---
id: measurement
title: Measurement
description: Full KPI contracts, minimal events, illustrative calculations, privacy and limits.
---


<div className="strategy-content">

**TO-BE · Target operating model.** Introduction depends on the [roadmap gates](./roadmap.mdx); these pages do not describe installed controls or measured company results.

### Decide what counts before counting

Use the metric contracts below for exact definitions. Every report states its eligible population, observation window, numerator and denominator or distribution sample count, source coverage, exclusions and calculation version. Zero denominators return “not available.” Missing telemetry is unknown, not inactivity, compliance or success. Examples are explicitly synthetic and illustrative.

Begin with task acceptance, repository, CI, deployment and incident systems because they can independently establish outcomes. Add catalog/version inventory and task-level declarations. Client telemetry is supplementary and version-dependent; enabling rich tool details may collect sensitive commands and identifiers. Do not enable it merely to count skills. A normalized adapter may report approved skill identifiers without forwarding raw arguments.

Validated success uses all eligible initiated tasks whose predeclared observation window has matured. Failed and abandoned tasks remain nonsuccess. Unresolved or unobserved outcomes remain in the denominator, with known-outcome coverage shown alongside the conservative confirmed-success share. They are not relabeled as observed failure. A task cancelled before start is excluded; cancellation after start remains visible. Count a task once across retries and multiple skills. For timeliness, also show unfinished work and age; accepted-only lead-time distributions have survivorship limitations.

Track all five service-level DORA measures: commit-to-production lead time, deployment frequency, change fail rate, failed deployment recovery time and deployment rework rate. Do not substitute PR-open-to-merge time or all-incident MTTR. Pair them with matured escaped-quality rates, policy effects, total cost per accepted outcome, support coverage, adoption, human experience and catalog maintenance. Keep customer/business outcomes linked to their departmental hypotheses; do not infer conversion, trust or revenue improvement from delivery telemetry.

### Baseline and interpretation

Before a pilot, freeze eligibility and acceptance rules and verify event joins. Collect prospective no-skill/current-practice evidence over a complete comparable workflow cycle and until the preregistered precision/sample requirement is met. Do not select a convenient end date after seeing results. Retain task class, service, skill, client/model configuration and concurrent changes. A matched or randomized comparison may be used when practical and ethical; label observational trends as descriptive and report confounding, selection and uncertainty.

Elapsed time and human effort are different quantities. Parallel agents may reduce waiting while increasing review or compute. Include failed attempts and human review/rework in cost, do not multiply a multi-skill task's value across every invocation, and do not convert survey perceptions into proven time savings. Small or incomplete populations yield evidence limits, not an ROI percentage.

### Event and privacy contract

Use a versioned event envelope and required fields per event. Source producer plus event ID deduplicates transport retries. Conflicting payloads under the same key are quarantined. Attempts have distinct IDs under one task. Domain IDs deduplicate deployments, defects and approvals even when multiple feeds describe them. Late arrivals produce versioned aggregate corrections; never silently overwrite a published result. Preserve occurrence and receipt times, reject impossible orderings and flag clock skew. Missing terminal events remain unresolved until the work owner reconciles them.

Many-to-many task/attempt/skill/client associations preserve exact immutable versions. Unknown version stays null with a reason; never assign the latest revision retroactively. Client declarations, server facts and self-reports remain separately labeled. A skill-loaded event is evidence of loading only. The minimal prototype can operate without actor identity except where a lawful, necessary adoption denominator requires pseudonymous cohort membership.

The privacy starting proposal is 30 days for raw structured analytics events and 12 months for aggregated trends, subject to the responsible owners' review. Keep the approved catalog/approval record for the supported revision's lifetime and its required audit period, which must be decided separately. Incident evidence uses a restricted, explicitly authorized hold and deletion schedule, not an indefinite analytics exception. Suppress reports below five people and prohibit drill-down or overlapping cohort slices that reconstruct identities. Five is a proposed minimum, not a guarantee against re-identification. No raw prompts, code, screens, customer cases or secrets are collected by default. Publish the purpose, lawful collection basis, access/deletion route and retention before collecting. Consent is not presumed to be an appropriate employment-law basis.

## Metric contracts

Each contract is a prospective collection design. No live source or observed baseline is established. N and D refer to the numerator and denominator shown for that metric.

### Validated task success

Confirmed independently accepted tasks as a share of all eligible initiated tasks in a matured start cohort; a conservative confirmed-success share, not observed failure rate.

| Contract | Definition |
| --- | --- |
| Numerator | Distinct matured task_ids with valid independent task.accepted evidence by as_of |
| Denominator | All distinct eligible task_ids started in window with started_at + preregistered task_observation_hours &lt;= as_of |
| Expression | N / D * 100 |
| Aggregation | percent |
| Unit | % |
| Eligible population | Tasks in a preregistered workflow cohort, started in window; each counted once across retries, skills and clients. |
| Exclusions | Cancelled before start, sandbox/evaluation tasks and out-of-scope workflows; never post-start failures/abandonments. |
| Events and source | task.started; task.accepted; task.failed; task.abandoned; task.cancelled; work-management acceptance record |
| Owner / cadence | Quality Engineering / Weekly pilot; monthly departmental outcome review |
| Missing evidence | Unresolved/missing terminal outcomes remain in denominator with unknown count and known-outcome coverage; do not label them failed. Invalid/missing start excluded from calculation but flagged as orphan evidence. |
| Gaming and limits | Split easy tasks or omit starts; reconcile starts to approved backlog and audit acceptance rubrics. Descriptive signal, not causal AI productivity attribution. Source completeness, task mix and sampling limit inference; report uncertainty. Maturation horizon is workflow-specific and must be approved; no automatic abandonment on timeout. |


### Skill selection precision

Correct activations among activations on an independently labeled evaluation corpus.

| Contract | Definition |
| --- | --- |
| Numerator | True-positive activations for the requested workflow |
| Denominator | True-positive plus false-positive activations |
| Expression | N / D * 100 |
| Aggregation | percent |
| Unit | % |
| Eligible population | All candidate/client labeled evaluation task-trials with known activation and relevance. |
| Exclusions | Unlabeled/unknown activations excluded with coverage; no cherry-picked failed trials. |
| Events and source | eval.selection; versioned labeled corpus and runner |
| Owner / cadence | Data & AI / Each skill/client qualification |
| Missing evidence | Unknown activation/relevance is unscorable; publish missing count and deny qualification if planned coverage incomplete. |
| Gaming and limits | Choose easy labels or hide negative cases; freeze corpus and independently review labels. Descriptive signal, not causal AI productivity attribution. Source completeness, task mix and sampling limit inference; report uncertainty. Does not show execution success; precision depends on corpus prevalence. |


### Skill selection recall

Relevant task-trials in which the intended skill activates.

| Contract | Definition |
| --- | --- |
| Numerator | True-positive activations |
| Denominator | True-positive plus false-negative task-trials |
| Expression | N / D * 100 |
| Aggregation | percent |
| Unit | % |
| Eligible population | Independently labeled relevant evaluation task-trials for a skill/client tuple. |
| Exclusions | Irrelevant tasks; missing relevance or activation reported as unscorable, not negative. |
| Events and source | eval.selection; versioned labeled corpus and runner |
| Owner / cadence | Data & AI / Each skill/client qualification |
| Missing evidence | Report evaluation coverage; null if no relevant labeled tasks. |
| Gaming and limits | Overtrigger to maximize recall; always pair with precision and negative cases. Descriptive signal, not causal AI productivity attribution. Source completeness, task mix and sampling limit inference; report uncertainty. Loading the right skill is not adherence. |


### Supported bundle coverage

Inventoried active installations with verified effective approved, supported and nonrevoked bundle/adapter tuple.

| Contract | Definition |
| --- | --- |
| Numerator | Eligible installation_ids with valid inventory evidence within approved freshness window and matching support matrix |
| Denominator | All expected active installation_ids in the managed pilot inventory |
| Expression | N / D * 100 |
| Aggregation | percent |
| Unit | % |
| Eligible population | Active installation inventory frozen for report, including invisible/offline entries until authoritative offboarding. |
| Exclusions | Verified decommissioned installations and nonpilot assets; lack of telemetry alone never excludes. |
| Events and source | inventory.observed; catalog.published; catalog.revoked; device inventory |
| Owner / cadence | Platform & IT / Weekly and at revocation |
| Missing evidence | Unknown/stale versions count outside numerator, inside denominator. Show inventory discovery coverage versus eligible device roster; if roster unknown metric is provisional. |
| Gaming and limits | Remove silent devices or trust declared versions; reconcile managed inventory and separately label attestation trust. Descriptive signal, not causal AI productivity attribution. Source completeness, task mix and sampling limit inference; report uncertainty. Even verified file digests do not prove a private model followed the content. |


### Approved-workflow adoption

Eligible participants with at least one approved-skill workflow use; usefulness assessed separately through accepted outcomes and feedback.

| Contract | Definition |
| --- | --- |
| Numerator | Distinct eligible pseudonymous participants with workflow-linked skill.used on approved revision |
| Denominator | Distinct eligible participants in frozen invited cohort |
| Expression | N / D * 100 |
| Aggregation | percent |
| Unit | % |
| Eligible population | Consented or otherwise lawfully enrolled pilot cohort for the period; supported workflow available. |
| Exclusions | Outside pilot and formally recorded leave before period; nonresponders remain eligible, not excluded. |
| Events and source | skill.used; cohort.snapshot; optional qualified client adapter or declaration |
| Owner / cadence | Data & AI / Monthly |
| Missing evidence | Show observed lower bound and telemetry/response coverage; missing usage unknown rather than non-use. |
| Gaming and limits | Invocation quotas and coercion; no target usage count, split server/client/self-report origins. Descriptive signal, not causal AI productivity attribution. Source completeness, task mix and sampling limit inference; report uncertainty. Self-report is not verified use; installation/loading is not use or benefit. Suppress small groups. |


### Change lead time

Arithmetic mean commit-to-first-successful-production-deployment duration; also publish median/p90 and sample count.

| Contract | Definition |
| --- | --- |
| Numerator | Sum of elapsed hours from committed_at to first successful production deployment for each service+commit |
| Denominator | Count of eligible service+commit pairs with valid mappings |
| Expression | N / D |
| Aggregation | mean |
| Unit | hours/change |
| Eligible population | Changes first successfully deployed to a service in reporting window; rollout retries collapse to same logical deployment. |
| Exclusions | Nonproduction, duplicates, no-op deployment with no new commits; missing mappings shown as coverage loss. |
| Events and source | change.committed; deployment.completed; VCS immutable commit timestamps and release manifest |
| Owner / cadence | Platform & IT / Weekly per service |
| Missing evidence | Missing commit mapping or negative/skewed duration excluded from numeric sample, reported explicitly; no zero substitution. |
| Gaming and limits | Timestamp rewriting and cherry-picking fast work; lock change mapping and show undeployed backlog age. Descriptive signal, not causal AI productivity attribution. Source completeness, task mix and sampling limit inference; report uncertainty. Not PR cycle time, effort saved, or a complete view of unfinished changes. p90 uses nearest-rank sorted sample. |


### Deployment frequency

Distinct successful logical production deployments per complete service-day of observation.

| Contract | Definition |
| --- | --- |
| Numerator | Distinct service_id+deployment_id successful production deployments in window |
| Denominator | Observed service-days in window |
| Expression | N / D |
| Aggregation | ratio |
| Unit | deployments/service-day |
| Eligible population | Declared production services and complete UTC observation days; report each service before pooled views. |
| Exclusions | Test/staging, failed attempts without production effect, duplicate callbacks and retries of the same rollout. |
| Events and source | deployment.completed; authoritative deployment service |
| Owner / cadence | Platform & IT / Weekly per service |
| Missing evidence | Missing feed periods not zero; report coverage and no unqualified overall rate when period incomplete. |
| Gaming and limits | Split deployments without value; pair with success, rework and failure measures. Descriptive signal, not causal AI productivity attribution. Source completeness, task mix and sampling limit inference; report uncertainty. More deployments alone do not establish better performance; affected unsuccessful changes remain in change-fail population. |


### Change fail rate

Production deployment effects requiring unplanned remediation, rollback or hotfix, not solely outage declarations.

| Contract | Definition |
| --- | --- |
| Numerator | Distinct matured production deployment_ids linked to qualifying immediate intervention |
| Denominator | All distinct production deployment_ids that reached production in the matured deployment cohort |
| Expression | N / D * 100 |
| Aggregation | percent |
| Unit | % |
| Eligible population | Deployments with production effect during window and approved intervention follow-up horizon elapsed. |
| Exclusions | Failed preproduction attempts, duplicate callbacks and no-effect retries; failures after production effect stay included. |
| Events and source | deployment.completed; deployment.failed; incident.linked; release and incident records |
| Owner / cadence | Quality Engineering / Weekly; finalized after horizon |
| Missing evidence | Known failures / all eligible deployments is a lower bound where incident linkage incomplete; label provisional and report unknown links. |
| Gaming and limits | Avoid incident links or relabel intervention planned; reconcile rollbacks/hotfixes independently. Descriptive signal, not causal AI productivity attribution. Source completeness, task mix and sampling limit inference; report uncertainty. Define immediate intervention and follow-up horizon before pilot; no universal incident-to-AI attribution. |


### Failed deployment recovery time

Mean elapsed time from production deployment failure onset to service restoration, with median/p90 and unresolved count/age.

| Contract | Definition |
| --- | --- |
| Numerator | Sum of recovery_at minus failure_started_at in hours for recovered eligible deployment failures |
| Denominator | Count of recovered eligible deployment failures with valid timestamps |
| Expression | N / D |
| Aggregation | mean |
| Unit | hours/failure |
| Eligible population | Production deployment failures beginning in window; latest verified restoration if a recovery is rescinded. |
| Exclusions | Nondeployment incidents; invalid timestamp pairs reported missing, not treated as instantaneous recovery. |
| Events and source | deployment.failed; service.restored; incident service |
| Owner / cadence | Platform & IT / Weekly with unresolved failures |
| Missing evidence | Unresolved failures reported separately and excluded only from recovered-duration distribution; prevent declaring improvement without their visibility. |
| Gaming and limits | Premature recovery declarations or omit hard cases; require operational readback and carry unresolved ages. Descriptive signal, not causal AI productivity attribution. Source completeness, task mix and sampling limit inference; report uncertainty. Not all-incident MTTR; recovered-only sample has survivorship bias. p90 nearest rank. |


### Deployment rework rate

Unplanned production deployment effects triggered by a production incident as a share of deployment effects.

| Contract | Definition |
| --- | --- |
| Numerator | Distinct incident-linked deployment_ids classified unplanned remediation |
| Denominator | All distinct production deployment_ids with production effect in window |
| Expression | N / D * 100 |
| Aggregation | percent |
| Unit | % |
| Eligible population | Production deployment effects in window with immutable planned/unplanned classification and incident linkage. |
| Exclusions | Nonproduction, no-effect retries and duplicates; do not exclude unclassified changes silently. |
| Events and source | deployment.completed; incident.linked; release intent classification |
| Owner / cadence | Platform & IT / Weekly |
| Missing evidence | Unknown classification stays denominator; observed numerator is lower bound until reconciliation; show classification coverage. |
| Gaming and limits | Call hotfixes planned; freeze reason and independently reconcile incident/deployment links. Descriptive signal, not causal AI productivity attribution. Source completeness, task mix and sampling limit inference; report uncertainty. Distinct from failure rate: one failed deployment can lead to multiple separate rework deployments. |


### Changes with escaped quality issues

Accepted changes with at least one confirmed post-acceptance defect during approved follow-up, split by severity.

| Contract | Definition |
| --- | --- |
| Numerator | Distinct eligible change_ids with one or more linked confirmed defects in follow-up |
| Denominator | Accepted change_ids with completed predeclared follow-up horizon |
| Expression | N / D * 100 |
| Aggregation | percent |
| Unit | % |
| Eligible population | Accepted changes in acceptance window whose follow-up is complete by as_of. |
| Exclusions | Immature changes shown separately; duplicates/unconfirmed reports excluded but counted as pending triage. |
| Events and source | change.accepted; defect.confirmed; defect tracking and acceptance evidence |
| Owner / cadence | Quality Engineering / Monthly mature cohorts |
| Missing evidence | Unknown linkage is a coverage warning; no fabricated clean outcome. Show absolute defect and severe incident counts as well. |
| Gaming and limits | Shorten follow-up or downgrade severity; freeze horizon and rubric and independently sample defects. Descriptive signal, not causal AI productivity attribution. Source completeness, task mix and sampling limit inference; report uncertainty. Counts affected changes, not raw defects per change; no presumption defects are AI-caused. |


### Confirmed policy effects

Eligible evaluated attempts with an actual confirmed prohibited effect; report attempts, blocked attempts and effects separately.

| Contract | Definition |
| --- | --- |
| Numerator | Distinct attempt_ids with confirmed prohibited action effect |
| Denominator | All evaluated eligible attempt_ids including failed and abandoned runs |
| Expression | N / D * 100 |
| Aggregation | percent |
| Unit | % |
| Eligible population | Governed skill trials or supported workflow attempts, reported separately for eval and live populations. |
| Exclusions | Out-of-scope runs; detection gaps remain coverage issues, not exclusions from known initiated population. |
| Events and source | attempt.started; policy.violation; gate.blocked; security audit and incident triage |
| Owner / cadence | Architecture & Security / Immediate incident action; weekly aggregates |
| Missing evidence | Unknown outcomes remain visible; zero detected effects never proves safety. Missing audits make rate provisional. |
| Gaming and limits | Hide incidents or inflate harmless trials; absolute severity counts and fixed task mix accompany rate. Descriptive signal, not causal AI productivity attribution. Source completeness, task mix and sampling limit inference; report uncertainty. Blocked attempts are not actual effects; any critical effect blocks promotion regardless of aggregate rate. |


### Cost per accepted outcome

Allocated total workflow cost including unsuccessful attempts, licenses, compute, tooling and human review/rework divided by accepted outcomes.

| Contract | Definition |
| --- | --- |
| Numerator | Sum allocated costs in one approved reporting currency for all tasks/attempts in matured start cohort |
| Denominator | Distinct independently accepted tasks in same cohort |
| Expression | N / D |
| Aggregation | ratio |
| Unit | currency/accepted outcome |
| Eligible population | Matured eligible started-task cohort, with all attempt costs through as_of and allocated shared period costs. |
| Exclusions | Unrelated projects and documented taxes/transfers outside chosen accounting basis; never failed/abandoned attempts. |
| Events and source | cost.recorded; task.accepted; finance invoices, usage ledger, sampled effort with approved rates |
| Owner / cadence | Finance & Accounting Squad / Monthly with late invoice restatement |
| Missing evidence | Missing cost buckets produce partial estimate plus coverage, not a total. Mixed currency requires dated approved conversion; zero accepted outcomes = null with full cost shown. |
| Gaming and limits | Count tokens only or hide labor/failures; reconcile invoice and allocation totals without double counting. Descriptive signal, not causal AI productivity attribution. Source completeness, task mix and sampling limit inference; report uncertainty. Allocation and sampled labor carry uncertainty; no ROI without independently measured business benefit. |


### Verification confidence and cognitive load

Three separate anonymous 1–5 item distributions: confidence in verifying output, manageable workload, usefulness. Primary item: verification confidence mean; report full distributions and response rate.

| Contract | Definition |
| --- | --- |
| Numerator | Sum valid 1–5 verification-confidence responses, one per participant per survey wave |
| Denominator | Count valid responses to that item |
| Expression | N / D |
| Aggregation | mean |
| Unit | points (1–5) |
| Eligible population | Invited eligible cohort at fixed survey wave; voluntary responses. |
| Exclusions | Invalid/out-of-range answers and superseded duplicate submission; nonresponders stay in response-rate denominator. |
| Events and source | survey.response; anonymous survey with single-use token and aggregate invitation count |
| Owner / cadence | People & Administration Squad / After pilot workflow cycle; periodic follow-up |
| Missing evidence | Report valid response count / invited count and item nonresponse; no imputation. Suppress people cohorts below five. |
| Gaming and limits | Pressure to respond positively; no manager access to individual responses, avoid identifying free text. Descriptive signal, not causal AI productivity attribution. Source completeness, task mix and sampling limit inference; report uncertainty. Perception and selection bias; not measured time savings. No composite productivity index. |


### Skills within substantive review window

Active approved skill revisions with an accountable owner and completed substantive review not past due.

| Contract | Definition |
| --- | --- |
| Numerator | Distinct active approved skill revisions with current owner, review evidence and review_due_at &gt;= as_of |
| Denominator | All active approved skill revisions in catalog snapshot |
| Expression | N / D * 100 |
| Aggregation | percent |
| Unit | % |
| Eligible population | Approved revisions currently supported for use at as_of. |
| Exclusions | Experimental and retired revisions; deprecated/revoked in-use counts reported independently, not hidden. |
| Events and source | catalog.published; catalog.reviewed; catalog.deprecated; catalog.revoked; version inventory |
| Owner / cadence | Data & AI / Monthly and each release |
| Missing evidence | Missing owner/date/evidence outside numerator; show ownerless, deprecated-in-use and revoked-in-use absolute counts. |
| Gaming and limits | Rubber-stamp review dates; require linked regression/security/usefulness evidence. Descriptive signal, not causal AI productivity attribution. Source completeness, task mix and sampling limit inference; report uncertainty. A current review is not proof of effectiveness; consumer inventory may miss shadow copies. |


### Workflow-specific business acceptance

Independently accepted domain outcomes against a predeclared business rubric, separate from technical completion.

| Contract | Definition |
| --- | --- |
| Numerator | Eligible completed-observation task_ids meeting the department-specific outcome rubric |
| Denominator | All eligible initiated workflow task_ids with matured business-outcome horizon |
| Expression | N / D * 100 |
| Aggregation | percent |
| Unit | % |
| Eligible population | One named departmental workflow and predeclared start cohort; never pool unlike rubrics. |
| Exclusions | Cancelled-before-start and unrelated workflows; unsuccessful or abandoned eligible work remains. |
| Events and source | task.started; business.accepted; departmental case/content/reconciliation/onboarding review record |
| Owner / cadence | Product Management / Each pilot cycle with owning department |
| Missing evidence | Unknown follow-up stays denominator with unresolved count; no claim actual business outcome changed without source evidence. |
| Gaming and limits | Weaken rubric or count drafts as customer benefit; lock rubric and independently audit acceptance. Descriptive signal, not causal AI productivity attribution. Source completeness, task mix and sampling limit inference; report uncertainty. Domain owner signs acceptance: Operations service accuracy; Marketing claims/rights; Finance reconciliation accuracy; HR policy correctness; Product usability/value. Not revenue uplift. |


## Run the synthetic measurement example

**Executed synthetic example — not Eldorado results.** The bundled fixture produces 1 independently accepted task from 4 matured starts: 25% confirmed success. One unresolved task remains in that denominator; known-outcome coverage is 75%. Selection precision and recall are each 1 / 2 = 50%. Allocated synthetic cost is EUR 60 / 1 accepted outcome = EUR 60 per accepted outcome. These deliberately small samples demonstrate arithmetic and missingness, not a baseline, target or ROI claim.

From the private documentation checkout, run `node scripts/ai-kpi.mjs` and `node --test scripts/ai-kpi.test.mjs`. The fixture `scripts/fixtures/ai-kpi-synthetic.json` is labeled synthetic; every result carries the same label and calculation version. This prototype has no network collectors and does not enable employee telemetry.

The executable covers validated success, selection precision/recall, change fail and rework rates, escaped quality, policy effects, cost and human experience. Other catalog metrics remain contracts rather than implemented collectors; output lists the omissions. Snapshot inputs are simplified, pre-reconciled records, not a production ingestion system. Conflicting duplicates reject the calculation rather than silently choosing a value.

</div>