refactor: stream store records as events

[pyropy]

Description

RevocationStore.Stream yields a store.Event, a sum of a revocation record and a principal revocation record, so both kinds share one poll, cursor, settle window and dedup map. Nothing produces the second kind yet. Part of the Forge S3 tenant IAM work (RFC).

Change log

• store.Event, EventKind, PrincipalRevocationRecord and constructors; Stream returns events
• Memory backend streams from an append-only log (a re-revocation now streams both records, as Postgres already did)
• Firehose handler dispatches on event kind
• Tests moved to Event; stream-events tests on both backends

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Unresolved moderate issues affect retry idempotency and stream deduplication.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Refactors revocation streaming to use typed events across storage backends and firehose handling.

Changes:

• Adds event types, constructors, and accessors.
• Updates PostgreSQL and memory streaming.
• Adapts firehose dispatch and tests.

File summaries

File	Summary
pkg/store/store.go	Defines the event-based store API.
pkg/store/store_test.go	Tests event helpers.
pkg/store/postgres/store.go	Streams PostgreSQL records as events; moderate deduplication concern remains (1 vote).
pkg/store/postgres/store_test.go	Updates PostgreSQL stream tests.
pkg/store/memory/store.go	Adds append-only event logging; moderate retry-idempotency concern (2 votes) and a nit for additional coverage (1 vote).
pkg/store/memory/store_test.go	Updates memory stream tests.
pkg/fx/app.go	Dispatches firehose events by kind.
pkg/fx/app_test.go	Adapts the firehose test store.

Review details

Suppressed comments (2)

pkg/store/memory/store.go:80

• The append-only log is what makes the new re-revocation behavior observable, but the memory-store tests only add distinct delegations. If this is accidentally changed back to keeping only the latest entry per delegation, the current suite still passes. Please add a test that adds two different revocation invocations for the same delegation before starting the stream and asserts that both events are delivered (while Get still returns the latest record).

	s.log = append(s.log, logEntry{event: event, seq: s.nextSeq})

pkg/store/postgres/store.go:144

• Event exposes a pointer to the record, so the callback can mutate rec.Revocation.RecordedAt before this line runs. That lets a consumer change the timestamp stored in seen (for example to zero), causing the row to be pruned from deduplication and delivered again on a later poll. Capture rec.RecordedAt() before invoking yield, or yield a protected copy, and use the captured value here.

				seen[link] = rec.RecordedAt()

• Files reviewed: 8/8 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[pyropy]

Fixed in 20876b8: the memory store keeps the set of stored cause links and drops a repeated one from the log, mirroring Postgres's conflict rule on the invocation CID, while a different invocation for the same delegation is still appended. Tests cover both: a retried invocation streams once, and two revocations of one delegation both stream with Get returning the latest. The suppressed note about reading RecordedAt after yielding is also addressed there: the value is captured before the yield.

[pyropy]

Superseded by the per-key marker design in fil-one/RFC#30 (f61f474): no principal invalidation record; markers are revoked through the existing /ucan/revoke, and the client's nonce option is #15. Branch kept.