fedipod 0.8.0 → 0.10.0

package/bin/fedipod.mjs

@@ -1492,12 +1492,44 @@ if (cmd === 'up') {
   console.log('UI password set — /oauth/authorize now shows a login form (restart a running agent to pick it up)');
 } else if (cmd === 'gateway' || cmd === 'front') {
   // Attach this identity to a gateway ('front' kept as an alias). Shapes:
-  //   fedipod gateway <.../ap/inbox/> --secret S --inbox-only   the usual one:
+  //   fedipod gateway --attach <origin> [--name N] [--fronted]  ask the gateway
+  //     itself: the agent proves the pod with its own credential and stores
+  //     the door + secret the gateway answers with.
+  //   fedipod gateway <.../ap/inbox/> --secret S --inbox-only   paste-in form:
   //     identity stays on the pod; only the advertised inbox moves to the
   //     gateway's door. Leaving is one republish with the pod inbox.
   //   fedipod gateway <.../ap/actor> --secret S                 fronted identity
   //   fedipod gateway --detach                                  back to the pod inbox
   requireIdentity();
+  if (has('attach')) {
+    const front = flag('attach');
+    if (!/^https?:\/\/\S+$/.test(String(front || ''))) {
+      console.error('usage: fedipod gateway --attach <https://gateway-origin> [--name yourname] [--fronted]');
+      process.exit(2);
+    }
+    try {
+      const res = await localFetch(HOME, PORT, `/gateway`, {
+        method: 'POST', headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ action: 'attach', front,
+          ...(flag('name') ? { handle: flag('name') } : {}),
+          ...(has('fronted') ? { fronted: true } : {}) }),
+      });
+      const body = await res.json();
+      if (res.status >= 400) { console.error(body.error || `HTTP ${res.status}`); process.exit(1); }
+      if (body.frontActor) {
+        console.log(`attached — this identity now publishes as ${body.address || body.frontActor}`);
+        console.log('Restart the agent (or `fedipod up`) to republish under the front.');
+      } else {
+        console.log(`attached — your mail now arrives through ${body.url}, filtered; your name has not moved.`);
+        console.log('Starting in shadow: the door filters, and the agent measures how much');
+        console.log('verifies before it believes any receipt. Move to trust when you are ready.');
+      }
+    } catch (e) {
+      console.error(`agent not reachable on :${PORT} (${e.message}) — start it, then attach`);
+      process.exit(1);
+    }
+    process.exit(0);
+  }
   if (has('detach')) {
     try {
       const res = await localFetch(HOME, PORT, `/gateway`, {

package/cli.md

@@ -38,9 +38,10 @@ several identities, say which you mean. `profiles` does not list identities
 under a custom `AP_HOME`.
 
 Commands that manage a live identity — `alias`, `admit`, `import`, `archive`,
-`bsky`, `describe`, `status`, `rebuild`, `gateway --detach` and the group
-commands — talk to the running agent and say so when it is not there. `keys`,
-`state`, `home` and attaching a gateway want the agent stopped.
+`bsky`, `describe`, `status`, `rebuild`, `gateway --attach`,
+`gateway --detach` and the group commands — talk to the running agent and say
+so when it is not there. `keys`, `state`, `home` and the paste-in gateway form
+(`gateway <url> --secret …`) want the agent stopped.
 
 ## Recovery
 
@@ -189,9 +190,16 @@ are not imported.
 ## The gateway
 
 ```
+fedipod gateway --attach <gateway-origin> [--name N] [--fronted]
 fedipod gateway <door-inbox-url> --secret <hmac> --inbox-only
 fedipod gateway --detach
 ```
+
+`--attach` asks the gateway itself: the agent proves the pod with its own
+credential, and the gateway answers with the door and the receipt secret.
+`--name` defaults to your handle; `--fronted` takes a gateway-based name,
+published at the next restart. The admin page's Gateway panel is the same
+action with the name checked as you type.
 Attaching points your actor's advertised inbox at a gateway's door, so
 deliveries are verified and de-junked before they reach your pod; your name,
 key and data stay on your pod. The URL and secret come from the gateway's

package/gui.md

@@ -3,6 +3,8 @@
 Open `https://localhost:8030/` while any agent is running — it forwards you to the agent — then choose `manage account` and select the actor you want from the local actors dropdown.
 Picking an actor marked "(stopped)" starts its agent, then opens its page.
 
+The software row names the version the agent is running. When the copy on the machine is further ahead — after an update, or after pulling a checkout — it says so and asks for a restart, because an agent goes on serving the code it started with until it is restarted.
+
 `Update`, shown on the software row when a newer FediPod exists, pulls the latest version and restarts every agent on the machine — agents installed as services; any started by hand need their own restart. The same row flags an older data layout after an update; the `fedipod upgrade` terminal command lists those moves and the commands that make them.
 
 * **Parking** (the status control) stops the mail and unfollows people you follow, but keeps your handle
@@ -70,12 +72,24 @@ follows the group's own moderation settings; see [Groups](groups.md).
 **new followers** control switches between waiting for your approval and
 accepting automatically.
 
+## The gateway
+
+The **Gateway** panel attaches this account to a mail-filtering gateway (a
+fedipod.net-style front), shows what its door has verified, and detaches it.
+Give the gateway's address and the name you want there — the panel checks the
+name is free as you type — and choose a pod-based name (`@you@your.pod`) or a
+gateway-based name (`@you@the-gateway`); the gateway account is created
+automatically either way. Attaching proves the pod with the agent's own
+credential, so no password is typed anywhere. Detaching republishes your
+actor with your pod's own inbox.
+
 ## Moving here from another server
 
 Open **Transfer an account here** on the action rail and add your old account
 as an alias, set
 **new followers** to *accepted automatically*, then trigger the move on the
-old server; your followers arrive by themselves. Removing an alias asks
+old server (on Mastodon: Preferences → Account → *Move to a different
+account*); your followers arrive by themselves. Removing an alias asks
 twice — servers still processing the move check it while they retry. The CSV
 files from the old server's export are imported with the CLI; see
 [CLI admin](cli.md).

package/lib/admin.mjs

@@ -32,6 +32,7 @@ import { portFree, freePortFrom } from './ports.mjs';
 import { claimDirectory, yieldDirectory } from './directory.mjs';
 import { localFetch } from './localapi.mjs';
 import { ensureTrustedTls } from './certs.mjs';
+import { localVersion } from './update.mjs';
 
 const require = createRequire(import.meta.url);
 const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -325,7 +326,8 @@ function sendFile(res, baseDir, rel, auth) {
 // guards the operator's door (basePath) instead of the whole surface.
 export function buildAdminSurface({ agent, gate, allowed, log = console.log,
   port = null, handle = null, embedded = false, basePath = '/',
-  publicOrigin = null, scheme = null }) {
+  publicOrigin = null, scheme = null,
+  versionOnDisk = () => localVersion(projectRoot) }) {
   const json = (res, status, obj) => sendJson(res, status, obj, allowed);
   const masto = new MastoApi({ agent, log, allowed, scheme, embedded });
   // The spec's own write API (§6), beside the facade. Its bearer fallback is
@@ -592,6 +594,10 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           privateRoot: agent.readCredential?.()?.privateRoot || null,
           mode: agent.status?.().mode || null, port, home: tildify(agent.home) || null,
           update: agent.updateInfo || null,
+          // What this process is running, against what a restart would run:
+          // the checkout can move while an agent stays up.
+          version: AGENT_VERSION,
+          versionOnDisk: versionOnDisk(),
           pendingUpgrade: agent.pendingUpgrade || [],
           // The connected Bluesky account, non-secret half. `connected` is the
           // credential's word, so a config entry orphaned by a deleted
@@ -1423,6 +1429,16 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
           const cfg = { ...agent.store.getConfig() };
           const g = { ...(cfg.gateway || {}) };
           const inboxUrl = agent.publisher?.urls?.inbox;
+          // Availability is a read: answered before the lease takeover below,
+          // which every real gateway change does want.
+          if (body.action === 'check') {
+            const front = String(body.front || '').replace(/\/+$/, '');
+            try { new URL(front); } catch { return json(res, 400, { error: 'front must be a gateway origin URL' }); }
+            const chk = await fetch(`${front}/api/handle?handle=${encodeURIComponent(String(body.handle || '').toLowerCase())}`,
+              { headers: { accept: 'application/json' } }).then((r) => r.json()).catch(() => null);
+            if (!chk) return json(res, 502, { error: `${front} did not answer its handle check` });
+            return json(res, 200, { available: !!chk.available, reason: chk.reason || null });
+          }
           await agent.requestTakeover?.();
           const persist = async () => {
             cfg.gateway = g; agent.store.setConfig(cfg);
@@ -1478,6 +1494,56 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
             else if (target !== 'off') await agent.publisher?.publishGatewayPolicy().catch(() => {});
             return json(res, 200, { ok: true, mode: g.mode });
           }
+          // Attach through a multi-user front (fedipod.net and kin): the agent
+          // proves the pod with its own credential — no browser, no password —
+          // and the front answers with the door and the receipt secret.
+          if (body.action === 'attach') {
+            const front = String(body.front || '').replace(/\/+$/, '');
+            let fu;
+            try { fu = new URL(front); } catch { return json(res, 400, { error: 'front must be the gateway origin, like https://fedipod.net' }); }
+            if (fu.protocol !== 'https:' && !/^(localhost|127\.0\.0\.1)$|\.localhost$/.test(fu.hostname)) {
+              return json(res, 400, { error: 'front must be https' });
+            }
+            if (agent.embedded) {
+              return json(res, 400, { error: 'this identity runs inside its pod server and has no portable credential — attach from a standalone agent' });
+            }
+            const handle = String(body.handle || cfg.handle || '').toLowerCase().trim();
+            if (!handle) return json(res, 400, { error: 'a name at the gateway is required' });
+            const fronted = body.fronted === true;
+            const frontActor = `${front}/u/${handle}/ap/actor`;
+            if (g.frontActor && (!fronted || g.frontActor !== frontActor)) {
+              return json(res, 400, { error: `this identity already fronts through ${g.frontActor} — changing a published front renames every id; detach first if you mean it` });
+            }
+            // Availability first, for a clean answer before anything is created.
+            const chk = await fetch(`${front}/api/handle?handle=${encodeURIComponent(handle)}`,
+              { headers: { accept: 'application/json' } }).then((r) => r.json()).catch(() => null);
+            if (!chk) return json(res, 502, { error: `${front} did not answer its handle check` });
+            if (!chk.available) return json(res, 409, { error: chk.reason || `the name ${handle} is taken at ${front}` });
+            const attach = await agent.remote.session.fetch(`${front}/api/attach`, {
+              method: 'POST', headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ handle, podHome: agent.urls.home, kind: cfg.kind || 'person', fronted }),
+            }).catch(() => null);
+            if (!attach) return json(res, 502, { error: `${front} did not answer the attach` });
+            const d = await attach.json().catch(() => ({}));
+            if (attach.status !== 201) {
+              return json(res, attach.status >= 400 && attach.status < 500 ? attach.status : 502,
+                { error: d.error || `attach failed (HTTP ${attach.status})` });
+            }
+            g.url = String(d.doorInbox || `${front}/u/${handle}/ap/inbox/`);
+            if (d.hmacSecret) g.hmacSecret = String(d.hmacSecret);
+            if (fronted) g.frontActor = String(d.frontActor || frontActor);
+            if (!g.mode || g.mode === 'off') g.mode = 'shadow';
+            await persist();
+            // Inbox-only applies live: the actor republishes advertising the
+            // door. A front carries new ids, which are wired at startup — that
+            // attach persists and owes a restart.
+            if (!fronted) {
+              await agent.publisher?.publishProfile();
+              await agent.publisher?.publishGatewayPolicy?.().catch(() => {});
+            }
+            return json(res, 200, { ok: true, mode: g.mode, url: g.url,
+              ...(fronted ? { frontActor: g.frontActor, address: d.address || null, restart: true } : {}) });
+          }
           if (body.action === 'forget') {
             const wasLocked = g.mode === 'locked';
             delete cfg.gateway; agent.store.setConfig(cfg);
@@ -1487,7 +1553,7 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
             await agent.publisher?.publishProfile();   // re-advertise the pod inbox
             return json(res, 200, { ok: true, mode: 'off', forgotten: true });
           }
-          return json(res, 400, { error: 'action must be configure, mode or forget' });
+          return json(res, 400, { error: 'action must be configure, mode, check, attach or forget' });
         }
         // Symmetrical with /block, and open for the same reason: a block made
         // by mistake is worth undoing before federation is even configured.
@@ -1534,14 +1600,17 @@ export function buildAdminSurface({ agent, gate, allowed, log = console.log,
   return { handler, masto, c2s, streaming };
 }
 
-export function startAdmin({ port, gateToken, agent, log = console.log, handle = null, tls = null }) {
+export function startAdmin({ port, gateToken, agent, log = console.log, handle = null, tls = null,
+  // Injectable, so a test can put a checkout ahead of the running process
+  // without editing the package.json of the machine running the test.
+  versionOnDisk = () => localVersion(projectRoot) }) {
   const gate = makeGate(gateToken);
   // Live, so the named origin appears the moment connect() reads the handle
   // out of pod state — including for the OAuth redirect check in MastoApi.
   // The https listener's port joins the authority set: same names, second port.
   const allowed = new Authorities(port, handle);
   agent.authorities = allowed;
-  const { handler, streaming } = buildAdminSurface({ agent, gate, allowed, log, port, handle });
+  const { handler, streaming } = buildAdminSurface({ agent, gate, allowed, log, port, handle, versionOnDisk });
 
   // Loopback both ways: the canonical URL is https://localhost:<port>/, and
   // "localhost" resolves to ::1 on many systems before falling back to IPv4 —

package/lib/deliver.mjs

@@ -4,11 +4,43 @@
 // dropped after MAX_ATTEMPTS (~3 days).
 
 import { signRequest } from '@fedify/fedify/sig';
+import { webcrypto } from 'node:crypto';
+import { attachProof } from './proof.mjs';
 import { pinnedFor, retryAfterMs, HTTP_TIMEOUT_MS } from './safefetch.mjs';
 import { USER_AGENT } from './ua.mjs';
 
 const MAX_REDIRECTS = 3;
 
+// draft-cavage signs `(request-target): <method> <path><query>`. Fedify 2.3.4
+// builds that line from the pathname alone, so a signature over any URL
+// carrying a query is one a correct verifier cannot reconstruct — a paged
+// collection at `?page=2`, a WordPress inbox at `?rest_route=…`. Re-sign just
+// that line, over the header list Fedify already chose; a URL with no query
+// comes back untouched, and anything unexpected is left exactly as signed.
+export async function withQueryInTarget(signed, privateKey) {
+  const url = new URL(signed.url);
+  if (!url.search) return signed;
+  const header = signed.headers.get('signature');
+  if (!header) return signed;
+  const fields = Object.fromEntries(
+    [...header.matchAll(/([A-Za-z]+)="([^"]*)"/g)].map(m => [m[1], m[2]]));
+  const names = fields.headers?.split(/\s+/g) || [];
+  if (!fields.signature || !names.includes('(request-target)')) return signed;
+  if (names.some(n => n.startsWith('(') && n !== '(request-target)')) return signed;
+  const message = names.map(n => n === '(request-target)'
+    ? `(request-target): ${signed.method.toLowerCase()} ${url.pathname}${url.search}`
+    : `${n}: ${(n === 'host' ? signed.headers.get('host') || url.host : signed.headers.get(n)) ?? ''}`)
+    .join('\n');
+  const sig = await webcrypto.subtle.sign('RSASSA-PKCS1-v1_5', privateKey,
+    new TextEncoder().encode(message));
+  const headers = new Headers(signed.headers);
+  headers.set('signature',
+    header.replace(/signature="[^"]*"/, `signature="${Buffer.from(sig).toString('base64')}"`));
+  const init = { method: signed.method, headers, signal: signed.signal };
+  if (signed.method !== 'GET' && signed.method !== 'HEAD') init.body = await signed.arrayBuffer();
+  return new Request(signed.url, init);
+}
+
 const MAX_ATTEMPTS = 12;                       // 2^12 min ≈ 68h of backoff
 const TICK_MS = 60_000;
 const MAX_QUEUE = 2000;                        // beyond it, overflow dead-letters
@@ -25,10 +57,14 @@ export class Deliverer {
   // passive: signing-only (viewer-mode agents) — no queue drain timer, so a
   // read-only agent never mutates shared delivery state. startQueue() flips
   // it live when a viewer is promoted to active.
-  constructor({ store, keyId, rsaPrivate, log = console.log, passive = false }) {
+  constructor({ store, keyId, rsaPrivate, actorId = null, edPrivate = null, proofKeyId = null,
+    log = console.log, passive = false }) {
     this.store = store;
     this.keyId = keyId;
     this.rsaPrivate = rsaPrivate;
+    this.actorId = actorId;
+    this.edPrivate = edPrivate;
+    this.proofKeyId = proofKeyId;
     this.log = log;
     if (!passive) this.startQueue();
   }
@@ -64,7 +100,8 @@ export class Deliverer {
     for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
       const dispatcher = await pinnedFor(current);
       const req = new Request(current, withUa);
-      const signed = await signRequest(req, this.rsaPrivate, new URL(this.keyId));
+      const signed = await withQueryInTarget(
+        await signRequest(req, this.rsaPrivate, new URL(this.keyId)), this.rsaPrivate);
       const res = await fetch(signed, { ...(dispatcher ? { dispatcher } : {}), redirect: 'manual' });
       if (res.status >= 300 && res.status < 400 && res.headers.get('location')) {
         current = new URL(res.headers.get('location'), current).href;
@@ -101,20 +138,43 @@ export class Deliverer {
   }
 
   // Deliver, queueing on failure.
+  // FEP-8b32: a proof on everything WE author, so a server that meets one of
+  // our activities second-hand can verify it without asking us.
+  //
+  // Only ours. An activity we forward on someone else's behalf keeps whatever
+  // proof its author gave it — signing that one as an assertion of ours would
+  // be claiming to have written it.
+  async proofed(activity) {
+    if (!this.edPrivate || !this.proofKeyId || !activity || typeof activity !== 'object') return activity;
+    if (activity.proof) return activity;
+    const actor = typeof activity.actor === 'string' ? activity.actor : activity.actor?.id;
+    if (!this.actorId || actor !== this.actorId) return activity;
+    try {
+      return await attachProof(activity,
+        { privateKey: this.edPrivate, verificationMethod: this.proofKeyId });
+    } catch (e) {
+      this.log(`proof: ${e.message}`);      // an unproved activity still federates
+      return activity;
+    }
+  }
+
   async deliver(inbox, activity) {
+    // Proved before anything else, so the copy that goes on the queue is the
+    // copy that was signed — a retry days later must not post a bare activity.
+    const signed = await this.proofed(activity);
     // A host we already know is refusing: queue without asking again. This is
     // the path a FRESH activity takes, so without it a fan-out to a struggling
     // server opened one socket per follower before any of this applied.
     const host = hostOf(inbox);
     const until = this._cooling?.get(host);
     if (until && until > Date.now()) {
-      this.log(`${host} is cooling — queueing ${activity.type} rather than asking again`);
-      this._enqueue({ inbox, activity, attempts: 1, nextAt: until });
+      this.log(`${host} is cooling — queueing ${signed.type} rather than asking again`);
+      this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: until });
       return;
     }
     try {
-      await this.deliverNow(inbox, activity);
-      this.log(`delivered ${activity.type} → ${inbox}`);
+      await this.deliverNow(inbox, signed);
+      this.log(`delivered ${signed.type} → ${inbox}`);
     } catch (e) {
       this.log(`delivery failed (${e.message}) — queued`);
       const wait = e.retryAfterMs || 60_000;
@@ -122,7 +182,7 @@ export class Deliverer {
         this._cooling ||= new Map();
         this._cooling.set(host, Date.now() + wait);
       }
-      this._enqueue({ inbox, activity, attempts: 1, nextAt: Date.now() + wait });
+      this._enqueue({ inbox, activity: signed, attempts: 1, nextAt: Date.now() + wait });
     }
   }
 
@@ -140,8 +200,11 @@ export class Deliverer {
   }
 
   async deliverToAll(inboxes, activity) {
+    // Proved once for the whole fan-out: every recipient gets the same bytes,
+    // and one signature is computed rather than one per follower.
+    const signed = await this.proofed(activity);
     // Shared inboxes deduplicate fan-out to the same server.
-    for (const inbox of [...new Set(inboxes)]) await this.deliver(inbox, activity);
+    for (const inbox of [...new Set(inboxes)]) await this.deliver(inbox, signed);
   }
 
   // Serialized, for the same reason Intake.drain is: the tick is 60s and a

package/lib/gateway-core.mjs

@@ -33,7 +33,9 @@ function httpUrl(u) {
 function isBlocked(actor, blocklist = {}) {
   if (!actor) return true;
   if ((blocklist.actors || []).includes(actor)) return true;
-  let host; try { host = new URL(actor).host; } catch { return false; }
+  // hostname, not host: the agent's own isBlocked strips the port, and a door
+  // that keeps it lets a blocked domain back in on a non-default port.
+  let host; try { host = new URL(actor).hostname; } catch { return false; }
   return (blocklist.domains || []).some(d => host === d || host.endsWith('.' + d));
 }
 
@@ -88,7 +90,7 @@ export async function handleDelivery(request, ident, { podPut, fetchImpl = fetch
   // reaches the pod (today it would, drain, and die unapplied). An absent or
   // unfetchable-key signature is NOT dropped: it forwards unverified and the
   // drain's verify-by-dereference still stands behind it.
-  if (v.verified === false && v.reason === 'bad-signature-or-key-unfetchable') {
+  if (v.verified === false && v.reason === 'bad-signature') {
     return { status: 202, reason: 'forged signature' };
   }
 

package/lib/httpsig.mjs

@@ -10,7 +10,7 @@
 // — so the key deref is injected as a loader that goes through safefetch.
 
 import crypto from 'node:crypto';
-import { verifyRequest } from '@fedify/fedify/sig';
+import { verifyRequestDetailed } from '@fedify/fedify/sig';
 import { assertPublicUrl, safeFetch, readCapped } from './safefetch.mjs';
 
 // An SSRF-safe JSON-LD document loader for Fedify's key fetch. The keyId in a
@@ -40,33 +40,48 @@ export function makeSafeLoader({ getActors = null, fetchImpl = fetch } = {}) {
 // has one natively; an agent-side endpoint builds one from its req). Returns a
 // normalized result both the gateway and the drain understand — never throws
 // on a bad signature, because "unverified" is a routine outcome, not an error.
+//
+// Three outcomes, kept apart because the door acts on them differently. Only a
+// signature we could CHECK and found wrong is a forgery. A key we could not
+// fetch proves nothing: a sender in secure mode — Threads, Mastodon with
+// AUTHORIZED_FETCH — answers this keyless loader 404 or 401, so its deliveries
+// have to degrade to unverified rather than be read as forged.
 export async function verifyHttpSignature(request, { documentLoader, keyCache, timeWindow } = {}) {
   const hadSig = request.headers.get('signature') != null;
-  let key = null;
+  let result = null;
   try {
-    key = await verifyRequest(request, {
+    result = await verifyRequestDetailed(request, {
       documentLoader,
       ...(keyCache ? { keyCache } : {}),
       timeWindow: timeWindow ?? { hours: 1 },
     });
   } catch {
-    key = null;   // a loader that refused (SSRF, 401 from a secure-mode pod) → unverified
+    result = null;   // the library itself failed — no more informative than a bad signature
   }
-  if (key) {
+  if (result?.verified) {
+    const key = result.key;
     return {
       verified: true, method: 'draft-cavage',
       keyId: key.id?.href ?? null, actor: key.ownerId?.href ?? null, reason: null,
       checks: { signature: true, digest: true, dateSkew: true, keyFetched: true },
     };
   }
+  const kind = result?.reason?.type;
+  if (!hadSig || kind === 'noSignature') {
+    return {
+      verified: false, method: 'none', keyId: null, actor: null,
+      reason: 'no-signature', checks: { signature: false },
+    };
+  }
+  if (kind === 'keyFetchError') {
+    return {
+      verified: false, method: 'draft-cavage', keyId: null, actor: null,
+      reason: 'key-unfetchable', checks: { signature: false, keyFetched: false },
+    };
+  }
   return {
-    verified: false, method: hadSig ? 'draft-cavage' : 'none',
-    keyId: null, actor: null,
-    // The distinction the receipt needs: a forgery (present but invalid) is
-    // dropped at the edge; an absent or unfetchable-key signature degrades to
-    // buffered-unverified, exactly as an install with no gateway behaves.
-    reason: hadSig ? 'bad-signature-or-key-unfetchable' : 'no-signature',
-    checks: { signature: false },
+    verified: false, method: 'draft-cavage', keyId: null, actor: null,
+    reason: 'bad-signature', checks: { signature: false },
   };
 }
 

package/lib/intake.mjs

@@ -113,7 +113,19 @@ function pollOf(note) {
     })),
   };
 }
-export const isContentType = (t) => CONTENT_TYPES.has(t);
+// AS2 lets `type` be one string or a list, and implementations use both —
+// `["Person","Service"]` is an ordinary actor. Read either form.
+const typesOf = (t) => (Array.isArray(t) ? t : [t]).filter(x => typeof x === 'string');
+export const isContentType = (t) => typesOf(t).some(x => CONTENT_TYPES.has(x));
+const isActorType = (t) => typesOf(t).some(x => ACTOR_TYPES.has(x));
+
+// What we will carry to our followers on someone else's behalf (§7.1.2): the
+// activities a conversation is made of, and nothing else. A type this file
+// does not handle falls out of handle() with no rejection, and "no rejection"
+// is what qualifies an activity for forwarding — so without this gate a
+// stranger could have anything at all, of a type nothing here reads,
+// re-delivered to every follower over our signature.
+const FORWARDABLE = new Set(['Create', 'Update', 'Delete', 'Like', 'Announce', 'Undo']);
 const ACCEPT_AP = 'application/activity+json, application/ld+json; profile="https://www.w3.org/ns/activitystreams"';
 
 export function sameOrigin(a, b) {
@@ -741,7 +753,7 @@ export class Intake {
     // Same origin rather than exact equality: signedFetch follows redirects
     // without reporting where it landed, so a server that redirects its own
     // canonical actor URL would otherwise stop being cached at all.
-    if (ACTOR_TYPES.has(doc?.type) && doc.id && sameOrigin(doc.id, url)) {
+    if (isActorType(doc?.type) && doc.id && sameOrigin(doc.id, url)) {
       this.store.cacheActor(doc.id, doc);
     }
     return doc;
@@ -1123,6 +1135,7 @@ export class Intake {
   // never forwarded.
   async _maybeForward(activity) {
     if (!activity || typeof activity !== 'object') return;
+    if (!FORWARDABLE.has(activity.type)) return;              // see FORWARDABLE
     try {
       const audience = []
         .concat(activity.to || [], activity.cc || [], activity.audience || [])
@@ -1380,9 +1393,9 @@ export class Intake {
     const note = await this.fetchAP(objectId);
     if (!note) return `object fetch failed (${objectId})`;
     if (note.id !== objectId || !isContentType(note.type)) return `object not verifiable content (${objectId}, ${note.type})`;
-    const { attachmentsOf, sanitizeHtml } = await import('./wire.mjs');
+    const { attachmentsOf, titledContent } = await import('./wire.mjs');
     const attachments = attachmentsOf(note);
-    const content = sanitizeHtml(note.content);   // hostile markup never reaches pod or client
+    const content = titledContent(note);          // hostile markup never reaches pod or client
     // The delivering actor was checked on arrival; the author is only known once
     // the note is dereferenced. authorOf refuses an author the note's own origin
     // does not vouch for — see its comment; this is where a forged attribution
@@ -1594,8 +1607,8 @@ export class Intake {
     const note = await this.fetchAP(objectId);
     if (!note) throw new Error(`cannot refetch ${objectId} — will retry`);
     if (note.id !== objectId || !isContentType(note.type)) return `object not verifiable content (${objectId}, ${note.type})`;
-    const { attachmentsOf, sanitizeHtml } = await import('./wire.mjs');
-    const content = sanitizeHtml(note.content);
+    const { attachmentsOf, titledContent } = await import('./wire.mjs');
+    const content = titledContent(note);
     const attachments = attachmentsOf(note);
     const freshPoll = pollOf(note);
     const freshEmojis = emojisOf(note);

package/lib/keys.mjs

@@ -1,7 +1,7 @@
 // keys.mjs — actor signing keys. RSA (Mastodon's draft-cavage HTTP Signatures
-// require RSA-SHA256) + Ed25519 (stored for future FEP-8b32 use, not yet in
-// the actor doc). PEM at rest (0600), CryptoKey in memory for Fedify's
-// signRequest.
+// require RSA-SHA256) signs deliveries; Ed25519 signs the FEP-8b32 proof that
+// travels with an activity. PEM at rest (0600), CryptoKey in memory for
+// Fedify's signRequest and for the proof.
 //
 // The key lives on THIS MACHINE by default (AP_HOME/keys.json): the pod host
 // then never holds it. `setup --keys pod` puts it in pod state instead,
@@ -112,9 +112,23 @@ export async function resolveKeys(store, { localDir = null, rotate = false, acto
     log(rotate ? 'minted a REPLACEMENT signing key — republish the profile' : 'minted a signing key');
   }
 
+  // A record written before proofs existed has no Ed25519 half. Minting one is
+  // safe in a way minting an RSA key is not: nothing has ever published or
+  // cached it, so no remote signature is invalidated.
+  if (!rec.ed25519) {
+    rec = { ...rec, ed25519: generate().ed25519 };
+    if (localDir) writeLocal(localDir, rec); else store.write('keys.json', rec);
+    log('minted the Ed25519 half of the signing key');
+  }
+
   const der = crypto.createPrivateKey(rec.rsa.privatePem).export({ type: 'pkcs8', format: 'der' });
   const rsaPrivate = await crypto.subtle.importKey('pkcs8', der, RSA_ALG, true, ['sign']);
-  return { rsaPrivate, rsaPublicPem: rec.rsa.publicPem };
+  const { edPrivateKey, multibaseEd25519 } = await import('./proof.mjs');
+  return {
+    rsaPrivate, rsaPublicPem: rec.rsa.publicPem,
+    edPrivate: await edPrivateKey(rec.ed25519.privatePem),
+    edPublicMultibase: multibaseEd25519(rec.ed25519.publicPem),
+  };
 }
 
 // Move a local key into pod state — the arrangement that lets several

package/lib/lease.mjs

@@ -29,6 +29,7 @@ export class Lease {
     this.stopped = false;
     this.timer = null;
     this.heldUntil = 0;   // wall-clock end of the lease we last wrote
+    this.denied = null;   // why the last acquire() said no: 'unreadable' | 'held'
   }
 
   // null means the lease document is NOT THERE — nobody holds it. UNREADABLE
@@ -74,16 +75,21 @@ export class Lease {
     const cur = await this.readFresh();
     // Cannot read it: stay a viewer. A viewer that should have been active is
     // an inconvenience; two agents both draining is the destructive one.
-    if (cur === UNREADABLE) { this.log('lease unreadable — staying a viewer'); return false; }
-    if (cur && cur.holder !== this.id && Date.now() < cur.expiresAt) return false;
+    if (cur === UNREADABLE) {
+      this.denied = 'unreadable';
+      this.log('lease unreadable — staying a viewer'); return false;
+    }
+    if (cur && cur.holder !== this.id && Date.now() < cur.expiresAt) { this.denied = 'held'; return false; }
     const doc = { holder: this.id, expiresAt: Date.now() + TTL_MS };
-    if (!await this.write(doc)) return false;
+    if (!await this.write(doc)) { this.denied = 'held'; return false; }
     const confirm = await this.readFresh();
-    if (confirm === UNREADABLE || confirm?.holder !== this.id) return false;
+    if (confirm === UNREADABLE) { this.denied = 'unreadable'; return false; }
+    if (confirm?.holder !== this.id) { this.denied = 'held'; return false; }
     // From the document we WROTE, and only once the confirm agrees. Recomputing
     // it here would claim a lease that outlives what the pod's copy grants, by
     // however long the PUT and the confirming GET took.
     this.heldUntil = doc.expiresAt;
+    this.denied = null;
     return true;
   }
 

package/lib/mastoapi.mjs

@@ -12,7 +12,7 @@
 
 import crypto from 'node:crypto';
 import * as social from './social.mjs';
-import { sanitizeHtml } from './wire.mjs';
+import { sanitizeHtml, followsNeedApproval } from './wire.mjs';
 import { authorOf } from './intake.mjs';
 import { profileUrl, postUrl } from './bskyfeed.mjs';
 import { Push } from './webpush.mjs';
@@ -222,7 +222,7 @@ export class MastoApi {
       // people — so read it from config, or the editor opens empty and saving
       // wipes what was there.
       display_name: (self ? this.store.getConfig()?.name : cached.name) || cached.name || user,
-      locked: self ? !!this.store.getConfig()?.approveJoins : false,
+      locked: self ? followsNeedApproval(this.store.getConfig() || {}) : false,
       // Read from config for self, like the fields above it: our own actor is
       // not in the actor cache — the cache is for other people — so a group
       // asking about itself would be told it was a person.