thepra/SocialPub
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

R1 cleanup: collAnon and dead code gone, docs current, every peer's scenario in one sweep
Build / Build (push) Successful in 1m7s
Details

Browse Source 
Starts the completion program (docs/ROADMAP.md, "Owner decisions on finishing everything", 2026-10-17).

- Dead code: the commented-out collAnon blocks (discussions, seeding, admin user lists, HTTP/3, the old signature
  middleware), the empty PrivaPubWorkersConfiguration, PublicAvatarUsersService and UserPolicyType, unused helpers,
  the second IPasswordHasher registration, the PasswordGenerator package, SignUpAsync/LoginAsync's unused invitation
  parameters. "Starting PrivaPub"; a signed-in login is sent to "/", not to "/discussions".
- Stored fields nothing read: RootUser.Contacts and ResetPasswordToken*, the local Avatar.AvatarServer,
  EmailRecovery.RecoveryCode/RequestIP/CreationDate, MongoSettings.LogsDatabase, and AppConfiguration's
  upload/discussion keys, RequiresFirstTimeSetup and Version (old documents still load: MongoDB.Entities ignores extra
  elements). DmPost's indexes are no longer made. 49 collAnon keys leave FieldsNameResource in every language.
- /clientapi/data/current-version answers the build's ref. UsersIds is a list that can't throw, and the admin routes
  leave the administrator out without mutating the request.
- deploy.yml checks SecureMode on a name no persona can have, and the browser redirect on the directory's first local
  persona: @thepra is the administrator's own now.
- Town: decePub's e2e remnants (expect, client.jsonl, the decePub column) and town/tests go; the dead gaps/load
  commands too. Mobilizon no longer keeps an event for a deleted test.
- tools/pasture/sweep.sh runs every peer's scenario, batch by batch, as CLAUDE.md asks before a change to what
  PrivaPub sends.
- Docs: CLAUDE.md's repo map, route table (every frozen route) and stale lines; ROADMAP's status (setup, v1.25.0,
  v1.26.0, the program C), the 2026-10-17 decisions, and dated notes where earlier text no longer holds; FEDERATION.md's
  FEP list (7888, f228, 7628, ae0c and 8967 supported) and the deploy's persona.

Verified: dotnet build PrivaPub.sln -c Release (0 errors, no new warnings); bash -n on the touched scripts; py_compile
on the town; the pasture's gts, mastodon and lemmy scenarios on this build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof
This commit is contained in:
thepraandClaude Opus 5.5 committed 2026-10-17 02:56:57 +02:00
1 parent 6727e1817a
commit ff5e635dda
71 files changed
+238 -4767
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/INTEROP.md
+1 -1
View File
@@ -535,7 +535,7 @@ on a Page: pins live in `featured`, locks in `Lock`.
| Gap | P | Client surface |
|---|---|---|
| `Dislike` and its `Undo`: a vote ledger per object (actor, ±1, activity, relaying group, time) | P1 | `favourites_count` = upvotes; own `privapub.vote{score, up, down, mine}`, `POST …/vote` |
| Announces of activities other than Create (votes, moderation): trust the inner activity when the object's own group signed the Announce; refetching every vote does not scale. Keep the origin refetch for Create and Update. Votes and their undoing **done** 2026-10-04 (`AnnounceHandler.Relayed`: trusted from the community's own server or on its own posts, otherwise fetched from the voter's origin); moderation still open | P1 | — |
| Announces of activities other than Create (votes, moderation): trust the inner activity when the object's own group signed the Announce; refetching every vote does not scale. Keep the origin refetch for Create and Update. Votes and their undoing **done** 2026-10-04 (`AnnounceHandler.Relayed`: trusted from the community's own server or on its own posts, otherwise fetched from the voter's origin); relayed locks and bans **done** 2026-10-05 (G-0006) | P1 | — |
| Moderation state: removals (reason, by, at, cascade), locks, bans with `endTime`/`removeData`, featured, moderators, `Update{Group}` by a moderator | P1 | removed posts hidden plus `privapub.removed`; `privapub.locked` (replying answers 422); pins as `pinned=true` |
| Link posts: keep `Link.href`, the thumbnail `image` and alt text; build the card (Lemmy sends no title or description for the link) | P1 | `Status.card` |
| `ChatMessage` in and out (out to someone who writes to us that way, and to Lemmy 0.19 and Mbin by NodeInfo, done 2026-10-05) | P1 | `visibility: direct` |
docs/ROADMAP.md
+57 -25
View File
@@ -9,10 +9,10 @@ Written 2026-10-01 from the original 2023 code, the decePubClient UI, a federati
- [x] P1.2 Social graph and timelines: v1.3.0, deployed and verified 2026-10-01
- [x] P2 Mastodon client API: v1.4.0, deployed 2026-10-01; OAuth and the anonymous API verified on production, the signed-in API verified locally (no real-client login on production yet)
- [x] P3 Social features: v1.5.0, deployed 2026-10-01; media, proxy, blocks, mutes, bookmarks, pins and reports verified by tests and locally (no upload on production yet)
- [x] P4 Groups and privacy features: v1.6.0, deployed 2026-10-01; communities, circles and local-only located posts verified by tests. v1.6.1 adds the pasture (`tools/pasture/`): live interop with GoToSocial 0.22.1 passes all 25 checks, three runs in a row. Lemmy and a live Mastodon circle member are not run yet; the pasture has GoToSocial only
- [x] P4 Groups and privacy features: v1.6.0, deployed 2026-10-01; communities, circles and local-only located posts verified by tests. v1.6.1 adds the pasture (`tools/pasture/`): live interop with GoToSocial 0.22.1 passes all 25 checks, three runs in a row. Lemmy and a live Mastodon circle member are not run yet; the pasture has GoToSocial only (both run since: T/M and v1.19.1)
- [x] P5 Lose nothing: v1.7.0 to v1.9.1, deployed 2026-10-01; parsing, typed details, provenance, downvotes, tombstones, federated blocks, all checked live against GoToSocial. Book reviews and forum threads keep their raw form only (typed in P7 and P8)
- [x] P6 Emoji, polls, quotes, reactions, cards, players: v1.10.0 to v1.15.0, deployed 2026-10-01; polls, link cards, ranged video streaming and quote policies checked live against GoToSocial
- [ ] T/M Test sweep, the full pasture and the interaction ledger (see "Sweep and statistics" below). T1–T4: v1.15.1, deployed and verified 2026-10-03 (CI runs all tests on a throwaway mongod; nothing answers 500). M1–M6: v1.16.0, deployed and verified 2026-10-03 (the interaction ledger records every inbox answer, handler verdict, delivery attempt and outbound request; the GoToSocial pasture passes 33/33 with no names in the statistics). T5–T9, T11 and M7–M11: v1.17.0, 2026-10-03:
- [x] T/M Test sweep, the full pasture and the interaction ledger (see "Sweep and statistics" below). T1–T4: v1.15.1, deployed and verified 2026-10-03 (CI runs all tests on a throwaway mongod; nothing answers 500). M1–M6: v1.16.0, deployed and verified 2026-10-03 (the interaction ledger records every inbox answer, handler verdict, delivery attempt and outbound request; the GoToSocial pasture passes 33/33 with no names in the statistics). T5–T9, T11 and M7–M11: v1.17.0, 2026-10-03:
- 639 tests, now over HTTP too;
- daily rollups, every touched server described and located, the admin statistics API, the opt-in crawler and `/stargazing`;
- the pasture as plugins: GoToSocial 37/37, Mastodon 49 plus 2 expected failures.
@@ -30,7 +30,7 @@ Written 2026-10-01 from the original 2023 code, the decePubClient UI, a federati
- Akkoma's open polls showed as ended and refused votes.
Both open items were closed without a root step (owner decisions, 2026-10-04): the server fetches its geolocation
databases itself, and the deploy makes and signs in as @thepra.
databases itself, and the deploy makes and signs in as @thepra (that signed-in check was dropped on 2026-10-17).
- [x] Everything on in production (owner decisions 2026-10-04):
- v1.18.0, deployed and verified 2026-10-04: geolocation that updates itself (DB-IP Lite 2026-10 loaded), the deploy
signing in as @thepra (undiscoverable), the crawler on (1010 servers known within the hour), sign-up by invitation
@@ -55,7 +55,8 @@ Written 2026-10-01 from the original 2023 code, the decePubClient UI, a federati
gap it finds fixed. Runs alongside P7, P8 and P9. Done so far:
- the town toolkit (`tools/pasture/town/`): drivers for PrivaPub and the six peers, the seeded `village` (23 accounts,
205 objects, 970 steps), the coherence sweep with known gaps (`gaps.json`), the report and `docs/INTEROP-BACKLOG.md`;
- decePubClient's end-to-end tests against the pasture (`decePubClient/tests/e2e`, Playwright for .NET);
- decePubClient's end-to-end tests against the pasture (`decePubClient/tests/e2e`, Playwright for .NET; removed with the
test projects on 2026-10-17);
- three bugs the first village found, fixed: likes, reactions, votes and downvotes from followers on followers-only
posts and from circle members were dropped (G-0001); a Follow refused with Mastodon's first-contact 422 was lost for
good; a persona addressed without being named could not see the post (silent mentions).
@@ -108,6 +109,14 @@ Written 2026-10-01 from the original 2023 code, the decePubClient UI, a federati
- [x] Status search by words, scoped as Mastodon scopes it: what the persona wrote, boosted, favourited, bookmarked or
was named in, and public posts of authors who let themselves be indexed (off by default); newest first, through a
text index over the posts' words in every language alike.
- [x] First-time setup and invitations (2026-10-16/17): PrivaPub v1.25.0, the first login made from the client while no
administrator exists, then setup sealed for good; decePub v1.6.0, `/setup` and `/join?code=`; PrivaPub v1.26.0,
`admin move-persona` and `admin delete-root`, and the deploy no longer signs in (@thepra is the administrator's). The
test projects were deleted the same day.
- [ ] C The completion program (owner decisions 2026-10-17, below): everything unfinished, in sixteen releases. Cleanup;
accounts (email, recovery, sessions, TOTP); the client catching up; the server's own settings; moderation; custom
emoji; the Mastodon API made real; Web Push; P7's communities; P8's signatures; the long tail with HEIC/HEIF;
hosting events; town drivers for every peer; public `/stargazing` and Bluesky bridging; the close-out.
## Intent
@@ -244,7 +253,7 @@ and circles (see Owner decisions).
| Question | Decision |
|---|---|
| What runs in production | **Everything that is built is on and checked by the deploy**, and nothing waits on a person running a command. |
| What runs in production | **Everything that is built is on and checked by the deploy's anonymous checks** (nothing signs in since 2026-10-17), and nothing waits on a person running a command. |
| Geolocation | **The server fetches DB-IP Lite itself** (`GeoUpdater`): it checks daily, installs a new month's databases once they are published, refuses a file that does not open as the right kind of database, and keeps the old one when anything fails. No timer and no root step. The deploy fails if the databases are missing or more than 40 days old. |
| Crawler | **On in production**, seeded with a handful of large servers of different kinds (`appsettings.Production.json`); the deploy fails if `/stargazing` does not say it is on. |
| Sign-up | **Closed: invitations only.** A group invitation creates an account; open sign-up answers 403. NodeInfo, `/api/v1/instance` and `/api/v2/instance` read the same switch (`Registrations:Mode`), and the deploy fails if they disagree. The first login on a server is made from the client's setup page while no administrator exists (2026-10-16: first come, first served, no setup code); it becomes the administrator with its first persona, and setup closes for good (`ServerSetup`, kept across restores). `PrivaPub admin create-root` remains the way in from the box. |
@@ -253,7 +262,7 @@ and circles (see Owner decisions).
| Signed fetches (SecureMode) | **On in production** once the pasture passes with it on (Phase 2 of the 2026-10-04 plan). |
| Circles on Mastodon and GoToSocial | **Each member's copy names that member** in `cc`; a member's refetch names the member, an instance actor's refetch the members on its server. Nothing new is revealed to anyone outside the circle. |
| What circles and located posts reveal | **Unchanged**: circles still answer WebFinger, and circle and located posts still count in a persona's post count, "a good balance for the fediverse to work". |
| Public `/stargazing` statistics | **Later**, as decided on 2026-10-03; the crawler and the admin API keep collecting meanwhile. |
| Public `/stargazing` statistics | **Approved 2026-10-17** (C, release R15), built from public counters only. Until then the crawler and the admin API keep collecting. |
### Owner decisions on decePubClient (2026-10-04)
@@ -269,10 +278,10 @@ and circles (see Owner decisions).
| Question | Decision |
|---|---|
| Scope | **Every self-hostable fediverse platform** in the pasture, accounts of every kind, a fake community across them, and coherence of state between all of them and PrivaPub, checked from both the servers and decePubClient. What the town finds is fixed until PrivaPub is the best federating server and decePubClient the best client for the fediverse at volume. |
| The "Cut" list | **Lists, server-side filters, scheduled posts, followed hashtags, trends and a directory come back** (P9). The directory lists only discoverable personas; trends count only public posts PrivaPub already holds. Translation, local custom emoji, the Mastodon admin API, API registration, S3 and JSON-LD processing stay cut. |
| decePubClient tests | **Playwright for .NET**, against the pasture, never in CI. |
| How work lands | Commits on master in both repositories; nothing is pushed, tagged or deployed without asking. |
| Still asked first | Anything new that tells another server something about a persona, Web Push (traffic to push services), any admin endpoint in production, and anything acting from production or the owner's accounts. |
| The "Cut" list | **Lists, server-side filters, scheduled posts, followed hashtags, trends and a directory come back** (P9). The directory lists only discoverable personas; trends count only public posts PrivaPub already holds. Translation, local custom emoji, the Mastodon admin API, API registration, S3 and JSON-LD processing stay cut. *Local custom emoji came back on 2026-10-17 (C, R7).* |
| decePubClient tests | **Removed 2026-10-17.** They were Playwright for .NET against the pasture, never in CI. |
| How work lands | Commits on master in both repositories; nothing is pushed, tagged or deployed without asking. *For the completion program (2026-10-17): each release is pushed to master, and the owner tags.* |
| Still asked first | Anything new that tells another server something about a persona, Web Push (traffic to push services), any admin endpoint in production, and anything acting from production or the owner's accounts. *2026-10-17: Web Push, admin endpoints in production, public statistics and per-persona Bluesky bridging are approved; the rest still asks.* |
### Owner decisions on events and threads (2026-10-05)
@@ -321,6 +330,26 @@ directory; the nginx locations), then v1.23.0, whose own pre-deploy backup was v
which held statistics salts, were deleted (owner's go-ahead); a salt-free dump taken just before the replica-set
conversion is kept in `/var/backups/privapub.thepra.dev/`.
### Owner decisions on finishing everything (2026-10-17)
The owner found decePubClient's Administration page mostly placeholders and asked for every unfinished thing, there
and elsewhere, to be finished end to end. The plan is sixteen releases (Status, C): R1 cleanup, R2 accounts, R3 TOTP,
R4 the client catching up, R5 the server's own settings, R6 moderation, R7 custom emoji, R8 the Mastodon API, R9 Web
Push, R10 communities (P7), R11 signatures (P8), R12 the long tail, R13 hosting events, R14 town drivers, R15 public
statistics and Bluesky bridging, R16 the close-out.
| Question | Decision |
|---|---|
| Scope | **Everything, in waves**: the product (administration, accounts, the client, the Mastodon API, Web Push), then P7 and P8, then the long tail. |
| Administration | **Users and personas, instance and rules, relays and media limits, custom emoji** become real. The other Pleroma-era placeholders (Authentication, Frontend, Link formatter) go. |
| Secrets | **Stay committed**, by the existing convention; only code-level security is fixed. |
| Approved | **Web Push, the public `/stargazing` statistics, per-persona Bluesky bridging, email recovery in the client, local custom emoji, admin endpoints in production.** |
| Built after all | **Hosting events, HEIC/HEIF uploads, town drivers for every peer.** Discourse, NeoDB and Loops peers stay out. |
| Two-factor | **TOTP, right after email recovery** (R3). |
| A suspended local persona | **Tells other servers nothing new**: its posts and collections answer 404 and nothing is delivered from it; the actor stays as it is, so lifting the suspension is clean. |
| Releases | **Pushed to master, not tagged**: the owner tags when they choose. |
| Cut | FASP; rewriting HLS playlists; `Announce(object)` per peer; cross-post detection, PieFed's genAI flag, accepted answers and batched Announces; Ed25519 inbound RFC 9421; typed book reviews; the `Api/ClientApi` folder move; Pleroma `Listen` and `acceptsChatMessages` out; Owncast live state; a dislikes collection; Lemmy's `removeData`; translation; the Mastodon admin API; `POST /api/v1/accounts`; S3. |
## Libraries (researched; no maintained .NET ActivityPub library exists, so Letterbook and Iceshrimp.NET both wrote their own)
| Area | Choice |
@@ -332,14 +361,14 @@ conversion is kept in `/var/backups/privapub.thepra.dev/`.
| Media | **NetVips** (+NetVips.Native) for images: autorotate, strip EXIF/GPS, thumbnails. **Blurhash.Core**, **FFMpegCore** for video. Own `IMediaStore` (local disk now). Not ImageSharp 4, whose license key is enforced at build. |
| OAuth | **OpenIddict 7.7 + OpenIddict.MongoDb**: authorization code with PKCE, client_credentials, `oob` redirect, dynamic apps from `POST /api/v1/apps`, reference tokens |
| Jobs | Own Mongo job collection for both inbox processing and delivery: `FindOneAndUpdate` leases, a `Channel` wake-up, per-host circuit breaker, Mastodon's backoff (`n⁴+15+jitter`, 16 tries). No MassTransit (commercial from v9, no Mongo transport). |
| Tests | New xUnit project with fixture JSON captured from Mastodon, GoToSocial, Misskey, Lemmy and Akkoma; interop checked with Fediverse Pasture, verify.funfedi.dev and activitypub.academy |
| Tests | *Removed 2026-10-17 (owner decision): there is no test project.* Interop is checked with the pasture, verify.funfedi.dev and activitypub.academy |
**FEPs, now:** FEP-f1d5 (NodeInfo 2.0 and 2.1), FEP-67ff (FEDERATION.md), FEP-8fcf, FEP-5feb `indexable`,
FEP-7628 Move, FEP-2c59, FEP-044f quotes (parse, plus `interactionPolicy`), FEP-1b12 groups.
**FEPs, later:** FEP-521a, FEP-8b32, FEP-e232, relays (FEP-ae0c).
**FEPs, later:** FEP-521a, FEP-8b32, FEP-e232, relays (FEP-ae0c); all done since.
**FEPs, skipped:** FEP-c390, FEP-ef61, FEP-fb2a, FEP-844e.
**FEPs, skipped:** FEP-c390, FEP-ef61, FEP-fb2a. (FEP-844e was implemented after all, 2026-10-06.)
## Route names (deliberate; part of the project's character)
@@ -434,9 +463,10 @@ The first refactor commit is a pure move with namespaces only. Logic changes fol
- Plain: `PublicKeyId`, `(GroupUserId, _id)`, `(GroupId, _id)`.
- **Rate limiting** on login, signup, invitation and inbox (per key host).
- **Cleanup:** delete `Services/ActivityPubClient.cs` and `Models/Post/PostBoost.cs`.
- **New `PrivaPub.Tests`** (xUnit v3): IpRangeGuard table, signature fixtures (a real Mastodon request plus tampering
- **New `PrivaPub.Tests`** (xUnit v3; removed 2026-10-17): IpRangeGuard table, signature fixtures (a real Mastodon request plus tampering
cases), key-poisoning, origin rules, XSS corpus, DM injection.
- **CI:** `build.yml` runs the tests. `deploy.yml` runs the tests and a `mongodump` before swapping.
- **CI:** `build.yml` runs the tests. `deploy.yml` runs the tests and a `mongodump` before swapping. *Since then the server's
own pre-deploy backup replaced the mongodump, and on 2026-10-17 the tests went.*
### P1 Interop foundations (two deploys)
@@ -573,7 +603,7 @@ The first refactor commit is a pure move with namespaces only. Logic changes fol
- **Bookmarks and pins:** pins are served as the `featured` collection at `/peasants/{name}/trophies`, with featured
tags at `/tattoos`.
- **Blocks and mutes:** per avatar. **Block is not federated**: it sends Reject or Undo Follow instead and drops the
blocked actor's traffic. Domain blocks per account as well.
blocked actor's traffic. *Superseded: blocks federate (owner decision, "Blocks").* Domain blocks per account as well.
- **Reports:** inbound Flag becomes a `Report`. Outbound Flag is **sent by the instance actor**, or for a post in a
community on Lemmy, PieFed or Mbin by the reporter `privapub_reports` (2026-10-06), so the reporting persona isn't
revealed. Moderator endpoints on `/clientapi`.
@@ -759,8 +789,8 @@ it, raw where it doesn't.
- `implements` (FEP-844e): **done 2026-10-06** (RFC 9421, on the instance actor and as every actor's `generator`).
- **Mastodon API:** ~~streaming WebSocket~~ (done 2026-10-05: `/api/v1/streaming` as a WebSocket and as server-sent
events, user, notification, public, hashtag and list streams, each event mapped for its persona; a deletion reaches
only the streams that showed the post), Web Push (gated: outbound traffic to push services), grouped notifications.
Then advertise an honest version.
only the streams that showed the post), Web Push (gated: outbound traffic to push services; approved 2026-10-17, C R9), grouped
notifications. Then advertise an honest version.
- **Backfill:** an author's outbox after following them: **done 2026-10-05** (`OutboxBackfill`, the first page's
public posts, twenty at most, once a day; checked live against Mastodon).
- **Long tail:**
@@ -793,25 +823,27 @@ buckets and only for servers reporting at least 10 users; the owner never intend
### Cut or deferred (deliberately)
- **Cut:**
- Link-preview cards *fetched from the linked page* by default. Cards built from the object, or from FEP-8967
`preview` data, are in P6; fetching the page is an owner decision (INTEROP §6.1).
`preview` data, are in P6; fetching the page is an owner decision (INTEROP §6.1). *The owner decided to fetch ("Link
previews"); shipped in P6.*
- Translation. (Trends, the directory, lists, filters and scheduled posts were cut too, until the owner brought them
back on 2026-10-04: P9.)
- The Mastodon admin API: moderation stays on `/clientapi`.
- `POST /api/v1/accounts` registration: avatars are created through `/clientapi`.
- Local custom emoji.
- Local custom emoji. *Back on 2026-10-17 (C, R7).*
- S3 storage.
- JSON-LD and LD-signature processing. FEP-8b32 proofs need neither (JCS), so they are in P8.
- **Deferred:** video transcoding (remux only for now).
- **Deferred:** video transcoding (remux only for now). *Done since: video is transcoded (CLAUDE.md, Media invariants).*
## Verification (per phase)
- **Unit tests** (`PrivaPub.Tests`) on every phase. Fixture JSON is captured per peer into
- **Unit tests** (`PrivaPub.Tests`) on every phase. *Removed 2026-10-17: no test project remains.* Fixture JSON is captured per peer into
`Fixtures/{mastodon,gotosocial,misskey,akkoma,lemmy}/`. Renderers are checked against golden JSON. Inbound
scenarios run as integration tests on a throwaway mongod.
- **Interop:** **Fediverse Pasture** runs on the workstation with podman: Mastodon, GoToSocial, Misskey/Sharkey,
Akkoma, plus Lemmy for P4. As built, `tools/pasture/run.sh` runs PrivaPub and GoToSocial behind one Caddy on a
podman network, with `AllowPrivateNetworks`, `AllowPlainHttp` and `AcceptAnyCertificate`; startup refuses all three in
Production. `tools/pasture/interop.sh` drives the matrix for GoToSocial; the other peers are still to be added. The
Production. `tools/pasture/interop.sh` drives the matrix for GoToSocial; the other peers are still to be added. *(Since added: the
pasture runs every peer in `tools/pasture/peers/`, and `tools/pasture/sweep.sh` runs them all.)* The
matrix, per peer:
- follow both ways;
- public, unlisted, followers-only and direct posts both ways;
@@ -829,7 +861,7 @@ buckets and only for servers reporting at least 10 users; the owner never intend
- **P2:** Tusky, Elk, Phanpy and Ivory each log in with two avatars of one root as separate accounts. Home paginates
both ways; post, reply, DM, follow-by-search, notifications, CW, and edit or delete-and-redraft all work.
`tools/smoke/mastodon-api.sh` runs after every deploy. A test asserts that no response for avatar A contains avatar
B's id.
B's id. *(That test went with the test projects.)*
- **P3:**
- `exiftool` shows no GPS data on an uploaded original.
- Elk renders the blurhash.
@@ -845,7 +877,7 @@ buckets and only for servers reporting at least 10 users; the owner never intend
## Risks and sequencing
- Unique indexes fail on existing duplicates, so the dedupe migration runs first. Run a `mongodump` before every
tagged deploy from P0 on.
tagged deploy from P0 on. *(The server's own pre-deploy backup does this now.)*
- Merge DmPost into Post and register `PrivacyIdGenerator` **before P2** exposes ids to clients.
- The publish grows by about 20 MB (OpenIddict, NetVips.Native, FFMpegCore). Keep `deploy.yml`'s asserted file list
current, and add ffmpeg in `deploy/max/setup.sh`.