feat: enable CloudWatch Transaction Search on deploy and guard A/B runs

[jariy17]

What

Enable CloudWatch Transaction Search automatically and guard evaluation flows that depend on it. Transaction Search delivers agent OTel spans to the aws/spans log group, which evaluations read to score sessions — so this makes sure those spans exist.

This folds the former A/B guard PR (#2349) into this one; both the enable and the check now live on a single client.

Changes

• ObservabilityClient owns both concerns. It now takes AwsClients and builds its own CloudWatchClient, and exposes:
  • isTransactionSearchEnabled(options) — read-only check (DescribeLogGroups on aws/spans).
  • enableTransactionSearch(params) — the four idempotent setup steps (Application Signals discovery → CloudWatch Logs resource policy → X-Ray trace-segment destination → X-Ray indexing rule).
• AwsClients gains xray() and applicationSignals() factories, alongside the existing control / data / iam / logs (required, same convention).
• Enable on deploy. The CDK backend enables Transaction Search for the deploy target, hard-failing with a clear error if the principal lacks the setup permissions. The enabler is injected through the project manager.
• Opt out via config. A project can set transactionSearch: false in its spec to skip the enable step (defaults on) — for projects that manage Transaction Search elsewhere.
• A/B guard moved core → handler. Both the config-based and target-based run handlers fail fast with TransactionSearchNotEnabledError (pointing to the docs) when Transaction Search is off, closing the gap where the target-based path was unguarded.

Idempotency

Every setup step is idempotent, so it is safe to run on each deploy: Application Signals discovery no-ops if already enabled, the resource policy is skipped when already present, the trace destination is only flipped when not already CloudWatch Logs, and the indexing rule is an overwrite.

Testing

• tsc --noEmit clean; oxlint + prettier clean.
• Full suite green (the two failures in renderer.test.ts are a pre-existing, unrelated untracked file).
• Verified the real code paths against a live account: isTransactionSearchEnabled returns the correct boolean for both an enabled region and a fresh region; enableTransactionSearch runs all four steps successfully on a fresh region and is idempotent on a second run.
• Unit tests cover the deploy opt-out and the A/B disabled-path guard (the latter via a recorded fixture).

Follow-up

Transaction Search enablement currently lives in CdkBackend.deploy() because that is the only layer where the deploy target's credentials and account are resolved. It is a backend-agnostic concern, though — any backend deploying to an account wants it. As a follow-up, move target resolution (target name → credentials → account) up into ProjectManager so the enablement can run there once, independent of the chosen backend, instead of being embedded in the CDK backend.

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Changes requested

The feature is well-scoped and the test coverage in both transactionSearch.test.ts and the new harness path in cdk.test.ts is solid. One design issue worth resolving before merge:

Transaction Search runs even when the deploy is really a teardown

In src/core/project/backends/cdk.ts around lines 249–253, enableTransactionSearch is invoked before the empty-assembly check at line 284 that routes to teardown(). That means a user running deploy on a project whose spec is empty (e.g. right after project remove all) will still make Application Signals / CloudWatch Logs / X-Ray mutations, and — because the enabler hard-fails — a principal that has deploy-and-destroy permissions but lacks the TS setup permissions will be blocked from tearing down their own stack with a TransactionSearchSetupError. That's a regression in the destroy path.

Options for the author:

1. Move the enableTransactionSearch call below the countDeployableResources(...) === 0 branch so it only runs on real deploys, not teardowns. Since teardown doesn't need spans, this preserves the "spans always exist after a successful deploy" invariant.
2. Keep the current position but skip the enable when the assembly resource count is zero (functionally the same as option 1, just later in the code).
3. If you deliberately want TS setup on every deploy invocation, document why teardowns should hard-fail on missing TS permissions and mention it in the error message so the user understands what's blocking their destroy.

Minor (not blocking)

• In cdk.ts, the new import { enableTransactionSearch, transactionSearchClients } / import type { AwsCredentials } / type TransactionSearchEnabler = … block (lines 32–40) is inserted in the middle of the import block, splitting it before the later import type { CreateCloudFormationClient } on line 41. Consider moving the TransactionSearchEnabler type below all imports for consistency with the rest of the file.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[codecov-commenter]

Codecov Report

❌ Patch coverage is 96.71053% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.26%. Comparing base (a23e472) to head (ba66302).
⚠️ Report is 21 commits behind head on refactor.

Files with missing lines	Patch %	Lines
src/core/index.tsx	75.00%	4 Missing ⚠️
src/core/factories.tsx	80.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##           refactor    #2356      +/-   ##
============================================
- Coverage     97.26%   97.26%   -0.01%     
============================================
  Files           610      610              
  Lines         40590    40736     +146     
============================================
+ Hits          39480    39621     +141     
- Misses         1110     1115       +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)