[Makisuo]

Stack: #2293 model, #2294 latency ladder, #2295 compute, #2296 burn alerts, #2297 MCP, #2298 UI

Part 1 of 6 of SLOs with multiwindow burn-rate alerts.

An SLO targets one service's entry-point spans (the spans the service overview counts), optionally limited to some environments. It has:

• an SLI: availability (good = not Error) or latency (good = faster than a threshold from a fixed ladder, 50 ms to 10 s);
• a target percent (50 to 99.999);
• a rolling window of 7, 28 or 30 days.

What this PR adds:

• The slos table and its migration.
• SlosService, and /v2/slos with list, create, retrieve, update and delete.
• slo_… public ids and audit actions.
• An org's SLOs are deleted with the org.
• Writes need alerts:manage, because every SLO owns a burn-rate alert rule (part 4).

Verification

• PGlite route tests cover CRUD, validation (target, window, ladder threshold, empty service), unique names, member read-only access, and the slos:read/slos:write scopes.
• parity.test.ts, the OpenAPI paths list, anticipated errors and the org-scoped tables test all pass.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 32 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 72d4a39c-4441-44f7-bf07-b41a9ec192b8

Commits

Reviewing files that changed from the base of the PR and between ef1b44e and 9232463.

Files ignored due to path filters: 1

• packages/domain/src/generated/anticipated-error-identifiers.ts is excluded by !**/generated/**

Files selected for processing: 23

• apps/api/src/routes/v2/slos.http.test.ts
• apps/api/src/routes/v2/slos.http.ts
• apps/api/src/routes/v2/v2-test-support.ts
• apps/api/src/runtime/http-graph.ts
• apps/api/src/runtime/service-graph.ts
• apps/ios/Packages/MapleAPI/Sources/MapleAPI/openapi.json
• packages/backend/src/services/org/OrganizationService.ts
• packages/backend/src/services/slos/SlosService.ts
• packages/db/drizzle/20261105234830_slos/migration.sql
• packages/db/drizzle/20261105234830_slos/snapshot.json
• packages/db/src/tables/index.ts
• packages/db/src/tables/slos.ts
• packages/domain/package.json
• packages/domain/src/audit-actions.ts
• packages/domain/src/http/index.ts
• packages/domain/src/http/slos.ts
• packages/domain/src/http/v2/api.ts
• packages/domain/src/http/v2/index.ts
• packages/domain/src/http/v2/openapi.test.ts
• packages/domain/src/http/v2/public-id.ts
• packages/domain/src/http/v2/slos.ts
• packages/domain/src/slo.ts
• packages/primitives/src/index.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[Makisuo]

F1: valid on this PR alone. It's closed in part 4 (#2296): SLO create, update and delete take the per-org advisory lock (lockOrgAlertRules, the lock alert rule writes use) before the name check. Overlapping creates are serialized, so the second one sees the first SLO and gets the 400 slo_invalid. The stack merges in order, so I'm not adding a second fix here.

Migration: 20261105234830_slos only creates a new table and its two indexes. No existing table is touched, and the code still deployed never reads slos, so it's safe to apply on production.

[maple-review-bot]

Maple review

🟢 Confidence 10/10 · safe to merge. Only F1 is left: the duplicate-name race still answers 503, deferred to #2296; tenancy filters and CRUD are pinned by the PGlite route tests.
_{1 note · tests covered · risk medium · 3/3 new units observable}

Adds the slos table, SlosService and the /v2/slos CRUD group with slo_… ids, audit actions and org-deletion scoping. Safe to merge apart from the duplicate-name race (F1) the author has deferred to #2296; the open VcsWebhookEnqueueFailure error in http-graph.ts is untouched by this diff and not fixed.

• slos table plus migration, unique on (org_id, name)
• SlosService CRUD with target/window/threshold validation and name uniqueness
• /v2/slos list, create, retrieve, update, delete needing alerts:manage for writes
• Slos added to ORG_SCOPED_TABLES so an org delete takes its SLOs

Before merge

• Migration · Check it is safe on production data and with the code still deployed · packages/db/drizzle/20261105234830_slos/migration.sql

Still open from earlier reviews

• 🔵 Note · F1 · An overlapping duplicate SLO name escapes the guard as a 503 · packages/backend/src/services/slos/SlosService.ts:191

Production impact

Open errors in the changed files (1)

Issue	Service	Occurrences	File
@maple/api/routes/VcsWebhookEnqueueFailure	maple-api	6	apps/api/src/runtime/http-graph.ts

After this merges, Maple checks whether they stop.

_{9232463 · What was checked, coverage and telemetry details are on the Maple / review check. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}

[maple-review-bot]

Merged with 1 step from "Before merge" still open. If it is done, tick it on the review comment; if not, now is the time.

• Migration · Check it is safe on production data and with the code still deployed

[maple-review-bot]

Maple: after this shipped

✅ Shipped clean. Nothing this change touches got worse in the hour after it deployed.

Deployed to maple-api (pr-2302) at 2026-11-06 11:43 UTC as 8b2dbf3, the first version after the merge (the merge commit itself never reported). Compared the 60 minutes before and after.

Errors in the changed files:

• ➖ @maple/api/routes/VcsWebhookEnqueueFailure: 0/h → 0/h

_{Maple looks once, an hour after the first deploy that carries the merge.}