identity: trust-gated federated identity + cross-instance mapping (Phase 4 complete, +13)

federation.sx — peer-asserted subjects, advisory and trust-gated. An
assertion is accepted only from an explicitly trusted peer (else
{error, untrusted}) and is flagged {peer_asserted, Peer}, never promoted to
local authority; acl decides what a peer-asserted identity may do. Cross-
instance subject mapping namespaces remote subjects by peer
({federated, Peer, Remote}) so two peers' "alice" never collide, with
optional explicit aliasing. Adds an audit-completeness test. New
tests/federation.sx. All four phases done — 124/124.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/identity-on-sx.md

@@ -19,7 +19,7 @@ through the event log, all authorization questions delegated to `acl-on-sx`.
 
 ## Status (rolling)
 
-`bash lib/identity/conformance.sh` → **111/111** (Phases 1–3 + audit ledger)
+`bash lib/identity/conformance.sh` → **124/124** (all four phases complete)
 
 ## Ground rules
 
@@ -74,10 +74,19 @@ lib/identity/api.sx ── (identity/login) (identity/grant?) (identity/revoke)
 
 ## Phase 4 — Audit + federation
 - [x] every issue/refresh/revoke is a `persist` event; `(identity/audit subject)`
-- [ ] federated identity (peer-asserted subject) — advisory, trust-gated stub
-- [ ] tests: audit completeness, cross-instance subject mapping
+- [x] federated identity (peer-asserted subject) — advisory, trust-gated stub
+- [x] tests: audit completeness, cross-instance subject mapping
 
 ## Progress log
+- 2026-06-07 — `federation.sx`: trust-gated, advisory federated identity.
+  A peer assertion is accepted only from an explicitly trusted peer
+  (else `{error, untrusted}`) and is flagged `{peer_asserted, Peer}`, never
+  promoted to local authority — acl decides what it may do. Cross-instance
+  subject mapping namespaces remote subjects by peer (`{federated, Peer,
+  Remote}`) so two peers' "alice" never collide, with optional explicit
+  aliasing. Added an audit-completeness test (mixed transition stream → no
+  event dropped). New tests/federation.sx (12). **Phase 4 complete — all four
+  phases done.** +13 → 124/124.
 - 2026-06-07 — `audit.sx`: append-only grant audit ledger (an Erlang
   process). `token.sx` gains `start/1(Audit)` and emits issue/refresh/revoke
   events (incl. reuse-triggered revoke); `start/0` stays unaudited (no