feat: Slack integration — OAuth install, alert delivery, and MCP-backed Slack agent

[JeremyFunk]

Summary

Full Slack ↔ Maple integration across three areas, built on the eve-based Slack agent introduced earlier on this branch:

Backend (packages/db, packages/domain, apps/api)

• New slack_workspaces table: team_id → orgId binding with AES-256-GCM-encrypted bot token and an auto-minted org-scoped mcp-kind API key (secret stored encrypted so it can be handed to the bot). Partial unique index enforces one active workspace per org; installs transactionally revoke/replace prior same-org workspaces, and a guarded upsert closes the concurrent cross-org install race.
• Dashboard-initiated OAuth v2 install: POST /v2/integrations/slack/install (admin) → single-use, TTL-bound state → GET /oauth/slack/callback exchanges the code, mints the key, and redirects back to /integrations?integration=slack.
• GET/DELETE /v2/integrations/slack (status/uninstall — uninstall revokes both the row and the minted API key) and GET /v2/integrations/slack/channels (conversations.list proxy for the channel picker).
• Internal bot resolve endpoint GET /internal/slack/workspaces/:teamId guarded by the constant-time maple_svc_ bearer; returns {orgId, teamId, teamName, botToken, mapleApiKey}.
• New slack-bot alert destination type: posts Block Kit via chat.postMessage using the installed workspace token + configured channel; works with the existing POST /v2/alerts/destinations/:id/test.

Slack agent (apps/slack-agent)

• Multi-workspace: custom webhookVerifier owns Slack v0 signature verification and extracts team_id; per-team bot token resolved through a cached credentials client against the internal endpoint (SLACK_BOT_TOKEN remains a single-workspace dev fallback).
• Read path: eve MCP client connection to Maple's /mcp with a per-session auth resolver that selects the installing org's API key from the session's team_id — the bot gets the same tool set as the in-dashboard chat agent (listServices, searchTraces, findErrors, diagnoseService, …).
• Maple-domain instructions; README documents the manifest scopes, OAuth redirect, and the build-time MAPLE_API_BASE_URL baking footgun.

Web (apps/web)

• Slack card on the integrations page: Add to Slack → OAuth → success/error toast, workspace status, admin-gated disconnect.
• slack-bot destination in notification settings with searchable channel picker (public/private, invite-the-bot hint), only offered when the integration is installed.

Security review

An adversarial review of the OAuth flow, internal endpoint, crypto, and tenant isolation found no critical issues; its one real finding (ambiguous multi-workspace rows per org) is fixed as described above. Known accepted limitations, documented in the bot README: bot-side positive credential cache means uninstall takes up to ~5 min to fully propagate (MCP access dies immediately since the key is revoked), and concurrent events from different workspaces can make an outbound reply resolve the wrong team's token — which fails closed (Slack rejects the post).

Deployment notes

• New api env: SLACK_CLIENT_ID / SLACK_CLIENT_SECRET (wired in alchemy.run.ts).
• Railway bot env: MAPLE_API_BASE_URL (required at build time), MAPLE_INTERNAL_SERVICE_TOKEN.
• Slack app manifest: add redirect URL https://<api-host>/oauth/slack/callback, broaden bot scopes (see apps/slack-agent/README.md), enable public distribution.
• Migration 0017_fair_mandarin (slack_workspaces).

Testing

• Full repo typecheck green (30/30 turbo tasks).
• apps/api suite: 965+ passing incl. 12 new SlackIntegrationService PGlite tests (state handling, install/replace/revoke, resolve, dispatch token) and 16 AlertDeliveryDispatch tests incl. slack-bot arms.
• apps/web: destination-builder unit tests for slack-bot create/update params; suite green apart from the two known pre-existing localStorage jsdom failures.
• Bot: eve build + typecheck green; signature-verification/team-parsing/token-bridging verified by a 14-check standalone harness.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[pullfrog]

Your Pullfrog Router balance is exhausted.

You have a card on file but auto-reload is disabled, so runs paused once your balance went past the overdraft buffer.

Top up balance → · Enable auto-reload →

  ^{｜ ⚠️ this action is pinned to a commit SHA, which freezes the cleanup step — switch to @v0 or keep the SHA fresh with Dependabot ｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[github-actions]

Ingest Rust Test + Benchmark Results

Commit: 1be894e5c59e2f9c7f645b9a65131e06a63b84b2

Load Benchmark — tinybird mode, median of 3 run(s) vs main

Metric	main (median)	PR (median)	Delta
Requests/sec	15352.06	12111.72	-21.1% worse
Rows/sec	153520.61	121117.22	-21.1% worse
p50 latency	3.91 ms	4.83 ms	+23.4% worse
p95 latency	7.57 ms	9.50 ms	+25.5% worse
p99 latency	9.89 ms	11.56 ms	+16.8% worse
Export catch-up	0.026 s	0.027 s	+2.2% worse
Max RSS	15.83 MiB	15.12 MiB	-4.5% better
Failures	0	0	same

Same code path on both sides (same LOAD_TEST_INGEST_MODE), so the delta column is meaningful. Numbers come from ubuntu-latest, which is noisy — treat single-digit-percent deltas as noise.

PR load benchmark JSON (per-iteration)

[
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 10,
    "duration_seconds": 0.1657743,
    "export_catchup_seconds": 0.02555001,
    "request_rps": 12064.596261302264,
    "row_rps": 120645.96261302264,
    "p50_ms": 4.83,
    "p95_ms": 9.788,
    "p99_ms": 14.654,
    "max_rss_mb": 15.1171875,
    "max_cpu_percent": 0.0,
    "avg_cpu_percent": 0.0
  },
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 10,
    "duration_seconds": 0.161472913,
    "export_catchup_seconds": 0.02654584,
    "request_rps": 12385.978321949267,
    "row_rps": 123859.78321949267,
    "p50_ms": 4.777,
    "p95_ms": 9.322,
    "p99_ms": 11.556,
    "max_rss_mb": 14.19921875,
    "max_cpu_percent": 0.0,
    "avg_cpu_percent": 0.0
  },
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 12,
    "duration_seconds": 0.165129279,
    "export_catchup_seconds": 0.026508339,
    "request_rps": 12111.722476545181,
    "row_rps": 121117.22476545181,
    "p50_ms": 4.993,
    "p95_ms": 9.504,
    "p99_ms": 11.542,
    "max_rss_mb": 16.71875,
    "max_cpu_percent": 0.0,
    "avg_cpu_percent": 0.0
  }
]

main load benchmark JSON (per-iteration)

[
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 9,
    "duration_seconds": 0.130275667,
    "export_catchup_seconds": 0.025934987,
    "request_rps": 15352.061102861211,
    "row_rps": 153520.6110286121,
    "p50_ms": 3.859,
    "p95_ms": 7.573,
    "p99_ms": 9.89,
    "max_rss_mb": 15.828125,
    "max_cpu_percent": 0.0,
    "avg_cpu_percent": 0.0
  },
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 9,
    "duration_seconds": 0.135152472,
    "export_catchup_seconds": 0.02599498,
    "request_rps": 14798.101510122582,
    "row_rps": 147981.0151012258,
    "p50_ms": 4.113,
    "p95_ms": 8.175,
    "p99_ms": 11.515,
    "max_rss_mb": 18.12109375,
    "max_cpu_percent": 16.6,
    "avg_cpu_percent": 16.6
  },
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 9,
    "duration_seconds": 0.129020732,
    "export_catchup_seconds": 0.025870536,
    "request_rps": 15501.384692190399,
    "row_rps": 155013.84692190398,
    "p50_ms": 3.913,
    "p95_ms": 7.53,
    "p99_ms": 8.266,
    "max_rss_mb": 15.02734375,
    "max_cpu_percent": 0.0,
    "avg_cpu_percent": 0.0
  }
]

WAL-acked microbench (cargo bench --bench ingest_bench)

   Compiling maple-ingest v0.1.0 (/home/runner/_work/maple/maple/apps/ingest)
    Finished `bench` profile [optimized] target(s) in 15.74s
     Running benches/ingest_bench.rs (target/release/deps/ingest_bench-581d2100de893627)
Gnuplot not found, using plotters backend
test ingest_accept/logs_10_rows_wal_ack ... bench:       83050 ns/iter (+/- 7542)
test ingest_accept/traces_10_spans_wal_ack ... bench:      111293 ns/iter (+/- 10364)

cargo test

test telemetry::tests::pipeline_can_start_for_clickhouse_only_without_tinybird_credentials ... ok
test telemetry::tests::clickhouse_export_drops_passworded_non_https_endpoint_without_sending ... ok
test telemetry::tests::sampling_keeps_errors_even_when_ratio_low ... ok
test telemetry::tests::scraper_contract::scraper_otlp_json_decodes_with_gateway_serde_and_encodes_to_rows ... ok
test telemetry::tests::signal_tag_round_trips_all_variants ... ok
test telemetry::tests::pipeline_e2e_exports_metrics_to_fake_tinybird ... ok
test telemetry::tests::telemetry_signal_as_str_is_canonical_lowercase ... ok
test telemetry::tests::timestamp_has_nano_precision ... ok
test telemetry::tests::timestamps_match_clickhouse_datetime64_nine_format ... ok
test telemetry::tests::pipeline_e2e_exports_gzip_ndjson_to_fake_tinybird ... ok
test telemetry::tests::traces_emit_exactly_the_jsonpaths_declared_in_datasources_ts ... ok
test telemetry::tests::trace_encoder_matches_tinybird_row_shape ... ok
test telemetry::tests::wal_round_trips_frame ... ok
test telemetry::tests::wal_partial_drain_advances_cursor_without_truncating ... ok
test telemetry::tests::wal_truncates_after_full_drain_allowing_further_appends ... ok
test telemetry::tests::pipeline_e2e_exports_traces_to_fake_tinybird ... ok
test telemetry::tests::pipeline_exports_ready_org_to_clickhouse_without_tinybird_calls ... ok
test telemetry::tests::slow_clickhouse_lane_does_not_block_cosharded_tinybird_org ... ok
test telemetry::tests::clickhouse_breaker_sheds_after_threshold_failures ... ok

test result: ok. 36 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.73s

     Running unittests src/bin/load_test.rs (target/debug/deps/load_test-661a0aa1eb3f6d6d)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/main.rs (target/debug/deps/maple_ingest-c33bf80c577edb95)

running 41 tests
test autumn::tests::allowed_only_no_balance_field ... ok
test autumn::tests::flat_sub_one_gb_remaining_still_allows ... ok
test autumn::tests::flat_hardcap_depleted_blocks ... ok
test autumn::tests::flat_overage_allows ... ok
test autumn::tests::flat_hardcap_with_remaining_allows ... ok
test autumn::tests::flat_unlimited_allows ... ok
test autumn::tests::nested_balance_object_depleted_blocks ... ok
test autumn::tests::nested_overage_allows ... ok
test autumn::tests::nested_balance_object_with_remaining_allows ... ok
test autumn::tests::null_balance_no_subscription_blocks ... ok
test autumn::tests::unrecognized_shape_returns_none ... ok
test tests::clickhouse_destination_uses_native_pipeline_even_in_forward_mode ... ok
test tests::api_error_from_pipeline_maps_variants_to_status ... ok
test tests::api_error_kind_maps_status_to_stable_label ... ok
test tests::clickhouse_destination_is_terminal_in_dual_mode ... ok
test tests::cloudflare_log_record_maps_body_severity_and_attributes ... ok
test tests::cloudflare_ndjson_payload_parses_multiple_records ... ok
test tests::cloudflare_timestamps_support_rfc3339_unix_and_unix_nano ... ok
test tests::clickhouse_target_resolver_requires_current_schema ... ok
test tests::cloudflare_validation_payload_is_detected ... ok
test tests::decrypt_aes256_gcm_matches_node_crypto_fixture ... ok
test tests::clickhouse_target_resolver_rejects_password_over_http ... ok
test tests::clickhouse_target_resolver_decrypts_current_schema_password ... ok
test tests::enrichment_overwrites_tenant_fields ... ok
test tests::extract_ingest_key_returns_sentinel_literal_unchanged ... ok
test tests::rejection_span_status_is_error_only_for_5xx ... ok
test tests::hash_is_deterministic ... ok
test tests::replay_budget_disabled_when_limit_is_zero ... ok
test tests::replay_budget_scopes_totals_per_session_and_org ... ok
test tests::replay_budget_truncates_session_at_its_ceiling ... ok
test tests::resolve_ingest_key_keeps_stale_schema_on_managed_native_path ... ok
test tests::resolve_ingest_key_returns_none_when_hash_missing ... ok
test tests::resolve_ingest_key_returns_self_managed_false_when_no_settings_row ... ok
test tests::resolve_ingest_key_returns_self_managed_true_when_active_settings_row ... ok
test tests::sentinel_token_matches_only_exact_literal ... ok
test tests::tinybird_destination_keeps_forward_mode_on_forward_path ... ok
test tests::resolve_ingest_key_refreshes_routing_before_auth_cache_expires ... ok
test tests::resolve_connector_refreshes_routing_before_auth_cache_expires ... ok
test autumn::tests::fails_open_on_transport_error ... ok
test tests::resolve_ingest_key_serves_last_known_routing_when_refresh_fails ... ok
test tests::forward_mode_switches_ready_org_to_clickhouse_without_forwarding_again ... ok

test result: ok. 41 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.19s

   Doc-tests maple_ingest

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s