3: Notifications and subscriptions

The Dashboard is the hub apps push events to, and the place users choose what reaches them.

3.1: Notifications

Any app can POST an event to the Dashboard's central inbox using a shared secret. Logged-in users see a server-scoped inbox of these events. This gives a fleet one place to watch: a failed build, a new signup, a low-stock alert from any app land in the same stream.

POST /notify   (header: secret)   -> logged for the relevant server

The secret is checked with hash_equals; without it the endpoint rejects the request.

3.2: Subscriptions

Subscriptions decide delivery: a user can subscribe to a class of events and receive them out-of-band, for example forwarded to WhatsApp through a phloWA gateway. The subscription module holds the routing (which events, which channel, which secret).

3.3: The pattern

Apps stay simple: they fire a one-line, best-effort POST and move on. The Dashboard owns fan-out, history and delivery. This is the same "thin app, smart hub" split phloWA uses for messaging.