Personas prove what goes to relays; the server says what it reads

FEP-521a and FEP-8b32. Every persona has an Ed25519 key of its own (Avatar.SigningKey; migration 014 gives the earlier
ones theirs), named in its actor's assertionMethod as a Multikey, the terms defined in the actor's own context. A
persona's activity going to a relay carries an eddsa-jcs-2022 proof (JSON canonicalised by RFC 8785, Jcs), so what
Activity-Relay forwards reaches Mastodon, which verifies it with its own code. Nothing else carries one: Mitra takes a
proof over the HTTP signature and refuses one by a key it has not read, without reading the actor again. Received: an
actor's own Multikeys are kept, and a forwarded activity whose proof one of them verifies is taken as it came instead of
being read again from its origin.

Discovery: WebFinger for the server's origin links its instance actor (FEP-d556), NodeInfo links it as the application
actor (FEP-2677), and actors name RFC 9421 under implements (FEP-844e).

Checked live: relay 16 (Activity-Relay's forward of alice's post reaches Mastodon), Mitra, GoToSocial and Mastodon
unchanged (165 in all).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LsXgEaXee4GCU1hwYgPJXw

docs/ROADMAP.md

@@ -686,16 +686,20 @@ it, raw where it doesn't.
   - RFC 9421 inbound (RSA and Ed25519, Content-Digest): **RSA done 2026-10-05** (PKCS#1 v1.5 and PSS, Content-Digest,
     deliveries and signed fetches); Ed25519 waits for FEP-521a keys;
   - outbound double-knock, remembered per host;
-  - `publicKey` arrays and FEP-521a Multikey;
-  - FEP-8b32 proof verification;
+  - `publicKey` arrays and FEP-521a Multikey: Multikeys **done 2026-10-06** (each persona's Ed25519 key published, peers'
+    read);
+  - FEP-8b32 proofs: **done 2026-10-06** (`eddsa-jcs-2022` on a persona's activity going to a relay, and only there:
+    Mitra refuses a proof by a key it has not read and does not read the actor again; a forwarded activity with a
+    proof its actor's key verifies is taken without reading it again; Mastodon accepts PrivaPub's, so Activity-Relay's
+    forwards reach it);
   - `hs2019` with SHA-512.
 - **Discovery:**
   - a relay client for both relay styles: **done 2026-10-05/06** (`Federation:Relays`; forwarded posts read again
     from their origin, announces unwrapped; personas' public posts sent to them, owner decision; checked live against
     Activity-Relay and aode-relay). Mastodon drops what Activity-Relay forwards without an LD signature or FEP-8b32
-    proof;
-  - instance actor discovery (FEP-d556, FEP-2677);
-  - `implements` (FEP-844e).
+    proof, which personas' activities now carry;
+  - instance actor discovery (FEP-d556, FEP-2677): **done 2026-10-06**;
+  - `implements` (FEP-844e): **done 2026-10-06** (RFC 9421, on the instance actor and as every actor's `generator`).
 - **Mastodon API:** ~~streaming WebSocket~~ (done 2026-10-05: `/api/v1/streaming` as a WebSocket and as server-sent
   events, user, notification, public, hashtag and list streams, each event mapped for its persona; a deletion reaches
   only the streams that showed the post), Web Push (gated: outbound traffic to push services), grouped notifications.