**Phase 4 — Self-host-native differentiators** ## Context Each self-hosted instance already computes local calibration and can export anonymized signals (`src/selfhost/orb-collector.ts`, `src/orb/analytics.ts`). Because we're purely self-hosted, cross-instance learning must be **opt-in and operator-controlled** — no mandatory central service. ## Goal Optional, operator-controlled federation so self-hosted instances can share anonymized calibration + slop/copycat signatures and benchmark against a chosen peer/aggregator. ## Requirements - Opt-in only (private by default, mirroring the `ORB_AIR_GAP` posture). Operators choose to either (a) export/import a signed, anonymized signature bundle, or (b) point at a collector they run/trust. - Never sends code/diffs/logins — only anonymized signals/signatures (HMAC-anonymized). Trust-gating to prevent poisoning. - A "your gate precision vs peer median" benchmark in the dashboard when federation is enabled. ## Deliverables - Bundle export/import + optional collector client + benchmark view + tests + docs; explicit operator-consent + privacy docs. ## Expected outcome - Operators who opt in get compounding accuracy and shared abuse signatures — a network effect with no dependency on any central or managed service. ## Effort L. ### Hosted-track cross-reference (added 2026-07-12) Since this was written, ORB Cloud Readiness (#26, epic #4877) became an active parallel track toward a genuinely hosted/multi-tenant ORB offering. This issue can and should stay scoped to the self-host track as originally written — just noting so a future reader doesn't take the framing above as ruling out a hosted offering for the product as a whole.