2 Commits

Include renames

Author	SHA1	Message	Date
thepraandClaude Opus 5.5	611abb5857	Inbound signatures must be fresh and cover the request line and host ... S6 of the roadmap. An inbox POST is refused unless its signature covers (request-target) and host, as well as the digest and a date or (created). The Date or (created) may be at most an hour old and fifteen minutes ahead (it was twelve hours either way), and an (expires) in the past is refused. The request target is read raw from the server, so a percent-encoded path verifies as the sender signed it. Tests cover a Mastodon-shaped delivery and each way of tampering with it, plus a round trip of our own outbound signature. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 10:51:10 +02:00
thepraandClaude Opus 5.5	034b792801	Move the federation code under Federation/, namespaces only ... Services/Federation and Controllers/ServerToServer become Federation/{Actors,Signing,Inbox,Outbox,Rendering,Controllers}, the first step of the roadmap's layout. No type, route or behaviour changes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 10:39:41 +02:00