[afoote-mitre]

Summary

Add disabled-by-default, aggregate performance telemetry for /search so controlled load tests can distinguish OpenSearch execution time from transport delay, application-side semantic filtering, and Node.js process pressure.

The telemetry emits one structured search_performance_summary JSON event per active interval. It does not record request bodies, filter values, credentials, or returned records.

Why This Is Needed

External Artillery, ALB, ECS, and OpenSearch metrics show when latency or errors increase, but they do not identify where an individual Search API process spends its time. This change adds the missing application-side evidence needed to correlate:

• API wall-clock time with OpenSearch's server-reported took value
• semantic candidate retrieval with in-process post-filtering and page fetching
• request concurrency with event-loop delay, CPU, and memory pressure
• completed searches with timeout, disconnect, availability, and upstream-error outcomes

This is diagnostic instrumentation rather than a permanent metrics backend. It writes aggregate events to standard output for collection by the deployment logging system and remains disabled unless explicitly enabled.

Changes

Area	Primary files	Change
Telemetry aggregation	utils/searchPerformanceTelemetry.js, utils/constants.js	Adds bounded interval distributions, search-type classification, lifecycle counters, outcome counts, process CPU/memory, and event-loop measurements. Percentile reservoirs are capped at 2,000 samples per measurement and interval.
Search-stage instrumentation	controllers/searchController.js	Measures direct OpenSearch calls, semantic candidate retrieval, post-filtering, follow-up page fetches, candidate counts, matched counts, total request duration, and sanitized outcomes. Telemetry failures are isolated from request handling.
Runtime configuration	config/default.jsonc, config/custom-environment-variables.jsonc, .env.example	Adds SearchLogPerformanceTimings and SearchPerformanceTelemetryIntervalMs. Telemetry defaults to disabled with a 10-second interval and a 1-second minimum.
Documentation	README.md	Documents configuration, emitted fields, privacy boundaries, multi-task aggregation, and how to interpret OpenSearch wall time versus took, post-filter time, active requests, and event-loop pressure.
Coverage	utils/searchPerformanceTelemetry.test.js, controllers/searchController.test.js, config/runtime-config.test.js	Covers disabled behavior, configuration normalization, aggregation, bounded sampling, fail-open diagnostics, interval-spanning requests, controller timing stages, outcomes, and runtime environment mappings.
Dependency security	package.json, package-lock.json	Updates the qs override to 6.16.0 and the transitive development dependency browserslist to 4.28.9, resolving two medium qs alerts and two high browserslist alerts. body-parser remains on its already-patched 1.20.6 release. GitHub will continue reporting default-branch alerts until this change reaches the default branch.