…tion

Phase 1 (remote identity):
- db::users::upsert_remote_user stores a federated user as a normal `users`
  row keyed by qualified ID, with the fully-qualified handle in `username`
  (collision-free against local bare usernames) and origin set.
- snowflake::timestamp_of tolerates qualified IDs (strips @Domain).

Phase 2 (inbound content injection seam):
- Migration 028/013: `origin` on spaces/channels/roles/messages/members and
  spaces.federation_enabled; indexes on members/spaces/messages origin.
- Replica upserts in db::federation (space/channel/role/member) keyed by
  qualified IDs with origin set; db::messages::insert_remote_message stores a
  mirrored message idempotently; db::federation::interested_servers computes
  the fanout target set (distinct member origins).
- src/federation/apply.rs applies m.message.create: re-checks authority (S1:
  message/author/channel homed on the signing peer), enforces input caps (S6),
  ignores events for unmirrored channels, upserts the remote author, stores the
  replica message, and injects a message.create at the gateway_tx seam —
  delivery-only, never re-fanning out (S7 loop prevention).
- Inbox dispatches non-ping events through the applier.
- MessageRow/models gain an `origin` field.

Tests: 12 federation integration tests (added inbound message stored+broadcast,
spoofed-author rejected, unmirrored-channel ignored). Full suite green; clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4N5r2u3KcGouc7Nfnq9cP

When a message is created in a locally-homed space, fan it out to every peer
that has a member there:
- db::federation::space_origin (am I authoritative?) + interested_servers
  (distinct member origins) gate and target the fanout.
- src/federation/outbound.rs builds an m.message.create envelope with all IDs
  qualified to our domain (including author profile so peers can cache it) and
  enqueues it via the durable sender to interested peers only.
- Wired into routes/messages.rs create_message after the local gateway
  broadcast; non-fatal and a no-op unless federation is on and the space is
  local with >=1 remote member.

Guards: fanout is skipped for remote-homed spaces (we are not authoritative;
the forward path will handle those) and for DMs. Combined with the inbound
applier's inject-only behaviour, this preserves S7 loop prevention.

Tests: +2 (fans out a qualified envelope to interested peers; no fanout without
remote members). 14 federation tests; full suite green; clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4N5r2u3KcGouc7Nfnq9cP

A user on server A can now join a space homed on server B:
- src/federation/handshake.rs implements both sides:
  - Home side (POST /federation/v1/join): verifies the signature (shared
    verify::verify_signed), binds the joining user to the signing peer (S1),
    requires the space to be federation_enabled (S9) and the user un-banned
    (reuses db::bans::get_ban), adds the remote user as a member, and returns a
    snapshot (space, channels, roles, members, recent messages) with all IDs
    qualified to the home domain.
  - Joining side (apply_snapshot): mirrors the snapshot as local replica rows
    (origin = home domain), refusing any entity not homed on the peer (S2),
    and records the local joining user as a member so the mirrored space shows
    up in their space list / gateway delivery.
- Extracted shared inbound signature+trust verification into
  src/federation/verify.rs; inbox now reuses it.
- db::federation: space_federation_enabled / set_space_federation_enabled,
  space_origin, replica upserts already added in the prior commit.
- mapping::handle centralises qualified-handle construction (idempotent),
  used by the applier and snapshot builder.

Tests: +4 (home serves join & records remote member; refuses non-federated
space; joiner applies snapshot as replica incl. local membership; joiner
rejects a snapshot targeting a local space). 18 federation tests; full suite
green; clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4N5r2u3KcGouc7Nfnq9cP

…trip

Completes bidirectional content federation: a user on A can join a space homed
on B and post into it, with messages flowing both ways.

- src/federation/forward.rs:
  - handle_send (POST /federation/v1/send, home side): a peer forwards one of
    its members' message actions; the home server re-runs permissions from its
    OWN DB via require_channel_permission with a synthetic AuthUser (authority
    stays home, never trusting the request), persists the canonical message,
    broadcasts locally, and fans out to interested peers.
  - forward_message / initiate_join (replica side): synchronous signed S2S
    calls used by local routes.
- routes/messages.rs create_message now forwards to the home server for
  remote-homed spaces instead of persisting locally; the authoritative message
  returns via the inbox fanout.
- New authed REST trigger POST /api/v1/federation/spaces/join
  (spaces::join_federated_space) initiates a join and applies the snapshot.
- sender::request_signed (synchronous signed POST) + sender::deliver_due_once
  (drain the outbox once; also used by the background loop).
- outbound::message_payload extracted and shared by fanout and the /send reply.

Authority refinement: the home server is authoritative for its space's whole
message stream, so an inbound/snapshot message must have its id/channel/space
homed on the signing peer, but its AUTHOR may be a member from another server
(relayed). Members in a join snapshot likewise may come from several servers;
only the space's own state must be homed on the home server. The spoofed-author
test is repurposed to assert a foreign message/channel home is rejected.

Tests: +1 two-server round-trip over real HTTP (join handshake -> remote-homed
post forwarded to B -> fanout back to A), using ACCORD_FEDERATION_ALLOW_INSECURE
for loopback. 19 federation tests; full suite green; clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4N5r2u3KcGouc7Nfnq9cP

…anout

Extends live federation beyond message.create so replicas stay current:
- Reactions, bidirectional:
  - Inbox appliers m.reaction.add / m.reaction.remove: bind message/channel to
    the signing peer (author/reactor may be remote), upsert the reactor, apply
    to the replica reactions table idempotently, and rebroadcast.
  - Home POST /federation/v1/react: re-runs add_reactions / membership from our
    own DB, applies, broadcasts, and fans out to interested peers.
  - routes/reactions.rs add_reaction & remove_own_reaction now forward to the
    home server for remote-homed spaces and fan out for locally-homed ones.
- Message edit/delete, home -> replica:
  - Inbox appliers m.message.update / m.message.delete mutate only replica rows
    homed on the signing peer (S2) and rebroadcast message.update/.delete.
  - routes/messages.rs update_message / delete_message fan the change out to
    interested peers for locally-homed spaces.
- Generalised outbound::fanout_to_space (reused by messages/reactions/edits/
  deletes) and added reaction_payload; new db helpers edit_remote_message,
  add_reaction, remove_reaction; MessageRow already carries origin.

Tests: two-server e2e now also round-trips a reaction over real HTTP
(alice reacts in a remote-homed space -> forwarded to B -> fanned back to A);
added an inbound edit+delete test. 20 federation tests; full suite green; clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4N5r2u3KcGouc7Nfnq9cP

- S7: per-peer inbound rate limiting. FederationContext carries a token-bucket
  DashMap keyed by peer domain (300 req/60s); enforced centrally in
  verify::verify_signed after the trust gate, so all signed endpoints (inbox,
  join, send, react) are covered. Exhaustion returns 429.
- S3: bounded dedup table. db::federation::cleanup_dedup deletes
  federation_inbox_dedup rows older than the retention window; the sender loop
  prunes ~hourly (24h retention).

Tests: +1 unit (bucket exhausts then blocks; independent per peer) and +1
integration (cleanup prunes old rows, fresh survives). Full suite green; clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4N5r2u3KcGouc7Nfnq9cP

… live

Closes the last core liveness gap: replica member lists now track joins and
leaves on the home server, and a local user can actually leave a remote-homed
space (previously only their replica row was dropped while the home still
listed them).

- Inbox appliers m.member.join / m.member.leave (src/federation/apply.rs):
  bound to the signing peer's space, upsert/add or remove the member on the
  replica, and rebroadcast member.join/.leave.
- Home -> replica fanout at the local member-change sites for locally-homed
  spaces (reusing outbound::fanout_to_space):
  - join: routes/spaces.rs join_public_space, routes/invites.rs accept_invite.
  - leave/kick: routes/members.rs leave_space, kick_member.
  - outbound::member_join_payload / member_leave_payload qualify IDs.
- Remote-homed leave forward: new POST /federation/v1/leave
  (forward::handle_leave -> serve_leave re-checks membership from our DB,
  removes, broadcasts, fans out) and forward::forward_leave; leave_space now
  forwards to the home for remote-homed spaces then drops the local replica row.
  Kick on a remote-homed space remains home-authority-only (deferred).

Tests: +1 inbound member join+leave applied; two-server e2e extended with a
leave round-trip (alice leaves -> forwarded -> B drops her -> a.test no longer
an interested server). 22 federation tests; full suite green; clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4N5r2u3KcGouc7Nfnq9cP

… complete

Closes the remaining bidirectional gaps so every core chat action federates
both ways:
- Remote-homed message edit/delete forward: new POST /federation/v1/edit and
  /federation/v1/delete (forward::handle_edit/handle_delete -> serve_* re-run
  the author-or-manage check from our own DB, apply, broadcast, fan out, and
  return the authoritative result). routes/messages.rs update_message and
  delete_message now forward to the home for remote-homed spaces instead of
  failing the local author check (a forwarded message's author is the
  qualified remote id).
- Typing indicators: POST /federation/v1/typing (home re-broadcasts + fans out
  to interested peers) and inbox m.typing applier (ephemeral rebroadcast, no
  DB). routes/messages.rs typing_indicator forwards for remote-homed spaces and
  fans out for locally-homed ones.
- forward::actor_ref centralises the qualified-actor object used by the
  send/react/leave/edit/delete/typing forwards.

Tests: the two-server e2e now round-trips the full lifecycle over real HTTP —
join, post, react, edit, typing, delete, leave. Full suite green; clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4N5r2u3KcGouc7Nfnq9cP

Security review found that the no-local-overwrite guard (S2) was bypassable:
the inbound appliers passed author/reactor/member user IDs straight into
upsert_remote_user without requiring them to be qualified. A trusted peer
could send an event whose author/reactor/member ID was a BARE local snowflake
(e.g. "42"); domain_of returns None so origin defaulted to the peer, and
INSERT ... ON CONFLICT(id="42") DO UPDATE overwrote the LOCAL user's
username/display_name/avatar and flipped its origin — identity takeover of any
local user (incl. admins) across the trust boundary.

Fix: call authority::require_remote_target (reject unqualified IDs) on every
inbound user-ID path before upsert_remote_user — apply_message_create (author),
apply_reaction (reactor), apply_member_join (member), and apply_snapshot
(members + message authors). Qualified IDs can never collide with local bare
snowflakes, so legitimate relayed/remote users are unaffected. The space/
channel/message/role paths were already guarded with require_homed_on.

Tests: +2 regression tests (inbound message and reaction with a bare local
author/reactor ID are rejected 403 and the local user row is untouched). Full
suite green; clippy clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4N5r2u3KcGouc7Nfnq9cP

…factor

Federate custom emoji for remote-homed spaces: included in the join
snapshot and propagated live via m.emoji.create/update/delete fanout.
Mirrored emoji use qualified IDs (origin = home domain) and reference
the home server's image by absolute URL rather than mirroring bytes.
Emoji mutations on a mirrored space are rejected — they must run on the
home server. Inbound appliers re-check authority, input caps, and only
ever touch replica rows homed on the signing peer (S2).

Also folds in the in-progress S2S refactor this builds on: a shared
verify::prepare helper for the signed endpoints, and RemoteUserRef
relocated to mapping with an optional username + username_or_id().

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Inbound appliers scoped their gateway broadcast on the peer-supplied
space_id rather than the resource's own space, letting a trusted peer
misroute (or globally fan out) events to spaces the resource does not
belong to:

- apply_message_create: store and broadcast on the mirrored channel's
  own space_id, not payload.space_id.
- apply_emoji_delete: read the emoji's space_id before deletion and
  broadcast on that, not payload.space_id; drop the now-unused field.

Member/emoji-upsert/message-update/delete/reaction paths already route
on authority-checked or DB-sourced values, so they are unaffected.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>