artdag: Phase 6 federation — shared content-addressed cache + trust + invalidation + 15 tests

federation.sx: instance = {cache, prov cid->peer}. fed-export/import share results
by global content-id (trusted import -> pure cache hit, the L2-registry analog);
trust gating rejects untrusted peers; fed-pull uses an injected fetch transport;
fed-invalidate drops a peer's provenanced results (peer-scoped, leaves local
results). fed 15/15, total 102/102. All 6 phases complete.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/artdag-on-sx.md

@@ -30,7 +30,7 @@ edges.
 
 ## Status (rolling)
 
-`bash lib/artdag/conformance.sh` → **87/87** (5 suites: dag, analyze, plan, execute, optimize)
+`bash lib/artdag/conformance.sh` → **102/102** (6 suites: dag, analyze, plan, execute, optimize, fed)
 
 ## Ground rules
 
@@ -127,15 +127,27 @@ lib/artdag/optimize.sx                  lib/artdag/federation.sx
 
 ## Phase 6 — Federation (shared content-addressed cache)
 
-- [ ] a result computed on one instance is reusable on another by content-id (the
+- [x] a result computed on one instance is reusable on another by content-id (the
   L2-registry analog): export/import `{content-id → result}` with provenance
-- [ ] trust gating — accept a remote result only from a trusted peer (mirror the
+- [x] trust gating — accept a remote result only from a trusted peer (mirror the
   fed trust shape; mock the transport in tests)
-- [ ] revocation/invalidation — drop a remote result if its provenance is withdrawn
-- [ ] `lib/artdag/tests/fed.sx` — remote cache hit, trust gating, invalidation
+- [x] revocation/invalidation — drop a remote result if its provenance is withdrawn
+- [x] `lib/artdag/tests/fed.sx` — remote cache hit, trust gating, invalidation
 
 ## Progress log
 
+- **Phase 6 — Federation (shared content-addressed cache)** (fed suite 15/15, total
+  102/102). `lib/artdag/federation.sx`: an instance = `{:cache <persist kv> :prov
+  {cid->origin-peer}}`. `fed-export` dumps the whole cache as `{:cid :result :peer}`
+  records tagged with the exporter's id; `fed-import` accepts only records from
+  trusted peers (trust gating) and records provenance; `fed-pull` imports via an
+  injected `fetch-fn(peer-id)` transport (mocked in tests). Because content-ids are
+  global, a trusted import makes the importer's run a pure cache hit (recompute 0) —
+  the L2-registry analog. `fed-invalidate peer` drops every result provenanced to a
+  peer from cache + prov (trust withdrawn → recompute), peer-scoped (other peers'
+  results survive) and leaving locally-computed (un-provenanced) results untouched.
+  ALL 6 PHASES COMPLETE.
+
 - **Phase 5 — Effect-pipeline optimization** (optimize suite 18/18, total 87/87).
   `lib/artdag/optimize.sx`: `artdag/dce dag outputs` keeps only the outputs plus
   their transitive ancestors (via analyze), preserving surviving content-ids.