protocol: gossip should support CID-based contribution/artifact fetch from peers

[windoliver]

Summary

Gossip currently propagates frontier digests only — compact summaries of the best CIDs and scores. It does NOT replicate the actual contribution graph or CAS artifacts. A new agent on server B that discovers a promising CID via gossip has no protocol-level way to fetch that contribution's manifest or artifacts from the peer that advertised it.

This is the single biggest gap between Grove's mission ("massively collaborative agent work") and what the wire actually moves.

Current state

• DefaultGossipService.handleExchange() merges remote FrontierDigestEntry[] — CID + score + summary
• mergedFrontier() combines local + remote digests using direction-aware comparison
• CYCLON peer sampling maintains the partial view for peer discovery
• No GET /api/gossip/contribution/:cid or similar endpoint
• No CAS fetch-by-hash from remote peers
• docs/proposals/grove-async-agent-graph.md explicitly lists "Full federation" as a v1 non-goal

What's needed

Phase 1: On-demand CID fetch

When an agent discovers a CID via gossip frontier that doesn't exist locally, they should be able to request the full contribution manifest + artifacts from the advertising peer:

• GET /api/contributions/:cid already exists on the HTTP API
• Gossip exchange includes peer addresses
• Add a fetchRemoteContribution(cid, peerAddress) that pulls manifest + artifacts and stores locally

Phase 2: Background anti-entropy sync

Periodic background sync of contributions above a quality threshold (frontier entries) from gossip peers. Not full graph replication — just the "best work" that peers advertise.

Phase 3: CAS artifact replication

When a contribution references artifacts by hash, fetch them from the peer's CAS if not locally available. The BLAKE3 content-addressing makes this safe — verify hash on receipt.

Why this matters

Without this, gossip is a "look but don't touch" system. Agents can see that great work exists on other servers but can't build on it (no derives_from without the actual contribution, no checkout without the artifacts). The contribution DAG becomes partitioned by server.

Files

• src/gossip/protocol.ts — exchange handler
• src/gossip/http-transport.ts — peer communication
• src/server/routes/gossip.ts — gossip HTTP endpoints
• src/server/routes/contributions.ts — existing contribution fetch endpoints