Parent issue: federation foundations and replication backlog

[jillesvangurp]

Summary

This parent issue groups the federation design and implementation backlog needed to move from a single-hub product baseline toward secure, replay-aware hub-to-hub operation.

Sub-issues

• Define stable hub identity and peer configuration for federation #17 Define stable hub identity and peer configuration for federation
• Design federation auth and trust for hub-to-hub service identities #18 Design federation auth and trust for hub-to-hub service identities
• Implement cloud-authoritative metadata sync and slave-mode behavior #19 Implement cloud-authoritative metadata sync and slave-mode behavior
• Add resource snapshot sync and change feeds for federated CRUD resources #20 Add resource snapshot sync and change feeds for federated CRUD resources
• Add federated event replication with provenance, replay handling, deduplication, and loop suppression #21 Add federated event replication with provenance, replay handling, deduplication, and loop suppression
• Add federation operational visibility for peer health, lag, retries, and dead-letter conditions #22 Add federation operational visibility for peer health, lag, retries, and dead-letter conditions

Done when

• the main federation design and execution tracks are visible under one parent
• blocked design work and implementation follow-ons are easy to review together

[jillesvangurp]

Status update after reviewing the April 1-2 merged work against the federation backlog:

Partially addressed

• Define stable hub identity and peer configuration for federation #17 advanced through PR [codex] Persist hub metadata at startup #28, which established persisted stable hub identity and label behavior as a prerequisite for federation work

Remaining work now split more explicitly

• the remaining peer-configuration design slice from Define stable hub identity and peer configuration for federation #17 is now tracked in Define the federation peer configuration model on top of persisted hub identity #40

No close recommendation from this review

• Design federation auth and trust for hub-to-hub service identities #18, Implement cloud-authoritative metadata sync and slave-mode behavior #19, Add resource snapshot sync and change feeds for federated CRUD resources #20, Add federated event replication with provenance, replay handling, deduplication, and loop suppression #21, and Add federation operational visibility for peer health, lag, retries, and dead-letter conditions #22 still appear open without material implementation progress from last week

This keeps the federation tracker aligned with the prerequisite identity work that landed while making the unimplemented peer-configuration step explicit.