Ktistec in the pasture

Ktistec 3.13.0 (peers/ktistec.sh): built from its tag (images/ktistec, its own Dockerfile pinned), set up through its
API. scenarios/ktistec.sh, 27 checks, twice in a row: follows, posts, replies, likes and boosts with their undos both
ways, its poll and alice's vote, FEP-044f quotes both ways, edits and deletions both ways, the unfollow, statistics. It
is driven through the part of the Mastodon API it speaks and its own outbox API, and read from a copy of its SQLite
database, since its API counts no likes or boosts. CLAUDE.md also asks that a change to what PrivaPub sends be run
against every peer before it is committed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

CLAUDE.md

@@ -471,6 +471,10 @@ tools/pasture/interop.sh [gts mastodon ...]                          # each peer
 tools/pasture/run.sh down                                            # removes every pasture container and volume
 ```
 
+- **A change to what PrivaPub sends** (the `@context`, an actor's properties, an activity's shape, a delivery's headers)
+  is run against every peer's scenario before it is committed, not only the peers it was written for. One reader
+  stricter than the rest fails on it alone: the 2026-10-06 `proof` term passed every peer but Smithereen, whose JSON-LD
+  1.0 reader refused every document carrying it.
 - **Layout:** `lib/pasture.sh` (network, Caddy, Mongo, PrivaPub), `peers/<name>.sh` (`<name>_up`, plus `peers/shared.sh`
   for the Postgres and Redis several peers share), `lib/interop.sh` (`ok`, `ko`, `xf` for a check expected to fail until
   a later phase, `privapub_token <persona>`, `stats_check <host> <software>`), `scenarios/<name>.sh`. Each peer talks to
@@ -612,6 +616,12 @@ tools/pasture/run.sh down                                            # removes e
   `.env` the image rewrites at each start, `spark fediverse:broadcast` looping in the container. The podcast `@pod` is
   made and published through its admin pages (`cp_web`, CSRF on each form). `scenarios/castopod.sh`, 15 checks; the
   episode's sound is made with ffmpeg on the workstation.
+- **Ktistec (3.13.0, `peers/ktistec.sh`):** built from its tag by `images/ktistec` (its own Dockerfile, pinned: a static
+  Crystal server, its assets with node), SQLite in the `pasture-ktistec` volume, the pasture bundle mounted as
+  `/etc/ssl/cert.pem`. The server's name and ktuser come from its setup API (every field required, `summary` too);
+  `ktistec_token` signs in on `/sessions`. `scenarios/ktistec.sh`, 27 checks: its Mastodon API where it has the route,
+  its outbox API (`kn`) for follows, polls (`poll-duration` is seconds from now), edits, deletions and quotes, and a
+  copy of its SQLite database (`kt_sql`) for what it holds.
 - **Forte (26.9.10, `peers/forte.sh`):** built from its tag by `images/forte` (composer on Hubzilla's PHP image, an nginx
   routing through `index.php?req=`), on the shared MySQL (database `forte`), its `.htconfig.php` written to
   `.state/forte`, a cron sidecar (`src/Daemon/Run.php Cron`). The pasture bundle is mounted over `library/cacert.pem`,