M10: query remote traces through Athena

.github/workflows/ci.yml

@@ -19,10 +19,10 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --locked
       - run: cargo test --locked --no-default-features
-      - run: cargo test --locked --features s3,gcs,mcp-http
+      - run: cargo test --locked --features s3,gcs,mcp-http,athena
       - name: Exercise the HTTP MCP listener
         run: |
-          cargo build --locked --features s3,gcs,mcp-http
+          cargo build --locked --features s3,gcs,mcp-http,athena
           scripts/mcp-http-smoke.sh target/debug/synty
       - run: git diff --check
 
@@ -75,13 +75,18 @@ jobs:
           --set mcp.enabled=true
           --set mcp.tls.existingSecret=synty-mcp-tls
           --set mcp.allowedOrigins[0]=https://memory.example.com
+          --set mcp.athena.enabled=true
+          --set mcp.athena.workgroup=synty-mcp-readonly
           --set-json 'networkPolicy.objectStoreCidrs=["203.0.113.10/32"]'
+          --set-json 'networkPolicy.awsApiCidrs=["198.51.100.20/32"]'
           --set persistence.enabled=false >/tmp/synty-options.yaml
       - name: Assert MCP probe and egress contracts
         run: |
           grep -q 'path: /ready' /tmp/synty-options.yaml
           grep -q 'scheme: HTTPS' /tmp/synty-options.yaml
           grep -q '203.0.113.10/32' /tmp/synty-options.yaml
+          grep -q -- '--athena-workgroup "synty-mcp-readonly"' /tmp/synty-options.yaml
+          grep -q '198.51.100.20/32' /tmp/synty-options.yaml
           if grep -q -- '- {}' /tmp/synty-options.yaml; then
             echo "MCP rendered an unrestricted NetworkPolicy rule" >&2
             exit 1

.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@1.97.0
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --locked # pure: no model, corpus, or network
-      - run: cargo test --locked --features s3,gcs,mcp-http # compile + test shipped remote paths
+      - run: cargo test --locked --features s3,gcs,mcp-http,athena # compile + test shipped remote paths
       - name: Verify tag, binary, and chart versions agree
         run: |
           cargo_version="$(awk -F ' *= *' '$1 == "version" {gsub(/"/, "", $2); print $2; exit}' Cargo.toml)"
@@ -38,11 +38,11 @@ jobs:
           # Apple Silicon: GPU encode via metal, with runtime CPU fallback.
           - os: macos-14
             asset: synty-darwin-arm64
-            features: metal,s3,gcs,mcp-http
+            features: metal,s3,gcs,mcp-http,athena
           # Linux x64: plain CPU, portable.
           - os: ubuntu-latest
             asset: synty-linux-x64
-            features: s3,gcs,mcp-http
+            features: s3,gcs,mcp-http,athena
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4

AGENTS.md

@@ -33,8 +33,8 @@ Rust binary.
   the other opt-in backends. None may become default.
 - Distribution is GitHub Releases, cut by `.github/workflows/release.yml` on a
   `v*` tag: it builds per platform with explicit features (this does not change
-  the default above) — `--features metal,s3,gcs,mcp-http` for the macOS asset,
-  `--features s3,gcs,mcp-http` for Linux — and attaches `synty-<os>-<arch>`
+  the default above) — `--features metal,s3,gcs,mcp-http,athena` for the macOS asset,
+  `--features s3,gcs,mcp-http,athena` for Linux — and attaches `synty-<os>-<arch>`
   (+ `.sha256`).
   `synty upgrade` self-updates from the latest release (sha256-verified, via the
   GitHub token); a cached nag flags when behind. These are ops, not pipeline