feat(orchestration): add default 5m telemetry lookback policy

[dirtyren]

Summary

When Aura operates as an SRE orchestrator or incident responder, queries to metrics, logs, and telemetry systems should focus on the most recent operational state by default. Without an explicit lookback window, agents or specialist workers can either issue unbounded queries or fail to focus on recent anomalies.

This PR establishes a default 5-minute lookback window policy across Aura's quickstart configuration, SRE orchestration integration tests, and example incident response agent profiles:

• Coordinator & Delegation Rules: Instructs workers to inspect telemetry (metrics, logs, traces, alerts) from the last 5 minutes (now-5m to now) by default.
• Specialist Workers (incident-responder, metrics-analyst, log-analyst): Added default 5m time window guidance to preambles.
• User Override Preservation: Explicitly respects user requests when a different or longer time window is requested (e.g. "past 2 hours", "since yesterday").
• Focused Test Coverage: Added dedicated test coverage inspecting telemetry query arguments for both the default 5-minute lookback window and explicit user overrides.

Changes

• quickstart.toml: Added default 5m lookback policy to coordinator delegation rules/principles and worker preambles (incident-responder, metrics-analyst, log-analyst).
• configs/integration-sre-orchestration.toml: Added 5m lookback guidance to coordinator routing and prometheus-analyst preamble.
• examples/complete/kubernetes-sre-orchestrated-multi-model.toml: Added 5m lookback guidance to coordinator routing and prometheus-analyst.
• examples/complete/kubernetes-sre.toml: Added 5m telemetry lookback step to cluster troubleshooting workflow.
• examples/complete/incident-response-mezmo.toml & examples/complete/incident-response-datadog.toml: Added default 5m telemetry lookback guideline to triage workflows.
• crates/aura-web-server/tests/sre_orchestration_test.rs:
  • Added helper functions get_tool_calls and extract_telemetry_query to inspect tool invocation arguments.
  • Enhanced test_sre_workers_use_domain_tools to inspect arguments when telemetry queries execute.
  • Added test_sre_telemetry_query_defaults_to_five_minute_window to assert that telemetry query arguments default to a 5-minute lookback interval (5m).
  • Added test_sre_telemetry_query_respects_explicit_override_window to assert that user-specified overrides (e.g. 1 hour) are respected in query arguments and not overwritten by the 5-minute default.
• crates/aura/src/orchestration/config.rs: Added unit tests verifying preamble builders preserve telemetry lookback policies.
• crates/aura-config/src/config_test.rs: Added unit tests verifying shipped configurations preserve lookback guidance.

Verification

• Validated that all modified and existing TOML configurations parse cleanly.
• Added unit tests for preamble builders and shipped configuration validation.
• Added SRE integration test assertions for default lookback arguments and explicit override preservation.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[greptile-apps]

Confidence Score: 4/5

The PR is not yet safe to merge because the five-minute cutoff can hide older active incidents or alerts.

Findings

1.  Lookback Hides Active Incidents ▶
2.  Lookback Behavior Lacks Coverage ▶

Summary

This PR adds a default five-minute telemetry lookback policy to shipped SRE and incident-response configurations and adds tests intended to cover the default and user-specified overrides.

• Adds lookback guidance to coordinator and specialist-worker prompts.
• Preserves explicitly requested longer time windows.
• Adds configuration, preamble, and orchestration integration tests.
• The earlier active-incident concern remains unresolved, and the attempted integration-test fix remains incomplete.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    U[User telemetry request] --> C[Coordinator]
    C -->|No explicit range| D[Apply default last 5 minutes]
    C -->|Explicit range| O[Preserve requested range]
    D --> W[Specialist worker]
    O --> W
    W --> T[Telemetry tool query]
    T --> R[Timestamped findings]

Loading

_{Reviews (4) · Last reviewed commit: "Merge branch 'nightly' into feat/sre-tel..."}

[greptile-apps]

Lookback Hides Active Incidents

Applying the five-minute cutoff to incidents, monitors, alerts, and status can hide an active object that opened earlier. For example, an older but still-triggered PagerDuty incident could be omitted, causing incomplete triage or a false all-clear. Query active or open state independently, and apply the lookback only to the supporting telemetry timeline. This pattern also appears in the Datadog and Mezmo incident-response examples.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[greptile-apps]

Lookback Behavior Lacks Coverage

The SRE orchestration tests only check tool-name prefixes and do not inspect telemetry query arguments. A worker can therefore ignore the five-minute default or overwrite a user-requested range while all current tests still pass. Please add focused coverage for both the default window and an explicit override.

[dirtyren]

I have read the CLA Document and I hereby sign the CLA

[Shearerbeard]

Hey @dirtyren - this PR looks good but only has some minor failings with fmt (we use nightly - you can see some of the setup in the .ci dir) and a commitlint run. There is a commitlintrc.js at the root that should be able to run with npm run commitlint.