Observability infra enablement: Transaction Search workflow + alarms [Chore-1142]

Story 1142Epic None3 files · +460/−0

PR #289 · pramaan-io/pramaan-functions · merged 2026-06-10

Why this matters

The scouts are riding, but the tower has no antenna.

When telemetry goes silent and billing spikes, nobody hears it.

Wrong region — and the alarm never rings.

The fix — Wire the watchtower once — and the kingdom hears when scouts go silent.

How it flows

sequenceDiagram
  autonumber
  participant Workflow as Workflow
  participant IAM as IAM
  participant CloudWatch as CloudWatch
  participant SNS as SNS
  Workflow->>Workflow: workflow_dispatch (staging)
  Workflow->>IAM: OIDC assume pramaan-agents-infra-provision-stg
  Workflow->>CloudWatch: Transaction Search destination
  Workflow->>CloudWatch: aws/spans resource policy + indexing rule
  Workflow->>CloudWatch: saved query pramaan-trace-by-correlation-id
  Workflow->>CloudWatch: Application Signals discovery + SLR
  Workflow->>CloudWatch: re-assert alarms
  CloudWatch->>SNS: alarms → topics
  Workflow-->>CloudWatch: opt-in test-fire

What changed, file by file

.github/workflows/provision-observability-infra.yml+285

New staging-only GitHub Actions workflow that idempotently provisions Transaction Search, Application Signals, saved query, and alarms, printing CLI evidence per step.

New fields: name : Provision observability infrarun : |

Files changed (3)

File	±
`.github/workflows/provision-observability-infra.yml` ★	+285
`AGENTS.md` ★	+3
`runbooks/enable-observability-infra.md` ★	+172