mod: Phase 4 — federation (trust, sharing, revocation), 132/132 — roadmap done

Cross-instance reports ingest into the local registry with origin tags; the
engine decides them unchanged. Decision sharing pushes to a mock fed-sx outbox
(mod/fed-send! is the transport seam). Trust is advisory by default: a peer's
decision binds locally only under (mod/trusted? peer :mod), else it lands in the
advisory log unapplied. Revocation composes with the Phase-2 proof model —
fed-revoke-if-invalidated re-runs the engine and undoes moderation only when the
action no longer holds (exoneration flips hide→keep → revoked + origin notified).
+26 fed tests. Full mod-on-sx roadmap complete.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/mod-on-sx.md

@@ -16,7 +16,7 @@ federation extension.
 
 ## Status (rolling)
 
-`bash lib/mod/conformance.sh` → **106/106** (Phases 1–3 complete)
+`bash lib/mod/conformance.sh` → **132/132** (Phases 1–4 complete — roadmap done)
 
 ## Ground rules
 
@@ -113,14 +113,37 @@ lib/mod/fed.sx
 
 ## Phase 4 — Federation
 
-- [ ] cross-instance reports — peer raises report about local content (or vice versa)
-- [ ] decision sharing — actions taken locally propagate to peers via fed-sx
-- [ ] trust model — peer's decision is advisory unless `(trust peer :mod)` is granted
-- [ ] revocation — undo applied moderation if proof was invalidated
-- [ ] `lib/mod/tests/fed.sx` — federated decision chains (mock fed-sx in tests)
+- [x] cross-instance reports — `mod/fed-receive-report peer …` ingests a peer's
+  report into the local registry, tagging origin; `mod/report-origin` resolves it
+  (local reports default to `"local"`); the engine decides federated reports
+  unchanged
+- [x] decision sharing — `mod/fed-share-decision decision peers` pushes messages to
+  the mock outbox (`mod/fed-send!` is the seam the real fed-sx transport replaces)
+- [x] trust model — `mod/fed-receive-decision` applies a peer's decision locally
+  ONLY when `(mod/trusted? peer :mod)`; otherwise it lands in the advisory log,
+  unapplied. `mod/grant-trust` / `mod/revoke-trust` manage the trust registry
+- [x] revocation — `mod/fed-revoke!` marks the applied action revoked + emits a
+  revocation message to the origin; `mod/fed-revoke-if-invalidated` re-runs the
+  engine and revokes only when the action no longer holds (proof invalidated)
+- [x] `lib/mod/tests/fed.sx` — 26 cases: trust grant/scope/revoke, cross-instance
+  ingest + origin, outbox sharing, advisory-vs-trusted apply, revocation +
+  invalidation (exoneration flips hide→keep → revoked)
 
 ## Progress log
 
+- **Phase 4 complete — 132/132** (+26 fed). **Full roadmap done.** Federation:
+  cross-instance reports, decision sharing, advisory-by-default trust, revocation.
+  fed-sx is mocked behind `mod/fed-send!` (in-memory outbox) — the only seam a real
+  transport must replace. The hard rule is enforced: a peer's decision binds
+  locally only under `(mod/trusted? peer :mod)`; otherwise it is recorded as a
+  suggestion and never auto-applied. Revocation composes with the proof model from
+  Phase 2 — `mod/fed-revoke-if-invalidated` re-runs the *same* engine and undoes a
+  moderation only when the action it once proved no longer holds (an exoneration
+  evidence flips hide→keep, triggering revocation + an origin-bound revocation
+  message).
+  - **Liftable (acl-sx watch):** the trust registry (`grant`/`revoke`/`trusted?`
+    over `{:peer :scope}`) and the outbox/send! seam are generic federation
+    plumbing; candidates for `lib/guest/` if acl-sx grows a federation phase.
 - **Phase 3 complete — 106/106** (+46 escalation). Lifecycle state machine,
   auto/human tiers, appeal-override, and an api façade. The state machine is a
   pure SX module (`lib/mod/lifecycle.sx`) over the engine — policy stays in