Opt-in federated fleet intelligence across self-hosted instances

[JSONbored]

Phase 4 — Self-host-native differentiators

Context

Each self-hosted instance already computes local calibration and can export anonymized signals (src/selfhost/orb-collector.ts, src/orb/analytics.ts). Because we're purely self-hosted, cross-instance learning must be opt-in and operator-controlled — no mandatory central service.

Goal

Optional, operator-controlled federation so self-hosted instances can share anonymized calibration + slop/copycat signatures and benchmark against a chosen peer/aggregator.

Requirements

• Opt-in only (private by default, mirroring the ORB_AIR_GAP posture). Operators choose to either (a) export/import a signed, anonymized signature bundle, or (b) point at a collector they run/trust.
• Never sends code/diffs/logins — only anonymized signals/signatures (HMAC-anonymized). Trust-gating to prevent poisoning.
• A "your gate precision vs peer median" benchmark in the dashboard when federation is enabled.

Deliverables

• Bundle export/import + optional collector client + benchmark view + tests + docs; explicit operator-consent + privacy docs.

Expected outcome

• Operators who opt in get compounding accuracy and shared abuse signatures — a network effect with no dependency on any central or managed service.

Effort

L.

Hosted-track cross-reference (added 2026-07-12)

Since this was written, ORB Cloud Readiness (#26, epic #4877) became an active parallel track toward a genuinely hosted/multi-tenant ORB offering. This issue can and should stay scoped to the self-host track as originally written — just noting so a future reader doesn't take the framing above as ruling out a hosted offering for the product as a whole.

[linear-code]

JSO-2050

[JSONbored]

2026-07-01 audit: canonical cross-instance tracker — absorbing #1272 (fleet auto-tune) as a consumer of opt-in operator federation.