orb(federated): the bundle signing key IS the anonymization secret — enrolling a peer hands it the key that de-anonymizes your ORB telemetry

[JSONbored]

Problem

Enrolling a federated peer requires handing that peer the secret that de-anonymizes your instance's
always-on ORB telemetry. The bundle signing key is the anonymization secret.

buildFederatedBundle (src/orb/federated-bundle.ts:210, :258):

const secret = await getOrCreateAnonSecret(db);
…
return { ...body, signature: signFederatedBundle(body, secret) };

signFederatedBundle is HMAC-SHA256 — symmetric. For a peer to verify your bundles, the operator
must place that exact secret in the peer's federatedIntelligence.peerKeys (the manifest requires a
64-char hex value, precisely the shape generateAnonSecret() produces).

That same secret HMACs repo_hash / pr_hash on the always-on #1255 export
(src/selfhost/orb-collector.ts:267-268, :286). The shared primitive's docstring
(packages/loopover-engine/src/telemetry/anonymize.ts:12-27) promises the opposite, twice:

Never derived from, or shared with, any other credential … key separation means a leaked
anonymization secret can't be used to forge or decrypt anything else.

The collector receiving the output never holds secret, so it can never reverse the hash.

Federating mandates that leak. Repo full names are low-entropy public strings, so a key holder
inverts any repo_hash it observes by dictionary attack.

Two further consequences: the key holder can forge your instance's x-orb-signature
(orb-collector.ts:286); and for a brokered instance instanceId = sha256("anon:" + secret)
(orb-collector.ts:109), so the secret is also that instance's telemetry identity — it cannot be rotated
without breaking the collector's dedup key.

Trigger

Any operator following the documented enrolment flow ("Configure a peer in
federatedIntelligence.peerKeys", federated-benchmark-card.tsx:26).

Impact

The advertised privacy floor of the always-on ORB export is voided as a side effect of opting into an
unrelated, opt-in feature — and the code comment a reader would check says it cannot happen.

Requirements

• Mint a separate federated signing key, distinct from orb:anon_secret.
• Better: move to a detached asymmetric signature so peerKeys holds public keys and nothing secret
  is ever shared. This also fixes rotation.
• Decouple instanceId from the anon secret so the secret becomes rotatable.
• Correct anonymize.ts:12-27, whose key-separation claim is currently false for any federated instance.

Test Coverage Requirements

99%+ patch coverage, branch-counted; a test asserting the federated key and the anon secret are never the
same value.

Links & Resources

• src/orb/federated-bundle.ts ~166-172, ~210, ~258; src/selfhost/orb-collector.ts ~109, ~267-268, ~286;
  packages/loopover-engine/src/telemetry/anonymize.ts ~12-27
• Feature is currently inert (federatedIntelligence absent from the live manifest), so this is
  latent — but it arms on one YAML key.

maintainer-only — key management and telemetry privacy.

[linear-code]

JSO-6319