The Problem

Operating an OpenTelemetry observability platform means juggling ingestion, querying, alerting, and a frontend across multiple environments. This repo attempts to bundle all of that into a monorepo with a SPA frontend, an Effect-based API, and Cloudflare-native deployment.

What This Does

This is a collection of 8 self-contained projects, not a single codebase. The substantial ones are apps/ (1,236 files) with web (TanStack Router SPA), api (Effect HTTP API proxying Tinybird), ingest (OTLP gateway), landing (Astro), alerting (worker), and chat-agent (Cloudflare Worker). The packages/ directory (536 files) holds shared domain contracts, query logic, and UI primitives.

The .context/ directory (2,671 files) is a large embedded dependency tree for "alchemy-effect" — a Cloudflare deployment framework. The .agents/ directory (183 files) contains ClickHouse and chDB skill definitions, mostly documentation and verification scripts. The actual platform logic lives in apps/ and packages/.

How It Is Wired

The only mapped entry point is .github/scripts/format-ingest-benchmark-comment.py:160 — a main function that reaches 12 functions. It calls load_runs (twice), render_runs_json (twice), and tail (twice), which reads files via path.read_text. This script formats benchmark comments for CI, not the platform itself.

The internal call graph is sparse: 17 resolved edges total. The most-called functions are aggregate, fmt, and numeric (each called from 2 places). comparison_table calls aggregate, fmt, and delta; absolute_table calls aggregate, value_range, fmt, and fmt_range. The main function routes through comparison_table and absolute_table to produce output.

The platform's actual wiring — API routes, ingest flow, alert evaluation — has not been mapped by static analysis. The README describes the intended flow: ingest receives OTLP, enriches with org keys, forwards to a collector, and the API proxies Tinybird queries. But the code paths are not traced here.

How To Use It

Setup: Requires Bun >=1.3. Install with bun install.

Configuration: Copy .env.example to .env. The API needs VITE_API_BASE_URL; deployments require Doppler secrets including CLOUDFLARE_API_TOKEN, TINYBIRD_TOKEN, CLERK_SECRET_KEY, and MAPLE_INGEST_KEY_ENCRYPTION_KEY.

Running locally:

bun run dev
docker compose -f docker-compose.yml up --build

Services: API on :3472, web on :3471, ingest on :3474, OTEL collector on :4317/:4318.

Deploying: bun run alchemy:deploy:prd for production, bun run alchemy:deploy:stg for staging, PR_NUMBER=123 bun run alchemy:deploy:pr for previews.

Real-World Use

A team runs this as a self-hosted observability backend: the ingest app receives OTLP traces from instrumented services, enriches them with tenant keys, and forwards to a collector. The api app proxies queries to Tinybird, and web renders dashboards. Alerts flow through the alerting worker. CI deploys staging on push to main, production manually.

Code Health & Issues

Static analysis found 7 findings (0 critical, 1 high, 4 medium, 2 low):

  • High - CI never runs the 553 test files; no test command in the 4 workflows. Add a test step to .github/workflows.
  • Medium - No Dependabot or Renovate across 67 manifests. Add .github/dependabot.yml.
  • Medium - apps/api/Dockerfile uses mutable base images oven/bun:1.3.8. Pin by digest.
  • Medium - No dependency vulnerability scan in CI. Add dependency-review-action or osv-scanner.
  • Medium - Two blobs over 5MB in .context/alchemy-effect/images/ (8.2MB and 5.1MB GIFs). Move to LFS.
  • Low - No timeout-minutes on workflow jobs in .github/workflows/deploy-pr-preview.yml.
  • Low - Missing .editorconfig, .gitattributes, and formatter config.

SDLC observation: the repo has committed secrets (flagged by the audit), 705 test files exist but are not run in CI — that is the highest-risk gap.

The Bottom Line

The monorepo structure is sensible for a multi-app observability platform, and the Cloudflare deployment story is well-documented. The critical weakness is that CI validates nothing — tests exist but never run, and dependencies are never scanned. Treat this as a solid scaffold that needs CI hardening before production trust.