Reconcile signed Follow fixes with SlugKit 1.0.1 #32

Merged

erik merged 1 commit from task-6fa3ef35-signed-follow-reconcile into main

2026-11-04 12:48:32 -06:00

erik commented

2026-11-04 12:45:17 -06:00

Owner

Summary

Reconciles this customized website with published SlugKit template 1.0.1 without redoing the original signed-fetch fix (completed task-b5f8d008, PR #25, deployment 0.3.16). Task: task-6fa3ef35.

Runtime source inspection:

src/api/routes/following.ts and src/federation/keys.ts are byte-identical to release commit 2a883b590e7c184be81201e9ae67b53a73865a7f.
Resolver signing matches; the site's stronger shared URL-safety helper, canonical/profile alias behavior and inline authenticated-loader wiring are preserved. No runtime resolver/key/loader edits or dependency/schema changes are needed.
The toolkit-root Makefile dotenv fallback/CLI bug has no equivalent site target or recursive export. Keep site tooling unchanged; add actual Node dotenv precedence regressions using synthetic files without starting the app or reading private .env files.

Applicable adoption:

Add missing credential-bearing actor metadata, unsigned WebFinger rejection, invalid persisted-key/no-rotation, and non-primary-actor signer regressions.
Harden the existing local Follow/Undo fixture: block unexpected outbound requests even if Fedify catches the exception; verify every intercepted Accept cryptographically; test each ready message is processed once and deliberate delayed inbox retries stay queued; fail unexpected outbox retries. The explicit 503 failure fixture alone opts into its expected outbox retry. No production Undo or timeout changes.
Update docs/activitypub-signed-follow-resolution.md with comparison/provenance, applicability assessment, original completed/deployed status and operational boundaries.

Verification

npm ci, typecheck, lint, build and diff check passed.
Full tests: 765 passed (70 files).
CI-scope tests: 594 passed (58 files).
Synthetic Playwright: 40 passed, using installed Chromium 1234 executable override.
Intercepted fixtures/generated keys and disposable synthetic databases only; no real accounts or live social servers used.
Original checkout's generated CSS preserved unchanged (SHA256 b111b4a78e3e020216bdbb3239d58cbf0a923f4fe49faf1cb6f7ebff87d9c17d). Worktree build-generated CSS excluded from this PR.
npm installation reported 25 dependency advisories (17 moderate, 8 high); no package versions or unrelated remediation changed.
Hosted CI and independent read-only review pending; results will be attached before merge.

Boundaries

No release/publishing/deployment, live Follow, production data/key/origin changes, new contract 3.0.0 behavior or legacy cleanup. Existing retention and Rott rollout guidance remains unchanged; no Rott readiness or remote acceptance is claimed. Successful local API fixtures establish pending persistence/one queued Follow, not remote delivery or acceptance.

## Summary Reconciles this customized website with published SlugKit template **1.0.1** without redoing the original signed-fetch fix (completed task-b5f8d008, PR #25, deployment 0.3.16). Task: `task-6fa3ef35`. Runtime source inspection: - `src/api/routes/following.ts` and `src/federation/keys.ts` are byte-identical to release commit `2a883b590e7c184be81201e9ae67b53a73865a7f`. - Resolver signing matches; the site's stronger shared URL-safety helper, canonical/profile alias behavior and inline authenticated-loader wiring are preserved. No runtime resolver/key/loader edits or dependency/schema changes are needed. - The toolkit-root Makefile dotenv fallback/CLI bug has no equivalent site target or recursive export. Keep site tooling unchanged; add actual Node dotenv precedence regressions using synthetic files without starting the app or reading private .env files. Applicable adoption: - Add missing credential-bearing actor metadata, unsigned WebFinger rejection, invalid persisted-key/no-rotation, and non-primary-actor signer regressions. - Harden the existing local Follow/Undo fixture: block unexpected outbound requests even if Fedify catches the exception; verify every intercepted Accept cryptographically; test each ready message is processed once and deliberate delayed inbox retries stay queued; fail unexpected outbox retries. The explicit 503 failure fixture alone opts into its expected outbox retry. No production Undo or timeout changes. - Update `docs/activitypub-signed-follow-resolution.md` with comparison/provenance, applicability assessment, original completed/deployed status and operational boundaries. ## Verification - `npm ci`, typecheck, lint, build and diff check passed. - Full tests: **765 passed** (70 files). - CI-scope tests: **594 passed** (58 files). - Synthetic Playwright: **40 passed**, using installed Chromium 1234 executable override. - Intercepted fixtures/generated keys and disposable synthetic databases only; no real accounts or live social servers used. - Original checkout's generated CSS preserved unchanged (SHA256 `b111b4a78e3e020216bdbb3239d58cbf0a923f4fe49faf1cb6f7ebff87d9c17d`). Worktree build-generated CSS excluded from this PR. - npm installation reported 25 dependency advisories (17 moderate, 8 high); no package versions or unrelated remediation changed. - Hosted CI and independent read-only review pending; results will be attached before merge. ## Boundaries No release/publishing/deployment, live Follow, production data/key/origin changes, new contract 3.0.0 behavior or legacy cleanup. Existing retention and Rott rollout guidance remains unchanged; no Rott readiness or remote acceptance is claimed. Successful local API fixtures establish pending persistence/one queued Follow, not remote delivery or acceptance.

erik added 1 commit

2026-11-04 12:45:18 -06:00

test: reconcile SlugKit 1.0.1 signed Follow adoption

CI / build-lint-test (push) Successful in 1m27s

Details

fbe1c2182a

erik commented

2026-11-04 12:48:32 -06:00

Author

Owner

Independent review — task-6fa3ef35

Result

No actionable defects or unmet scoped requirements found. The reconciliation appropriately preserves the already-completed signed-fetch implementation rather than replacing working customized source.

Reviewed current commit fbe1c21 against its parent, the supplied review diff, and all five changed files in full. src/config/__tests__/dotenv-port.test.ts, described as untracked in the request, is now included in that commit. The worktree was clean at inspection.

Assessment

Compared actual released upstream commit 2a883b590e7c184be81201e9ae67b53a73865a7f in ../slugkit, plus the supplied changelog, guide and fixture/test references. Hash comparisons confirm src/api/routes/following.ts and src/federation/keys.ts are byte-identical to released upstream. Resolver differences are the retained stronger shared URL-safety helper and explanatory comments, not lost signing behavior.
Inspected the resolver, API/key selection, actor document, inline authenticated loaders, Follow/Undo handlers and surrounding identity/transaction tests. Primary-actor persisted keys, compatible acct: signing, unsigned WebFinger, constrained retrieval, sanitized fetch errors, no unsigned retry, canonical/profile verification and resolution-before-persistence/queueing remain intact. The newly added non-primary-actor and corrupt-key cases exercise the intended failure boundaries without rotation.
src/federation/__tests__/inbox.integration.test.ts:66-81,277-331 adds a network-denying default, an afterEach assertion for swallowed unexpected requests, and cryptographic verification against the app-advertised actor before recording intercepted Accept deliveries. Queue controls preserve ready-message-once behavior and reject unexpected delayed outbox retries; only the explicit 503 case opts out. Existing customized stale-Undo cases remain unchanged. No production Undo or timeout change was introduced.
The released toolkit Makefile contains dotenv fallback/export and local CLI targets absent from this site's Makefile, Procfile.dev and package.json. Not copying those targets is appropriate. The new dotenv test imports only src/config/runtime.ts in a Node subprocess using a synthetic env file; it does not import the app or open private databases.
The adoption document now distinguishes the completed original deployment from this source reconciliation, and retains local pending/queued versus remote acceptance distinctions. Existing retention/client-readiness rollout guidance is unchanged. The commit contains no runtime, dependency, schema, release, retention or generated-CSS changes.

Optional suggestion — not a blocker

src/following/__tests__/following.test.ts:129-174: consider also porting upstream's intercepted 302 response case and one-fetch assertion for the rejection matrix. The current suite already asserts redirect: error and tests transport rejection without unsigned fallback, so this is additional regression precision, not evidence of a runtime defect.

Verification limits

This was a read-only static review using file inspection and local read-only Git comparisons. I did not rerun tests, typecheck, lint, build or browser checks, and do not infer their final outcome from the reported initial focused run. Separately running check results still need verification by the task owner. No app was started; no live social-server requests, real-account actions, deployment, publishing, key rotation or production-data operations were performed. Historical release/deployment facts are taken from the supplied task context, not independently checked against production. No repository files were modified.

Implementer verification and delivery decision

Exact reviewed head: fbe1c2182a8ccf7b4cae44d7fe27007f01ec7dad. Hosted CI run #118 passed in 1m27s: https://forge.caradoc.com/erik/erikvancraddock.com/actions/runs/118 . Local npm ci/typecheck/lint/build/diff check passed; full suite 765 tests, CI-scope 594 tests, Playwright 40 tests. All fixture activity is synthetic/intercepted; no live social servers or real accounts were used.

The review's one explicitly optional 302/one-fetch test-precision suggestion is not a requested change or blocking warning. Existing redirect:error and transport/no-unsigned-fallback coverage remains intact; no additional runtime change is justified by it. No code changed after review.

No package/schema/runtime/retention changes, release/deployment, live Follow, key rotation, production data repair or legacy cleanup. Original main checkout's pre-existing generated CSS remains untouched; the task worktree's generated-only output was excluded from the commit. Proceeding with merge under the user's approved pickup pipeline.

# Independent review — task-6fa3ef35 ## Result **No actionable defects or unmet scoped requirements found.** The reconciliation appropriately preserves the already-completed signed-fetch implementation rather than replacing working customized source. Reviewed current commit `fbe1c21` against its parent, the supplied review diff, and all five changed files in full. `src/config/__tests__/dotenv-port.test.ts`, described as untracked in the request, is now included in that commit. The worktree was clean at inspection. ## Assessment - Compared actual released upstream commit `2a883b590e7c184be81201e9ae67b53a73865a7f` in `../slugkit`, plus the supplied changelog, guide and fixture/test references. Hash comparisons confirm `src/api/routes/following.ts` and `src/federation/keys.ts` are byte-identical to released upstream. Resolver differences are the retained stronger shared URL-safety helper and explanatory comments, not lost signing behavior. - Inspected the resolver, API/key selection, actor document, inline authenticated loaders, Follow/Undo handlers and surrounding identity/transaction tests. Primary-actor persisted keys, compatible `acct:` signing, unsigned WebFinger, constrained retrieval, sanitized fetch errors, no unsigned retry, canonical/profile verification and resolution-before-persistence/queueing remain intact. The newly added non-primary-actor and corrupt-key cases exercise the intended failure boundaries without rotation. - `src/federation/__tests__/inbox.integration.test.ts:66-81,277-331` adds a network-denying default, an afterEach assertion for swallowed unexpected requests, and cryptographic verification against the app-advertised actor before recording intercepted Accept deliveries. Queue controls preserve ready-message-once behavior and reject unexpected delayed outbox retries; only the explicit 503 case opts out. Existing customized stale-Undo cases remain unchanged. No production Undo or timeout change was introduced. - The released toolkit Makefile contains dotenv fallback/export and local CLI targets absent from this site's `Makefile`, `Procfile.dev` and `package.json`. Not copying those targets is appropriate. The new dotenv test imports only `src/config/runtime.ts` in a Node subprocess using a synthetic env file; it does not import the app or open private databases. - The adoption document now distinguishes the completed original deployment from this source reconciliation, and retains local pending/queued versus remote acceptance distinctions. Existing retention/client-readiness rollout guidance is unchanged. The commit contains no runtime, dependency, schema, release, retention or generated-CSS changes. ## Optional suggestion — not a blocker `src/following/__tests__/following.test.ts:129-174`: consider also porting upstream's intercepted 302 response case and one-fetch assertion for the rejection matrix. The current suite already asserts `redirect: error` and tests transport rejection without unsigned fallback, so this is additional regression precision, not evidence of a runtime defect. ## Verification limits This was a read-only static review using file inspection and local read-only Git comparisons. I did not rerun tests, typecheck, lint, build or browser checks, and do not infer their final outcome from the reported initial focused run. Separately running check results still need verification by the task owner. No app was started; no live social-server requests, real-account actions, deployment, publishing, key rotation or production-data operations were performed. Historical release/deployment facts are taken from the supplied task context, not independently checked against production. No repository files were modified. ## Implementer verification and delivery decision Exact reviewed head: `fbe1c2182a8ccf7b4cae44d7fe27007f01ec7dad`. Hosted CI run #118 passed in 1m27s: https://forge.caradoc.com/erik/erikvancraddock.com/actions/runs/118 . Local npm ci/typecheck/lint/build/diff check passed; full suite 765 tests, CI-scope 594 tests, Playwright 40 tests. All fixture activity is synthetic/intercepted; no live social servers or real accounts were used. The review's one explicitly optional 302/one-fetch test-precision suggestion is not a requested change or blocking warning. Existing redirect:error and transport/no-unsigned-fallback coverage remains intact; no additional runtime change is justified by it. No code changed after review. No package/schema/runtime/retention changes, release/deployment, live Follow, key rotation, production data repair or legacy cleanup. Original main checkout's pre-existing generated CSS remains untouched; the task worktree's generated-only output was excluded from the commit. Proceeding with merge under the user's approved pickup pipeline.

erik merged commit c7b20ce13e into main

2026-11-04 12:48:32 -06:00

erik deleted branch task-6fa3ef35-signed-follow-reconcile

2026-11-04 12:48:32 -06:00

erik referenced this pull request from a commit

2026-11-04 12:48:34 -06:00

Merge pull request 'Reconcile signed Follow fixes with SlugKit 1.0.1' (#32) from task-6fa3ef35-signed-follow-reconcile into main