Forwarded activities are believed as far as their origin vouches

A thread's server passes on what happens in it, signed with its own key: Mastodon forwards the replies to its
accounts' posts and their deletions, Friendica every activity in its threads. PrivaPub answered them 401, which also
tells a sender its signature failed. Now they get 202 and nothing in them is believed: a forwarded Create or Update is
taken as its object reads at the actor's origin, a Delete of a public or unlisted copy once that origin answers 404 or
410 (RemoteActorService.IsGone; FederationHttp remembers the status of a refusal), anything else is let go, and our own
activities coming back are ignored. A forwarded copy has its own dedupe key, so one that failed never hides the
author's own delivery.

A reply in the thread of someone followed here is kept, as Mastodon keeps them. Mastodon delivers a reply to the
followers of the account it answers; PrivaPub dropped those as unaddressed, which the pasture showed: the outsider's
reply its Mastodon scenario said was never delivered had been, and was thrown away.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

CLAUDE.md

@@ -87,7 +87,8 @@ PrivaPub/                         ASP.NET Core Web API, net10.0
                                   RequestSignature (whichever a request carries)
     Inbox/                        InboxReceiver (verify, queue, 202) → InboxProcessor (job) → Handlers/{Follow,Accept,Reject,
                                   Undo,Create,Update,Delete,Like,Announce}; RemotePosts (build, fetch parents, FetchAncestors);
-                                  RemoteReplies (FetchReplies: a thread's `context`, else `replies` two levels down)
+                                  RemoteReplies (FetchReplies: a thread's `context`, else `replies` two levels down);
+                                  Forwarded (what a thread's server passes on, believed as far as the origin vouches)
     Outbox/                       OutboxPublisher (who a post goes to), DeliveryService (queues jobs) + DeliveryJobHandler
     Rendering/                    ActivityPubRenderer (Mastodon @context, actors, notes, collections)
   Domain/
@@ -168,7 +169,12 @@ group www-data and reaches the private mongod; `sudo -u www-data` works too.
 4. **Inbound inboxes verify everything before acting:**
    - the signature covers `(request-target)`, `host`, `digest` and `date` or `(created)`;
    - the Digest matches the body and the date is at most an hour old and fifteen minutes ahead;
-   - the signature verifies against the key owner's key, and the activity's `actor` is the key owner;
+   - the signature verifies against the key owner's key, and the activity's `actor` is the key owner, or else it was
+     forwarded (`Forwarded`: a thread's server passing on what happens in it, as Mastodon and Friendica do). A forwarded
+     activity proves nothing about its author: answered 202, a Create or Update is taken as its object reads at the
+     actor's origin now, a Delete of a public or unlisted copy once that origin answers 404 or 410
+     (`RemoteActorService.IsGone`), anything else let go. Forwarded copies have their own dedupe key, so a copy that
+     failed never hides the author's own delivery;
    - the activity's `id`, and any object it creates, updates or deletes, is on the actor's origin; a cross-origin
      object is refetched from its own origin.
 5. **Status codes:**