Description
Join HTTP events to Access identity logins on client IP + host + time window. Decision 2026-09-23 (Rob): infer, and always flag the inference.
Acceptance Criteria
- #1 Matched events carry cloudflare.access.user.email and cloudflare.access.identity.inferred=true plus the matching login ray id; unmatched events carry neither
- #2 The join window and ambiguity rule (multiple candidate users) are configurable and tested, and an ambiguous match is left unattributed
- #3 A metric counts matched, unmatched and ambiguous events
Definition of Done
- #1 just check (fmt-check, lint, vet, test, tidy-check, build, vuln)
- #2 just ci before a change that touches the Dockerfile, goreleaser or the image (adds snapshot + image)
- #3 Every new signal or attribute name declared in internal/semconv and listed in docs/signals.md
Implementation Notes
Join ambiguity, expiry and disabled-mode tests passed in exact CI 35875578089. Live Mimir has matched, unmatched and ambiguous identity metric families.
Wave 2 P4 live inference after v0.2.3 restore: 21:40-21:45 UTC Access source had 34 identity rays and matching Loki login rows; 129 cloudflare.http.request Loki rows carried cloudflare.access.identity.inferred=true. Inference remains explicitly flagged.
Final Summary
Bounded inferred-identity join and outcome metrics released; tests and live metric families verified.