fix(audit): harden data drains and expand security event coverage

[waleedlatif1]

Summary

• Checkpoint acknowledged provider requests and drain chunks, fence overlapping workers, resume bounded backlogs, and execute the database queue fallback.
• Bound source and archive reads, preserve tenant isolation, harden signed S3 transport, sanitize credential errors, and correct Snowflake and Datadog delivery.
• Add authentication, session, SSO, table-row, and export audit events; preserve deployment audit retries and historical CSV exports.
• Persist Vitest transforms across runs while retaining test isolation and time limits.

Type of Change

• Bug fix

Testing

• 74 PostgreSQL regressions with JSON reports in test-results/integration.json and test-results/data-drains-integration.json.
• 738 focused unit tests, including the touched and sibling suites.
• CI runs the complete script and workspace suites.
• Lint, all-workspace type-checking, 58 repository audits, docs manifest, block registry, migration safety, and schema generation checks.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 8, 2026 3:25am UTC

[cubic-dev-ai]

All reported issues were addressed across 55 files

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[High risk] Refactors audit logging and data export infrastructure across auth and drain systems.

The PR appears safe to merge; no new actionable defect was established.

What we checked:

• Stale workers cannot save progress: checkpoint locks both records and refuses the write when the run is no longer running or the saved cursor changed.
• Historical exports keep organization scope: includeDeparted returns the organization predicate unchanged. It only removes the current-actor restriction.
• Missing rows do not count: deleteRow throws when the database returns no deleted row. The use case never reaches its audit projection.

Summary

This PR adds acknowledged delivery checkpoints, bounded drain runs, queue continuations, and a working database fallback. It also strengthens S3 transport and expands audit coverage.

• CSV exports share one formatter for escaping and byte limits.
• Datadog saves each accepted request’s locator before sending another request.
• Authentication, session, SSO, table-row, and export actions gain audit events.
• Deployment audit writes are awaited and safe to retry.

Both earlier, unnumbered findings are fixed in the current code. Tests were inspected but not run during this review.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Scheduled or manual drain] --> B[Enqueue job]
  B --> C[Trigger.dev worker]
  B --> D[Database fallback]
  C --> E[Claim drain]
  D --> E
  E --> F[Read bounded page]
  F --> G[Deliver bounded chunk]
  G --> H[Save acknowledged cursor and locator]
  H --> F
  H --> I[Finish bounded run]
  I --> J{More rows remain?}
  J -->|Yes| B
  J -->|No| K[Done]

Loading

_{Reviews (3) · Last reviewed commit: "fix(audit): bound CSV allocation and dis..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

All reported issues were addressed across 61 files

<sub>Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 61 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}