Scaffold Phase 0: agent -> Redpanda -> ingest -> ClickHouse -> api -> web

End-to-end log pipeline for Linux hosts, per /docs/architecture.md:

- proto: shared gRPC contract (agent <-> ingest), Go bindings checked in
- agent: Rust, musl-targeted, journald/file sourcing, RFC5424 parser,
  mTLS gRPC client, no required config for the common case
- ingest: Go, single binary with --mode server|consumer|all; gRPC front
  end forwards to Redpanda unchanged, consumer normalizes and
  batch-writes to ClickHouse with at-least-once delivery
- storage: ClickHouse schema + a plain SQL-file migration runner
- api: minimal SELECT-only query endpoint, plain REST (not gRPC+gateway
  yet -- see api/README.md)
- web: SvelteKit static SPA, one query page
- transport: Redpanda compose + topic provisioning
- cli: sentryctl ping stub
- hack/dev-certs: throwaway CA + cert generation for local mTLS
- root docker-compose.yml + docs/phase-0-runbook.md tie it together

Not yet run end-to-end against real Docker/ClickHouse/Redpanda -- see the
runbook's caveats section before relying on this working as-is.

ingest/internal/normalize/normalize.go

@@ -0,0 +1,58 @@
+// Package normalize maps the wire-format LogRecord (as agents send it)
+// into the ClickHouse row shape defined in /storage. This is the "OTel-log-
+// like schema" normalization step called for in the ingest design — Phase
+// 0 keeps it to the minimal column set; full OTel field mapping (separate
+// SeverityNumber/SeverityText, resource attributes, etc.) is deferred, see
+// the open questions in /docs/architecture.md.
+package normalize
+
+import (
+	"time"
+
+	logsv1 "github.com/sentry/sentry/proto/sentry/logs/v1"
+)
+
+type Row struct {
+	Timestamp  time.Time
+	Host       string
+	Service    string
+	Severity   string
+	Message    string
+	Attributes map[string]string
+}
+
+func ToRow(rec *logsv1.LogRecord) Row {
+	attrs := rec.GetAttributes()
+	if attrs == nil {
+		attrs = map[string]string{}
+	}
+	return Row{
+		Timestamp:  time.Unix(0, rec.GetTimestampUnixNano()).UTC(),
+		Host:       rec.GetHost(),
+		Service:    rec.GetService(),
+		Severity:   severityText(rec.GetSeverity()),
+		Message:    rec.GetMessage(),
+		Attributes: attrs,
+	}
+}
+
+// severityText maps the proto Severity enum to short OTel-style severity
+// names, stored as the `severity` column's value.
+func severityText(sev logsv1.Severity) string {
+	switch sev {
+	case logsv1.Severity_SEVERITY_TRACE:
+		return "TRACE"
+	case logsv1.Severity_SEVERITY_DEBUG:
+		return "DEBUG"
+	case logsv1.Severity_SEVERITY_INFO:
+		return "INFO"
+	case logsv1.Severity_SEVERITY_WARN:
+		return "WARN"
+	case logsv1.Severity_SEVERITY_ERROR:
+		return "ERROR"
+	case logsv1.Severity_SEVERITY_FATAL:
+		return "FATAL"
+	default:
+		return "UNSPECIFIED"
+	}
+}

ingest/internal/normalize/normalize_test.go

@@ -0,0 +1,68 @@
+package normalize
+
+import (
+	"testing"
+	"time"
+
+	logsv1 "github.com/sentry/sentry/proto/sentry/logs/v1"
+)
+
+func TestToRowMapsFieldsAndSeverity(t *testing.T) {
+	rec := &logsv1.LogRecord{
+		TimestampUnixNano: time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC).UnixNano(),
+		Host:               "host-1",
+		Service:            "svc-a",
+		Severity:           logsv1.Severity_SEVERITY_ERROR,
+		Message:            "boom",
+		Attributes:         map[string]string{"k": "v"},
+	}
+
+	row := ToRow(rec)
+
+	if row.Host != "host-1" || row.Service != "svc-a" || row.Message != "boom" {
+		t.Fatalf("unexpected row: %+v", row)
+	}
+	if row.Severity != "ERROR" {
+		t.Fatalf("expected severity ERROR, got %s", row.Severity)
+	}
+	if row.Attributes["k"] != "v" {
+		t.Fatalf("expected attribute k=v, got %+v", row.Attributes)
+	}
+	if !row.Timestamp.Equal(time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)) {
+		t.Fatalf("unexpected timestamp: %v", row.Timestamp)
+	}
+}
+
+func TestToRowNilAttributesBecomesEmptyMap(t *testing.T) {
+	rec := &logsv1.LogRecord{Host: "h", Service: "s", Message: "m"}
+	row := ToRow(rec)
+	if row.Attributes == nil {
+		t.Fatal("expected non-nil empty map, got nil")
+	}
+	if len(row.Attributes) != 0 {
+		t.Fatalf("expected empty map, got %+v", row.Attributes)
+	}
+}
+
+func TestSeverityTextCoversAllEnumValues(t *testing.T) {
+	cases := map[logsv1.Severity]string{
+		logsv1.Severity_SEVERITY_UNSPECIFIED: "UNSPECIFIED",
+		logsv1.Severity_SEVERITY_TRACE:       "TRACE",
+		logsv1.Severity_SEVERITY_DEBUG:       "DEBUG",
+		logsv1.Severity_SEVERITY_INFO:        "INFO",
+		logsv1.Severity_SEVERITY_WARN:        "WARN",
+		logsv1.Severity_SEVERITY_ERROR:       "ERROR",
+		logsv1.Severity_SEVERITY_FATAL:       "FATAL",
+	}
+	for sev, want := range cases {
+		if got := severityText(sev); got != want {
+			t.Errorf("severityText(%v) = %q, want %q", sev, got, want)
+		}
+	}
+}
+
+func TestSeverityTextUnknownValueFallsBackToUnspecified(t *testing.T) {
+	if got := severityText(logsv1.Severity(99)); got != "UNSPECIFIED" {
+		t.Fatalf("expected UNSPECIFIED for unknown severity, got %q", got)
+	}
+}