[afoote-mitre]

Summary

Remove the process-local search performance proof of concept so the public-testing branch focuses on the core API contract and search behavior.

Why This Change Is Needed

The in-process cache, request coalescing, cold-search queue, performance metrics, and rate limiter were temporary evaluation mechanisms. They are not intended to be the production architecture: public rate enforcement is owned by AWS WAF, and any future shared cache, admission control, or telemetry should be implemented with deployment-level AWS services rather than independent state in each API process.

Keeping those controls in the public-testing code would add configuration and operational complexity without providing consistent behavior across ECS tasks.

Changes

• Removed the process-local CPE result cache, in-flight request registry, cold-search work queue, performance event collection, and application rate limiter.
• Simplified /search execution to call OpenSearch directly while retaining request deadlines, transport cancellation, response validation, sanitized errors, exact in-bound totals, and the existing semantic candidate/filter/page-fetch strategy.
• Removed obsolete environment variables, defaults, constants, error responses, express-rate-limit dependency, and HTTP 429 OpenAPI contract.
• Added a root adm-zip@0.6.0 override to remediate GHSA-xcpc-8h2w-3j85 in the transitive cve-core dependency path; the production dependency audit now reports zero vulnerabilities.
• Updated unit and integration tests for the simplified provider/controller lifecycle.
• Regenerated the OpenAPI document and Postman collection, removing fault cases that depended on the deleted application controls.
• Updated README and Postman guidance to state that caching, admission control, rate enforcement, and performance telemetry are infrastructure responsibilities.

Preserved Proof Of Concept

The removed implementation remains available on af/search-performance-poc-archive at commit ad2546a. That branch includes docs/search-performance-proof-of-concept.md, which documents the prior flow and a migration path to AWS Valkey, WAF/ALB/ECS controls, and CloudWatch/OpenTelemetry/X-Ray.