Communities follow FEP-1b12, circles federate to their members only

Communities:
- a post addressed to a community (to, cc or audience) is accepted
  according to its posting policy - followers, anyone, or moderators -
  and GroupDistributor announces the whole activity with `audience` to
  the community's followers, plus the object for new posts so Mastodon
  shows them; updates and deletes of community content are announced too;
- top-level posts are Pages with a name (the title, or a headline from
  the text); /flock counts members, /wardens lists moderators;
- a Mastodon client posts into a community by mentioning it, or into a
  remote group, which sets `audience`;
- an Announce of an activity from a remote group a persona follows (Lemmy)
  is followed through: the object is fetched from its own origin, kept with
  its AudienceURI, and fanned out to the group's local followers; updates
  are applied in place and deletes checked against the origin.

Circles stop being local-only: an undiscoverable Group actor whose follows
are all requests the owner approves; posts addressed to the circle and its
/flock and delivered to members' own inboxes, never announced, never
public; a remote member's post into the circle is accepted from members
only. SignedFetchAuthorizer serves circle posts and collections only to a
signed request from a member or a member server's instance actor - 404 for
anyone else. Circles never surface in search, lookups, mentions, account
ids or profile pages.

Federation:SecureMode requires a valid signature on every GET under
/peasants except the instance actor. Group forms take a posting policy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB

PrivaPub.Tests/Federation/InboxScenarioTests.cs

@@ -54,9 +54,9 @@ namespace PrivaPub.Tests.Federation
 			{
 				new FollowHandler(db, _local, remote, delivery),
 				new UndoHandler(db, _local),
-				new CreateHandler(db, _local, remote, delivery, _blocks, new Fanout(db), new RemotePosts(db, _local, remote, _blocks, queue)),
-				new DeleteHandler(db, _local, remote, delivery),
-				new UpdateHandler(db, _local, remote)
+				new CreateHandler(db, _local, remote, delivery, _blocks, new Fanout(db), new RemotePosts(db, _local, remote, _blocks, queue), new GroupDistributor(delivery)),
+				new DeleteHandler(db, _local, remote, delivery, new GroupDistributor(delivery)),
+				new UpdateHandler(db, _local, remote, new GroupDistributor(delivery))
 			}, NullLogger<InboxProcessor>.Instance);
 		}
 
@@ -323,7 +323,7 @@ namespace PrivaPub.Tests.Federation
 		}
 
 		[Fact]
-		public async Task A_circle_is_not_a_federated_actor()
+		public async Task A_circle_only_takes_follow_requests()
 		{
 			var token = TestContext.Current.CancellationToken;
 			var (privateKey, publicKey) = Keys.NewKeyPair();
@@ -339,8 +339,13 @@ namespace PrivaPub.Tests.Federation
 				["object"] = actor.Uri
 			};
 
-			Assert.False(actor.IsFederated);
-			Assert.Equal(404, (await Deliver(bob, "/human-centipede", follow)).StatusCode);
+			Assert.True(actor.IsCircle);
+			Assert.True(actor.ManuallyApprovesFollowers);
+			Assert.False(actor.Discoverable);
+			Assert.Equal(202, (await Deliver(bob, "/human-centipede", follow)).StatusCode);
+			var request = await DB.Default.Find<Follower>().Match(f => f.LocalActorId == circle.ID).ExecuteSingleAsync(token);
+			Assert.False(request.IsAccepted);
+			Assert.DoesNotContain(circle.Members, m => m.AvatarId == bob.Id);
 		}
 	}
 }