Communities follow FEP-1b12, circles federate to their members only

Communities:
- a post addressed to a community (to, cc or audience) is accepted
  according to its posting policy - followers, anyone, or moderators -
  and GroupDistributor announces the whole activity with `audience` to
  the community's followers, plus the object for new posts so Mastodon
  shows them; updates and deletes of community content are announced too;
- top-level posts are Pages with a name (the title, or a headline from
  the text); /flock counts members, /wardens lists moderators;
- a Mastodon client posts into a community by mentioning it, or into a
  remote group, which sets `audience`;
- an Announce of an activity from a remote group a persona follows (Lemmy)
  is followed through: the object is fetched from its own origin, kept with
  its AudienceURI, and fanned out to the group's local followers; updates
  are applied in place and deletes checked against the origin.

Circles stop being local-only: an undiscoverable Group actor whose follows
are all requests the owner approves; posts addressed to the circle and its
/flock and delivered to members' own inboxes, never announced, never
public; a remote member's post into the circle is accepted from members
only. SignedFetchAuthorizer serves circle posts and collections only to a
signed request from a member or a member server's instance actor - 404 for
anyone else. Circles never surface in search, lookups, mentions, account
ids or profile pages.

Federation:SecureMode requires a valid signature on every GET under
/peasants except the instance actor. Group forms take a posting policy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub/Federation/Outbox/OutboxPublisher.cs

@@ -32,8 +32,10 @@ namespace PrivaPub.Federation.Outbox
 
 		public async Task<IReadOnlyList<string>> Audience(LocalActor author, PostEntity post, CancellationToken token)
 		{
-			if (post.Visibility is PostVisibility.Circle or PostVisibility.LocalGeo || post.IsLocalOnly)
+			if (post.Visibility == PostVisibility.LocalGeo || post.IsLocalOnly)
 				return Array.Empty<string>();
+			if (post.Visibility == PostVisibility.Circle)
+				return await CircleMembers(post.GroupId, token);
 
 			var inboxes = new List<string>();
 			if (post.Visibility is PostVisibility.Public or PostVisibility.Unlisted or PostVisibility.FollowersOnly)
@@ -58,16 +60,21 @@ namespace PrivaPub.Federation.Outbox
 					inboxes.Add(parentAuthor.InboxURL);
 			}
 
-			if (!string.IsNullOrEmpty(post.GroupId) && post.Visibility is PostVisibility.Public or PostVisibility.Unlisted)
-			{
-				var group = await _localActors.FindById(LocalActorKind.Group, post.GroupId, token);
-				if (group is { IsFederated: true })
-					inboxes.AddRange(await _delivery.FollowerInboxes(group, token));
-			}
-
 			return inboxes.Where(i => !string.IsNullOrEmpty(i)).Distinct(StringComparer.Ordinal).ToList();
 		}
 
+		async Task<IReadOnlyList<string>> CircleMembers(string groupId, CancellationToken token)
+		{
+			var circle = string.IsNullOrEmpty(groupId) ? default : await _dbEntities.Groups.MatchID(groupId).ExecuteFirstAsync(token);
+			if (circle == default)
+				return Array.Empty<string>();
+			var remote = circle.Members.Where(m => m.IsForeign).Select(m => m.AvatarId).ToList();
+			if (remote.Count == 0)
+				return Array.Empty<string>();
+			return (await _dbEntities.ForeignAvatars.Match(a => remote.Contains(a.ActorURI)).ExecuteAsync(token))
+				.Select(a => a.InboxURL).Where(i => !string.IsNullOrEmpty(i)).Distinct(StringComparer.Ordinal).ToList();
+		}
+
 		public async Task Publish(LocalActor author, PostEntity post, JsonObject activity, CancellationToken token)
 		{
 			var inboxes = await Audience(author, post, token);