Rebrand: Sentry -> Cairn OBS

Full rebrand across cosmetic branding, code identifiers, and
infrastructure/data-plane naming, using the supplied Cairn OBS logo
package. Cosmetic: favicon/logo swap (also closes a stale license-audit
finding -- the old favicon was SvelteKit's unreplaced scaffold logo),
new centered welcome landing page, larger/legible sidebar logo, page
titles, CLAUDE.md/README/docs prose.

Code identifiers: Go module path github.com/sentry/sentry ->
github.com/cairnobs/cairnobs across all 13 modules and ~91 files (protoc
regenerated); Rust crates sentry-agent/sentry-parser/sentry-search ->
cairnobs-*; CLI sentryctl -> cairnobsctl; Terraform provider fully
renamed (sentry_dashboard etc. -> cairnobs_dashboard, provider type,
env vars); every session/auth cookie name; agent config paths and
Windows service identity.

Deliberately preserved: the gRPC wire protocol's protobuf packages
(sentry.logs.v1, sentry.agent.v1) and their Go import directory
(proto/sentry/...) -- renaming the wire-level package would break every
currently-deployed agent binary (confirmed two real hosts, including
mail.inbuxa.com, are actively streaming through this exact contract)
until rebuilt and redeployed in lockstep with an ingest cutover. Only
the Go module path wrapping the generated code changes.

Infrastructure: every docker-compose container name (root and three
component-level compose files); the Helm chart (directory, Chart.yaml,
named-template helpers, all templates, values.yaml image repos);
Kubernetes Operator (CRD group sentry.io -> cairnobs.io, both CRD YAML
files, Go identifiers, RBAC markers); the coupled enterprise/tenantcrd
package. Caught and fixed real path-coupling bugs along the way: the
Helm chart's search/ingest volume mounts and the dev-only-credential
detection constant vs. docker-compose.yml's literal values had to move
together or a security warning would have silently stopped firing.

Data plane: Postgres database sentry_metadata -> cairnobs_metadata and
role sentry -> cairnobs; ClickHouse database sentry -> cairnobs; Kafka
topic sentry.logs.raw -> cairnobs.logs.raw and its consumer groups.
Source-level defaults, docker-compose.yml, and every migrate.sh/
provision script default updated together; already-applied migration
files left untouched per this repo's immutable-migration convention.

Verified at every layer: all 13 Go modules build/vet/test clean, both
Rust workspaces (agent, search) build/clippy/test clean, npm run check/
build clean, docker compose config validates on all four compose files.
Live-verified against a real docker stack multiple times through this
work, including a final fresh-volume run confirming the actual renamed
Postgres database/role, ClickHouse database, and Kafka topic all work
end to end with a real login and query, zero console errors.

alerting/README.md

@@ -8,7 +8,7 @@ correctness properties this implementation follows exactly).
 ## Running
 
 ```sh
-POSTGRES_PASSWORD=sentry-dev-only API_QUERY_URL=http://localhost:8080 go run ./cmd/alerting
+POSTGRES_PASSWORD=cairnobs-dev-only API_QUERY_URL=http://localhost:8080 go run ./cmd/alerting
 ```
 
 Talks to the same `sentry_metadata` Postgres database as `/api`

alerting/cmd/alerting/main.go

@@ -1,9 +1,9 @@
-// Command alerting is Sentry's alert rule evaluator and delivery
+// Command alerting is Cairn OBS's alert rule evaluator and delivery
 // service: rule/target CRUD, the ticker-driven ok/pending/firing
 // evaluator, and the webhook/Slack/PagerDuty delivery worker. See
 // /docs/phase-3-alerting-design.md. Never talks to ClickHouse/Tantivy
 // directly -- rule queries run through /api's POST /query
-// (internal/queryclient), same precedent sentryctl query and the web
+// (internal/queryclient), same precedent cairnobsctl query and the web
 // UI's dashboard panels already set.
 package main
 
@@ -21,15 +21,15 @@ import (
 	"github.com/jackc/pgx/v5/pgxpool"
 	"golang.org/x/sync/errgroup"
 
-	"github.com/sentry/sentry/alerting/internal/config"
-	"github.com/sentry/sentry/alerting/internal/delivery"
-	"github.com/sentry/sentry/alerting/internal/evaluator"
-	"github.com/sentry/sentry/alerting/internal/httpapi"
-	"github.com/sentry/sentry/alerting/internal/httpserver"
-	"github.com/sentry/sentry/alerting/internal/notifystore"
-	"github.com/sentry/sentry/alerting/internal/queryclient"
-	"github.com/sentry/sentry/alerting/internal/rulestore"
-	"github.com/sentry/sentry/alerting/internal/sessioncheck"
+	"github.com/cairnobs/cairnobs/alerting/internal/config"
+	"github.com/cairnobs/cairnobs/alerting/internal/delivery"
+	"github.com/cairnobs/cairnobs/alerting/internal/evaluator"
+	"github.com/cairnobs/cairnobs/alerting/internal/httpapi"
+	"github.com/cairnobs/cairnobs/alerting/internal/httpserver"
+	"github.com/cairnobs/cairnobs/alerting/internal/notifystore"
+	"github.com/cairnobs/cairnobs/alerting/internal/queryclient"
+	"github.com/cairnobs/cairnobs/alerting/internal/rulestore"
+	"github.com/cairnobs/cairnobs/alerting/internal/sessioncheck"
 )
 
 func main() {

alerting/go.mod

@@ -1,4 +1,4 @@
-module github.com/sentry/sentry/alerting
+module github.com/cairnobs/cairnobs/alerting
 
 go 1.25.0
 

alerting/internal/config/config.go

@@ -53,7 +53,7 @@ type EvaluatorConfig struct {
 // api/internal/config.Config.DevCredentialWarnings for the full
 // reasoning (duplicated here per this repo's no-shared-code-between-
 // services convention).
-const devOnlyCredential = "sentry-dev-only"
+const devOnlyCredential = "cairnobs-dev-only"
 
 // DevCredentialWarnings reports whether the configured Postgres
 // credential still equals the literal dev-only default --

alerting/internal/delivery/delivery_test.go

@@ -5,7 +5,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/sentry/sentry/alerting/internal/notifystore"
+	"github.com/cairnobs/cairnobs/alerting/internal/notifystore"
 )
 
 func TestBuildPayloadGenericDefaultShape(t *testing.T) {

alerting/internal/delivery/pagerduty.go

@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 
-	"github.com/sentry/sentry/alerting/internal/notifystore"
+	"github.com/cairnobs/cairnobs/alerting/internal/notifystore"
 )
 
 // pagerDutyPayload is PagerDuty's Events API v2 shape. routing_key comes
@@ -50,7 +50,7 @@ func buildPagerDutyPayload(target notifystore.Target, event Event) ([]byte, erro
 		DedupKey:    event.RuleID,
 		Payload: pagerDutyEventPayload{
 			Summary:  summary,
-			Source:   "sentry",
+			Source:   "cairnobs",
 			Severity: severity,
 		},
 	})

alerting/internal/delivery/webhook.go

@@ -19,7 +19,7 @@ import (
 
 	"github.com/jackc/pgx/v5/pgxpool"
 
-	"github.com/sentry/sentry/alerting/internal/notifystore"
+	"github.com/cairnobs/cairnobs/alerting/internal/notifystore"
 )
 
 // Event is the firing/resolved occurrence a payload is rendered from.

alerting/internal/evaluator/condition.go

@@ -3,8 +3,8 @@ package evaluator
 import (
 	"fmt"
 
-	"github.com/sentry/sentry/alerting/internal/queryclient"
-	"github.com/sentry/sentry/alerting/internal/rulestore"
+	"github.com/cairnobs/cairnobs/alerting/internal/queryclient"
+	"github.com/cairnobs/cairnobs/alerting/internal/rulestore"
 )
 
 // evaluateCondition implements fixes 3 and 4 from

alerting/internal/evaluator/condition_test.go

@@ -3,8 +3,8 @@ package evaluator
 import (
 	"testing"
 
-	"github.com/sentry/sentry/alerting/internal/queryclient"
-	"github.com/sentry/sentry/alerting/internal/rulestore"
+	"github.com/cairnobs/cairnobs/alerting/internal/queryclient"
+	"github.com/cairnobs/cairnobs/alerting/internal/rulestore"
 )
 
 func thresholdRule(comparator rulestore.Comparator, threshold float64) rulestore.Rule {

alerting/internal/evaluator/evaluator.go

@@ -6,10 +6,10 @@ import (
 	"sync"
 	"time"
 
-	"github.com/sentry/sentry/alerting/internal/delivery"
-	"github.com/sentry/sentry/alerting/internal/notifystore"
-	"github.com/sentry/sentry/alerting/internal/queryclient"
-	"github.com/sentry/sentry/alerting/internal/rulestore"
+	"github.com/cairnobs/cairnobs/alerting/internal/delivery"
+	"github.com/cairnobs/cairnobs/alerting/internal/notifystore"
+	"github.com/cairnobs/cairnobs/alerting/internal/queryclient"
+	"github.com/cairnobs/cairnobs/alerting/internal/rulestore"
 )
 
 // Evaluator is the ticker-driven scheduler -- a bounded worker pool, not

alerting/internal/evaluator/transitions.go

@@ -10,7 +10,7 @@ package evaluator
 import (
 	"time"
 
-	"github.com/sentry/sentry/alerting/internal/rulestore"
+	"github.com/cairnobs/cairnobs/alerting/internal/rulestore"
 )
 
 // TransitionInput is everything ComputeTransition needs: the rule's

alerting/internal/evaluator/transitions_test.go

@@ -4,7 +4,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/sentry/sentry/alerting/internal/rulestore"
+	"github.com/cairnobs/cairnobs/alerting/internal/rulestore"
 )
 
 var t0 = time.Date(2026, 8, 14, 0, 0, 0, 0, time.UTC)

alerting/internal/httpapi/handler.go

@@ -11,8 +11,8 @@ import (
 	"log/slog"
 	"net/http"
 
-	"github.com/sentry/sentry/alerting/internal/notifystore"
-	"github.com/sentry/sentry/alerting/internal/rulestore"
+	"github.com/cairnobs/cairnobs/alerting/internal/notifystore"
+	"github.com/cairnobs/cairnobs/alerting/internal/rulestore"
 )
 
 type ruleStore interface {

alerting/internal/httpapi/handler_test.go

@@ -9,8 +9,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/sentry/sentry/alerting/internal/notifystore"
-	"github.com/sentry/sentry/alerting/internal/rulestore"
+	"github.com/cairnobs/cairnobs/alerting/internal/notifystore"
+	"github.com/cairnobs/cairnobs/alerting/internal/rulestore"
 )
 
 type fakeRuleStore struct {

alerting/internal/queryclient/client.go

@@ -1,6 +1,6 @@
 // Package queryclient is a thin HTTP client to /api's POST /query --
 // alerting never imports querylang or talks to ClickHouse/Tantivy
-// directly, same precedent sentryctl query and the web UI's dashboard
+// directly, same precedent cairnobsctl query and the web UI's dashboard
 // panels already set: one query-execution path, reused everywhere.
 package queryclient
 

alerting/internal/sessioncheck/middleware.go

@@ -10,7 +10,7 @@ import (
 // imported -- see this package's doc comment) -- the same cookie
 // api/localauth.Handler.setCookie writes, scoped (via SESSION_COOKIE_
 // DOMAIN) to cover both api's and alerting's subdomains in production.
-const sessionCookieName = "sentry_local_session"
+const sessionCookieName = "cairnobs_local_session"
 
 type errorResponse struct {
 	Error string `json:"error"`

alerting/internal/sessioncheck/sessioncheck_integration_test.go

@@ -9,7 +9,7 @@
 //
 //	docker run --rm --network sentry_default -v $(pwd)/../../..:/src -w /src/alerting \
 //	  -e SESSIONCHECK_TEST_POSTGRES_ADDR=metadata-postgres:5432 \
-//	  -e SESSIONCHECK_TEST_POSTGRES_PASSWORD=sentry-dev-only \
+//	  -e SESSIONCHECK_TEST_POSTGRES_PASSWORD=cairnobs-dev-only \
 //	  golang:1.25-alpine go test ./internal/sessioncheck/... -run Integration -v
 package sessioncheck