3 Commits

Include renames

Author	SHA1	Message	Date
thepraandClaude Opus 5.5	bb9bd71391	P5, first batch: summaries stop hiding articles, personas get reachable names, blocks federate ... - A remote `summary` is a content warning only on a Note or Question, or when `sensitive` is set. On Articles, Events, Videos, Pages and Audio it is an excerpt (WordPress teasers, Mobilizon dates and places, Mbin titles) and is now kept as `Post.Excerpt` instead of hiding the post. `Post.ObjectType` records the remote type, and the Mastodon API shows a remote non-Note object's title above its body again. - Persona usernames must match `^[a-z0-9_]+$`, as groups already did; a name outside it was unreachable from Mastodon and Misskey. - `postingRestrictedToMods` is defined in our JSON-LD context (Iceshrimp.NET drops undefined terms). - `Vary: Accept` on actor and object URLs. - Owner decision: blocks federate. A block sends `Block`, an unblock `Undo{Block}`; checked live against GoToSocial. - Owner decision: a persona's and a group's `published`, and the day in new ids, is a random day up to two weeks before creation, so personas made the same day no longer share a date. Migration _007 gives existing ones theirs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 17:39:58 +02:00
thepraandClaude Opus 5.5	8f4d6cbdf9	A private fediverse on the workstation: PrivaPub against a real GoToSocial ... tools/pasture/run.sh starts PrivaPub, GoToSocial and Mongo on one podman network behind Caddy's internal CA, and interop.sh drives both through their own client APIs: follows (one to a locked account), posts, CW, replies, likes, boosts, DMs, edits, deletes and unfollow. All 25 checks pass, three fresh runs in a row. - Federation:AcceptAnyCertificate joins the two test-network switches; startup refuses all three in Production. - WebFinger falls back to http only when AllowPlainHttp is on. - A bootstrap logger, so a failure before the host is built is no longer silent. - P4 is ticked in the roadmap, with what has not been run live (Lemmy, a Mastodon circle member). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 13:19:16 +02:00
thepraandClaude Opus 5.5	d8f163b5ce	Persona separation is tested, the API is smoke-checked on deploy, OAuth rows are pruned ... - PersonaSeparationTests: two personas of one login follow the same account and post; nothing the API maps for one contains the other's id, username or the root id. - tools/smoke/mastodon-api.sh checks what a client meets first (instance v1/v2, discovery, app registration, client credentials, an app token refused by a user endpoint, the public timeline, revocation) and, given a persona token, verify_credentials, home and notifications. deploy.yml runs it after every deploy. - OAuthPruner removes invalid tokens and authorizations older than two weeks, every six hours. - The consent page no longer sets form-action, which browsers apply to the redirect back to the client after the form is posted. CLAUDE.md gains the Mastodon API layout and invariants. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012CzABvBkbcFqoHdmi8b9WB	2026-10-01 12:09:19 +02:00