Drain the workspace's coordination event log

Every coordination mutation announces itself here as a compact envelope — pointers, never claim values. The cursor IS the subscription: there is no server-side subscriber state; persist the page's next_cursor (or any event's own cursor) and pass it back to resume exactly after it. next_cursor is null only when the page was EMPTY — a short page is not the end.

kind filters by PREFIX: claim. selects the family, claim.lapsed exactly one kind. A malformed filter is a 400; a well-formed kind nothing emits yet matches nothing — the vocabulary is open.

Requires the coord:read scope on the presented credential. Enforced by Kairos on this surface — the gateway forwards the credential without inspecting it. A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include coord:read: mint a key with it explicitly (POST /v2/workspaces/{id}/keys) or grant it through OAuth consent.

Canon — the coordination layer. Where memory answers what do my agents know, Canon answers what do my agents agree is true: an append-only assertion store with enforced authority ordering (operator > observation > inference — authority outranks recency), bitemporal reads (valid time vs transaction time), explicit contested state, and advisory claims with fencing tokens.

Proxied verbatim to Kairos; the gateway authenticates and parses NOTHING here, so the Authorization header goes upstream untouched and Kairos is the sole authority — the same terms as /v1. Either il_* credential is accepted; a Supabase session JWT is not.

Canon is optional per deployment, and detectable. Where it is not enabled, EVERY /coord/v1 path answers 404 — including the four verbs below — and the gateway forwards that 404 unchanged rather than substituting an error of its own. The memory API is completely unaffected either way: enabling or disabling Canon changes nothing about /v1, /v2 or /mcp. Probe GET /coord/v1/healthz (or read capabilities.canon from GET /v2/me) before relying on Canon.