feat: Slack integration — OAuth install, alert delivery, and MCP-backed Slack agent

[JeremyFunk]

Summary

Full Slack ↔ Maple integration across three areas, built on the eve-based Slack agent introduced earlier on this branch:

Backend (packages/db, packages/domain, apps/api)

• New slack_workspaces table: team_id → orgId binding with AES-256-GCM-encrypted bot token and an auto-minted org-scoped mcp-kind API key (secret stored encrypted so it can be handed to the bot). Partial unique index enforces one active workspace per org; installs transactionally revoke/replace prior same-org workspaces, and a guarded upsert closes the concurrent cross-org install race.
• Dashboard-initiated OAuth v2 install: POST /v2/integrations/slack/install (admin) → single-use, TTL-bound state → GET /oauth/slack/callback exchanges the code, mints the key, and redirects back to /integrations?integration=slack.
• GET/DELETE /v2/integrations/slack (status/uninstall — uninstall revokes both the row and the minted API key) and GET /v2/integrations/slack/channels (conversations.list proxy for the channel picker).
• Internal bot resolve endpoint GET /internal/slack/workspaces/:teamId guarded by the constant-time maple_svc_ bearer; returns {orgId, teamId, teamName, botToken, mapleApiKey}.
• New slack-bot alert destination type: posts Block Kit via chat.postMessage using the installed workspace token + configured channel; works with the existing POST /v2/alerts/destinations/:id/test.

Slack agent (apps/slack-agent)

• Multi-workspace: custom webhookVerifier owns Slack v0 signature verification and extracts team_id; per-team bot token resolved through a cached credentials client against the internal endpoint (SLACK_BOT_TOKEN remains a single-workspace dev fallback).
• Read path: eve MCP client connection to Maple's /mcp with a per-session auth resolver that selects the installing org's API key from the session's team_id — the bot gets the same tool set as the in-dashboard chat agent (listServices, searchTraces, findErrors, diagnoseService, …).
• Maple-domain instructions; README documents the manifest scopes, OAuth redirect, and the build-time MAPLE_API_BASE_URL baking footgun.

Web (apps/web)

• Slack card on the integrations page: Add to Slack → OAuth → success/error toast, workspace status, admin-gated disconnect.
• slack-bot destination in notification settings with searchable channel picker (public/private, invite-the-bot hint), only offered when the integration is installed.

Security review

An adversarial review of the OAuth flow, internal endpoint, crypto, and tenant isolation found no critical issues; its one real finding (ambiguous multi-workspace rows per org) is fixed as described above. Known accepted limitations, documented in the bot README: bot-side positive credential cache means uninstall takes up to ~5 min to fully propagate (MCP access dies immediately since the key is revoked), and concurrent events from different workspaces can make an outbound reply resolve the wrong team's token — which fails closed (Slack rejects the post).

Deployment notes

• New api env: SLACK_CLIENT_ID / SLACK_CLIENT_SECRET (wired in alchemy.run.ts).
• Railway bot env: MAPLE_API_BASE_URL (required at build time), MAPLE_INTERNAL_SERVICE_TOKEN.
• Slack app manifest: add redirect URL https://<api-host>/oauth/slack/callback, broaden bot scopes (see apps/slack-agent/README.md), enable public distribution.
• Migration 0017_fair_mandarin (slack_workspaces).

Testing

• Full repo typecheck green (30/30 turbo tasks).
• apps/api suite: 965+ passing incl. 12 new SlackIntegrationService PGlite tests (state handling, install/replace/revoke, resolve, dispatch token) and 16 AlertDeliveryDispatch tests incl. slack-bot arms.
• apps/web: destination-builder unit tests for slack-bot create/update params; suite green apart from the two known pre-existing localStorage jsdom failures.
• Bot: eve build + typecheck green; signature-verification/team-parsing/token-bridging verified by a 14-check standalone harness.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[pullfrog]

Your Pullfrog Router balance is exhausted.

You have a card on file but auto-reload is disabled, so runs paused once your balance went past the overdraft buffer.

Top up balance → · Enable auto-reload →

  ^{｜ ⚠️ this action is pinned to a commit SHA, which freezes the cleanup step — switch to @v0 or keep the SHA fresh with Dependabot ｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}

[github-actions]

Ingest Rust Test + Benchmark Results

Commit: 79c79ccafb7d0620e4aeba429293865aba941eff

Load Benchmark — tinybird mode, median of 3 run(s) vs main

Metric	main (median)	PR (median)	Delta
Requests/sec	8939.63	11264.18	+26.0% better
Rows/sec	89396.31	112641.78	+26.0% better
p50 latency	6.99 ms	5.52 ms	-21.1% better
p95 latency	13.15 ms	10.80 ms	-17.9% better
p99 latency	15.72 ms	11.83 ms	-24.7% better
Export catch-up	0.026 s	0.026 s	+1.0% worse
Max RSS	15.52 MiB	14.78 MiB	-4.7% better
Failures	0	0	same

Same code path on both sides (same LOAD_TEST_INGEST_MODE), so the delta column is meaningful. Numbers come from ubuntu-latest, which is noisy — treat single-digit-percent deltas as noise.

PR load benchmark JSON (per-iteration)

[
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 10,
    "duration_seconds": 0.173250705,
    "export_catchup_seconds": 0.02609651,
    "request_rps": 11543.964568571308,
    "row_rps": 115439.64568571308,
    "p50_ms": 5.254,
    "p95_ms": 10.812,
    "p99_ms": 15.784,
    "max_rss_mb": 18.03515625,
    "max_cpu_percent": 20.0,
    "avg_cpu_percent": 20.0
  },
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 11,
    "duration_seconds": 0.178654354,
    "export_catchup_seconds": 0.02611235,
    "request_rps": 11194.801331290253,
    "row_rps": 111948.01331290253,
    "p50_ms": 5.532,
    "p95_ms": 10.798,
    "p99_ms": 11.832,
    "max_rss_mb": 14.78125,
    "max_cpu_percent": 0.0,
    "avg_cpu_percent": 0.0
  },
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 11,
    "duration_seconds": 0.177554009,
    "export_catchup_seconds": 0.026136705,
    "request_rps": 11264.178214077947,
    "row_rps": 112641.78214077948,
    "p50_ms": 5.52,
    "p95_ms": 10.552,
    "p99_ms": 11.769,
    "max_rss_mb": 14.6328125,
    "max_cpu_percent": 0.0,
    "avg_cpu_percent": 0.0
  }
]

main load benchmark JSON (per-iteration)

[
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 12,
    "duration_seconds": 0.208447296,
    "export_catchup_seconds": 0.026127761,
    "request_rps": 9594.751471374328,
    "row_rps": 95947.51471374328,
    "p50_ms": 6.46,
    "p95_ms": 12.266,
    "p99_ms": 15.723,
    "max_rss_mb": 15.515625,
    "max_cpu_percent": 16.6,
    "avg_cpu_percent": 16.6
  },
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 13,
    "duration_seconds": 0.223722871,
    "export_catchup_seconds": 0.025458494,
    "request_rps": 8939.63138887128,
    "row_rps": 89396.3138887128,
    "p50_ms": 6.992,
    "p95_ms": 13.154,
    "p99_ms": 14.947,
    "max_rss_mb": 18.6796875,
    "max_cpu_percent": 0.0,
    "avg_cpu_percent": 0.0
  },
  {
    "ingest_mode": "tinybird",
    "requests": 2000,
    "successes": 2000,
    "failures": 0,
    "rows_sent": 20000,
    "rows_exported": 20000,
    "imports": 11,
    "duration_seconds": 0.247873411,
    "export_catchup_seconds": 0.025861601,
    "request_rps": 8068.634679013636,
    "row_rps": 80686.34679013636,
    "p50_ms": 7.583,
    "p95_ms": 15.027,
    "p99_ms": 21.262,
    "max_rss_mb": 14.6015625,
    "max_cpu_percent": 16.6,
    "avg_cpu_percent": 16.6
  }
]

WAL-acked microbench (cargo bench --bench ingest_bench)

   Compiling maple-ingest v0.1.0 (/home/runner/_work/maple/maple/apps/ingest)
    Finished `bench` profile [optimized] target(s) in 14.32s
     Running benches/ingest_bench.rs (target/release/deps/ingest_bench-581d2100de893627)
Gnuplot not found, using plotters backend
test ingest_accept/logs_10_rows_wal_ack ... bench:       99037 ns/iter (+/- 6982)
test ingest_accept/traces_10_spans_wal_ack ... bench:      121804 ns/iter (+/- 10192)

cargo test

test telemetry::tests::metrics_emit_exactly_the_jsonpaths_declared_in_datasources_ts ... ok
test telemetry::tests::migrate_legacy_shard_relocates_frames_into_lanes ... ok
test telemetry::tests::clickhouse_breaker_trips_sheds_and_recovers ... ok
test telemetry::tests::pipeline_can_start_for_clickhouse_only_without_tinybird_credentials ... ok
test telemetry::tests::clickhouse_export_drops_passworded_non_https_endpoint_without_sending ... ok
test telemetry::tests::sampling_keeps_errors_even_when_ratio_low ... ok
test telemetry::tests::scraper_contract::scraper_otlp_json_decodes_with_gateway_serde_and_encodes_to_rows ... ok
test telemetry::tests::signal_tag_round_trips_all_variants ... ok
test telemetry::tests::pipeline_e2e_exports_gzip_ndjson_to_fake_tinybird ... ok
test telemetry::tests::telemetry_signal_as_str_is_canonical_lowercase ... ok
test telemetry::tests::timestamp_has_nano_precision ... ok
test telemetry::tests::timestamps_match_clickhouse_datetime64_nine_format ... ok
test telemetry::tests::trace_encoder_matches_tinybird_row_shape ... ok
test telemetry::tests::traces_emit_exactly_the_jsonpaths_declared_in_datasources_ts ... ok
test telemetry::tests::wal_partial_drain_advances_cursor_without_truncating ... ok
test telemetry::tests::wal_round_trips_frame ... ok
test telemetry::tests::wal_truncates_after_full_drain_allowing_further_appends ... ok
test telemetry::tests::pipeline_e2e_exports_metrics_to_fake_tinybird ... ok
test telemetry::tests::pipeline_e2e_exports_traces_to_fake_tinybird ... ok
test telemetry::tests::pipeline_exports_ready_org_to_clickhouse_without_tinybird_calls ... ok
test telemetry::tests::slow_clickhouse_lane_does_not_block_cosharded_tinybird_org ... ok
test telemetry::tests::clickhouse_breaker_sheds_after_threshold_failures ... ok

test result: ok. 36 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.73s

     Running unittests src/bin/load_test.rs (target/debug/deps/load_test-661a0aa1eb3f6d6d)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/main.rs (target/debug/deps/maple_ingest-c33bf80c577edb95)

running 38 tests
test autumn::tests::allowed_only_no_balance_field ... ok
test autumn::tests::flat_sub_one_gb_remaining_still_allows ... ok
test autumn::tests::flat_hardcap_depleted_blocks ... ok
test autumn::tests::flat_hardcap_with_remaining_allows ... ok
test autumn::tests::flat_overage_allows ... ok
test autumn::tests::flat_unlimited_allows ... ok
test autumn::tests::nested_balance_object_with_remaining_allows ... ok
test autumn::tests::nested_overage_allows ... ok
test autumn::tests::nested_balance_object_depleted_blocks ... ok
test autumn::tests::null_balance_no_subscription_blocks ... ok
test tests::api_error_kind_maps_status_to_stable_label ... ok
test tests::api_error_from_pipeline_maps_variants_to_status ... ok
test autumn::tests::unrecognized_shape_returns_none ... ok
test tests::clickhouse_destination_is_terminal_in_dual_mode ... ok
test tests::cloudflare_log_record_maps_body_severity_and_attributes ... ok
test tests::cloudflare_ndjson_payload_parses_multiple_records ... ok
test tests::cloudflare_timestamps_support_rfc3339_unix_and_unix_nano ... ok
test tests::clickhouse_target_resolver_decrypts_current_schema_password ... ok
test tests::cloudflare_validation_payload_is_detected ... ok
test tests::decrypt_aes256_gcm_matches_node_crypto_fixture ... ok
test tests::enrichment_overwrites_tenant_fields ... ok
test tests::clickhouse_destination_uses_native_pipeline_even_in_forward_mode ... ok
test tests::extract_ingest_key_returns_sentinel_literal_unchanged ... ok
test tests::clickhouse_target_resolver_rejects_password_over_http ... ok
test tests::rejection_span_status_is_error_only_for_5xx ... ok
test tests::clickhouse_target_resolver_requires_current_schema ... ok
test tests::hash_is_deterministic ... ok
test tests::resolve_ingest_key_keeps_stale_schema_on_managed_native_path ... ok
test tests::resolve_ingest_key_returns_self_managed_false_when_no_settings_row ... ok
test tests::resolve_ingest_key_returns_none_when_hash_missing ... ok
test tests::resolve_ingest_key_returns_self_managed_true_when_active_settings_row ... ok
test tests::sentinel_token_matches_only_exact_literal ... ok
test tests::tinybird_destination_keeps_forward_mode_on_forward_path ... ok
test tests::resolve_connector_refreshes_routing_before_auth_cache_expires ... ok
test tests::resolve_ingest_key_refreshes_routing_before_auth_cache_expires ... ok
test autumn::tests::fails_open_on_transport_error ... ok
test tests::resolve_ingest_key_serves_last_known_routing_when_refresh_fails ... ok
test tests::forward_mode_switches_ready_org_to_clickhouse_without_forwarding_again ... ok

test result: ok. 38 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.19s

   Doc-tests maple_ingest

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s