Follow-up to the phase-1 sentinel: reconcile actual GA4 page_delivery event counts against Vercel middleware invocation counts to catch post-ingestion loss (the failure mode phase 1 cannot see: GA4 accepting hits then dropping them).
- Vercel side: already ready — project
oidcTokenConfig: { enabled: true, issuerMode: "team" } (verified 2026-08-27 via API).
- GCP side (owner session required): Workload Identity Pool + provider trusting Vercel's issuer, service-account binding with
roles/analyticsdata.viewer, then getVercelOidcToken() → STS exchange in the sentinel. Removes any long-lived Google key from env.
- Alerting stays the intentional-500 → ar_default chain.
Follow-up to the phase-1 sentinel: reconcile actual GA4
page_deliveryevent counts against Vercel middleware invocation counts to catch post-ingestion loss (the failure mode phase 1 cannot see: GA4 accepting hits then dropping them).oidcTokenConfig: { enabled: true, issuerMode: "team" }(verified 2026-08-27 via API).roles/analyticsdata.viewer, thengetVercelOidcToken()→ STS exchange in the sentinel. Removes any long-lived Google key from env.