@prism-d1/cli 1.0.98 → 1.0.99

package/dist/assets/github-workflows/prism-ai-metrics.yml

@@ -32,6 +32,8 @@ on:
   pull_request:
     types: [closed]
     branches: [main, master]
+  push:
+    branches: [main, master]
 
 
 env:
@@ -45,7 +47,7 @@ permissions:
 
 jobs:
   emit-metrics:
-    if: github.event.pull_request.merged == true
+    if: github.event_name == 'pull_request' && github.event.pull_request.merged == true
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -245,3 +247,172 @@ jobs:
               \"EventBusName\": \"prism-d1-metrics\",
               \"Detail\": $(echo "${DEPLOY_EVENT}" | jq -c '.' | jq -Rs '.')
             }]"
+
+  # ---------------------------------------------------------------------------
+  # Census-only path: commits that reached the default branch WITHOUT a PR.
+  #
+  # WHY THIS EXISTS. Attribution Coverage is attributed_commits / ci_commits,
+  # and ci_commits was sourced solely from merged-PR events. A direct push to
+  # main therefore shrank the denominator while codeburn still attributed the
+  # commits, so coverage rose toward a confident 100% precisely as the census
+  # became less complete -- the one number meant to flag untrustworthy AI
+  # metrics failed in the reassuring direction. See velocity-widget.ts →
+  # attributionCoverage().
+  #
+  # WHAT IT DELIBERATELY DOES NOT DO. It emits no `dora` block and no
+  # prism.d1.deploy event, and it uses its own detail type rather than
+  # prism.d1.pr. Three reasons, each load-bearing:
+  #   - Change Failure Rate is failure_fixes / prs.length. Pushing census
+  #     events into prism.d1.pr would inflate that denominator and make the
+  #     revert rate look better, reintroducing the same class of lie.
+  #   - A push has no created_at → merged_at pair, so any lead time would be
+  #     fabricated.
+  #   - A push has no title convention to test for revert/hotfix/rollback.
+  # Deployment Frequency therefore still counts merges only. That is the
+  # accepted trade: this job fixes the census, it does not invent DORA data.
+  #
+  # NOT prism.d1.commit, which already exists: that type is per-commit and
+  # carries ai_context.{tool,model,origin} from the deprecated git hook. Its
+  # two remaining consumers (api-handler.ts, security-agent-processor.ts)
+  # expect that shape, and AI origin is deliberately resolved at render time
+  # here rather than at CI time.
+  emit-push-census:
+    # A PR merge fires BOTH pull_request:closed AND push, so this job must not
+    # double-count it. The head-commit-has-no-PR check below is the guard; this
+    # condition only keeps push-triggered runs.
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          # Full history: `git rev-list before..after` needs both endpoints.
+          fetch-depth: 0
+
+      - name: Skip if this push came from a PR merge
+        id: gate
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -uo pipefail
+          SHA="${{ github.event.after }}"
+          REPO="${{ github.repository }}"
+
+          # Covers all three merge strategies in one check. A merge commit, a
+          # squashed commit, and a rebased commit are all associated with their
+          # PR by this endpoint, whereas a hand-pushed commit is associated with
+          # none. Testing parent count instead would only catch merge commits
+          # and would double-count every squash merge.
+          PR_COUNT=$(gh api "repos/${REPO}/commits/${SHA}/pulls" --jq 'length' 2>/dev/null || echo "unknown")
+
+          if [[ "${PR_COUNT}" == "unknown" ]]; then
+            # Fail closed: emitting on an inconclusive check risks double-counting
+            # the census, which corrupts coverage in the direction this job exists
+            # to prevent. Under-counting is the safer error.
+            echo "Could not determine PR association for ${SHA}; skipping to avoid double-count."
+            echo "emit=false" >> "$GITHUB_OUTPUT"
+          elif [[ "${PR_COUNT}" != "0" ]]; then
+            echo "${SHA} belongs to ${PR_COUNT} PR(s); the emit-metrics job owns this merge."
+            echo "emit=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "${SHA} has no associated PR — direct push, emitting census."
+            echo "emit=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Configure AWS credentials (OIDC)
+        if: steps.gate.outputs.emit == 'true'
+        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
+        with:
+          role-to-assume: ${{ secrets.PRISM_METRICS_ROLE_ARN }}
+          aws-region: ${{ env.PRISM_AWS_REGION }}
+
+      - name: Read team ID from .prism/config.json
+        if: steps.gate.outputs.emit == 'true'
+        id: prism-config
+        run: |
+          if [[ -f .prism/config.json ]]; then
+            TEAM_ID=$(jq -r '.team_id // ""' .prism/config.json 2>/dev/null || echo "")
+          else
+            TEAM_ID=""
+          fi
+          if [[ -z "${TEAM_ID}" ]]; then
+            TEAM_ID="no_team"
+          fi
+          echo "team_id=${TEAM_ID}" >> "$GITHUB_OUTPUT"
+
+      - name: Collect commit census
+        if: steps.gate.outputs.emit == 'true'
+        id: census
+        run: |
+          set -uo pipefail
+          BEFORE="${{ github.event.before }}"
+          AFTER="${{ github.event.after }}"
+
+          # A new branch (or the first push) reports an all-zero `before`, and
+          # a force-push reports a SHA that is no longer an ancestor. Both make
+          # `before..after` invalid or unboundedly large, so fall back to the
+          # single head commit rather than emitting a bogus count.
+          if [[ "${BEFORE}" =~ ^0+$ ]] || ! git cat-file -e "${BEFORE}^{commit}" 2>/dev/null; then
+            echo "Unusable before-SHA (${BEFORE}); counting the head commit only."
+            RANGE="${AFTER} -1"
+          else
+            RANGE="${BEFORE}..${AFTER}"
+          fi
+
+          # --no-merges and the 50-item cap match the PR path exactly, so both
+          # sides of the coverage ratio are counted on the same basis. A merge
+          # commit introduces no authored lines and can never appear in the
+          # attribution store, so counting one would put a structural ceiling
+          # on coverage.
+          COMMIT_SHAS=$(git rev-list --no-merges ${RANGE} 2>/dev/null | head -50 | jq -R . | jq -sc . || echo '[]')
+          TOTAL_COMMITS=$(git rev-list --no-merges --count ${RANGE} 2>/dev/null || echo 0)
+          COMMIT_AUTHORS=$(git rev-list --no-merges ${RANGE} 2>/dev/null | head -50 | while read sha; do git log -1 --format='%ae' "$sha"; done | jq -R . | jq -sc . || echo '[]')
+
+          echo "commit_shas=${COMMIT_SHAS}" >> "$GITHUB_OUTPUT"
+          echo "commit_authors=${COMMIT_AUTHORS}" >> "$GITHUB_OUTPUT"
+          echo "total_commits=${TOTAL_COMMITS}" >> "$GITHUB_OUTPUT"
+
+      - name: Emit prism.d1.push event
+        if: steps.gate.outputs.emit == 'true' && steps.census.outputs.total_commits != '0'
+        run: |
+          TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+          PUSH_EVENT=$(jq -n \
+            --arg team_id "${{ steps.prism-config.outputs.team_id }}" \
+            --arg repo "${PRISM_REPO}" \
+            --arg timestamp "${TIMESTAMP}" \
+            --arg sha "${{ github.event.after }}" \
+            --arg pusher "${{ github.event.pusher.name }}" \
+            --argjson total_commits "${{ steps.census.outputs.total_commits }}" \
+            --argjson commit_shas '${{ steps.census.outputs.commit_shas }}' \
+            --argjson commit_authors '${{ steps.census.outputs.commit_authors }}' \
+            '{
+              "team_id": $team_id,
+              "repo": $repo,
+              "timestamp": $timestamp,
+              "prism_level": 2,
+              "metric": {
+                "name": "push_commits",
+                "value": $total_commits,
+                "unit": "count"
+              },
+              "push": {
+                "sha": $sha,
+                "pusher": $pusher,
+                "total_commits": $total_commits,
+                "commit_shas": $commit_shas,
+                "commit_authors": $commit_authors
+              }
+            }')
+
+          aws events put-events \
+            --region $PRISM_AWS_REGION \
+            --entries "[{
+              \"Source\": \"prism.d1.velocity\",
+              \"DetailType\": \"prism.d1.push\",
+              \"EventBusName\": \"prism-d1-metrics\",
+              \"Detail\": $(echo "${PUSH_EVENT}" | jq -c '.' | jq -Rs '.')
+            }]"
+
+          echo "Emitted prism.d1.push for ${{ github.event.after }}"
+          echo "  commits in census: ${{ steps.census.outputs.total_commits }}"

package/dist/assets/infra/lib/lambda/event-schema.ts

@@ -36,6 +36,7 @@ export const PERSISTED_SECTIONS = [
   'security_agent_finding',
   'security_remediation',
   'pr',
+  'push',
 ] as const;
 
 export type PersistedSection = (typeof PERSISTED_SECTIONS)[number];
@@ -76,7 +77,16 @@ export const SECTION_FIELDS: Record<PersistedSection, readonly string[]> = {
   ],
   pr: [
     'number', 'author', 'reviews_approved', 'reviews_changes_requested',
-    'total_commits', 'commit_shas',
+    'total_commits', 'commit_shas', 'commit_authors',
+  ],
+  // Census-only counterpart to `pr`, emitted by prism-ai-metrics.yml when
+  // commits reach the default branch without a PR. Deliberately carries no
+  // lead-time or failure-fix field: a push has neither a created_at→merged_at
+  // pair nor a title convention, so any such value would be fabricated. Kept a
+  // separate section (rather than reusing `pr`) because Change Failure Rate
+  // divides by the count of prism.d1.pr events.
+  push: [
+    'sha', 'pusher', 'total_commits', 'commit_shas', 'commit_authors',
   ],
 };
 

package/dist/assets/infra/lib/lambda/metrics-processor.ts

@@ -892,15 +892,20 @@ function mapUnit(unit: string): StandardUnit {
  * processor already handles both forms for point lookups.
  */
 async function seedCommitAttribution(detailType: string, detail: any): Promise<void> {
-  // Only process prism.d1.pr events that carry commit SHAs
-  if (detailType !== 'prism.d1.pr') return;
+  // prism.d1.pr and prism.d1.push both report commits that reached the default
+  // branch, so both seed in_main=true. A direct push is as much "shipped" as a
+  // merge; excluding it would undercount shipped commits and inflate the
+  // cost-per-shipped-commit KPI, while still charging the tokens that produced
+  // them. The census fields are identically shaped on the two events, only
+  // nested under a different key.
+  if (detailType !== 'prism.d1.pr' && detailType !== 'prism.d1.push') return;
   if (!AI_USAGE_TABLE) return;
 
-  const pr = detail.pr as PrDetail | undefined;
-  const shas = pr?.commit_shas;
+  const census = (detailType === 'prism.d1.pr' ? detail.pr : detail.push) as PrDetail | undefined;
+  const shas = census?.commit_shas;
   if (!shas || shas.length === 0) return;
 
-  const authors: string[] = (pr as any)?.commit_authors ?? [];
+  const authors: string[] = (census as any)?.commit_authors ?? [];
   const repo = detail.repo as string;
   // CI workflows now emit fully-qualified repo names (github.com/owner/repo
   // or gitlab.com/group/project) matching codeburn's convention. No

package/dist/assets/infra/lib/lambda/velocity-widget.ts

@@ -193,7 +193,7 @@ async function renderDora(fromIso: string, toIso: string, days: number, p: Palet
   ]);
 
   if (deploys.length === 0 && prs.length === 0) {
-    return emptyState('deploy / PR', 'Populated by prism-ai-metrics.yml on PR merge. Install the workflow and set PRISM_METRICS_ROLE_ARN.', p);
+    return emptyState('deploy / PR', 'Populated by prism-ai-metrics.yml on PR merge (and on direct pushes to the default branch, census only). Install the workflow and set PRISM_METRICS_ROLE_ARN.', p);
   }
 
   const mergeFreq = days > 0 ? deploys.length / days : deploys.length;
@@ -246,18 +246,32 @@ function median(values: number[]): number | null {
  * of who authored it and reports pr.total_commits. Attribution gives us the
  * sample. The ratio is the coverage.
  *
+ * `pushes` carries the other half of that census. Commits pushed straight to
+ * the default branch produce no PR event, so before they were counted they
+ * shrank this denominator while codeburn still attributed them -- coverage rose
+ * toward 100% exactly as the census got less complete, and the Math.min below
+ * hid the overshoot that would otherwise have exposed it. Both event types are
+ * summed here; they are kept separate from `prs` everywhere else, because
+ * Change Failure Rate divides by prs.length and a push has no title to test.
+ *
+ * The emitter guarantees these do not overlap: emit-push-census skips any push
+ * whose head commit is associated with a PR, which covers merge, squash and
+ * rebase strategies alike.
+ *
  * Returns null when CI events are absent, since coverage is unknowable then —
  * deliberately not 0%, which would imply "measured and found nothing".
  */
-function attributionCoverage(prs: PrismEvent[], attributedCommits: number | null): {
+function attributionCoverage(prs: PrismEvent[], pushes: PrismEvent[], attributedCommits: number | null): {
   pct: number | null;
   ciCommits: number;
   attributed: number | null;
 } {
-  const ciCommits = prs.reduce((sum, e) => {
-    const n = e.data.pr?.total_commits;
-    return sum + (typeof n === 'number' && n > 0 ? n : 0);
-  }, 0);
+  const countCommits = (events: PrismEvent[], key: 'pr' | 'push') =>
+    events.reduce((sum, e) => {
+      const n = (e.data as any)[key]?.total_commits;
+      return sum + (typeof n === 'number' && n > 0 ? n : 0);
+    }, 0);
+  const ciCommits = countCommits(prs, 'pr') + countCommits(pushes, 'push');
   if (ciCommits === 0 || attributedCommits === null) {
     return { pct: null, ciCommits, attributed: attributedCommits };
   }
@@ -345,17 +359,18 @@ async function renderRepos(fromIso: string, toIso: string, p: Palette): Promise<
 }
 
 async function renderAidora(fromIso: string, toIso: string, p: Palette): Promise<string> {
-  const [report, evals, prs] = await Promise.all([
+  const [report, evals, prs, pushes] = await Promise.all([
     fetchProductivity(fromIso, toIso).catch(() => null),
     queryEvents('prism.d1.eval', fromIso, toIso),
     queryEvents('prism.d1.pr', fromIso, toIso),
+    queryEvents('prism.d1.push', fromIso, toIso),
   ]);
 
   const t = report?.totals;
   const passRate = evals.length > 0
     ? (evals.filter(e => e.data.eval?.result === 'PASS').length / evals.length) * 100
     : null;
-  const cov = attributionCoverage(prs, t?.commits?.total ?? null);
+  const cov = attributionCoverage(prs, pushes, t?.commits?.total ?? null);
 
   const cells = [
     { label: 'AI Share of Commits', value: pct(t?.ratios?.aiSharePct ?? null), note: 'attribution store', color: (t?.ratios?.aiSharePct ?? 0) >= 30 ? p.ok : undefined },
@@ -458,13 +473,14 @@ function computeObservedLevel(input: {
 // ---- View: exec (business KPIs + delivery proxies + observed level) ----
 
 async function renderExec(fromIso: string, toIso: string, days: number, p: Palette): Promise<string> {
-  const [report, evals, mcp, guardrails, deploys, prs] = await Promise.all([
+  const [report, evals, mcp, guardrails, deploys, prs, pushes] = await Promise.all([
     fetchProductivity(fromIso, toIso).catch(() => null),
     queryEvents('prism.d1.eval', fromIso, toIso),
     queryEvents('prism.d1.mcp.tool_call', fromIso, toIso),
     queryEvents('prism.d1.guardrail', fromIso, toIso),
     queryEvents('prism.d1.deploy', fromIso, toIso),
     queryEvents('prism.d1.pr', fromIso, toIso),
+    queryEvents('prism.d1.push', fromIso, toIso),
   ]);
 
   const t = report?.totals;
@@ -506,7 +522,7 @@ async function renderExec(fromIso: string, toIso: string, days: number, p: Palet
     ]), p, 1);
 
   // --- Business KPIs (attribution store) ---
-  const cov = attributionCoverage(prs, t?.commits?.total ?? null);
+  const cov = attributionCoverage(prs, pushes, t?.commits?.total ?? null);
   const businessKpis = kpiRow([
     { label: 'AI Share of Commits', value: pct(r.aiSharePct ?? null), note: 'L2 >= 30%', color: (r.aiSharePct ?? 0) >= 30 ? p.ok : undefined },
     { label: 'AI Merge Rate', value: pct(r.mergeRatePct ?? null), note: 'L2 >= 20% · L4 >= 45%', color: (r.mergeRatePct ?? 0) >= 45 ? p.ok : (r.mergeRatePct ?? 0) >= 20 ? p.warn : undefined },

package/dist/assets/infra/lib/metrics-pipeline-stack.ts

@@ -288,6 +288,7 @@ export class MetricsPipelineStack extends cdk.Stack {
     const detailTypes = [
       'prism.d1.commit',
       'prism.d1.pr',
+      'prism.d1.push',
       'prism.d1.deploy',
       'prism.d1.eval',
       'prism.d1.incident',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prism-d1/cli",
-  "version": "1.0.98",
+  "version": "1.0.99",
   "description": "PRISM D1 Velocity CLI — AI development lifecycle assessment tool",
   "author": "andklee",
   "engines": {