[Makisuo]

Follow-up to #2530, from the review it got once it targeted main. All of it is on the audit trail path, which is off in production until INGEST_AUDIT_TRAIL_ENABLED is set.

What changes

• A late audit event is still stored. The export worker sheds any frame older than INGEST_QUEUE_MAX_AGE_SECS (300 s by default), and that included audit events, so an export backlog longer than five minutes dropped accepted audit rows. Audit trail frames are now exempt. Their volume is bounded per org at the accept path (10 requests a second for Vercel, 100 for GCP), so the exemption cannot build an unbounded backlog.
• The Vercel audit drain stamps the integration's source. An accepted delivery recorded use of the private key's default source, not the integration source the delivery was verified against. An integration whose only feed is the audit drain never looked used.
• Docs. The Vercel page no longer says audit events show on the Vercel overview or in Logs, and both the Vercel and GCP pages say what a self-hosted gateway needs to store audit events in the audit log, and that without it they stay logs every member can read.

Not in this PR

• A Tinybird batch is dropped once its retry budget is spent, audit rows included. That is the gateway's behaviour for every signal and needs its own design (a lane that holds audit rows without holding other signals behind them).
• A Vercel audit delivery is authenticated by the org's private ingest key and its integration source, not by a signature Vercel computes. Whoever holds that key can write the org an audit event. Verifying the drain's signature needs a per-drain secret the gateway can read.

Verification

• cargo test in apps/ingest: 377 + 215 + 4 pass. New tests: an audit event past the queue age bound is still exported; an accepted Vercel audit delivery records use of the integration's source.
• The existing test that a log frame past the bound is shed still passes.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 40 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: c38e3012-ca51-498c-a3e1-a6e89ea48803

Commits

Reviewing files that changed from the base of the PR and between 6a14c3f and 40d3dd7.

Files selected for processing: 5

• apps/ingest/src/main.rs
• apps/ingest/src/telemetry.rs
• apps/landing/src/content/docs/integrations/gcp.md
• apps/landing/src/content/docs/integrations/vercel.md
• docs/ingest-wal-durability.md

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[maple-review-bot]

Maple review

🟢 Confidence 10/10 · safe to merge. Two contained changes, each pinned by a test that fails before it; the shed exemption keys on a signal no sender can set.
_{no findings · tests covered · risk medium}

Exempts AuditTrail frames from the export worker's max-queue-age shed, and makes the Vercel audit drain stamp the integrated source instead of the key's default. Both changes are contained, off by default, and tested; safe to merge.

• export_and_mark no longer sheds frames whose signal is AuditTrail
• The Vercel audit drain stamps the verified claim's source via note_claimed_source_use
• Docs drop the claim that audit events appear on the Vercel overview

_{40d3dd7 · What was checked, coverage and telemetry details are on the Maple / review check. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}