Track B Phase 3 — live governance feed (dashboard consumes the CR-7 events)

2026-06-21

governance-dashboardsse

LOCKSTEP TRACEABILITY MATRIX --- api_endpoints: ["consumes /auth/events (CR-7 governance types)"] sdk_methods_updated: ["none"] mcp_tools_updated: ["none"] ---

What We Built

The dashboard's SSE consumer now understands the CR-7 governance vocabulary (scope_denial, would_deny, grant_issued, grant_revoked, chain_break) — the server already broadcasts them on the unfiltered /auth/events stream, dispatched by event: name. A new ● LIVE pill on the #grants surface lights up the instant a governance event arrives, color-coded by severity (red for denials/chain-break, amber for would-deny, green for grant changes) and showing the most recent one. A grant_revoked/grant_issued anywhere refreshes the grant list automatically.

Why It Matters

CR-7 made governance events emittable; this makes them _felt_. An operator watching the grants page sees authority changes and denials land in real time — the "evidence plane, live" experience, not a page they refresh and hope is current.

How It Works

governanceLiveIndicator() holds exactly one module-level subscription for the tab's lifetime, re-pointing at whichever pill is currently mounted — leak-safe across navigations (no duplicate listeners, ever). The dashboard SSEEventType union was extended so the new types type-check through eventStream.subscribe(...).

The Numbers

5 governance event types wired into the live feed; 389 dashboard tests pass; build + lint green.

Lockstep Checklist

[x] API Routes: consumes /auth/events (CR-7); no backend change.
[x] TS/Python SDK / MCP: none.

Remaining (Phase 3 + 4)

The live spine (CR-7 emit + CR-1 chain badge + this feed) is in. Still ahead: the would-deny preview UI (CR-3), effective-state badges (CR-2/CR-5), the scope-check composer (CR-4 refactor), the full chained Ledger view, and the /v1 chain-verify DRY migration. Phase 4 (Plans) after.