Skip to content

fix(ingest): a late audit event is still stored, and the Vercel drain stamps its own source - #2561

Merged
Makisuo merged 1 commit into
mainfrom
audit-trail/gateway-hardening
Nov 13, 2026
Merged

Makisuo merged 1 commit into
mainfrom
audit-trail/gateway-hardening

fix(ingest): a late audit event is still stored, and the Vercel drain…

40d3dd7
Select commit
Loading
Failed to load commit list.
Maple Review Bot / Maple / review succeeded Nov 13, 2026 in 1m 25s

Confidence 10/10 · No issues found

🟢 Confidence 10/10 · safe to merge. Two contained changes, each pinned by a test that fails before it; the shed exemption keys on a signal no sender can set.
no findings · tests covered · risk medium

Exempts AuditTrail frames from the export worker's max-queue-age shed, and makes the Vercel audit drain stamp the integrated source instead of the key's default. Both changes are contained, off by default, and tested; safe to merge.

  • export_and_mark no longer sheds frames whose signal is AuditTrail
  • The Vercel audit drain stamps the verified claim's source via note_claimed_source_use
  • Docs drop the claim that audit events appear on the Vercel overview
What was checked
  • The exemption keys on frame.signal, set by the accept path (store_audit_trail_rows), never by a sender
  • The drain resolves its stamp with source_uuid_from_public_id, the same map verify_source_claims verified through (main.rs:8757)
  • Dropping note_source_use matches the general path, which skips the default source when a claim is kept (main.rs:8819), and org byte caps still bound the WAL lane

40d3dd7 · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.