[thystra]

Activity-Relay RFC 9421 outbound profile handoff

Generated: 20260802T183644Z

Exact provenance

• Baseline commit: 01a890b78122cba075889e9a128050d5404e8e80
• Feature branch: feature/v3-rfc9421-outbound-profile
• Stable release ancestor: v2.5.1
• Default outbound profile changed: no
• Destination negotiation added: no
• Queue or Redis schema changed: no
• Packaging changed: no
• Production changed: no

Implemented

• OUTBOUND_SIGNATURE_PROFILE
• Empty or omitted configuration normalizes to legacy
• Explicit legacy and rfc9421 values
• Startup rejection of unknown values
• Startup rejection of dual
• Shared configured signer abstraction
• API authorized-fetch GET profile wiring
• Worker delivery POST profile wiring
• Legacy and RFC 9421 cryptographic tests
• RFC 9421 redirect re-signing
• Welcome-message profile display
• YAML and environment-variable documentation

Changed files

• TODO.md
• api/api.go
• api/outbound_profile_test.go
• config.yml.example
• deliver/deliver.go
• deliver/outbound_profile_test.go
• deliver/sender.go
• deliver/sender_test.go
• docs/HTTP-MESSAGE-SIGNATURES.md
• docs/INTEGRATION-TESTING.md
• internal/httpsignature/configured_signer.go
• internal/httpsignature/configured_signer_test.go
• main.go
• models/config.go
• models/config_test.go
• models/http_test.go
• models/models.go
• readme.md

Validation completed

• Exact clean PR Wire RFC 9421 inbound runtime verification #20 merge baseline verification
• Exact changed-path manifest
• Diff whitespace validation
• Go module verification
• Focused signature, configuration, fetch, API, and delivery tests, run
  package-by-package with Redis flushed between packages
• Full serialized Redis-backed tests from a clean Redis database
• Full serialized Redis-backed race tests
• Go vet
• Website Python tests
• Operations Python tests
• Modern-inbound / default-legacy-outbound real-process regression
• Default-legacy two-relay no-reflection real-process regression
• Installed-tree focused retest

Real-process results

• Inbound regression: rfc9421_inbound_runtime_pass
• Inbound evidence: /home/alan/src/activity-relay-validation-artifacts/v3-rfc9421-outbound-profile/20260802T183644Z/inbound-runtime-regression
• Two-relay regression: no_reflection_observed
• Two-relay evidence: /home/alan/src/activity-relay-validation-artifacts/v3-rfc9421-outbound-profile/20260802T183644Z/two-relay-legacy-regression

Safety boundary

Selecting rfc9421 is global and explicit. Activity-Relay does not discover
destination support, retry a POST using another signature grammar, or fall back
after remote rejection. dual remains unavailable until a separately
reviewed destination-aware policy exists.

Next tranche

1. Design destination capability state and expiry.
2. Define idempotent negotiation rules for GET and POST separately.
3. Avoid simultaneous incompatible Signature grammars.
4. Avoid blind duplicate POST delivery.
5. Add mixed legacy/RFC receiver fixtures and real-process negotiation probes.
6. Run Mastodon, Friendica, NodeBB, WordPress, and two-relay interoperability
   before considering a default change.

Backup and evidence

• Backup: /home/alan/src/backups/activity-relay-backups/20260802T183644Z-before-v3-rfc9421-outbound-profile-r5
• Validation report: /home/alan/src/activity-relay-validation-artifacts/v3-rfc9421-outbound-profile/20260802T183644Z/validation-report.txt
• Artifact directory: /home/alan/src/activity-relay-validation-artifacts/v3-rfc9421-outbound-profile/20260802T183644Z

Current state

The validated changes are installed on feature/v3-rfc9421-outbound-profile and remain uncommitted and
unpushed. Nothing has been tagged, published, deployed, or changed in
production.