Operator-facing observability for public-port traffic on
/api/webhooks/* once the daemon deploys to Fly. Joshua needs to see
"what's hitting the public port" — verified events, dead-lettered
HMAC failures, rate-limited bursts — without `flyctl logs`.

Stub-then-real per the proven CC#2 pattern (HB-PANEL #103,
KR-MCP-3 #106). CC#3 will wire per-event chain-event recording OR
a substrate webhook_events table in a follow-on — blocked on the
substrate-team coord ask for the dead-letter ledger shape. Until
then the stub:true flag keeps the FE banner visible.

Branch base: feature/phase2-upgrades per bucket §0.

SECURITY: source_ip values are OCTET-MASKED in the response
(e.g. "54.203.x.x" never "54.203.99.142") — operator gets the
geolocation hint without full PII exposure on the panel.
Three-layer contract from KR-MCP-3 (#106 b34b268) applied here too:

  1. Backend payload — bucket §3 stub uses masked literals
     ("54.203.x.x", "203.0.113.x", "198.51.100.x") that are
     RFC5737/example-IP-shaped to be unambiguously not-real
  2. TS interface — source_ip: string (no value-level type info,
     but the wire contract is enforced by the backend test)
  3. Backend tests — two regex guards:
       * each event's source_ip matches the octet-mask shape
         (must contain literal "x" octet)
       * walk-the-whole-payload guard rejects any 4-octet IPv4
         appearing anywhere (catches future drift that adds a
         "real_source_ip" diagnostic field, embeds a full IP in
         details, etc.)
  CC#3 will enforce the same masking when real data flips in.

§2 K-DG verifications:
  * kora_cli/listeners/webhooks.py + webhook_dead_letter.py confirmed
    (CC#3 KR-D-DAEMON ST3 PR #104)
  * No collision with existing /api/webhooks/* listener routes — the
    new GET /api/webhooks/events/recent is a sibling read endpoint;
    POST /slack/events + POST /email/inbound are untouched
  * Dashboard layout currently lg:grid-cols-3 (2-row symmetry) —
    adding a 7th card pushes row 2 to 7 cards; keep cols-3 for
    visual stability (3 rows of 3 with the last row half-full looks
    cleaner than cols-7 single-row narrowness)

Backend (kora_cli/web_server.py):
  * GET /api/webhooks/events/recent — stub returns 4 representative
    events per bucket §3 verbatim:
      - 2 verified slack events (message, url_verification)
      - 1 dead-letter email (hmac_invalid, signature_mismatch)
      - 1 rate-limited slack (event_type:null per "request never
        reached the handler" semantics)
    stub:true + total_recent_24h:4 + generated_at.

Frontend:
  * pages/WebhookEventsPanel.tsx —
    - Stats strip: total_recent_24h + per-status counts + italic
      "Source IPs octet-masked for PII" reminder
    - Filter pills: All / Verified / Dead Letter / Rate Limited /
      Handler Error (FE-only scoping; operator narrows fetched
      data without re-hitting backend)
    - Timeline rows newest-first: status icon + status badge +
      short endpoint (/slack/events vs /api/webhooks/slack/events)
      + event_type + Globe-icon masked source_ip + Clock-icon
      relative timestamp
    - Expandable detail: id + full endpoint + absolute received_at
      + source_ip with italic "(octet-masked for PII)" note +
      pretty-printed details JSON
    - STUB banner with CC#3 follow-on note (mentions substrate-team
      coord ask blocker)
    - Empty state guides operator: "No webhook events yet. Public
      webhook plane is on port 9118; verify daemon is running."
  * lib/api.ts — WebhookEventStatus type alias + WebhookEvent +
    WebhookEventsResponse interfaces + getRecentWebhookEvents client
  * App.tsx — /webhook-events route + nav entry (Inbox icon)
    between /heartbeat and /mcp-clients (operator scans public-port
    activity near service-health cluster)
  * DashboardPage.tsx — new Webhook Events card on row 2 (7th card;
    grid stays lg:grid-cols-3 for visual symmetry). Card body:
    total_24h headline + per-status pills (verified/dead-letter/
    rate-limited/handler-error when non-zero). Headline tone goes
    destructive when dead_letter > 5 in 24h per bucket §3(c)
    operator-attention contract — card visually screams from
    dashboard glance. ALL_SOURCES extended → footer stubbed count
    adds 1.

Tests: tests/kora_cli/test_web_server_webhook_events.py — 10 tests
covering all 6 §4 scenarios plus security/contract guards:
  * 4-event-pin (bucket §3 canonical stub list)
  * Status diversity guard (3 statuses must be present so FE color
    rendering is exercised)
  * Per-entry shape + null-event_type-for-rate_limited contract
  * SECURITY: source_ip octet-mask regex (must contain "x" octet)
  * SECURITY: walk-all guard rejects any full IPv4 anywhere in payload
  * Dead-letter event carries reason field
  * Endpoints reference real CC#3 ST3 routes only
  * Cron-regression sanity

178/178 admin-panel suite green (was 168 + 10 new). tsc -b + vite
build clean.

PII redaction in `details` body is OUT OF SCOPE here (per bucket
§5 — flagged for follow-on when CC#3 wires real data and the
substrate-team coord ask lands).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>