[thystra]

Activity-Relay RFC 9421 inbound runtime handoff

Generated: 20260802T152806Z

Exact provenance

• Baseline commit: cf820e70f23b9a05a012c4ff1568eb8d129ba8e3
• Feature branch: feature/v3-rfc9421-inbound-runtime
• Stable release ancestor: v2.5.1
• Public inbox behavior changed: additive RFC 9421 acceptance
• Legacy inbound path retained: yes
• Outbound signing default changed: no
• Configuration changed: no
• Packaging changed: no
• Production changed: no

Implemented

• Strict Signature-Input-based inbound profile selection
• No modern-to-legacy downgrade fallback
• Exact ActivityPub key-ID resolution
• Required embedded key owner and actor identity
• Existing relay-authenticated GET for remote actor/key retrieval
• Runtime verifier initialization from public scheme/authority and Redis
• Exact activity actor, key owner, resolved key actor, and processing actor
  binding
• Bounded profile/result/reason metrics
• Redis-backed replay rejection
• RFC 9530 body verification before signature-base derivation so body
  tampering is classified as a digest failure
• Real-process valid/replay/tamper/valid-after-tamper probe

Changed files

• TODO.md
• api/api.go
• api/decode.go
• api/operational_metrics.go
• api/operational_metrics_test.go
• api/rfc9421_inbound.go
• api/rfc9421_inbound_test.go
• contrib/ops/rfc9421inbound/main.go
• contrib/ops/test_rfc9421_inbound_probe.sh
• docs/HTTP-MESSAGE-SIGNATURES.md
• docs/INTEGRATION-TESTING.md
• internal/httpsignature/rfc9421_verify.go
• internal/httpsignature/rfc9421_verify_test.go
• internal/observability/operational.go
• internal/observability/operational_test.go

Validation completed

• Exact clean PR Add RFC 9421 inbound verification core #19 merge baseline verification
• Exact changed-path manifest
• Diff whitespace validation
• Shell syntax validation
• Go module verification
• Helper-command vet
• Focused API, signature, and observability tests
• Full serialized Redis-backed tests
• Full serialized Redis-backed race tests
• Go vet
• Website Python tests
• Operations Python tests
• Real-process TLS/Redis/signed-origin inbound invariant
• Installed-tree focused retest

Real-process result

• Classification: rfc9421_inbound_runtime_pass
• Evidence: /home/alan/src/activity-relay-validation-artifacts/v3-rfc9421-inbound-runtime/20260802T152806Z/real-process-inbound-probe
• Valid RFC 9421 request: HTTP 202
• Identical replay: HTTP 400
• Tampered body: HTTP 400
• Original valid request after tamper: HTTP 202
• Signed actor retrieval required
• Exactly two nonce markers required
• Bounded success, replay, and digest metrics required

Safety boundary

Outbound delivery and authorized fetch continue to use the established legacy
signature profile. No runtime configuration or destination negotiation is
introduced here.

Next tranche

1. Add explicit outbound profile configuration with legacy as the default.
2. Validate startup configuration and worker/server consistency.
3. Wire rfc9421 to authorized fetch and outbound delivery only when selected.
4. Keep dual unavailable until destination-aware negotiation is designed.
5. Add mixed-profile real-process delivery tests before changing defaults.

Backup and evidence

• Backup: /home/alan/src/backups/activity-relay-backups/20260802T152806Z-before-v3-rfc9421-inbound-runtime-r4
• Validation report: /home/alan/src/activity-relay-validation-artifacts/v3-rfc9421-inbound-runtime/20260802T152806Z/validation-report.txt
• Artifact directory: /home/alan/src/activity-relay-validation-artifacts/v3-rfc9421-inbound-runtime/20260802T152806Z

Current state

The validated changes are installed on feature/v3-rfc9421-inbound-runtime and remain uncommitted and
unpushed. Nothing has been tagged, published, deployed, or changed in
production.