Communities follow FEP-1b12, circles federate to their members only

Communities:
- a post addressed to a community (to, cc or audience) is accepted
  according to its posting policy - followers, anyone, or moderators -
  and GroupDistributor announces the whole activity with `audience` to
  the community's followers, plus the object for new posts so Mastodon
  shows them; updates and deletes of community content are announced too;
- top-level posts are Pages with a name (the title, or a headline from
  the text); /flock counts members, /wardens lists moderators;
- a Mastodon client posts into a community by mentioning it, or into a
  remote group, which sets `audience`;
- an Announce of an activity from a remote group a persona follows (Lemmy)
  is followed through: the object is fetched from its own origin, kept with
  its AudienceURI, and fanned out to the group's local followers; updates
  are applied in place and deletes checked against the origin.

Circles stop being local-only: an undiscoverable Group actor whose follows
are all requests the owner approves; posts addressed to the circle and its
/flock and delivered to members' own inboxes, never announced, never
public; a remote member's post into the circle is accepted from members
only. SignedFetchAuthorizer serves circle posts and collections only to a
signed request from a member or a member server's instance actor - 404 for
anyone else. Circles never surface in search, lookups, mentions, account
ids or profile pages.

Federation:SecureMode requires a valid signature on every GET under
/peasants except the instance actor. Group forms take a posting policy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

FEDERATION.md

@@ -47,10 +47,18 @@ The names are the project's own and are stable; resolve actors through WebFinger
 
 A group is either a **community** or a **circle**.
 
-- A community is a `Group` actor. It accepts `Follow` and re-shares (`Announce`) posts from its followers that address
-  it. Full FEP-1b12 behaviour (announcing activities, `audience`, moderation) is planned.
-- A circle is private and does not federate yet: its actor, collections and WebFinger answer 404, and its posts are never
-  delivered.
+- A **community** follows [FEP-1b12](https://codeberg.org/fediverse/fep/src/branch/main/fep/1b12/fep-1b12.md). Posts
+  addressed to it (in `to`, `cc` or `audience`) are accepted according to its posting policy (followers, anyone, or
+  moderators only) and the group `Announce`s the whole activity, with `audience` set, to its followers. A new post is
+  also announced as an object so Mastodon shows it. Updates and deletes of community content are announced too. A
+  top-level post is a `Page` with a `name`. Members are counted at `/flock`; moderators are listed at `/wardens`, which
+  `attributedTo` does not yet point to. A mention of a community posts into it.
+- A **circle** is private. Its actor is not discoverable and every follow is a request. Its posts are addressed to the
+  circle and its members collection, delivered to each member's own inbox and never announced. They are served only
+  to a signed request from a member, or from the instance actor of a member's server; anyone else gets 404. A
+  Mastodon member's replies reach only the people they mention.
+- Announces from **remote** groups (Lemmy communities) are followed through to the activity: the object is fetched
+  from its own origin, never taken from the announce.
 
 ## Activities
 
@@ -85,6 +93,10 @@ tags. A post's title becomes `name` and is also the first, bold line of `content
 Visibility is expressed in `to`/`cc` the way Mastodon does it: public, unlisted, followers-only and direct. Inbound
 followers-only posts are recognised by the author's own `followers` collection.
 
+## Local-only posts
+
+Posts with a location (shown to nearby users of this server) never leave the server, in any form.
+
 ## Security rules a peer will notice
 
 - **Signatures.** Inbox POSTs must be signed over `(request-target)`, `host`, `digest` and `date` (or `(created)`). The