@prism-d1/cli 1.0.98 → 1.1.2

package/dist/assets/github-workflows/prism-ai-metrics.yml

@@ -32,6 +32,8 @@ on:
   pull_request:
     types: [closed]
     branches: [main, master]
+  push:
+    branches: [main, master]
 
 
 env:
@@ -45,7 +47,7 @@ permissions:
 
 jobs:
   emit-metrics:
-    if: github.event.pull_request.merged == true
+    if: github.event_name == 'pull_request' && github.event.pull_request.merged == true
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -245,3 +247,172 @@ jobs:
               \"EventBusName\": \"prism-d1-metrics\",
               \"Detail\": $(echo "${DEPLOY_EVENT}" | jq -c '.' | jq -Rs '.')
             }]"
+
+  # ---------------------------------------------------------------------------
+  # Census-only path: commits that reached the default branch WITHOUT a PR.
+  #
+  # WHY THIS EXISTS. Attribution Coverage is attributed_commits / ci_commits,
+  # and ci_commits was sourced solely from merged-PR events. A direct push to
+  # main therefore shrank the denominator while codeburn still attributed the
+  # commits, so coverage rose toward a confident 100% precisely as the census
+  # became less complete -- the one number meant to flag untrustworthy AI
+  # metrics failed in the reassuring direction. See velocity-widget.ts →
+  # attributionCoverage().
+  #
+  # WHAT IT DELIBERATELY DOES NOT DO. It emits no `dora` block and no
+  # prism.d1.deploy event, and it uses its own detail type rather than
+  # prism.d1.pr. Three reasons, each load-bearing:
+  #   - Change Failure Rate is failure_fixes / prs.length. Pushing census
+  #     events into prism.d1.pr would inflate that denominator and make the
+  #     revert rate look better, reintroducing the same class of lie.
+  #   - A push has no created_at → merged_at pair, so any lead time would be
+  #     fabricated.
+  #   - A push has no title convention to test for revert/hotfix/rollback.
+  # Deployment Frequency therefore still counts merges only. That is the
+  # accepted trade: this job fixes the census, it does not invent DORA data.
+  #
+  # NOT prism.d1.commit, which already exists: that type is per-commit and
+  # carries ai_context.{tool,model,origin} from the deprecated git hook. Its
+  # two remaining consumers (api-handler.ts, security-agent-processor.ts)
+  # expect that shape, and AI origin is deliberately resolved at render time
+  # here rather than at CI time.
+  emit-push-census:
+    # A PR merge fires BOTH pull_request:closed AND push, so this job must not
+    # double-count it. The head-commit-has-no-PR check below is the guard; this
+    # condition only keeps push-triggered runs.
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          # Full history: `git rev-list before..after` needs both endpoints.
+          fetch-depth: 0
+
+      - name: Skip if this push came from a PR merge
+        id: gate
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -uo pipefail
+          SHA="${{ github.event.after }}"
+          REPO="${{ github.repository }}"
+
+          # Covers all three merge strategies in one check. A merge commit, a
+          # squashed commit, and a rebased commit are all associated with their
+          # PR by this endpoint, whereas a hand-pushed commit is associated with
+          # none. Testing parent count instead would only catch merge commits
+          # and would double-count every squash merge.
+          PR_COUNT=$(gh api "repos/${REPO}/commits/${SHA}/pulls" --jq 'length' 2>/dev/null || echo "unknown")
+
+          if [[ "${PR_COUNT}" == "unknown" ]]; then
+            # Fail closed: emitting on an inconclusive check risks double-counting
+            # the census, which corrupts coverage in the direction this job exists
+            # to prevent. Under-counting is the safer error.
+            echo "Could not determine PR association for ${SHA}; skipping to avoid double-count."
+            echo "emit=false" >> "$GITHUB_OUTPUT"
+          elif [[ "${PR_COUNT}" != "0" ]]; then
+            echo "${SHA} belongs to ${PR_COUNT} PR(s); the emit-metrics job owns this merge."
+            echo "emit=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "${SHA} has no associated PR — direct push, emitting census."
+            echo "emit=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Configure AWS credentials (OIDC)
+        if: steps.gate.outputs.emit == 'true'
+        uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
+        with:
+          role-to-assume: ${{ secrets.PRISM_METRICS_ROLE_ARN }}
+          aws-region: ${{ env.PRISM_AWS_REGION }}
+
+      - name: Read team ID from .prism/config.json
+        if: steps.gate.outputs.emit == 'true'
+        id: prism-config
+        run: |
+          if [[ -f .prism/config.json ]]; then
+            TEAM_ID=$(jq -r '.team_id // ""' .prism/config.json 2>/dev/null || echo "")
+          else
+            TEAM_ID=""
+          fi
+          if [[ -z "${TEAM_ID}" ]]; then
+            TEAM_ID="no_team"
+          fi
+          echo "team_id=${TEAM_ID}" >> "$GITHUB_OUTPUT"
+
+      - name: Collect commit census
+        if: steps.gate.outputs.emit == 'true'
+        id: census
+        run: |
+          set -uo pipefail
+          BEFORE="${{ github.event.before }}"
+          AFTER="${{ github.event.after }}"
+
+          # A new branch (or the first push) reports an all-zero `before`, and
+          # a force-push reports a SHA that is no longer an ancestor. Both make
+          # `before..after` invalid or unboundedly large, so fall back to the
+          # single head commit rather than emitting a bogus count.
+          if [[ "${BEFORE}" =~ ^0+$ ]] || ! git cat-file -e "${BEFORE}^{commit}" 2>/dev/null; then
+            echo "Unusable before-SHA (${BEFORE}); counting the head commit only."
+            RANGE="${AFTER} -1"
+          else
+            RANGE="${BEFORE}..${AFTER}"
+          fi
+
+          # --no-merges and the 50-item cap match the PR path exactly, so both
+          # sides of the coverage ratio are counted on the same basis. A merge
+          # commit introduces no authored lines and can never appear in the
+          # attribution store, so counting one would put a structural ceiling
+          # on coverage.
+          COMMIT_SHAS=$(git rev-list --no-merges ${RANGE} 2>/dev/null | head -50 | jq -R . | jq -sc . || echo '[]')
+          TOTAL_COMMITS=$(git rev-list --no-merges --count ${RANGE} 2>/dev/null || echo 0)
+          COMMIT_AUTHORS=$(git rev-list --no-merges ${RANGE} 2>/dev/null | head -50 | while read sha; do git log -1 --format='%ae' "$sha"; done | jq -R . | jq -sc . || echo '[]')
+
+          echo "commit_shas=${COMMIT_SHAS}" >> "$GITHUB_OUTPUT"
+          echo "commit_authors=${COMMIT_AUTHORS}" >> "$GITHUB_OUTPUT"
+          echo "total_commits=${TOTAL_COMMITS}" >> "$GITHUB_OUTPUT"
+
+      - name: Emit prism.d1.push event
+        if: steps.gate.outputs.emit == 'true' && steps.census.outputs.total_commits != '0'
+        run: |
+          TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+          PUSH_EVENT=$(jq -n \
+            --arg team_id "${{ steps.prism-config.outputs.team_id }}" \
+            --arg repo "${PRISM_REPO}" \
+            --arg timestamp "${TIMESTAMP}" \
+            --arg sha "${{ github.event.after }}" \
+            --arg pusher "${{ github.event.pusher.name }}" \
+            --argjson total_commits "${{ steps.census.outputs.total_commits }}" \
+            --argjson commit_shas '${{ steps.census.outputs.commit_shas }}' \
+            --argjson commit_authors '${{ steps.census.outputs.commit_authors }}' \
+            '{
+              "team_id": $team_id,
+              "repo": $repo,
+              "timestamp": $timestamp,
+              "prism_level": 2,
+              "metric": {
+                "name": "push_commits",
+                "value": $total_commits,
+                "unit": "count"
+              },
+              "push": {
+                "sha": $sha,
+                "pusher": $pusher,
+                "total_commits": $total_commits,
+                "commit_shas": $commit_shas,
+                "commit_authors": $commit_authors
+              }
+            }')
+
+          aws events put-events \
+            --region $PRISM_AWS_REGION \
+            --entries "[{
+              \"Source\": \"prism.d1.velocity\",
+              \"DetailType\": \"prism.d1.push\",
+              \"EventBusName\": \"prism-d1-metrics\",
+              \"Detail\": $(echo "${PUSH_EVENT}" | jq -c '.' | jq -Rs '.')
+            }]"
+
+          echo "Emitted prism.d1.push for ${{ github.event.after }}"
+          echo "  commits in census: ${{ steps.census.outputs.total_commits }}"

package/dist/assets/infra/lib/constructs/otel-collector-construct.ts

@@ -49,6 +49,57 @@ export interface OtelCollectorConstructProps {
   externalClientId?: string;
   /** JWT claim used as the user identity key (default: username for Cognito, sub for BYO). */
   identityClaim?: string;
+
+  // ---------------------------------------------------------------------------
+  // Federated IdP on the Cognito pool (Okta, Entra ID, any OIDC provider).
+  //
+  // Distinct from the BYO-IdP props above. Those REPLACE Cognito as the token
+  // issuer and drop the machine-to-machine client with it. These keep Cognito as
+  // the issuer and add an upstream provider behind it, so the coding agent's
+  // client-credentials path survives.
+  //
+  // All five must be supplied together; a partial set throws rather than
+  // half-configuring an IdP that fails at first login.
+  // ---------------------------------------------------------------------------
+
+  /** Provider name, e.g. 'CorpIdP'. Becomes the `<name>_` username prefix. */
+  idpName?: string;
+  /** OIDC issuer URL, e.g. https://idp.example.com */
+  idpIssuer?: string;
+  /** OAuth client id registered with the IdP for this user pool. */
+  idpClientId?: string;
+  /**
+   * ARN or name of a Secrets Manager secret holding the IdP client secret.
+   *
+   * A REFERENCE, never the value: the secret is resolved by a CloudFormation
+   * dynamic reference at deploy time, so the plaintext is never written to the
+   * template, CloudFormation state, or CI logs. Passing the secret itself
+   * through CDK context would put it in `cdk.context.json` and the synthesized
+   * template, which is the antipattern the reference exists to avoid.
+   *
+   * Provide either a plain-text secret whose whole value is the client secret,
+   * or a JSON secret with a `clientSecret` key (set idpClientSecretJsonKey).
+   *
+   * CAVEAT: CloudFormation resolves a dynamic reference only when the resource
+   * containing it is created or updated. Rotating the secret in Secrets Manager
+   * does NOT reach Cognito on its own — the IdP resource must change too.
+   */
+  idpClientSecretArn?: string;
+  /** JSON key inside the secret holding the client secret. Omit for a plain-text secret. */
+  idpClientSecretJsonKey?: string;
+  /**
+   * Scopes Cognito requests FROM the IdP. Defaults to 'openid email'.
+   *
+   * `email` is load-bearing and the default exists because of it: without it the
+   * IdP returns no email claim, Cognito stores `email: null` on every federated
+   * user, and the identity falls back to the `<provider>_<alias>` username —
+   * which never matches the git author emails the CI census emits, silently
+   * splitting each developer into two identities on the dashboards.
+   *
+   * NOT the same as the app client's AllowedOAuthScopes, which governs
+   * app→Cognito rather than Cognito→IdP.
+   */
+  idpScopes?: string;
 }
 
 export class OtelCollectorConstruct extends Construct {
@@ -117,6 +168,84 @@ export class OtelCollectorConstruct extends Construct {
         cognitoDomain: { domainPrefix },
       });
 
+      // -----------------------------------------------------------------
+      // Optional federated IdP in front of the pool.
+      //
+      // Created BEFORE the app client so the client's
+      // supportedIdentityProviders can reference it; CloudFormation rejects a
+      // client naming a provider that does not exist yet, and addDependency
+      // below makes that ordering explicit rather than incidental.
+      // -----------------------------------------------------------------
+      const idpFields = [props.idpName, props.idpIssuer, props.idpClientId, props.idpClientSecretArn];
+      const idpConfigured = idpFields.some((f) => f !== undefined);
+      if (idpConfigured && idpFields.some((f) => f === undefined)) {
+        throw new Error(
+          'Federated IdP requires idpName, idpIssuer, idpClientId and idpClientSecretArn together '
+          + '(context: -c otelIdpName=... -c otelIdpIssuer=... -c otelIdpClientId=... -c otelIdpClientSecretArn=...)',
+        );
+      }
+
+      let federatedIdp: cognito.CfnUserPoolIdentityProvider | undefined;
+      if (idpConfigured) {
+        // Build the dynamic reference as a LITERAL string.
+        //
+        // The obvious CDK spelling — Secret.fromSecretNameV2(...).secretValueFromJson(k)
+        // .unsafeUnwrap() — composes the ARN with `Ref: AWS::Partition`, so the
+        // property renders as an Fn::Join whose OUTPUT happens to be a
+        // {{resolve:...}} string. CloudFormation resolves dynamic references
+        // during template processing and does not reliably resolve one produced
+        // by an intrinsic; the risk is Cognito storing the literal
+        // "{{resolve:secretsmanager:...}}" as the client secret, which fails at
+        // first federated login with an upstream "invalid_client" and no failed
+        // resource to point at. Verified by synthesizing both forms.
+        //
+        // The secret id comes from CDK context, so it is a plain string and
+        // interpolation yields a literal with no intrinsic. Secrets Manager
+        // accepts either a friendly name (same account and region) or a full ARN.
+        const secretId = props.idpClientSecretArn!;
+        if (!/^(arn:[a-z0-9-]+:secretsmanager:[a-z0-9-]+:\d{12}:secret:[A-Za-z0-9/_+=.@-]+|[A-Za-z0-9/_+=.@-]+)$/.test(secretId)) {
+          throw new Error(
+            `idpClientSecretArn "${secretId}" is not a valid Secrets Manager secret name or ARN. `
+            + 'Expected a friendly name or a full arn:...:secretsmanager:...:secret:... ARN.',
+          );
+        }
+        const jsonKey = props.idpClientSecretJsonKey ?? '';
+        if (jsonKey && !/^[A-Za-z0-9_.-]+$/.test(jsonKey)) {
+          throw new Error(`idpClientSecretJsonKey "${jsonKey}" must be alphanumeric with . _ - only.`);
+        }
+        // Trailing `::` selects the current version stage (AWSCURRENT), so the
+        // reference tracks rotation without pinning a version id.
+        const clientSecretRef = `{{resolve:secretsmanager:${secretId}:SecretString:${jsonKey}::}}`;
+
+        federatedIdp = new cognito.CfnUserPoolIdentityProvider(this, 'FederatedIdp', {
+          userPoolId: this.userPool.userPoolId,
+          providerName: props.idpName!,
+          providerType: 'OIDC',
+          // A SUPERSET of what the console-created provider had, never a
+          // replacement. `username: sub` is what Cognito uses to derive the
+          // native federated username (`<ProviderName>_<sub>`); dropping it
+          // changes the username shape, which mints a second set of user
+          // records and splits every developer's history a second time. Only
+          // `email` and the name claims are additions.
+          //
+          // `email` is the load-bearing one: it is what lets the identity match
+          // the git author emails the CI census emits.
+          attributeMapping: {
+            username: 'sub',
+            email: 'EMAIL',
+            given_name: 'GIVEN_NAME',
+            family_name: 'FAMILY_NAME',
+          },
+          providerDetails: {
+            oidc_issuer: props.idpIssuer!,
+            client_id: props.idpClientId!,
+            client_secret: clientSecretRef,
+            authorize_scopes: props.idpScopes ?? 'openid email',
+            attributes_request_method: 'GET',
+          },
+        });
+      }
+
       // Public client (no secret) — codeburn does Authorization Code + PKCE
       // with loopback redirects. Cognito allows http:// for localhost, 127.0.0.1,
       // and [::1] (per CreateUserPoolClient API docs). codeburn uses 127.0.0.1.
@@ -132,10 +261,97 @@ export class OtelCollectorConstruct extends Construct {
           scopes: [cognito.OAuthScope.OPENID, cognito.OAuthScope.EMAIL, cognito.OAuthScope.PROFILE],
           callbackUrls,
         },
+        // Declared here so it cannot drift. Setting this in the console instead
+        // leaves CloudFormation believing the client is Cognito-only, and the
+        // next deploy of this stack silently reverts it — breaking federated
+        // login with no failed resource to point at.
+        supportedIdentityProviders: idpConfigured
+          ? [
+              cognito.UserPoolClientIdentityProvider.COGNITO,
+              cognito.UserPoolClientIdentityProvider.custom(props.idpName!),
+            ]
+          : [cognito.UserPoolClientIdentityProvider.COGNITO],
         preventUserExistenceErrors: true,
         accessTokenValidity: cdk.Duration.hours(1),
         refreshTokenValidity: cdk.Duration.days(30),
       });
+      if (federatedIdp) {
+        this.userPoolClient.node.defaultChild?.node.addDependency(federatedIdp);
+      }
+
+      // -----------------------------------------------------------------
+      // Pre token generation (V2_0) — puts `email` in the ACCESS token.
+      //
+      // Attached only when a federated IdP is configured: for admin-created
+      // users the username IS the email, so the trigger would be a no-op that
+      // still billed an invocation on every token issuance.
+      //
+      // Inert without `identityClaim: 'email'` — see the note in
+      // pre-token-generation.ts. The warning below fires on the one
+      // half-configured combination that looks like it should work.
+      // -----------------------------------------------------------------
+      if (idpConfigured) {
+        // props.identityClaim is not yet folded into `identityClaim` at this
+        // point in the branch, so resolve the same default inline.
+        const claimForWarning = props.identityClaim ?? 'username';
+        if (claimForWarning !== 'email') {
+          cdk.Annotations.of(this).addWarning(
+            'A federated IdP is configured and the pre-token-generation trigger will add an `email` '
+            + 'claim to access tokens, but identityClaim is '
+            + `"${claimForWarning}" — the receiver checks that claim (and then \`username\`, which is `
+            + 'always present) before `email`, so the trigger has no effect. Deploy with '
+            + '-c otelIdentityClaim=email to key identities on email.',
+          );
+        }
+
+        const preTokenGen = new lambda.Function(this, 'PreTokenGeneration', {
+          functionName: 'prism-d1-pre-token-generation',
+          runtime: lambda.Runtime.NODEJS_22_X,
+          handler: 'pre-token-generation.handler',
+          // Deliberately NOT in the VPC: Cognito invokes this synchronously on
+          // the token-issuance path, and it makes no network calls, so a VPC
+          // attachment would add cold-start ENI latency to every sign-in for
+          // nothing.
+          code: lambda.Code.fromAsset(path.join(__dirname, '..', 'lambda'), {
+            bundling: {
+              image: lambda.Runtime.NODEJS_22_X.bundlingImage,
+              command: [
+                'bash', '-c',
+                [
+                  'npm init -y > /dev/null 2>&1',
+                  'npm install --save esbuild > /dev/null 2>&1',
+                  'npx esbuild pre-token-generation.ts --bundle --platform=node --target=node22 --outfile=/asset-output/pre-token-generation.js --external:@aws-sdk/*',
+                ].join(' && '),
+              ],
+              local: {
+                tryBundle(outputDir: string): boolean {
+                  try {
+                    const { execSync } = require('child_process');
+                    execSync(
+                      `npx esbuild ${path.join(__dirname, '..', 'lambda', 'pre-token-generation.ts')} --bundle --platform=node --target=node22 --outfile=${path.join(outputDir, 'pre-token-generation.js')} --external:@aws-sdk/*`,
+                      { stdio: 'pipe' },
+                    );
+                    return true;
+                  } catch {
+                    return false;
+                  }
+                },
+              },
+            },
+          }),
+          // Token issuance blocks on this call, so keep the budget tight: the
+          // function reads one attribute off the event and returns.
+          timeout: cdk.Duration.seconds(5),
+          memorySize: 128,
+          logRetention: logs.RetentionDays.ONE_MONTH,
+        });
+
+        this.userPool.addTrigger(
+          cognito.UserPoolOperation.PRE_TOKEN_GENERATION_CONFIG,
+          preTokenGen,
+          cognito.LambdaVersion.V2_0,
+        );
+      }
 
       issuer = `https://cognito-idp.${cdk.Aws.REGION}.amazonaws.com/${this.userPool.userPoolId}`;
       clientId = this.userPoolClient.userPoolClientId;

package/dist/assets/infra/lib/dashboard-stack.ts

@@ -215,31 +215,31 @@ export class DashboardStack extends cdk.Stack {
         updateOnResize: false,
         updateOnTimeRangeChange: true,
       })] : []),
-      new cloudwatch.GraphWidget({
-        title: 'AI Spend Trend (Weekly)',
-        left: [weeklySum('AICostUSD', 'Spend ($)')],
+      new cloudwatch.CustomWidget({
+        functionArn: props?.velocityWidgetArn ?? '',
+        title: 'AI Spend Trend',
         width: 8,
         height: 6,
-        leftYAxis: { min: 0, label: 'USD' },
+        params: { view: 'ai-spend-trend' },
+        updateOnRefresh: true,
+        updateOnResize: false,
+        updateOnTimeRangeChange: true,
       }),
-      new cloudwatch.GraphWidget({
-        title: 'Cost per Shipped Commit (Weekly)',
-        left: [
-          // The ROI narrative: spend can rise while this falls, which means AI
-          // is getting more efficient per unit of shipped work.
-          new cloudwatch.MathExpression({
-            expression: 'FILL(IF(FILL(execMerged, 0) > 0, FILL(execCost, 0) / FILL(execMerged, 0)), REPEAT)',
-            usingMetrics: {
-              execCost: weeklySum('AICostUSD'),
-              execMerged: weeklySum('MergedAICommits'),
-            },
-            label: '$ / shipped AI commit',
-            period: cdk.Duration.days(7),
-          }),
-        ],
+      // The ROI narrative: spend can rise while this falls, which means AI is
+      // getting more efficient per unit of shipped work. That reading only holds
+      // if both terms are bucketed by when the work happened — the CloudWatch
+      // version this replaces divided two ingest-timestamped metrics, so a
+      // backfill collapsed the ratio and read as a 94% efficiency gain that
+      // never occurred. See renderCostPerCommitTrend.
+      new cloudwatch.CustomWidget({
+        functionArn: props?.velocityWidgetArn ?? '',
+        title: 'Cost per Shipped Commit',
         width: 8,
         height: 6,
-        leftYAxis: { min: 0, label: 'USD' },
+        params: { view: 'cost-per-commit-trend' },
+        updateOnRefresh: true,
+        updateOnResize: false,
+        updateOnTimeRangeChange: true,
       }),
     );
 
@@ -676,23 +676,6 @@ export class DashboardStack extends cdk.Stack {
       );
 
       // --- Row 1: Org KPIs (NaN-guarded metric math, follow time range) ---
-      const dailyMetric = (metricName: string, id: string): cloudwatch.Metric =>
-        new cloudwatch.Metric({
-          namespace: METRIC_NAMESPACE,
-          metricName,
-          statistic: 'Sum',
-          period: cdk.Duration.days(1),
-          label: id,
-        });
-      const ratioKpi = (title: string, expression: string, using: Record<string, cloudwatch.IMetric>): cloudwatch.SingleValueWidget =>
-        new cloudwatch.SingleValueWidget({
-          title,
-          metrics: [new cloudwatch.MathExpression({ expression, usingMetrics: using, label: title, period: cdk.Duration.days(1) })],
-          setPeriodToTimeRange: true,
-          width: 6,
-          height: 4,
-        });
-
       devDashboard.addWidgets(
         // AI Share and AI Merge Rate are DDB-backed (accurate, no CloudWatch delay)
         new cloudwatch.CustomWidget({
@@ -715,15 +698,31 @@ export class DashboardStack extends cdk.Stack {
           updateOnResize: false,
           updateOnTimeRangeChange: true,
         }),
-        ratioKpi('Cost per Shipped Commit ($)', 'IF(FILL(kMerged2, 0) > 0, FILL(kCost, 0) / FILL(kMerged2, 0))', {
-          kCost: dailyMetric('AICostUSD', 'kCost'), kMerged2: dailyMetric('MergedAICommits', 'kMerged2'),
+        // Both of these read the attribution store rather than CloudWatch metric
+        // math. The metric versions divided/summed AICostUSD and MergedAICommits,
+        // which are ingest-timestamped and subject to CloudWatch's two-week
+        // datapoint cutoff, and carry no user dimension — so they disagreed with
+        // the store-backed figures in row 3 on both terms AND ignored the
+        // Developer variable. See renderCostPerCommitKpi for the measured gap.
+        new cloudwatch.CustomWidget({
+          functionArn: props.velocityWidgetArn ?? '',
+          title: 'Cost per Shipped Commit ($)',
+          width: 6,
+          height: 4,
+          params: { view: 'cost-per-commit-kpi' },
+          updateOnRefresh: true,
+          updateOnResize: false,
+          updateOnTimeRangeChange: true,
         }),
-        new cloudwatch.SingleValueWidget({
+        new cloudwatch.CustomWidget({
+          functionArn: props.velocityWidgetArn ?? '',
           title: 'AI Spend (range, $)',
-          metrics: [dailyMetric('AICostUSD', 'AI Spend')],
-          setPeriodToTimeRange: true,
           width: 6,
           height: 4,
+          params: { view: 'ai-spend-kpi' },
+          updateOnRefresh: true,
+          updateOnResize: false,
+          updateOnTimeRangeChange: true,
         }),
       );
 
@@ -740,12 +739,15 @@ export class DashboardStack extends cdk.Stack {
           updateOnResize: false,
           updateOnTimeRangeChange: true,
         }),
-        new cloudwatch.GraphWidget({
+        new cloudwatch.CustomWidget({
+          functionArn: props?.velocityWidgetArn ?? '',
           title: 'AI Spend / Day',
-          left: [dailyMetric('AICostUSD', 'Spend ($)')],
           width: 8,
           height: 6,
-          leftYAxis: { min: 0, label: 'USD' },
+          params: { view: 'ai-spend-trend' },
+          updateOnRefresh: true,
+          updateOnResize: false,
+          updateOnTimeRangeChange: true,
         }),
         // Merge Rate Trend — DDB-backed line chart replacing CloudWatch AI Merge Ratio Trend
         new cloudwatch.CustomWidget({

package/dist/assets/infra/lib/lambda/event-schema.ts

@@ -36,6 +36,7 @@ export const PERSISTED_SECTIONS = [
   'security_agent_finding',
   'security_remediation',
   'pr',
+  'push',
 ] as const;
 
 export type PersistedSection = (typeof PERSISTED_SECTIONS)[number];
@@ -76,7 +77,16 @@ export const SECTION_FIELDS: Record<PersistedSection, readonly string[]> = {
   ],
   pr: [
     'number', 'author', 'reviews_approved', 'reviews_changes_requested',
-    'total_commits', 'commit_shas',
+    'total_commits', 'commit_shas', 'commit_authors',
+  ],
+  // Census-only counterpart to `pr`, emitted by prism-ai-metrics.yml when
+  // commits reach the default branch without a PR. Deliberately carries no
+  // lead-time or failure-fix field: a push has neither a created_at→merged_at
+  // pair nor a title convention, so any such value would be fabricated. Kept a
+  // separate section (rather than reusing `pr`) because Change Failure Rate
+  // divides by the count of prism.d1.pr events.
+  push: [
+    'sha', 'pusher', 'total_commits', 'commit_shas', 'commit_authors',
   ],
 };
 

package/dist/assets/infra/lib/lambda/metrics-processor.ts

@@ -892,15 +892,20 @@ function mapUnit(unit: string): StandardUnit {
  * processor already handles both forms for point lookups.
  */
 async function seedCommitAttribution(detailType: string, detail: any): Promise<void> {
-  // Only process prism.d1.pr events that carry commit SHAs
-  if (detailType !== 'prism.d1.pr') return;
+  // prism.d1.pr and prism.d1.push both report commits that reached the default
+  // branch, so both seed in_main=true. A direct push is as much "shipped" as a
+  // merge; excluding it would undercount shipped commits and inflate the
+  // cost-per-shipped-commit KPI, while still charging the tokens that produced
+  // them. The census fields are identically shaped on the two events, only
+  // nested under a different key.
+  if (detailType !== 'prism.d1.pr' && detailType !== 'prism.d1.push') return;
   if (!AI_USAGE_TABLE) return;
 
-  const pr = detail.pr as PrDetail | undefined;
-  const shas = pr?.commit_shas;
+  const census = (detailType === 'prism.d1.pr' ? detail.pr : detail.push) as PrDetail | undefined;
+  const shas = census?.commit_shas;
   if (!shas || shas.length === 0) return;
 
-  const authors: string[] = (pr as any)?.commit_authors ?? [];
+  const authors: string[] = (census as any)?.commit_authors ?? [];
   const repo = detail.repo as string;
   // CI workflows now emit fully-qualified repo names (github.com/owner/repo
   // or gitlab.com/group/project) matching codeburn's convention. No

package/dist/assets/infra/lib/lambda/otel-receiver.ts

@@ -1539,7 +1539,7 @@ async function handleCommitsDailyQuery(event: HttpApiEvent): Promise<HttpApiResp
   }
 
   // Scan COMMIT# items in the date range.
-  const days = new Map<string, { ai: number; human: number; mergedAi: number; mergedHuman: number }>();
+  const days = new Map<string, { ai: number; human: number; mergedAi: number; mergedHuman: number; costUsd: number }>();
   let lastKey: import('@aws-sdk/client-dynamodb').ScanCommandOutput['LastEvaluatedKey'];
   do {
     const result = await dynamoClient.send(new ScanCommand({
@@ -1561,7 +1561,7 @@ async function handleCommitsDailyQuery(event: HttpApiEvent): Promise<HttpApiResp
       const origin = item.ai_origin?.S ?? 'human';
       const inMain = item.in_main?.BOOL ?? false;
       let bucket = days.get(day);
-      if (!bucket) { bucket = { ai: 0, human: 0, mergedAi: 0, mergedHuman: 0 }; days.set(day, bucket); }
+      if (!bucket) { bucket = { ai: 0, human: 0, mergedAi: 0, mergedHuman: 0, costUsd: 0 }; days.set(day, bucket); }
       if (origin === 'ai-generated') {
         bucket.ai++;
         if (inMain) bucket.mergedAi++;
@@ -1573,10 +1573,52 @@ async function handleCommitsDailyQuery(event: HttpApiEvent): Promise<HttpApiResp
     lastKey = result.LastEvaluatedKey;
   } while (lastKey);
 
-  // Sort ascending by date and return as an array.
+  // Second pass: fold daily AI spend into the same buckets, so a cost-per-commit
+  // trend can be computed from one source instead of dividing a CloudWatch cost
+  // metric by a CloudWatch commit metric.
+  //
+  // The two passes key on DIFFERENT timestamps by design, and that is the whole
+  // point of serving this from the store. A COMMIT# item is bucketed by its real
+  // commit timestamp and an OTEL_DAY item by the day the usage happened, so both
+  // sides of the ratio land on the day the work actually occurred. The CloudWatch
+  // equivalent buckets by INGEST time, which is why a backfill dumps months of
+  // commits into the week it was pushed and collapses that week's ratio.
+  {
+    let costKey: import('@aws-sdk/client-dynamodb').ScanCommandOutput['LastEvaluatedKey'];
+    do {
+      const result = await dynamoClient.send(new ScanCommand({
+        TableName: AI_USAGE_TABLE,
+        FilterExpression: 'record_type = :rt AND #day BETWEEN :lo AND :hi',
+        ExpressionAttributeNames: { '#day': 'day' },
+        ExpressionAttributeValues: {
+          ':rt': { S: 'OTEL_DAY' },
+          ':lo': { S: from },
+          ':hi': { S: to },
+        },
+        ProjectionExpression: '#day, cost_usd',
+        ...(costKey ? { ExclusiveStartKey: costKey } : {}),
+      }));
+      for (const item of result.Items ?? []) {
+        const day = item.day?.S;
+        if (!day) continue;
+        const cost = Number(item.cost_usd?.N ?? '0');
+        if (!Number.isFinite(cost)) continue;
+        let bucket = days.get(day);
+        // A day with spend but no commits is a real observation — AI work that
+        // shipped nothing — so it gets a bucket rather than being dropped. The
+        // consumer renders its ratio as null, not as zero.
+        if (!bucket) { bucket = { ai: 0, human: 0, mergedAi: 0, mergedHuman: 0, costUsd: 0 }; days.set(day, bucket); }
+        bucket.costUsd += cost;
+      }
+      costKey = result.LastEvaluatedKey;
+    } while (costKey);
+  }
+
+  // Sort ascending by date and return as an array. Cost is rounded once, here,
+  // so every consumer renders the same figure.
   const sorted = [...days.entries()]
     .sort((a, b) => a[0].localeCompare(b[0]))
-    .map(([date, counts]) => ({ date, ...counts }));
+    .map(([date, counts]) => ({ ...counts, date, costUsd: Math.round(counts.costUsd * 100) / 100 }));
 
   return jsonResponse(200, {
     range: { from, to },

package/dist/assets/infra/lib/lambda/pre-token-generation.ts

@@ -0,0 +1,79 @@
+/**
+ * Pre token generation trigger (V2_0) — copies `email` into the ACCESS token.
+ *
+ * WHY THIS EXISTS
+ *
+ * Every per-developer number on these dashboards keys on the identity the
+ * otel-receiver derives from the caller's JWT, and the commit side of the
+ * pipeline keys on the git author email (`metrics-processor.ts` writes
+ * `gsi_user: USER#<author email>` from the CI census). For the two to join,
+ * the receiver's identity must also be an email.
+ *
+ * Cognito ID tokens carry `email`. Cognito ACCESS tokens do not — and API
+ * Gateway's HttpJwtAuthorizer validates the access token. So with a federated
+ * IdP the receiver falls back to `username`, which Cognito prefixes with the
+ * provider name (`corpidp_alice`). The same person then appears as two
+ * developers: one holding all the token spend and no commits, the other the
+ * reverse. On a pool with months of accumulated telemetry, effectively all of
+ * the AI-usage history lands on the prefixed identity while commit attribution
+ * lands on the email one.
+ *
+ * Mapping `email` on the identity provider is necessary but NOT sufficient: it
+ * populates the user ATTRIBUTE, which never reaches the access token on its
+ * own. This trigger is the piece that moves it there.
+ *
+ * PAIRED WITH `otelIdentityClaim=email`
+ *
+ * This function is inert by itself. The receiver resolves identity as
+ * `[IDENTITY_CLAIM, 'username', 'email', 'sub']`, and IDENTITY_CLAIM defaults
+ * to `username` — which is always present, so `email` is unreachable no matter
+ * what this trigger adds. Deploy this WITH `-c otelIdentityClaim=email`, or it
+ * adds a claim nothing reads.
+ *
+ * FAIL-OPEN, DELIBERATELY
+ *
+ * A federated user's `email` is populated by the IdP attribute mapping on
+ * sign-in, so a user who has not signed in since the mapping was added has no
+ * email yet. Returning the event unmodified in that case lets the receiver's
+ * chain fall through to `username` — the pre-existing behaviour — so those users
+ * keep writing to their old key until they next sign in, and the migration is
+ * self-completing. Throwing here would instead block token issuance and lock
+ * them out of sync entirely, turning a cosmetic split into an outage.
+ *
+ * Requires the Essentials or Plus feature plan; access token customization is
+ * unavailable on Lite. Deployed against a pool already on Plus.
+ */
+
+interface PreTokenGenerationV2Event {
+  request?: {
+    userAttributes?: Record<string, string>;
+  };
+  response?: unknown;
+}
+
+export async function handler(event: PreTokenGenerationV2Event): Promise<PreTokenGenerationV2Event> {
+  const email = event.request?.userAttributes?.email;
+
+  // Trim before testing: a whitespace-only attribute would satisfy a bare
+  // truthiness check here and then be rejected by the receiver's own
+  // `v.trim()` guard, silently reverting to `username` with no signal.
+  if (typeof email !== 'string' || email.trim() === '') {
+    return event;
+  }
+
+  // Lowercased to match the receiver, which lowercases every resolved identity
+  // before building `USER#<identity>`. Emitting mixed case here would create a
+  // second partition key for the same person the first time an IdP returned a
+  // capitalized address.
+  const normalized = email.trim().toLowerCase();
+
+  event.response = {
+    claimsAndScopeOverrideDetails: {
+      accessTokenGeneration: {
+        claimsToAddOrOverride: { email: normalized },
+      },
+    },
+  };
+
+  return event;
+}

package/dist/assets/infra/lib/lambda/velocity-widget.ts

@@ -193,7 +193,7 @@ async function renderDora(fromIso: string, toIso: string, days: number, p: Palet
   ]);
 
   if (deploys.length === 0 && prs.length === 0) {
-    return emptyState('deploy / PR', 'Populated by prism-ai-metrics.yml on PR merge. Install the workflow and set PRISM_METRICS_ROLE_ARN.', p);
+    return emptyState('deploy / PR', 'Populated by prism-ai-metrics.yml on PR merge (and on direct pushes to the default branch, census only). Install the workflow and set PRISM_METRICS_ROLE_ARN.', p);
   }
 
   const mergeFreq = days > 0 ? deploys.length / days : deploys.length;
@@ -246,18 +246,32 @@ function median(values: number[]): number | null {
  * of who authored it and reports pr.total_commits. Attribution gives us the
  * sample. The ratio is the coverage.
  *
+ * `pushes` carries the other half of that census. Commits pushed straight to
+ * the default branch produce no PR event, so before they were counted they
+ * shrank this denominator while codeburn still attributed them -- coverage rose
+ * toward 100% exactly as the census got less complete, and the Math.min below
+ * hid the overshoot that would otherwise have exposed it. Both event types are
+ * summed here; they are kept separate from `prs` everywhere else, because
+ * Change Failure Rate divides by prs.length and a push has no title to test.
+ *
+ * The emitter guarantees these do not overlap: emit-push-census skips any push
+ * whose head commit is associated with a PR, which covers merge, squash and
+ * rebase strategies alike.
+ *
  * Returns null when CI events are absent, since coverage is unknowable then —
  * deliberately not 0%, which would imply "measured and found nothing".
  */
-function attributionCoverage(prs: PrismEvent[], attributedCommits: number | null): {
+function attributionCoverage(prs: PrismEvent[], pushes: PrismEvent[], attributedCommits: number | null): {
   pct: number | null;
   ciCommits: number;
   attributed: number | null;
 } {
-  const ciCommits = prs.reduce((sum, e) => {
-    const n = e.data.pr?.total_commits;
-    return sum + (typeof n === 'number' && n > 0 ? n : 0);
-  }, 0);
+  const countCommits = (events: PrismEvent[], key: 'pr' | 'push') =>
+    events.reduce((sum, e) => {
+      const n = (e.data as any)[key]?.total_commits;
+      return sum + (typeof n === 'number' && n > 0 ? n : 0);
+    }, 0);
+  const ciCommits = countCommits(prs, 'pr') + countCommits(pushes, 'push');
   if (ciCommits === 0 || attributedCommits === null) {
     return { pct: null, ciCommits, attributed: attributedCommits };
   }
@@ -345,17 +359,18 @@ async function renderRepos(fromIso: string, toIso: string, p: Palette): Promise<
 }
 
 async function renderAidora(fromIso: string, toIso: string, p: Palette): Promise<string> {
-  const [report, evals, prs] = await Promise.all([
+  const [report, evals, prs, pushes] = await Promise.all([
     fetchProductivity(fromIso, toIso).catch(() => null),
     queryEvents('prism.d1.eval', fromIso, toIso),
     queryEvents('prism.d1.pr', fromIso, toIso),
+    queryEvents('prism.d1.push', fromIso, toIso),
   ]);
 
   const t = report?.totals;
   const passRate = evals.length > 0
     ? (evals.filter(e => e.data.eval?.result === 'PASS').length / evals.length) * 100
     : null;
-  const cov = attributionCoverage(prs, t?.commits?.total ?? null);
+  const cov = attributionCoverage(prs, pushes, t?.commits?.total ?? null);
 
   const cells = [
     { label: 'AI Share of Commits', value: pct(t?.ratios?.aiSharePct ?? null), note: 'attribution store', color: (t?.ratios?.aiSharePct ?? 0) >= 30 ? p.ok : undefined },
@@ -458,13 +473,14 @@ function computeObservedLevel(input: {
 // ---- View: exec (business KPIs + delivery proxies + observed level) ----
 
 async function renderExec(fromIso: string, toIso: string, days: number, p: Palette): Promise<string> {
-  const [report, evals, mcp, guardrails, deploys, prs] = await Promise.all([
+  const [report, evals, mcp, guardrails, deploys, prs, pushes] = await Promise.all([
     fetchProductivity(fromIso, toIso).catch(() => null),
     queryEvents('prism.d1.eval', fromIso, toIso),
     queryEvents('prism.d1.mcp.tool_call', fromIso, toIso),
     queryEvents('prism.d1.guardrail', fromIso, toIso),
     queryEvents('prism.d1.deploy', fromIso, toIso),
     queryEvents('prism.d1.pr', fromIso, toIso),
+    queryEvents('prism.d1.push', fromIso, toIso),
   ]);
 
   const t = report?.totals;
@@ -506,7 +522,7 @@ async function renderExec(fromIso: string, toIso: string, days: number, p: Palet
     ]), p, 1);
 
   // --- Business KPIs (attribution store) ---
-  const cov = attributionCoverage(prs, t?.commits?.total ?? null);
+  const cov = attributionCoverage(prs, pushes, t?.commits?.total ?? null);
   const businessKpis = kpiRow([
     { label: 'AI Share of Commits', value: pct(r.aiSharePct ?? null), note: 'L2 >= 30%', color: (r.aiSharePct ?? 0) >= 30 ? p.ok : undefined },
     { label: 'AI Merge Rate', value: pct(r.mergeRatePct ?? null), note: 'L2 >= 20% · L4 >= 45%', color: (r.mergeRatePct ?? 0) >= 45 ? p.ok : (r.mergeRatePct ?? 0) >= 20 ? p.warn : undefined },
@@ -1632,6 +1648,275 @@ async function renderMergeRateKpi(fromIso: string, toIso: string, p: Palette): P
   `;
 }
 
+// ---- View: cost-per-commit-kpi (single big-number KPI for $ / shipped commit) ----
+
+/**
+ * Replaces a CloudWatch `AICostUSD / MergedAICommits` ratio tile.
+ *
+ * Three things were wrong with the metric-math version, and all three are
+ * properties of CloudWatch rather than of the expression:
+ *
+ * 1. CloudWatch rejects datapoints older than two weeks, so a backfill lands
+ *    partially outside the ingestion window. Measured on a live 30-day range,
+ *    the metric path saw $1,387.61 / 141 commits where the store held
+ *    $1,496.24 / 164 — both terms short, in the same direction.
+ * 2. AICostUSD and MergedAICommits carry no user dimension, so the tile stayed
+ *    org-wide while the attribution-backed tile beside it scoped to the
+ *    dashboard's Developer variable. Same screen, near-identical labels, one
+ *    responding to the filter and one not.
+ * 3. The metrics are timestamped at ingest, not at commit time.
+ *
+ * Reading the store fixes all three, and makes this tile agree with the
+ * `$ / Shipped Commit` cells on Team Velocity and the Executive Readout, which
+ * already read the same field.
+ */
+async function renderCostPerCommitKpi(fromIso: string, toIso: string, p: Palette): Promise<string> {
+  let report: any;
+  try {
+    report = await fetchProductivity(fromIso, toIso);
+  } catch {
+    return emptyState('cost per shipped commit', 'Attribution store unreachable.', p);
+  }
+  const costPer = report?.totals?.ratios?.costPerShippedCommit ?? null;
+  const cost = report?.totals?.usage?.costUsd ?? null;
+  const mergedAi = report?.totals?.commits?.mergedAi ?? 0;
+  // Deliberately uncoloured: unit economics has no org-independent "good"
+  // threshold the way merge rate does, and a red/green here would invent one.
+  const sub = mergedAi > 0 && cost !== null
+    ? `$${num(Math.round(cost))} / ${num(mergedAi)} merged AI commits`
+    : cost !== null
+      ? `$${num(Math.round(cost))} spend · no merged AI commits attributed yet`
+      : 'no attribution data in range';
+  return `
+    <div style="text-align:center;padding:12px">
+      <div style="color:${p.mut};font-size:11px">$ / Shipped Commit</div>
+      <div style="color:${p.fg};font-size:36px;font-weight:700;margin:4px 0">${costPer !== null ? `$${costPer.toFixed(2)}` : '—'}</div>
+      <div style="color:${p.mut};font-size:10px">${sub}</div>
+    </div>
+  `;
+}
+
+// ---- View: ai-spend-kpi (single big-number KPI for total AI spend in range) ----
+
+/**
+ * Replaces a CloudWatch `Sum(AICostUSD)` tile, for the same ingestion-window
+ * reason as the ratio above: the metric sum is short by whatever part of the
+ * range predates CloudWatch's two-week cutoff, so a tile labelled "range"
+ * silently reports less than the range holds.
+ */
+async function renderAiSpendKpi(fromIso: string, toIso: string, p: Palette): Promise<string> {
+  let report: any;
+  try {
+    report = await fetchProductivity(fromIso, toIso);
+  } catch {
+    return emptyState('AI spend', 'Attribution store unreachable.', p);
+  }
+  const usage = report?.totals?.usage ?? null;
+  const cost = usage?.costUsd ?? null;
+  const calls = usage?.calls ?? 0;
+  const tokens = (usage?.inputTokens ?? 0) + (usage?.outputTokens ?? 0);
+  return `
+    <div style="text-align:center;padding:12px">
+      <div style="color:${p.mut};font-size:11px">AI Spend (range)</div>
+      <div style="color:${p.fg};font-size:36px;font-weight:700;margin:4px 0">${cost !== null ? `$${num(Math.round(cost))}` : '—'}</div>
+      <div style="color:${p.mut};font-size:10px">${cost !== null ? `${num(calls)} calls · ${num(Math.round(tokens / 1000))}k tokens` : 'no usage data in range'}</div>
+    </div>
+  `;
+}
+
+// ---- View: ai-spend-trend (AI spend over time) ----
+
+/**
+ * Replaces the CloudWatch `Sum(AICostUSD)` spend graphs.
+ *
+ * Same reason as the KPI tiles: CloudWatch drops datapoints older than two
+ * weeks, so a graph titled "spend trend" showed a flat or absent left-hand side
+ * for any range longer than that — not because spend was low then, but because
+ * the datapoints were refused at ingest. Reading OTEL_DAY rollups gives the real
+ * curve over full history, and puts this graph on the same source as the
+ * cost-per-commit trend beside it so the two can be read together.
+ */
+async function renderAiSpendTrend(fromIso: string, toIso: string, days: number, p: Palette): Promise<string> {
+  let data: any;
+  try {
+    data = await invokeReceiver('/v1/commits-daily', `from=${fromIso.slice(0, 10)}&to=${toIso.slice(0, 10)}`);
+  } catch (err) {
+    return emptyState('AI spend trend', `Attribution store unreachable (${(err as Error).message}).`, p);
+  }
+
+  const dayBuckets: Array<{ date: string; costUsd: number }> = data?.days ?? [];
+  if (dayBuckets.length === 0) {
+    return emptyState('AI spend trend', 'No usage data in range.', p);
+  }
+
+  const useWeekly = days > 21;
+  let buckets: Array<{ label: string; costUsd: number }>;
+  if (useWeekly) {
+    const weeks = new Map<string, { label: string; costUsd: number }>();
+    for (const d of dayBuckets) {
+      const dt = new Date(d.date);
+      const weekStart = new Date(dt);
+      weekStart.setDate(dt.getDate() - dt.getDay());
+      const key = weekStart.toISOString().slice(0, 10);
+      let w = weeks.get(key);
+      if (!w) { w = { label: key, costUsd: 0 }; weeks.set(key, w); }
+      w.costUsd += d.costUsd ?? 0;
+    }
+    buckets = [...weeks.values()].sort((a, b) => a.label.localeCompare(b.label));
+  } else {
+    buckets = dayBuckets.map(d => ({ label: d.date, costUsd: d.costUsd ?? 0 }));
+  }
+
+  const total = buckets.reduce((s, b) => s + b.costUsd, 0);
+  const maxC = Math.max(...buckets.map(b => b.costUsd), 0);
+  if (maxC === 0) {
+    return emptyState('AI spend trend', 'No AI spend recorded in range.', p);
+  }
+
+  // Bars rather than a line: spend is a per-bucket quantity, and a line implies
+  // interpolation between buckets that a sum does not have.
+  const chartW = 500;
+  const chartH = 100;
+  const slot = chartW / buckets.length;
+  const barW = Math.max(2, slot * 0.7);
+  const bars = buckets.map((b, i) => {
+    const h = (b.costUsd / maxC) * (chartH - 10);
+    return `<rect x="${i * slot + (slot - barW) / 2}" y="${chartH - h}" width="${barW}" height="${h}" fill="${p.accent}" opacity="0.85" />`;
+  }).join('');
+
+  return `
+    <div style="padding:8px 12px">
+      <div style="display:flex;justify-content:space-between;align-items:baseline;margin-bottom:4px">
+        <span style="color:${p.mut};font-size:11px">AI Spend (${useWeekly ? 'weekly' : 'daily'})</span>
+        <span style="color:${p.fg};font-size:13px;font-weight:600">$${num(Math.round(total))} total</span>
+      </div>
+      <svg viewBox="0 0 ${chartW} ${chartH + 16}" style="width:100%;height:auto">
+        ${bars}
+        <text x="2" y="${chartH + 13}" fill="${p.mut}" font-size="9">${esc(buckets[0]!.label)}</text>
+        <text x="${chartW - 2}" y="${chartH + 13}" fill="${p.mut}" font-size="9" text-anchor="end">${esc(buckets[buckets.length - 1]!.label)}</text>
+      </svg>
+      <div style="color:${p.mut};font-size:10px;margin-top:2px">peak $${maxC.toFixed(2)} per ${useWeekly ? 'week' : 'day'} · attribution store, full history</div>
+    </div>
+  `;
+}
+
+// ---- View: cost-per-commit-trend (cost per shipped commit over time) ----
+
+/**
+ * Replaces the CloudWatch "Cost per Shipped Commit (Weekly)" graph.
+ *
+ * That graph divided two ingest-timestamped metrics, which made it report
+ * efficiency changes that never happened. Measured on a live 30-day range the
+ * day attribution was first backfilled: the two earlier weeks plotted as gaps
+ * (spend, zero commits) and the current week read $0.55, because 141 commits
+ * spanning months were all stamped with their ingest time and divided into that
+ * one week's $77.33 of spend. The graph's premise — "spend can rise while this
+ * falls, which means AI is getting more efficient" — inverts under that
+ * artifact, so a reader draws exactly the wrong conclusion.
+ *
+ * Bucketing both terms by when the work happened is what makes the trend mean
+ * what its title says. A bucket with spend but no merged commits renders as a
+ * gap rather than as zero: no commits shipped is not a cost of zero per commit,
+ * and FILL(..., 0) on the metric version drew it as a floor.
+ */
+async function renderCostPerCommitTrend(fromIso: string, toIso: string, days: number, p: Palette): Promise<string> {
+  let data: any;
+  try {
+    data = await invokeReceiver('/v1/commits-daily', `from=${fromIso.slice(0, 10)}&to=${toIso.slice(0, 10)}`);
+  } catch (err) {
+    return emptyState('cost per commit trend', `Attribution store unreachable (${(err as Error).message}).`, p);
+  }
+
+  const dayBuckets: Array<{ date: string; mergedAi: number; costUsd: number }> = data?.days ?? [];
+  if (dayBuckets.length === 0) {
+    return emptyState('cost per commit trend', 'No commit or usage data in range.', p);
+  }
+
+  // Same weekly/daily threshold as renderMergeRateTrend, so the two trends on a
+  // dashboard share an x-axis granularity.
+  const useWeekly = days > 21;
+  type Bucket = { label: string; mergedAi: number; costUsd: number };
+  let buckets: Bucket[];
+  if (useWeekly) {
+    const weeks = new Map<string, Bucket>();
+    for (const d of dayBuckets) {
+      const dt = new Date(d.date);
+      const weekStart = new Date(dt);
+      weekStart.setDate(dt.getDate() - dt.getDay());
+      const key = weekStart.toISOString().slice(0, 10);
+      let w = weeks.get(key);
+      if (!w) { w = { label: key, mergedAi: 0, costUsd: 0 }; weeks.set(key, w); }
+      w.mergedAi += d.mergedAi ?? 0;
+      w.costUsd += d.costUsd ?? 0;
+    }
+    buckets = [...weeks.values()].sort((a, b) => a.label.localeCompare(b.label));
+  } else {
+    buckets = dayBuckets.map(d => ({ label: d.date, mergedAi: d.mergedAi ?? 0, costUsd: d.costUsd ?? 0 }));
+  }
+
+  const ratios = buckets.map(b => (b.mergedAi > 0 ? b.costUsd / b.mergedAi : null));
+  const present = ratios.filter((r): r is number => r !== null);
+  if (present.length === 0) {
+    const spend = buckets.reduce((s, b) => s + b.costUsd, 0);
+    return emptyState(
+      'cost per commit trend',
+      spend > 0
+        ? `$${num(Math.round(spend))} of AI spend in range with no merged AI commits attributed — run \`codeburn sync push --attribution\`.`
+        : 'No AI spend or merged commits in range.',
+      p,
+    );
+  }
+
+  const chartW = 500;
+  const chartH = 100;
+  const step = buckets.length > 1 ? (chartW - 20) / (buckets.length - 1) : 0;
+  const maxR = Math.max(...present);
+  const yOf = (r: number): number => chartH - (maxR > 0 ? (r / maxR) * (chartH - 10) : 0);
+
+  // Gaps break the polyline into segments instead of interpolating across a
+  // bucket that shipped nothing, which would draw a slope the data does not have.
+  const segments: string[] = [];
+  let current: string[] = [];
+  ratios.forEach((r, i) => {
+    if (r === null) {
+      if (current.length > 1) segments.push(current.join(' '));
+      current = [];
+      return;
+    }
+    current.push(`${10 + i * step},${yOf(r)}`);
+  });
+  if (current.length > 1) segments.push(current.join(' '));
+
+  const dots = ratios.map((r, i) => r === null ? '' :
+    `<circle cx="${10 + i * step}" cy="${yOf(r)}" r="2.5" fill="${p.accent}" />`).join('');
+  const lines = segments.map(s =>
+    `<polyline points="${s}" fill="none" stroke="${p.accent}" stroke-width="2" />`).join('');
+
+  const first = present[0];
+  const last = present[present.length - 1];
+  const delta = first > 0 ? ((last - first) / first) * 100 : null;
+  const gaps = ratios.filter(r => r === null).length;
+
+  return `
+    <div style="padding:8px 12px">
+      <div style="display:flex;justify-content:space-between;align-items:baseline;margin-bottom:4px">
+        <span style="color:${p.mut};font-size:11px">Cost per Shipped Commit (${useWeekly ? 'weekly' : 'daily'})</span>
+        <span style="color:${p.fg};font-size:13px;font-weight:600">$${last.toFixed(2)}${
+          delta !== null ? ` <span style="color:${delta <= 0 ? p.ok : p.warn};font-size:11px">${delta <= 0 ? '▼' : '▲'} ${Math.abs(delta).toFixed(0)}%</span>` : ''
+        }</span>
+      </div>
+      <svg viewBox="0 0 ${chartW} ${chartH + 16}" style="width:100%;height:auto">
+        ${lines}${dots}
+        <text x="10" y="${chartH + 13}" fill="${p.mut}" font-size="9">${esc(buckets[0]!.label)}</text>
+        <text x="${chartW - 10}" y="${chartH + 13}" fill="${p.mut}" font-size="9" text-anchor="end">${esc(buckets[buckets.length - 1]!.label)}</text>
+      </svg>
+      <div style="color:${p.mut};font-size:10px;margin-top:2px">
+        peak $${maxR.toFixed(2)} · attribution store, bucketed by commit date${gaps > 0 ? ` · ${gaps} ${useWeekly ? 'week' : 'day'}(s) with spend but no merged AI commits shown as gaps` : ''}
+      </div>
+    </div>
+  `;
+}
+
 // ---- View: merge-rate-trend (line chart of merge rate over time) ----
 
 async function renderMergeRateTrend(fromIso: string, toIso: string, days: number, p: Palette): Promise<string> {
@@ -1738,6 +2023,10 @@ export async function handler(event: WidgetEvent): Promise<string> {
       case 'commits-bar': body = await renderCommitsBar(fromIso, toIso, days, p); break;
       case 'ai-share-kpi': body = await renderAiShareKpi(fromIso, toIso, p); break;
       case 'merge-rate-kpi': body = await renderMergeRateKpi(fromIso, toIso, p); break;
+      case 'cost-per-commit-kpi': body = await renderCostPerCommitKpi(fromIso, toIso, p); break;
+      case 'ai-spend-kpi': body = await renderAiSpendKpi(fromIso, toIso, p); break;
+      case 'cost-per-commit-trend': body = await renderCostPerCommitTrend(fromIso, toIso, days, p); break;
+      case 'ai-spend-trend': body = await renderAiSpendTrend(fromIso, toIso, days, p); break;
       case 'merge-rate-trend': body = await renderMergeRateTrend(fromIso, toIso, days, p); break;
       default: body = `<div style="color:${p.danger}">Unknown view: ${esc(view)}</div>`;
     }

package/dist/assets/infra/lib/metrics-pipeline-stack.ts

@@ -288,6 +288,7 @@ export class MetricsPipelineStack extends cdk.Stack {
     const detailTypes = [
       'prism.d1.commit',
       'prism.d1.pr',
+      'prism.d1.push',
       'prism.d1.deploy',
       'prism.d1.eval',
       'prism.d1.incident',
@@ -354,6 +355,13 @@ export class MetricsPipelineStack extends cdk.Stack {
     // OTEL Collector (on by default — server side of `codeburn sync`)
     // Skip with:   npx cdk deploy --context skipOtelCollector=true
     // BYO IdP:     -c otelIssuer=... -c otelClientId=... [-c otelIdentityClaim=email]
+    // Federated IdP behind Cognito (keeps the M2M agent client):
+    //              -c otelIdpName=CorpIdP
+    //              -c otelIdpIssuer=https://idp.example.com
+    //              -c otelIdpClientId=...
+    //              -c otelIdpClientSecretArn=<secretsmanager name or arn>
+    //              [-c otelIdpClientSecretJsonKey=clientSecret]
+    //              [-c otelIdpScopes='openid email']  (default: openid email)
     // Per-user AI usage flows directly from codeburn sync to the
     // ai-usage table (spans + daily aggregates).
     // -------------------------------------------------------
@@ -365,6 +373,12 @@ export class MetricsPipelineStack extends cdk.Stack {
         externalIssuer: this.node.tryGetContext('otelIssuer') as string | undefined,
         externalClientId: this.node.tryGetContext('otelClientId') as string | undefined,
         identityClaim: this.node.tryGetContext('otelIdentityClaim') as string | undefined,
+        idpName: this.node.tryGetContext('otelIdpName') as string | undefined,
+        idpIssuer: this.node.tryGetContext('otelIdpIssuer') as string | undefined,
+        idpClientId: this.node.tryGetContext('otelIdpClientId') as string | undefined,
+        idpClientSecretArn: this.node.tryGetContext('otelIdpClientSecretArn') as string | undefined,
+        idpClientSecretJsonKey: this.node.tryGetContext('otelIdpClientSecretJsonKey') as string | undefined,
+        idpScopes: this.node.tryGetContext('otelIdpScopes') as string | undefined,
       });
 
       // ---------------------------------------------------

package/dist/assets/infra/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-d1-velocity-infra",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "PRISM D1 Velocity - AWS CDK Infrastructure for AI-DORA Metrics Platform",
   "scripts": {
     "build": "tsc",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prism-d1/cli",
-  "version": "1.0.98",
+  "version": "1.1.2",
   "description": "PRISM D1 Velocity CLI — AI development lifecycle assessment tool",
   "author": "andklee",
   "engines": {