[thystra]

Activity-Relay destination signature-negotiation core handoff

Generated: 20260802T190003Z

Exact provenance

• Baseline commit: d172d598786f0e3547355dc6d7568e3fa5a16ea9
• Feature branch: feature/v3-signature-negotiation-core
• Runtime dual enabled: no
• Outbound behavior changed: no
• Configuration changed: no
• Redis queue or activity schema changed: no
• Packaging changed: no
• Production changed: no

Implemented

• Normalized destination-origin identity
• Separate fetch and delivery scopes
• Positive RFC 9421 capability observations
• Short-lived explicit-rejection legacy observations
• Fourteen-day positive and one-day negative defaults
• Redis persistence with SHA-256-derived keys
• Atomic stale-observation rejection
• Fixed-profile planning without capability lookup
• Unknown GET RFC 9421 probe plan with narrow legacy fallback eligibility
• Unknown POST legacy plan with no fallback
• Cached modern and legacy single-profile planning
• Expired-state return to unknown rules
• Relay Phonebook future roadmap entry

Changed files

• TODO.md
• docs/HTTP-MESSAGE-SIGNATURES.md
• docs/INTEGRATION-TESTING.md
• docs/OUTBOUND-SIGNATURE-NEGOTIATION.md
• internal/httpsignature/destination_negotiation.go
• internal/httpsignature/destination_negotiation_test.go
• internal/httpsignature/redis_destination_capability.go
• internal/httpsignature/redis_destination_capability_test.go

Validation completed

• Exact clean PR Add configurable outbound signature profiles #21 merge baseline verification
• Exact changed-path manifest
• Diff whitespace validation
• Go module verification
• Focused Redis-backed negotiation tests
• Full serialized Redis-backed tests
• Full serialized Redis-backed race tests
• Go vet
• Website Python tests
• Operations Python tests
• Installed-tree focused retest

Safety boundary

OUTBOUND_SIGNATURE_PROFILE=dual remains rejected. No request path consumes
the new planner or capability store yet. The next tranche must define and test
runtime evidence classification before enabling negotiation.

Next tranche

1. Construct the Redis capability store in server and worker initialization.
2. Accept dual only when the planner is available.
3. Parse compatible RFC 9421 Accept-Signature evidence.
4. Define explicit signature-rejection evidence without treating generic status
   codes as capability signals.
5. Execute at most one GET fallback.
6. Persist one selected delivery profile across delayed retries.
7. Add real-process mixed legacy/RFC 9421 receiver fixtures.

Backup and evidence

• Backup: /home/alan/src/backups/activity-relay-backups/20260802T190003Z-before-v3-signature-negotiation-core-r2
• Validation report: /home/alan/src/activity-relay-validation-artifacts/v3-signature-negotiation-core/20260802T190003Z/validation-report.txt
• Artifact directory: /home/alan/src/activity-relay-validation-artifacts/v3-signature-negotiation-core/20260802T190003Z

Current state

The validated changes are installed on feature/v3-signature-negotiation-core and remain uncommitted and
unpushed. Nothing has been tagged, published, deployed, or changed in
production.