Node Message Broker — Phase 4 build-out (tracking)

[tada5hi]

Tracking issue for completing the node-message-broker (Track B of the message-broker rewrite — Hub PrivateAIM/hub Plan 013 Phase 4). Slice breakdown lives in .agents/plans/001-message-broker.md (local working doc).

Done

• Scaffold + config + HTTP module (Authup verify, GET /healthz)
• Local delivery: MemoryDeliveryService + webhook subscription CRUD
• Hub link: HubClient (send/pull/ack) + SseWakeupSource (feat(node-message-broker): implement Hub-link client with SSE wakeup #3)

Remaining slices (dependency order)

• S1 — E2E crypto adapter (node-to-node seal/open) #4 — S1: E2E crypto adapter (seal/open) — no deps
• S2 — server-core client + participant resolver #5 — S2: server-core client + participant resolver — no deps; unblocks S5/S6
• S3 — Analysis policy adapter (capability check) #6 — S3: analysis policy (capability check) — deps S2
• S4 — Outbound analysis credentials (server-core client/credentials) #7 — S4: outbound analysis credentials — deps S2; may fold into S3
• S5 — Container-facing message endpoints (send/broadcast/participants/pull) #8 — S5: container message endpoints (send/broadcast/participants/pull) — deps S1, S2, S3
• S6 — Inbound delivery loop (onWakeup → pull → decrypt → deliver) #9 — S6: inbound delivery loop (onWakeup → pull → decrypt → deliver) — deps S1, S2

Cross-cutting / future

• Container pull delivery (optional, alternative to webhooks)
• Packaging & CI — Dockerfile + entrypoint + GitHub Actions (lint/test/build)
• End-to-end integration test against a fake Hub
• Service README.md usage + env table

Suggested path: S1 + S2 in parallel (independent) → S3 → S5 → S6. S4 only if Hub send needs analysis-client creds (resolve the open question against Plan 013 §Auth first).