Repository navigation
feat(security): Vercel and GCP audit events go to the audit trail, not to logs - #2530
Merged
Merged
Maple Review Bot / Maple / review
succeeded
Nov 13, 2026 in 32s
Confidence 10/10 · No issues found
🟢 Confidence 10/10 · safe to merge. Only the merge delta was new since 04f6108; those four files are main's, and the ingest path was reviewed before with no open findings.
no findings · tests covered · risk high · 2/2 new units observable
The delta since the last review is a merge of main: the four named files are unchanged from base, so they carry no PR work and nothing new to judge. The McpQueryError issues in packages/backend/src/queries/registry.ts are unrelated and not addressed by this diff.
Before merge
- Env var · Set
INGEST_AUDIT_TRAIL_ENABLED=truein the prd gateway environment only afteraudit_trail_eventsexists in Tinybird ·apps/ingest/alchemy/gateway-env.ts:29 - Infra · Check every environment has what this config now expects ·
apps/ingest/alchemy.run.ts
Production impact
Open errors in the changed files (2)
| Issue | Service | Occurrences | File |
|---|---|---|---|
| @maple/mcp/errors/McpQueryError (7 issues) | maple-ai | 33 | packages/backend/src/queries/registry.ts |
| @maple/mcp/errors/McpQueryError (3 issues) | maple-chat | 15 | packages/backend/src/queries/registry.ts |
After this merges, Maple checks whether they stop.
Production traffic of the changed files (last 7 days)
| File | Calls/day | Busiest operations |
|---|---|---|
apps/ingest/src/audit_trail.rs |
3.0k | maple 3.0k/day, 2.1% err |
apps/web/src/page/security/audit-log/view.ts |
3.0k | maple 3.0k/day, 2.1% err |
apps/web/src/route/search.ts |
3.0k | maple 3.0k/day, 2.1% err |
packages/domain/src/audit-trail.ts |
3.0k | maple 3.0k/day, 2.1% err |
apps/ingest/src/main.rs |
2.9k | POST 1.8k/day, 0.1% errPOST 1.0k/day, 0.1% err |
apps/ingest/src/telemetry.rs |
44 | POST /v1/events 44/day, 0.0% err |
What was checked
git diff 04f6108..d8dd5ffnames only the four files, and all four are identical between base and head- No conflict markers at head under
packages/ui,packages/viewsorapps/ingest/src - The Vercel drain handler opens an
ingest_vercel_audit_trailspan withmaple.audit_trail.*attributes
Observability coverage: 2 of 2 changes observable
| Change | Kind | Observable | Evidence |
|---|---|---|---|
| Vercel audit drain delivery handler | HTTP consumer | yes | handle_vercel_audit_trail opens span ingest_vercel_audit_trail recording maple.audit_trail.events and maple.audit_trail.skipped (apps/ingest/src/main.rs:4144) |
GCP audit entry write to audit_trail_events |
queue-to-warehouse write | yes | Runs inside the existing ingest span at main.rs:6703, sharing store_audit_trail_rows with the traced drain handler |
d8dd5ff · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.
Loading