[thystra]

Summary

Fix Mastodon interoperability for unsigned public activities received from
publishers such as the WordPress ActivityPub plugin.

Traditional relay subscribers previously received the original source activity
signed with the relay's HTTP key. For unsigned source activities, that produced
a mismatch between:

• the HTTP-signing actor: the relay actor; and
• the top-level JSON actor: the original publisher.

Mastodon accepted these deliveries with HTTP 202 but silently stopped
processing them before importing the status.

Behavior

• Unsigned public Create, Update, Delete, and Move activities now produce one
  relay-authored Announce for traditional subscribers and follower-style
  receivers.
• Source activities carrying the expected historical Mastodon
  RsaSignature2017 shape retain exact-body forwarding to traditional
  subscribers.
• Follower-style receivers continue to receive a relay-authored Announce for
  those LD-signed activities.
• Domains registered through both receiver styles are deduplicated.
• The source domain remains excluded from reflection.
• Unsigned activities without an object ID fail closed rather than being
  forwarded with a signer/actor mismatch.

Activity-Relay only recognizes the expected LD-signature shape. The receiving
server remains responsible for cryptographic proof verification.

Interoperability evidence

An isolated WordPress blog-actor test established:

• WordPress -> relay2: pass
• relay2 -> Friendica: pass
• relay2 -> NodeBB: pass
• relay2 -> Mastodon HTTP ingress: four 202 responses
• Mastodon imported status: absent

Mastodon knew the WordPress Group actor, had relay2 enabled, and had neither
suspended nor silenced the actor. Its processing workers completed immediately
without fetching or storing the object. The source activity was unsigned, so
the relay HTTP signer differed from the top-level WordPress actor.

Validation

Prospective validation passed before applying the exact patch:

• focused public-wrapper and FEP-ae0c tests
• full serialized test suite
• full serialized race suite
• go vet
• full build
• exact prospective/applied patch comparison
• exact prospective/applied Git tree comparison
• post-application focused confirmation

Validated tree:

3a085218d1302849636f23deccf619d8431044e3

Validated patch SHA-256:

1a7c0dd8ed37830e35068556697970df4e2ceaf8430cca1113c8c710f3545753