event handler pipeline

[rob-9]

authenticate, authorize via capability, validate against schema, run policy check, append to log, transition state, project to graph. idempotent on event id.