Phase 2A.1: Log forwarding follow-ups (out-of-scope from Phase 2A)

[Levaj2000]

Tracker for the work explicitly deferred from Phase 2A (the log forwarding sink, PR forthcoming). Each bullet is a standalone PR-sized unit.

Transports

• Google Pub/Sub transport — for GCP-native customers. Sits behind the same Transport protocol as the webhook. Natural fit once we're on GKE (already planned).
• Splunk HEC transport — direct integration with Splunk HTTP Event Collector. Likely Cisco's primary target.
• Chronicle transport — Google's SIEM, uses ingestion API.
• Datadog Logs transport — for customers standardizing on Datadog observability.

Each transport is a new class implementing the Transport protocol + config fields on audit_log_sink.config + tests.

Ops / deployment

• Long-running worker process — wrap flush_outbox() in a dedicated K8s Deployment (not CronJob — poll interval of 5-30s). Needs graceful shutdown, liveness/readiness probes, horizontal scaling with FOR UPDATE SKIP LOCKED already in place from 2A.
• Cleanup worker for delivered rows — scheduled job that drops audit_log_outbox rows where status='delivered' AND delivered_at < now() - 7 days. Keeps the outbox table bounded.
• Dead-letter replay tool — CLI or endpoint to retry rows in dead_letter status after an operator has fixed the upstream issue (e.g., customer's HEC token rotated).

Observability

• Per-sink metrics (Prometheus) — delivery rate, p50/p95/p99 latency, DLQ depth, circuit-breaker open count. Depends on Phase 2B (Prometheus exporter).
• Delivery status dashboard — CEO Dashboard page showing per-sink health, recent failures, DLQ count, last-delivered-at. Surfaces problems before the customer does.
• Alerting — page when DLQ depth exceeds threshold, when a sink has been circuit-broken for > N minutes, when outbox backlog grows unusually.

UX

• Sink management UI in CEO Dashboard — form to create/edit/test sinks without curl'ing the API. Includes "send test event" button wired to POST /api/v1/audit/sinks/{id}/test.
• Onboarding flow for enterprise tier — when an org upgrades to enterprise, prompt them to configure at least one sink (SOC compliance signal).

Hardening

• URL allowlist at org level — optional per-org deny list of target domains (prevents accidental exfiltration to an attacker-controlled URL if admin creds leak).
• Secret rotation with grace window — support both old + new secret for 24h during rotation; the signature header includes a key ID so receiver picks the right one.
• Size caps on batches — enforce max batch-bytes (default 5MB) in addition to max-event-count.

---

This issue opens alongside Phase 2A. Closed when the checklist above is complete or individual items are split into their own issues.