feat(server): env-gate the querier role + compose with the receiver (rfc0016 green .5/.7)

[jensholdgaard]

What

RFC 0016 green slice 2: env-gate the querier role into the ourios-server binary and compose it with the receiver. Fills RFC0016.5 (role gating + graceful shutdown) and RFC0016.7 (receiver + querier compose over one bucket root). Slice 1 (#283) landed the POST /v1/query handler (.1–.4).

How

• OURIOS_QUERIER_ENABLED (1/true/yes) turns the role on; it binds the HTTP query API (ourios_server::querier::serve, landed in feat(rfc0016): query endpoint handler — POST /v1/query (.1-.4) #283) on OURIOS_QUERIER_HTTP_ADDR (default 0.0.0.0:4319) over the same OURIOS_BUCKET_ROOT the receiver writes and the compactor sweeps.
• A query with no range(...) stage looks back over a server-supplied default window — OURIOS_QUERIER_DEFAULT_WINDOW_SECS (default 1h), passed to the compiler as default_window_nanos. Never unbounded (RFC 0002 §4 P5). Resolves the RFC §7 default-window open question.
• The role joins the graceful-shutdown fan-out (SIGINT/SIGTERM drains it before telemetry flush), mirroring the receiver handle.

Tests

• New unix-gated served-binary integration test rfc0016_5_7_served_querier.rs (mirrors rfc0003_16_served_binary): spawns the binary, asserts no querier listener when disabled, that an enabled querier binds + drains cleanly on SIGTERM (.5), and that both roles compose over one bucket root with the querier serving a seeded row (.7).
• Pure build_querier_config unit tests (disabled/enabled/defaults/custom/zero+nonnumeric window/malformed addr), mirroring build_receiver_config.
• Full local gate green: cargo fmt --all --check, cargo clippy -p ourios-server --all-targets --all-features -- -D warnings, cargo test -p ourios-server, mdbook build.

Invariants / hazards

No hot-path or on-disk-format change. Multi-tenancy (§3.7) is unchanged — the endpoint already takes the tenant header (#283) and the engine partitions by tenant. The H6 boundary (no DataFusion/SQL/plan text leaks) is enforced by the handler landed in #283.

Remaining

RFC0016.6 (pruning observable + OTel query metrics) is the last red arm — lands next as the observability slice (semconv registry + weaver, consulting the OpenTelemetry MCP for metric naming), then RFC 0016 → green.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@jensholdgaard, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 20 minutes and 25 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f3122e69-945a-4a80-a010-c80b19c7f085

📥 Commits

Reviewing files that changed from the base of the PR and between 70b1f7a and 1f59ce8.

📒 Files selected for processing (4)

• crates/ourios-server/src/main.rs
• crates/ourios-server/tests/rfc0016_5_7_served_querier.rs
• crates/ourios-server/tests/rfc0016_query_endpoint.rs
• docs/rfcs/0016-query-serving-endpoint.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch rfc0016-green-querier-role

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR implements RFC 0016 green slice 2 in ourios-server by env-gating the querier role, composing it with the existing receiver role over the same OURIOS_BUCKET_ROOT, and wiring it into the process graceful-shutdown flow.

Changes:

• Added querier role configuration parsing (OURIOS_QUERIER_ENABLED, OURIOS_QUERIER_HTTP_ADDR, OURIOS_QUERIER_DEFAULT_WINDOW_SECS) and querier startup/shutdown in ourios-server.
• Added a Unix-only served-binary integration test covering RFC0016.5 (role gating + SIGTERM graceful shutdown) and RFC0016.7 (receiver+querier composition over one bucket root).
• Updated RFC 0016 open questions to mark the “default time window” decision as resolved and adjusted test scaffolding accordingly.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
docs/rfcs/0016-query-serving-endpoint.md	Marks default-window behavior as resolved and documents the env knob and non-unbounded invariant.
crates/ourios-server/tests/rfc0016_query_endpoint.rs	Removes the previously-ignored .5/.7 stubs and points to the new served-binary test.
crates/ourios-server/tests/rfc0016_5_7_served_querier.rs	Adds Unix-only process-boundary tests for querier gating, composition, and graceful shutdown.
crates/ourios-server/src/main.rs	Adds querier role config + startup/shutdown wiring and unit tests for querier config assembly.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.