Control Plane: implement append-only canonical event store

[mdheller]

Context

The control-plane schema spine is now in-repo. The next runtime step is an append-only local event store that can persist validated sourceos.event.v0.1 events without turning raw logs into the operator-facing product.

Scope

Implement a minimal local-first event store for canonical events.

Deliverables

• sourceos_eventctl.py subcommands or successor CLI commands for write, list, show, and verify.
• Append-only JSONL storage under an explicit local path.
• Event validation before write using schemas/sourceos-event.schema.json.
• Stable event ID lookup.
• Basic integrity check over the JSONL file.
• Documentation and examples.

Acceptance criteria

• make validate passes.
• A generated policy-decision event can be written to the event store.
• The event can be listed, shown by ID, and revalidated.
• Invalid events are rejected before persistence.
• No network access is used.

Non-goals

• Production daemonization.
• Remote replication.
• Destructive repair actions.

[mdheller]

Implementation tranche landed on main for the append-only canonical event store.

Completed scope:

• tools/sourceos_eventctl.py now supports:
  • validate
  • explain
  • emit-policy-decision
  • write
  • list
  • show
  • verify-store
• Event writes validate against the stricter schemas/sourceos.event.v0.1.schema.json before persistence.
• Store format is append-only JSONL.
• Duplicate event IDs are rejected by default on write.
• verify-store validates every event and reports a store SHA-256 digest.
• tools/smoke_event_store.py exercises write/list/show/verify-store and generated event persistence.
• make validate now includes the event-store smoke test.

Evidence limitation: connector did not surface a GitHub Actions run or combined status for the latest commit, so CI pass is not yet independently confirmed here. The issue should remain open until CI status is visible or someone runs make install-dev && make validate locally/through Actions and records the output.