initMetrics() idempotent re-entry now returns the values bound at first
init rather than re-reading env (which could lie if env mutated between
calls). shutdownMetrics() writes exporter/provider shutdown failures to
stderr instead of swallowing — silent failure during exit hid lost
final-flush data. Adds tests for idempotent re-init and forceEnabled.
Comments restated the privacy invariant in four places and narrated what
the next line of code did. Collapse to one canonical site on observe()'s
signature; drop AI-pattern phrasing, #1351 references, and dated bucket
prose. No behavior change; 11 tests still pass.
Adds server-side observability via the OpenTelemetry metrics SDK with a
Prometheus exporter that exposes a /metrics endpoint. Answers the
maintainer's framing: OpenTelemetry format, anonymous, quantized,
Prometheus.
Instruments (meter `gitnexus.mcp`):
- gitnexus_mcp_tool_requests_total (Counter) — labels: tool, error
- gitnexus_mcp_tool_request_duration_seconds (Histogram) — labels: tool, error
- gitnexus_mcp_tool_result_bytes (Histogram) — labels: tool
- gitnexus_mcp_tool_inflight (UpDownCounter) — labels: tool
Anonymity is type-enforced at the wrap-point: observe() takes a
boolean error detector only, never a message string. Error messages
echo user input (cypher parse errors include the offending clause) and
are recorded as error=true/false labels only. target_info and
otel_scope_info are suppressed on the exporter so the only label keys
that ever appear are { tool, error, le }.
Histogram buckets:
- Duration: [0.001, 0.005, 0.025, 0.1, 0.5, 2.5, 10, 30] s
- Result size: [512, 2048, 8192, 32768, 131072, 524288, 2097152] B
Opt-in via GITNEXUS_OTEL_METRICS=on/true/1. Default off. Binds 127.0.0.1
by default. `gitnexus serve` is the supported scrape target; stdio mode
spawns one process per agent host, so its metrics opt-in is for local
dev only.
Refs #1351.
