Bonumark Stream v0.8.1

Bonumark Stream v0.8.1

Bonumark Stream v0.8.1 adds optional ActivityPub federation while keeping Bonumark what it already is: a self-hosted publishing system built around your site, your domain, and your content.

The last public release, v0.7.2, focused heavily on hosting portability, upgrades, deployment verification, and the operational foundation underneath Bonumark.

v0.8.1 builds on that foundation by letting a Bonumark site participate directly in the fediverse.

You still publish from Bonumark. Your database remains the source of truth. Your public Stream remains centered on your own posts. ActivityPub adds federation around that system instead of turning Bonumark into another social network.

What ActivityPub Adds

When ActivityPub is enabled, a Bonumark Stream site gets a stable fediverse identity that people on compatible platforms can discover and follow.

Bonumark has been tested directly with Mastodon, GoToSocial, and Misskey.io.

The ActivityPub implementation includes:

• WebFinger discovery
• a stable single-owner actor
• follower requests and approval
• Follow, Accept, Reject, and Undo Follow
• outbound post federation
• post updates
• post deletion
• multiple images
• image alt text
• shared inbox delivery
• asynchronous delivery and retries
• incoming replies
• incoming Likes
• incoming boosts
• Undo Like and Undo Boost
• owner Follow and Unfollow
• owner Reply
• owner Like and Unlike
• owner Boost and Unboost
• actor and domain blocking
• delivery diagnostics and repair
• federation pause
• delivery suspension
• permanent actor retirement

ActivityPub is disabled by default. Nothing federates until the site owner configures and enables it.

Publish From Bonumark First

Federation does not replace Bonumark's normal publishing workflow.

You still create and publish Stream Posts from your own site.

When a local post is published, Bonumark completes the local publishing operation first. Federation happens afterward through the asynchronous delivery system.

That means a remote Mastodon, GoToSocial, Misskey, or other ActivityPub server being unavailable cannot prevent your post from being saved on your own site.

Bonumark remains your publishing home.

Federation is an additional delivery path.

A Private Following Timeline

v0.8.1 adds a private frontend Following experience for the site owner.

When ActivityPub is enabled, Following appears in the authenticated frontend navigation.

The timeline is:

• private to the owner
• chronological
• newest first
• non-algorithmic
• free of recommendations
• separate from the public Stream

Remote posts do not become public Bonumark content simply because you follow someone.

They stay out of:

• the public Stream
• public search
• the sitemap
• static export
• public feeds intended for local content

Following uses the active Bonumark theme so federation participation feels like part of the product instead of a separate administration tool.

Follow and Participate Without Leaving Bonumark

The owner can follow remote accounts by fediverse handle, profile URL, or actor URL.

Once the relationship is accepted, new remote posts can appear in Following.

From there, the owner can:

• open a private conversation
• reply
• Like
• Unlike
• Boost
• Unboost
• open the original remote post

Replies use Bonumark's normal frontend Stream composer.

A reply is still a normal Bonumark Stream Post. Bonumark remains the source of truth for the post, and the remote target is attached as ActivityPub reply metadata before the normal publication process runs.

There is no separate federation-only reply system.

Incoming Replies, Likes, and Boosts

Bonumark can also receive interaction from the fediverse.

Incoming replies begin in moderation.

Incoming Likes and boosts are stored separately from Bonumark's existing anonymous local Like system.

The owner can privately see incoming fediverse Likes and boosts on the corresponding local post.

That private interaction view:

• identifies the remote actor
• keeps Likes and boosts separate
• respects Undo activity
• stays private to the owner
• does not change local Like counts
• does not expose federation interaction data to public visitors

Remote actors never become Bonumark user accounts.

Media and Content Warnings

Following supports remote media while preserving Bonumark's presentation and safety boundaries.

Accepted media behavior includes:

• image-only remote posts
• single images
• two-image galleries
• four-image galleries
• mixed portrait and landscape images
• distinct image alt text
• full-frame image presentation
• remote image activation
• video and audio presentation
• content warnings

Content warnings conceal both the post body and its attached media until expanded.

Images retain their alt descriptions without displaying those descriptions as unwanted visible text.

Deleted Posts Stay Deleted

Bonumark separates local post identity from ActivityPub publication identity.

A local Stream Post keeps the same Bonumark post_id through normal reversible lifecycle changes such as:

• draft
• publish
• unpublish
• trash
• restore
• republish

Federated publication works differently.

Each federated publication lifetime receives its own ActivityPub generation and object address.

Once Bonumark sends Delete for a generation, that ActivityPub object is permanently retired.

It becomes a Tombstone and cannot later become a live Note again.

If the local Bonumark post is republished, Bonumark creates:

• a new ActivityPub generation
• a new ActivityPub object URI

The old generation remains retired.

Replies, Likes, boosts, and other federation interaction state stay attached to the generation they originally targeted.

This prevents deleted ActivityPub objects from silently coming back to life.

Delivery Is Asynchronous

Federation delivery runs separately from local publishing.

The delivery system includes:

• atomic queue claiming
• bounded batches
• stale-processing recovery
• exponential retry
• Retry-After handling
• dead-letter handling
• immutable delivery payload reuse
• queue inspection
• safe retry
• repair tools
• permanent cancellation where appropriate

Delivery can run through server cron or Bonumark's protected web-cron path.

If a remote service is temporarily unavailable, Bonumark can retry without blocking your local publishing workflow.

HTTP Signature Support

Bonumark supports both major signature styles encountered during federation testing:

• established RSA HTTP Signatures
• RFC 9421 HTTP Message Signatures

Inbound requests are checked for:

• valid signatures
• digest integrity
• actor identity
• key ownership
• activity identity
• replay attempts
• duplicate activity
• valid request structure

Private signing keys are encrypted using installation-derived key material.

Key creation and rotation include a cryptographic self-test.

Rotating the signing key does not change the Bonumark actor identity.

Safer Remote Networking

Remote actor discovery and federation delivery use a restricted HTTPS transport designed to reduce SSRF risk.

Bonumark rejects requests to destinations such as:

• private IP ranges
• loopback addresses
• link-local addresses
• reserved ranges
• carrier-grade NAT ranges
• metadata endpoints

The transport also places limits on:

• DNS behavior
• redirects
• response size
• request size
• JSON depth
• network time

These protections apply around remote actor discovery, object fetching, and delivery.

Pause, Suspend, or Permanently Deactivate Federation

v0.8.1 keeps several operational states separate.

Pause

Pause temporarily takes the actor and inbox out of service and stops new federation work.

The identity and existing relationships remain preserved.

Pause is reversible.

Delivery suspension

Delivery suspension keeps the actor and inbox active but stops Bonumark from claiming outbound deliveries.

Local publication work can still be recorded for later delivery.

Delivery suspension is reversible.

Permanent federation deactivation

Permanent deactivation sends Actor Delete and permanently retires the current actor URI.

After retirement:

• the actor endpoint returns 410 Gone
• WebFinger stops advertising the actor
• the identity cannot be re-enabled
• Bonumark does not currently create a replacement actor identity

Use Pause or delivery suspension if there is any chance the actor will be needed again.

Permanent deactivation is intentionally irreversible.

Blocking and Moderation

The owner can block:

• individual remote actors
• entire remote domains

Blocking affects federation participation across:

• follower relationships
• Following
• incoming replies
• incoming Likes and boosts
• cached remote content
• owner federation actions

Incoming replies remain subject to moderation rather than automatically becoming public local comments.

Phone and Accessibility Acceptance

The Following and Conversation interfaces were tested at:

• 390 × 844
• 360 × 800

Acceptance included:

• no horizontal page overflow
• long remote text staying inside cards
• long handles remaining usable
• links staying contained
• action rows wrapping correctly
• practical touch targets
• usable Reply composer controls
• readable timestamps
• usable Back to Following navigation
• working content-warning disclosure
• working remote image activation

Primary Following interaction controls use approximately 44px minimum touch targets.

Like and Boost active states are visually distinct and remain visible through hover and keyboard focus.

Hosting Requirements

ActivityPub requires a little more from the hosting environment than normal local Bonumark publishing.

Required capabilities include:

• canonical root-level HTTPS site URL
• domain-root /.well-known/webfinger routing
• PHP OpenSSL
• PHP cURL with outbound HTTPS access
• a high-entropy installation security salt
• protected private Bonumark paths
• writable runtime storage
• dependable server cron or protected web cron
• correct reverse-proxy forwarding for required signature and request headers

A Bonumark installation running from a subdirectory cannot automatically provide standards-compliant domain-root WebFinger.

That requires explicit hosting-level routing before ActivityPub can be enabled.

Upgrade From v0.7.2

v0.8.1 is the next public release after v0.7.2.

Upgrading from v0.7.2 applies migrations:

0018 through 0028

These migrations add the database structures required for:

• ActivityPub identity
• signing keys
• publication generations
• delivery queues
• followers
• Following relationships
• remote actors
• interactions
• blocking
• lifecycle state
• moderation
• actor retirement
• federation audit data

The migrations do not replace existing Bonumark posts or rewrite post bodies.

Normal upgrade preservation continues to cover owner data including:

• Stream Posts
• Pages
• accounts
• profiles
• comments
• local Likes
• media
• uploads
• settings
• API state
• custom themes
• imports
• exports
• backups
• content versions
• runtime data

ActivityPub remains disabled after a normal v0.7.2 upgrade until the owner explicitly enables it.

As always, back up the site files and database before upgrading.

Compatibility

The final v0.8.1 package passed the full supported compatibility matrix:

• PHP 8.1 / MySQL 8.0
• PHP 8.1 / MariaDB 10.6
• PHP 8.3 / MySQL 8.4
• PHP 8.3 / MariaDB 11.4

Release verification also included:

• PHP lint
• JavaScript syntax validation
• JSON validation
• release-manifest verification
• strict package validation
• clean-package smoke tests
• ActivityPub regression suites
• migration and schema tests
• migration recovery tests
• Remote Posting API database tests
• fresh installation
• upgrade from the actual public v0.7.2 package
• owner-data preservation
• RC deployment verification
• targeted live publishing after deployment

Known Limitations

The first public ActivityPub release intentionally does not try to implement every fediverse feature.

Current known limitations include:

• NodeInfo is not implemented.
• Automatic domain migration is not implemented.
• Replacement actor identities after permanent retirement are not implemented.
• Multi-user federation is not implemented.
• Public federated timelines are not implemented.
• Followers-only or private federation is not implemented.
• Direct messages are not implemented.
• Misskey.io accepted Bonumark Update activities during testing but did not always apply changed Note text. No Bonumark payload defect was identified.
• Sharkey.world connection failures observed during testing appeared server or connection specific.

Bonumark remains intentionally centered on a single owner publishing from a site they control.

Verified Release Artifact

Package:

bonumark-stream-v0.8.1.zip

Size:

1,118,446 bytes

SHA-256:

0a0e65ab6280510f07bd258fe45de81cc238487428ad6ace224932d90a226760

Migrations:

0001 through 0028

The final package passed fresh installation, upgrade from v0.7.2, strict package verification, all four supported compatibility combinations, and live RC deployment verification before publication.

What v0.8.1 Means for Bonumark Stream

Bonumark Stream started as a way to publish short-form work from your own site without making a social platform the permanent home of that work.

v0.8.1 does not change that idea.

It extends it.

You can still publish from your own domain, keep your own archive, control your own database, and decide how your site looks and operates.

Now that same site can also participate directly in the fediverse.

The publishing system stays yours.

Federation becomes another way for the work to travel.