MCP: bound Athena trace ID lookups

[huronat]

What

• derive a narrow Athena lookup window from canonical ULID trace IDs
• narrow resolved-session follow-ups to the matching event streams
• fall back from oversized $path lists to bounded stream/day partitions only for exact ID/session predicates
• document the fallback contract

Why

Live verification on sie-gw-cfg showed synty_trace_list succeeding while synty_trace_show on its returned ID attempted 6,034 raw objects and hit the 1,000-object guard.

Verification

• cargo test --locked — 301 passed
• cargo test --locked --no-default-features — 280 passed
• cargo test --locked --features s3,gcs,mcp-http,athena — 321 passed
• new scenario covers 1,001 physical paths and asserts exact-ID stream/day fallback retains the ID predicate

Summary by CodeRabbit

• New Features
  • Improved Athena trace lookups by deriving focused time windows from event IDs.
  • Added fallback querying across bounded stream and day partitions when precise object selection exceeds request limits.
  • Preserved exact ID and session filtering during fallback searches.
• Bug Fixes
  • Improved trace context expansion by limiting follow-up queries to matched event streams.
  • Added support for lowercase ULIDs and validation of invalid or out-of-range ULID timestamps.
• Documentation
  • Documented Athena event-time recovery behavior for trace viewing and comparison.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0adaedc0-36c8-4fe2-90ce-1a5bb6fa1854

📥 Commits

Reviewing files that changed from the base of the PR and between 55f7b9a and b4d51e3.

📒 Files selected for processing (3)

• README.md
• src/event.rs
• src/trace_athena.rs

---

📝 Walkthrough

Walkthrough

Athena trace lookups derive bounded windows from ULIDs, fall back from object-path enumeration to day partitions when limits are exceeded, and restrict follow-up queries to streams found in matched events.

Changes

Bounded trace lookup

Layer / File(s)	Summary
ULID timestamp and lookup window src/event.rs, src/trace_athena.rs	ULID timestamps are decoded case-insensitively and used for bounded show and compare windows, with tests for valid, invalid, and multi-ID inputs.
Bounded selection and SQL paths src/trace_athena.rs	Selection falls back to stream/day partitions when object-path enumeration exceeds limits, and SQL adds $path filtering only when paths are available.
Stream-scoped context loading src/trace_athena.rs, README.md	Matched event streams constrain session and context follow-up queries, and the exact-predicate partition fallback is documented.

Sequence Diagram(s)

sequenceDiagram
  participant Backend.show
  participant id_lookup_window
  participant select
  participant select_sql
  participant load_store
  participant event_streams
  Backend.show->>id_lookup_window: derive ULID-centered Window
  Backend.show->>select: request bounded selection
  select->>select_sql: build object-path or partition SQL
  select-->>load_store: return initially selected rows
  load_store->>event_streams: extract matching event streams
  load_store->>select: query matching context streams

Loading

Possibly related PRs

• superlinked/synty#20: Overlaps with the Athena trace-query selection and SQL generation changes.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/athena-trace-id-window

---

_{Comment @coderabbitai help to get the list of available commands.}

[huronat]

Live validation on sie-gw-cfg is complete for b4d51e3 (synty:pr21-b4d51e3, Helm revision 25).

• full s3,gcs,mcp-http,athena matrix: 322 passed
• cold-cache synty_trace_compare succeeded against the production S3/Athena data: exact selection 2 rows / 211,236 bytes scanned; bounded context 800 rows / 5,397,892 bytes scanned
• synty_trace_show succeeded for the same canonical ID and returned redacted surrounding evidence
• an unknown source filter failed closed with no matching-stream access
• pod is Ready with the permanent read-only IRSA; the one-time writer service account and CloudFormation role were deleted after publication

The raw events/ objects were not modified. The bucket points at format-2 build f1c28726b16dd2fc.0.