The owner's six decisions on what PrivaPub reveals: previews, blocks, authorship, views, bridging, reactions

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

docs/INTEROP.md

@@ -723,7 +723,16 @@ circuit breaker sees, and which signature scheme worked.
 
 ## 6. Choices the privacy design has to make
 
-These change what PrivaPub reveals, so they are the owner's calls, not implementation details:
+These change what PrivaPub reveals, so they are the owner's calls, not implementation details. **All six were decided on
+2026-10-01; the decisions are in `docs/ROADMAP.md`, "Owner decisions on what PrivaPub reveals".** In short:
+1. pages are fetched by the server for public posts;
+2. blocks federate;
+3. website authorship stays off;
+4. PeerTube views are never sent;
+5. Bluesky bridging is per persona, with persona dates randomised;
+6. a one-time notice before the first reaction or vote.
+
+The options as they were laid out:
 
 1. **Link previews.**
    - Building a card from the object, or from FEP-8967 `preview` data, fetches nothing; we do that.

docs/ROADMAP.md

@@ -118,6 +118,17 @@ and circles (see Owner decisions).
 | Location-ranged posts | **Local only, never federated.** Shown to local users within the radius, with coordinates rounded on storage. |
 | Groups | **Per group, two kinds.** A *community* federates per FEP-1b12, Lemmy-compatible: it Announces the activity, uses `audience`, and accepts posts from non-followers. A *circle* is invitation-only: posts are addressed to the members collection, and objects are served only to signed requests from members. |
 
+### Owner decisions on what PrivaPub reveals (2026-10-01, from `docs/INTEROP.md` §6)
+
+| Question | Decision |
+|---|---|
+| Link previews | **The server fetches the linked page itself.** It does this only for public posts, after a short random delay, once per link for the whole server (a shared cache, so a fetch never points at one persona), and when the post arrives, never when someone reads it. Cards built from the post's own data are used first. The client never contacts the site. |
+| Blocks | **Federated.** A persona's block is sent to the blocked account's server as `Block`, and an unblock as `Undo{Block}`. Their server enforces it too, and they can learn they were blocked. This replaces the earlier "blocks never federate" rule. |
+| Website authorship (`attributionDomains`, `fediverse:creator`) | **Off.** It is never emitted, not even as a per-persona option, because it would publicly tie a persona to a website. |
+| PeerTube views | **Never sent.** The remote video file is still downloaded through our proxy when it is played; that cannot be avoided without pre-downloading video. |
+| Bluesky bridging (Bridgy Fed) | **Allowed per persona**, with a clear warning that the posts become far more widely copied. Leaving the bridge must work, through a federated `Block` sent to the bridge. Persona creation dates are moved back by a random number of days, so personas created the same day no longer share a date. |
+| Reactions and votes | **Public, with a one-time notice.** The client tells each persona once, before its first reaction or vote, that these are public and visible as that persona. |
+
 ## Libraries (researched; no maintained .NET ActivityPub library exists, so Letterbook and Iceshrimp.NET both wrote their own)
 
 | Area | Choice |