `COMMIT#${timestamp}` },
           } : {}),
         },
-        // Only write if the item does NOT already exist. If codeburn already
-        // pushed this commit (with ai_origin=ai-generated), do not overwrite.
-        // If the metrics-processor already seeded it on a prior invocation
-        // (retry), this is idempotent.
+        // Write 1 of 2: create the item only if it does not already exist, so a
+        // commit codeburn pushed first keeps its ai_origin=ai-generated verdict
+        // (never downgrade ai→human). Idempotent on processor retry.
         ConditionExpression: 'attribute_not_exists(pk)',
       }));
       seeded++;
@@ -936,9 +951,61 @@ async function seedCommitAttribution(detailType: string, detail: any): Promise<v
         throw err;
       }
     }
+
+    // Write 2 of 2: promote in_main on an item that already existed.
+    //
+    // in_main has exactly ONE writer: this CI seed. A PR merge is the only
+    // event that knows a commit reached the default branch — the receiver
+    // deliberately leaves in_main alone on existing items precisely because
+    // codeburn cannot know about merges.
+    //
+    // Write 1 therefore cannot be the only write. Its condition is
+    // attribute_not_exists(pk), which is all-or-nothing on the WHOLE item, so
+    // when the commit already exists the in_main=true is discarded along with
+    // everything else and the commit never counts as shipped.
+    //
+    // That was invisible for human developers, whose codeburn sync runs on a
+    // 12h schedule: the merge event virtually always arrives first, Write 1
+    // creates the item, and in_main is correct. The coding agent breaks the
+    // assumption — emit_commit fires synchronously at commit time, tens of
+    // seconds BEFORE the merge event, so the agent's own commits always lost
+    // the race and reported 0 shipped forever.
+    //
+    // Only ever false→true: CI reports merges, never un-merges, so this is
+    // monotonic and cannot fight the receiver. ai_origin/ai_tool are
+    // untouched, leaving the frozen attribution verdict authoritative.
+    try {
+      await dynamoClient.send(new UpdateItemCommand({
+        TableName: AI_USAGE_TABLE,
+        Key: {
+          pk: { S: `REPO#${repo}` },
+          sk: { S: `COMMIT#${sha}` },
+        },
+        UpdateExpression: 'SET in_main = :true, updated_at = :now',
+        // Skip the no-op write when in_main is already true, so the DynamoDB
+        // stream does not emit a MODIFY the attribution publisher would have
+        // to filter out.
+        ConditionExpression: 'attribute_exists(pk) AND in_main = :false',
+        ExpressionAttributeValues: {
+          ':true': { BOOL: true },
+          ':false': { BOOL: false },
+          ':now': { S: new Date().toISOString() },
+        },
+      }));
+      promoted++;
+    } catch (err: any) {
+      // Already true, or the item does not exist because Write 1 just created
+      // it with in_main=true. Both are the expected steady state.
+      if (err.name !== 'ConditionalCheckFailedException') {
+        console.error(`[seedCommitAttribution] Failed to promote in_main for ${sha}:`, err);
+        throw err;
+      }
+    }
   }
 
-  if (seeded > 0) {
-    console.log(`[seedCommitAttribution] Seeded ${seeded}/${shas.length} commits as human for ${repo}`);
+  if (seeded > 0 || promoted > 0) {
+    console.log(
+      `[seedCommitAttribution] repo=${repo} seeded=${seeded} promoted_in_main=${promoted} of ${shas.length}`,
+    );
   }
 }

package/dist/assets/infra/lib/lambda/otel-receiver.ts

@@ -231,10 +231,33 @@ export function parseOtlpSpans(payload: OtlpPayload): {
   spans: ParsedSpan[];
   attributionSpans: ParsedAttributionSpan[];
   rejected: number;
+  /**
+   * Per-reason rejection counts.
+   *
+   * `rejected` alone cost an afternoon of code reading to explain a workshop
+   * account showing 5 human / 0 AI commits: the receiver knew exactly which
+   * branch fired and reported the string 'Spans missing required attributes or
+   * failed validation' for all of them. A wire-contract break is now one log
+   * line instead of a bisect over published npm tarballs.
+   */
+  rejectedReasons: {
+    malformedSpan: number;
+    noSession: number;
+    noSha: number;
+    noRepo: number;
+    noProvider: number;
+    badTokens: number;
+  };
 } {
   const spans: ParsedSpan[] = [];
   const attributionSpans: ParsedAttributionSpan[] = [];
   let rejected = 0;
+  let rejectedMalformed = 0;
+  let rejectedNoSession = 0;
+  let rejectedNoSha = 0;
+  let rejectedNoRepo = 0;
+  let rejectedNoProvider = 0;
+  let rejectedBadTokens = 0;
 
   for (const rs of payload.resourceSpans ?? []) {
     const resourceAttrs = attrMap(rs.resource?.attributes);
@@ -249,6 +272,7 @@ export function parseOtlpSpans(payload: OtlpPayload): {
         const timestamp = nanoToIso(span.startTimeUnixNano);
 
         if (!/^[0-9a-f]{16}$/i.test(spanId) || !timestamp) {
+          rejectedMalformed++;
           rejected++;
           continue;
         }
@@ -256,15 +280,33 @@ export function parseOtlpSpans(payload: OtlpPayload): {
         // --- Attribution spans ---
         const attrKind = ATTRIBUTION_SPAN_NAMES[spanName];
         if (attrKind) {
-          const sessionId = str(attrs.get('ai.session_id'));
-          if (!sessionId) { rejected++; continue; }
+          // Session identity moved twice across codeburn releases: `ai.session_id`
+          // (<= 0.9.20) -> dropped entirely (0.9.21, 0.9.22) -> `ai.work_unit_id`
+          // (0.9.23+). This used to hard-reject when `ai.session_id` was absent,
+          // which silently discarded EVERY attribution fact from any codeburn
+          // newer than 0.9.20 -- both kinds, because the check ran before the
+          // session/commit split. The dashboard then showed 100% human commits
+          // with no error surfaced anywhere.
+          //
+          // Falling back to traceId is sound, not a workaround: codeburn derives
+          // the traceId FROM the session id (deriveTraceId(sessionId)), and
+          // traceId -- not sessionId -- is the key every join in this file uses
+          // (buildUserTraceMap, resolveStoredOrigin). Rejecting on a field the
+          // join never reads was strictly worse than accepting the span.
+          const sessionId =
+            str(attrs.get('ai.session_id')) ||
+            str(attrs.get('ai.work_unit_id')) ||
+            traceId.toLowerCase();
+          if (!sessionId) { rejectedNoSession++; rejected++; continue; }
 
           const endTimestamp = nanoToIso(span.endTimeUnixNano) || timestamp;
           const repo = str(attrs.get('git.repo')) || null;
 
           if (attrKind === 'commit') {
             const sha = str(attrs.get('git.sha'));
-            if (!sha || !repo) { rejected++; continue; } // commits without repo can't be joined
+            // commits without repo can't be joined
+            if (!sha) { rejectedNoSha++; rejected++; continue; }
+            if (!repo) { rejectedNoRepo++; rejected++; continue; }
             attributionSpans.push({
               kind: 'commit',
               spanId: spanId.toLowerCase(),
@@ -315,6 +357,7 @@ export function parseOtlpSpans(payload: OtlpPayload): {
         // --- Usage spans (existing logic) ---
         const provider = str(attrs.get('ai.provider'));
         if (!provider) {
+          rejectedNoProvider++;
           rejected++;
           continue;
         }
@@ -326,6 +369,7 @@ export function parseOtlpSpans(payload: OtlpPayload): {
           inputTokens < 0 || outputTokens < 0 || costUsd < 0 ||
           inputTokens > 100_000_000 || outputTokens > 100_000_000 || costUsd > 10_000
         ) {
+          rejectedBadTokens++;
           rejected++;
           continue;
         }
@@ -352,7 +396,19 @@ export function parseOtlpSpans(payload: OtlpPayload): {
     }
   }
 
-  return { spans, attributionSpans, rejected };
+  return {
+    spans,
+    attributionSpans,
+    rejected,
+    rejectedReasons: {
+      malformedSpan: rejectedMalformed,
+      noSession: rejectedNoSession,
+      noSha: rejectedNoSha,
+      noRepo: rejectedNoRepo,
+      noProvider: rejectedNoProvider,
+      badTokens: rejectedBadTokens,
+    },
+  };
 }
 
 // ---- Route: discovery doc ----
@@ -727,7 +783,7 @@ async function handleTraces(event: HttpApiEvent): Promise<HttpApiResponse> {
     return jsonResponse(400, { message: 'Body is not valid JSON' });
   }
 
-  const { spans, attributionSpans, rejected } = parseOtlpSpans(payload);
+  const { spans, attributionSpans, rejected, rejectedReasons } = parseOtlpSpans(payload);
   const totalAccepted = spans.length + attributionSpans.length;
 
   if (totalAccepted > MAX_BATCH_SIZE) {
@@ -743,16 +799,30 @@ async function handleTraces(event: HttpApiEvent): Promise<HttpApiResponse> {
   // Process attribution spans (new flow)
   const attrWritten = await processAttributionSpans(user, attributionSpans);
 
+  // Only name the reasons that actually fired — a always-present zero-filled
+  // breakdown is noise on the overwhelmingly common clean batch.
+  const reasonDetail = Object.entries(rejectedReasons)
+    .filter(([, n]) => n > 0)
+    .map(([reason, n]) => `${reason}=${n}`)
+    .join(' ');
+
   console.log(
     `[otel-receiver] user=${user} ` +
     `usage: received=${spans.length} new=${usageWritten} dupes=${spans.length - usageWritten} | ` +
     `attribution: received=${attributionSpans.length} written=${attrWritten} | ` +
-    `rejected=${rejected}`,
+    `rejected=${rejected}${reasonDetail ? ` (${reasonDetail})` : ''}`,
   );
 
   if (rejected > 0) {
     return jsonResponse(200, {
-      partialSuccess: { rejectedSpans: rejected, errorMessage: 'Spans missing required attributes or failed validation' },
+      partialSuccess: {
+        rejectedSpans: rejected,
+        // Name the failing validation instead of a generic string: the client
+        // prints this, so a contract break is actionable from the CLI output
+        // rather than requiring receiver log access.
+        errorMessage: `Spans failed validation: ${reasonDetail}`,
+        rejectedReasons,
+      },
     });
   }
   return jsonResponse(200, {});
@@ -1257,18 +1327,7 @@ async function handleProductivityQuery(event: HttpApiEvent): Promise<HttpApiResp
     totals.usage.outputTokens += u.usage.outputTokens;
     totals.usage.costUsd += u.usage.costUsd;
     totals.usage.calls += u.usage.calls;
-    for (const [tool, t] of Object.entries(u.usage.byTool)) {
-      const agg = totals.usage.byTool[tool] ?? { costUsd: 0, calls: 0 };
-      agg.costUsd += t.costUsd;
-      agg.calls += t.calls;
-      totals.usage.byTool[tool] = agg;
-    }
-    for (const [model, m] of Object.entries(u.usage.byModel)) {
-      const agg = totals.usage.byModel[model] ?? { costUsd: 0, calls: 0 };
-      agg.costUsd += m.costUsd;
-      agg.calls += m.calls;
-      totals.usage.byModel[model] = agg;
-    }
+    mergeUsageBreakdowns(totals, u);
     totals.commits.total += u.commits.total;
     totals.commits.ai += u.commits.ai;
     totals.commits.human += u.commits.human;
@@ -1304,6 +1363,7 @@ async function handleProductivityQuery(event: HttpApiEvent): Promise<HttpApiResp
       into.usage.outputTokens += u.usage.outputTokens;
       into.usage.costUsd += u.usage.costUsd;
       into.usage.calls += u.usage.calls;
+      mergeUsageBreakdowns(into, u);
       into.commits.total += u.commits.total;
       into.commits.ai += u.commits.ai;
       into.commits.human += u.commits.human;
@@ -1525,6 +1585,31 @@ async function handleCommitsDailyQuery(event: HttpApiEvent): Promise<HttpApiResp
   });
 }
 
+/**
+ * Merge one user's byTool/byModel spend maps into an accumulator.
+ *
+ * Shared by the fleet-total and the human/agent-split loops. It exists as a
+ * function because it did not: the split loop was written later and summed
+ * costUsd, calls, commits and issues but not these two maps, so `totals.usage.byTool`
+ * arrived at the dashboard empty while every scalar beside it was correct. The
+ * Detail view then rendered "no by tool data" next to a populated cost-per-commit
+ * figure. Two loops summing the same shape is the drift; one function is the fix.
+ */
+function mergeUsageBreakdowns(into: UserProductivity, from: UserProductivity): void {
+  for (const [tool, t] of Object.entries(from.usage.byTool)) {
+    const agg = into.usage.byTool[tool] ?? { costUsd: 0, calls: 0 };
+    agg.costUsd = Math.round((agg.costUsd + t.costUsd) * 10000) / 10000;
+    agg.calls += t.calls;
+    into.usage.byTool[tool] = agg;
+  }
+  for (const [model, m] of Object.entries(from.usage.byModel)) {
+    const agg = into.usage.byModel[model] ?? { costUsd: 0, calls: 0 };
+    agg.costUsd = Math.round((agg.costUsd + m.costUsd) * 10000) / 10000;
+    agg.calls += m.calls;
+    into.usage.byModel[model] = agg;
+  }
+}
+
 function accumulateUsage(u: UserProductivity, item: Record<string, { S?: string; N?: string }>): void {
   const tool = item.tool?.S ?? 'unknown';
   const cost = Number(item.cost_usd?.N ?? 0);

package/dist/assets/infra/package.json

@@ -9,7 +9,9 @@
     "synth": "cdk synth",
     "deploy": "cdk deploy --all",
     "diff": "cdk diff",
-    "check:metrics": "tsx scripts/check-metric-coverage.ts"
+    "check:metrics": "tsx scripts/check-metric-coverage.ts",
+    "check:attribution": "tsx scripts/check-attribution-contract.ts",
+    "check:transitions": "tsx scripts/check-commit-transitions.ts"
   },
   "dependencies": {
     "aws-cdk-lib": "^2.170.0",
@@ -17,9 +19,13 @@
     "constructs": "^10.4.2"
   },
   "devDependencies": {
+    "@aws-sdk/client-cloudwatch": "^3.1121.0",
+    "@aws-sdk/client-dynamodb": "^3.1121.0",
+    "@aws-sdk/client-s3": "^3.1121.0",
     "@types/node": "^20.17.0",
+    "aws-cdk": "^2.170.0",
     "ts-node": "^10.9.2",
-    "typescript": "~5.6.0",
-    "aws-cdk": "^2.170.0"
+    "tsx": "^4.23.12",
+    "typescript": "~5.6.0"
   }
 }

package/dist/src/commands/bootstrapper/setup-github-oidc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-github-oidc.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":";;;;;;;;;;;iBA+CqB;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;AAP5E,wBAkTE"}
+{"version":3,"file":"setup-github-oidc.d.ts","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":";;;;;;;;;;;iBA+CqB;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;AAP5E,wBAsTE"}

package/dist/src/commands/bootstrapper/setup-github-oidc.js

@@ -243,10 +243,14 @@ export default {
                     // The coding agent workflow invokes the harness (InvokeHarness) and runs
                     // deterministic shell commands in the same session (InvokeAgentRuntimeCommand)
                     // for clone, toolchain install, dependency install, and verification.
+                    // GetHarness (→ GetAgentRuntime) resolves the model from the harness config
+                    // as a fallback when the SSM parameter is missing.
                     Effect: 'Allow',
                     Action: [
                         'bedrock-agentcore:InvokeHarness',
                         'bedrock-agentcore:InvokeAgentRuntimeCommand',
+                        'bedrock-agentcore:GetHarness',
+                        'bedrock-agentcore:GetAgentRuntime',
                     ],
                     Resource: `arn:aws:bedrock-agentcore:${region}:${accountId}:harness/*`,
                 },

package/dist/src/commands/bootstrapper/setup-github-oidc.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-github-oidc.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAExH,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,SAAS,CAAC,OAAe;IACtC,MAAM,MAAM,GAA8B,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;YAClF,IAAI,KAAK;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,yBAAyB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACzE,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,eAAe;IACb,WAAW,EAAE,sEAAsE;IACnF,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,yEAAyE,EAAE;QAC7G,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,yJAAyJ,EAAE;QAC9L,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,6EAA6E,EAAE,OAAO,EAAE,cAAc,EAAE;KACpJ;IACD,KAAK,CAAC,MAAM,CAAC,IAA6D;QACxE,mEAAmE;QACnE,gEAAgE;QAChE,2EAA2E;QAC3E,4EAA4E;QAC5E,kCAAkC;QAClC,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC;QAEhE,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,IAAI,CAAC,CAAC;QAEnC,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,mBAAmB,CAAC,cAAc,CAAC,CAAC;QAEpC,IAAI,QAAgB,CAAC;QACrB,IAAI,QAA4B,CAAC;QACjC,IAAI,QAAgB,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,QAAQ,GAAG,GAAG,cAAc,IAAI,CAAC;YACjC,QAAQ,GAAG,iBAAiB,cAAc,MAAM,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,qCAAqC,cAAc,IAAI,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAChE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC7B,QAAQ,GAAG,GAAG,cAAc,IAAI,QAAQ,EAAE,CAAC;YAC3C,QAAQ,GAAG,iBAAiB,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,iDAAiD;QACjD,uCAAuC;QACvC,8BAA8B;QAC9B,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,IAAI,OAA2B,CAAC;QAChC,IAAI,MAA0B,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,cAAc,EAAE,CAAC,CAAC;gBACzD,IAAI,IAAI,EAAE,EAAE;oBAAE,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,cAAc,IAAI,QAAQ,EAAE,CAAC,CAAC;gBACrE,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;oBAChC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACzB,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;gBACrG,OAAO,CAAC,GAAG,CAAC,0CAA0C,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,iCAAiC,CAAC,CAAC;gBAC1H,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM;oBACrC,CAAC,CAAC,qDAAqD;oBACvD,CAAC,CAAC,iEAAiE,CAAC,CAAC;gBACvE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClD,oEAAoE;gBACpE,oEAAoE;gBACpE,KAAK,MAAM,CAAC,IAAI,KAAK;oBAAE,iBAAiB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;gBACzD,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM;YAC7B,CAAC,CAAC;gBACE,QAAQ,cAAc,MAAM;gBAC5B,QAAQ,cAAc,IAAI,OAAO,IAAI,GAAG,MAAM;aAC/C;YACH,CAAC,CAAC;gBACE,QAAQ,cAAc,IAAI,QAAQ,IAAI;gBACtC,QAAQ,cAAc,IAAI,OAAO,IAAI,GAAG,IAAI,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI;aAC1E,CAAC;QAEN,wBAAwB;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,qBAAqB,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,IAAI,CAAC,CAAC;QAE3C,sEAAsE;QACtE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,gBAAgB,SAAS,oDAAoD,CAAC;QAElG,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,EAAE;YAClC,KAAK,EAAE,8BAA8B;YACrC,gCAAgC,EAAE,WAAW;SAC9C,CAAC,CAAC;QACH,IAAI,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,0CAA0C,CAAC;YAC9D,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,EAAE;gBAChC,KAAK,EAAE,iCAAiC;gBACxC,OAAO,EAAE,6CAA6C;gBACtD,kBAAkB,EAAE,mBAAmB;gBACvC,mBAAmB,EAAE,UAAU;aAChC,CAAC,CAAC;YACH,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,uCAAuC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,MAAM,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE;wBACT,SAAS,EAAE,WAAW;qBACvB;oBACD,MAAM,EAAE,+BAA+B;oBACvC,SAAS,EAAE;wBACT,YAAY,EAAE;4BACZ,yCAAyC,EAAE,mBAAmB;yBAC/D;wBACD,UAAU,EAAE;4BACV,yCAAyC,EAAE,WAAW;yBACvD;qBACF;iBACF;aACF;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9E,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,4CAA4C,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE;gBACxB,KAAK,EAAE,2BAA2B;gBAClC,aAAa,EAAE,QAAQ;gBACvB,mBAAmB,EAAE,WAAW;aACjC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,EAAE;gBAC5B,KAAK,EAAE,aAAa;gBACpB,aAAa,EAAE,QAAQ;gBACvB,+BAA+B,EAAE,WAAW;gBAC5C,eAAe,EAAE,gCAAgC,QAAQ,EAAE;aAC5D,CAAC,CAAC;YACH,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,YAAY,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;YACpC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ,EAAE,kBAAkB,MAAM,IAAI,SAAS,6BAA6B;iBAC7E;gBACD;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EAAE,GAAG;iBACd;gBACD;oBACE,yEAAyE;oBACzE,+EAA+E;oBAC/E,sEAAsE;oBACtE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE;wBACN,iCAAiC;wBACjC,6CAA6C;qBAC9C;oBACD,QAAQ,EAAE,6BAA6B,MAAM,IAAI,SAAS,YAAY;iBACvE;gBACD;oBACE,uEAAuE;oBACvE,sEAAsE;oBACtE,oEAAoE;oBACpE,6DAA6D;oBAC7D,wEAAwE;oBACxE,8BAA8B;oBAC9B,EAAE;oBACF,mEAAmE;oBACnE,uEAAuE;oBACvE,6CAA6C;oBAC7C,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,CAAC,+BAA+B,EAAE,+BAA+B,CAAC;oBAC1E,QAAQ,EAAE,0BAA0B,MAAM,IAAI,SAAS,oBAAoB;iBAC5E;gBACD;oBACE,wEAAwE;oBACxE,kEAAkE;oBAClE,qEAAqE;oBACrE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ,EAAE,eAAe,MAAM,IAAI,SAAS,uBAAuB;iBACpE;aACF;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,uBAAuB,CAAC;QAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,EAAE;YAC3B,KAAK,EAAE,iBAAiB;YACxB,aAAa,EAAE,QAAQ;YACvB,eAAe,EAAE,UAAU;YAC3B,mBAAmB,EAAE,cAAc;SACpC,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,sBAAsB,UAAU,aAAa,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,gCAAgC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,2DAA2D;QAC3D,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAC9E,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,EAAE;YACjC,KAAK,EAAE,eAAe;YACtB,SAAS,EAAE,OAAO;YAClB,+DAA+D;YAC/D,SAAS,EAAE,yDAAyD;YACpE,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;QACH,IAAI,eAAe,CAAC,EAAE,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,EAAE;gBAC9B,KAAK,EAAE,oBAAoB;gBAC3B,aAAa,EAAE,QAAQ;gBACvB,cAAc,EAAE,eAAe,CAAC,MAAM;aACvC,CAAC,CAAC;YACH,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;YACrF,CAAC;iBAAM,IAAI,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,4CAA4C,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/E,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,oGAAoG,CAAC,CAAC;YAClH,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAClF,CAAC;QAED,UAAU;QACV,MAAM,OAAO,GAAG,gBAAgB,SAAS,SAAS,QAAQ,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;YAC5F,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,gEAAgE,MAAM,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"setup-github-oidc.js","sourceRoot":"","sources":["../../../../src/commands/bootstrapper/setup-github-oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAExH,SAAS,MAAM,CAAC,QAAgB,EAAE,YAAqB;IACrD,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,SAAS,CAAC,OAAe;IACtC,MAAM,MAAM,GAA8B,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;YAClF,IAAI,KAAK;gBAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,yBAAyB,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACzE,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,eAAe;IACb,WAAW,EAAE,sEAAsE;IACnF,OAAO,EAAE;QACP,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,yEAAyE,EAAE;QAC7G,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,yJAAyJ,EAAE;QAC9L,EAAE,KAAK,EAAE,mBAAmB,EAAE,WAAW,EAAE,6EAA6E,EAAE,OAAO,EAAE,cAAc,EAAE;KACpJ;IACD,KAAK,CAAC,MAAM,CAAC,IAA6D;QACxE,mEAAmE;QACnE,gEAAgE;QAChE,2EAA2E;QAC3E,4EAA4E;QAC5E,kCAAkC;QAClC,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC;QAEhE,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,IAAI,CAAC,CAAC;QAEnC,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,mBAAmB,CAAC,cAAc,CAAC,CAAC;QAEpC,IAAI,QAAgB,CAAC;QACrB,IAAI,QAA4B,CAAC;QACjC,IAAI,QAAgB,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,QAAQ,GAAG,GAAG,cAAc,IAAI,CAAC;YACjC,QAAQ,GAAG,iBAAiB,cAAc,MAAM,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,qCAAqC,cAAc,IAAI,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;YAChE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC7B,QAAQ,GAAG,GAAG,cAAc,IAAI,QAAQ,EAAE,CAAC;YAC3C,QAAQ,GAAG,iBAAiB,QAAQ,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,iDAAiD;QACjD,uCAAuC;QACvC,8BAA8B;QAC9B,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,IAAI,OAA2B,CAAC;QAChC,IAAI,MAA0B,CAAC;QAC/B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC/D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,cAAc,EAAE,CAAC,CAAC;gBACzD,IAAI,IAAI,EAAE,EAAE;oBAAE,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,cAAc,IAAI,QAAQ,EAAE,CAAC,CAAC;gBACrE,IAAI,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;oBAChC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACzB,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;gBACrG,OAAO,CAAC,GAAG,CAAC,0CAA0C,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,iCAAiC,CAAC,CAAC;gBAC1H,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM;oBACrC,CAAC,CAAC,qDAAqD;oBACvD,CAAC,CAAC,iEAAiE,CAAC,CAAC;gBACvE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAClD,oEAAoE;gBACpE,oEAAoE;gBACpE,KAAK,MAAM,CAAC,IAAI,KAAK;oBAAE,iBAAiB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;gBACzD,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACjC,IAAI,KAAK,CAAC,CAAC,CAAC;oBAAE,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM;YAC7B,CAAC,CAAC;gBACE,QAAQ,cAAc,MAAM;gBAC5B,QAAQ,cAAc,IAAI,OAAO,IAAI,GAAG,MAAM;aAC/C;YACH,CAAC,CAAC;gBACE,QAAQ,cAAc,IAAI,QAAQ,IAAI;gBACtC,QAAQ,cAAc,IAAI,OAAO,IAAI,GAAG,IAAI,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI;aAC1E,CAAC;QAEN,wBAAwB;QACxB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,qBAAqB,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,IAAI,CAAC,CAAC;QAE3C,sEAAsE;QACtE,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,gBAAgB,SAAS,oDAAoD,CAAC;QAElG,MAAM,gBAAgB,GAAG,GAAG,CAAC,KAAK,EAAE;YAClC,KAAK,EAAE,8BAA8B;YACrC,gCAAgC,EAAE,WAAW;SAC9C,CAAC,CAAC;QACH,IAAI,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,0CAA0C,CAAC;YAC9D,MAAM,cAAc,GAAG,GAAG,CAAC,KAAK,EAAE;gBAChC,KAAK,EAAE,iCAAiC;gBACxC,OAAO,EAAE,6CAA6C;gBACtD,kBAAkB,EAAE,mBAAmB;gBACvC,mBAAmB,EAAE,UAAU;aAChC,CAAC,CAAC;YACH,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,uCAAuC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,MAAM,CAAC,CAAC;QAE5D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,SAAS,EAAE;wBACT,SAAS,EAAE,WAAW;qBACvB;oBACD,MAAM,EAAE,+BAA+B;oBACvC,SAAS,EAAE;wBACT,YAAY,EAAE;4BACZ,yCAAyC,EAAE,mBAAmB;yBAC/D;wBACD,UAAU,EAAE;4BACV,yCAAyC,EAAE,WAAW;yBACvD;qBACF;iBACF;aACF;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC9E,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,4CAA4C,CAAC,CAAC;YAC/E,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE;gBACxB,KAAK,EAAE,2BAA2B;gBAClC,aAAa,EAAE,QAAQ;gBACvB,mBAAmB,EAAE,WAAW;aACjC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,EAAE;gBAC5B,KAAK,EAAE,aAAa;gBACpB,aAAa,EAAE,QAAQ;gBACvB,+BAA+B,EAAE,WAAW;gBAC5C,eAAe,EAAE,gCAAgC,QAAQ,EAAE;aAC5D,CAAC,CAAC;YACH,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,YAAY,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,8BAA8B,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC;YACpC,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ,EAAE,kBAAkB,MAAM,IAAI,SAAS,6BAA6B;iBAC7E;gBACD;oBACE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EAAE,GAAG;iBACd;gBACD;oBACE,yEAAyE;oBACzE,+EAA+E;oBAC/E,sEAAsE;oBACtE,4EAA4E;oBAC5E,mDAAmD;oBACnD,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE;wBACN,iCAAiC;wBACjC,6CAA6C;wBAC7C,8BAA8B;wBAC9B,mCAAmC;qBACpC;oBACD,QAAQ,EAAE,6BAA6B,MAAM,IAAI,SAAS,YAAY;iBACvE;gBACD;oBACE,uEAAuE;oBACvE,sEAAsE;oBACtE,oEAAoE;oBACpE,6DAA6D;oBAC7D,wEAAwE;oBACxE,8BAA8B;oBAC9B,EAAE;oBACF,mEAAmE;oBACnE,uEAAuE;oBACvE,6CAA6C;oBAC7C,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,CAAC,+BAA+B,EAAE,+BAA+B,CAAC;oBAC1E,QAAQ,EAAE,0BAA0B,MAAM,IAAI,SAAS,oBAAoB;iBAC5E;gBACD;oBACE,wEAAwE;oBACxE,kEAAkE;oBAClE,qEAAqE;oBACrE,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,kBAAkB;oBAC1B,QAAQ,EAAE,eAAe,MAAM,IAAI,SAAS,uBAAuB;iBACpE;aACF;SACF,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,uBAAuB,CAAC;QAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,EAAE;YAC3B,KAAK,EAAE,iBAAiB;YACxB,aAAa,EAAE,QAAQ;YACvB,eAAe,EAAE,UAAU;YAC3B,mBAAmB,EAAE,cAAc;SACpC,CAAC,CAAC;QACH,IAAI,SAAS,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,sBAAsB,UAAU,aAAa,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,gCAAgC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,2DAA2D;QAC3D,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAC9E,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,EAAE;YACjC,KAAK,EAAE,eAAe;YACtB,SAAS,EAAE,OAAO;YAClB,+DAA+D;YAC/D,SAAS,EAAE,yDAAyD;YACpE,UAAU,EAAE,MAAM;SACnB,CAAC,CAAC;QACH,IAAI,eAAe,CAAC,EAAE,IAAI,eAAe,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,EAAE;gBAC9B,KAAK,EAAE,oBAAoB;gBAC3B,aAAa,EAAE,QAAQ;gBACvB,cAAc,EAAE,eAAe,CAAC,MAAM;aACvC,CAAC,CAAC;YACH,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,qEAAqE,CAAC,CAAC;YACrF,CAAC;iBAAM,IAAI,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACnD,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,4CAA4C,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/E,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,oGAAoG,CAAC,CAAC;YAClH,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAClF,CAAC;QAED,UAAU;QACV,MAAM,OAAO,GAAG,gBAAgB,SAAS,SAAS,QAAQ,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,iBAAiB,OAAO,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACvC,KAAK,MAAM,CAAC,IAAI,WAAW;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;YAC5F,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,gEAAgE,MAAM,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAChG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prism-d1/cli",
-  "version": "1.0.91",
+  "version": "1.0.93",
   "description": "PRISM D1 Velocity CLI — AI development lifecycle assessment tool",
   "author": "andklee",
   "engines": {