feat: publish and stream principal invalidations from the client

[pyropy]

Description

The client publishes and streams principal revocations. Invalidate submits a self-signed /principal/invalidate the way Publish submits a revocation; StreamEvents yields both firehose kinds and Stream stays as a deprecated filter. The reconnect logic no longer moves its resume point backwards, and asks from one settle window back so late records are not lost. Part of the Forge S3 tenant IAM work (RFC).

Change log

• Client.Invalidate, Client.StreamEvents; Stream deprecated
• streamConn handles principal and skips unknown event names
• Monotonic resume, reconnect from one settle window back, settle-window dedup set
• swarf stream prints <kind> <json>; README updated
• itest: a stranger is refused, an allowlisted invalidation is observed

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

Incremental pruning is needed to avoid quadratic work in pkg/client/client.go.

Pull request overview

Adds principal invalidation publishing and unified event streaming, with reconnect handling, CLI support, documentation, and tests.

Changes:

• Adds Client.Invalidate and Client.StreamEvents.
• Supports principal and delegation events with reconnect deduplication.
• Updates CLI output, documentation, and integration coverage.

File summaries

File	Summary
README.md	Documents principal invalidations and event streaming.
pkg/fx/app_test.go	Tests invalidation authorization and uniqueness.
pkg/client/client.go	Implements publishing and unified streaming; pruning currently performs potentially quadratic work.
pkg/client/client_test.go	Tests invalidation, event handling, and reconnect behavior.
itest/happy_path_test.go	Adds end-to-end authorization and streaming coverage.
cmd/swarf/stream.go	Prints both firehose event kinds.
cmd/swarf/stream_test.go	Tests mixed event output.

Review details

Suppressed comments (1)

pkg/client/client.go:266

• This scans every entry in seen whenever a newer timestamp arrives. With a busy firehose, the map contains roughly one settle window of events, so a burst of n records performs O(n²) pruning work and can make the client fall behind. Keep the timestamps in an ordered queue/min-heap (retaining the map for CID lookup), or otherwise prune incrementally.

					horizon := resume.Add(-streamSettleWindow)
					for link, at := range seen {
						if at.Before(horizon) {
							delete(seen, link)
						}

• Files reviewed: 7/7 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.