PR D: typed + signed event bus + events table + SSE (arch step 5)
- db/migrations/003_events.ts: append-only events table with
payload_hash, prev_hash, HMAC signature, indexed by plan_id + type
- services/eventBus.ts: EVENT_TYPES union (all 15 arch §7.2
categories), publish() with hash-chain + HMAC signing, verifyChain()
for tamper detection, subscribe() via in-process EventEmitter
- api/plans.ts:
- GET /api/plans/:planId/events (?verify=1 returns chain_valid)
- GET /api/plans/:planId/events/stream (SSE with history replay +
live push, 15s keep-alive, clean unsubscribe on client disconnect)
- index.ts: register the two new endpoints
- tests/unit/eventBus.test.ts: 9 tests covering publish, hash chain,
per-plan isolation, and three tamper-detection scenarios (payload,
signature, prev_hash)
60 tests pass. tsc clean.
f177f6f375