Three observations in a federation trace
A signed message reaching an inbox, a public forum rendering that message, and a web crawler fetching a linked document are separate events. This test keeps their evidence separate.
1. Record the protocol exchange
Record the exact actor, activity and object identifiers, destination inbox, send time, response status and response body. The signing key establishes which actor sent the activity; it does not establish that the receiver published it. A successful HTTP response can acknowledge receipt before asynchronous processing finishes.
2. Inspect the public representation
Open the resulting topic without signing in. Confirm the title and body, the real outgoing anchor, and the diagram. Separately inspect the public category or recent-topics listing for an incoming link. A topic URL that only its author knows is not the same as a discoverable topic.
HTML and ActivityPub JSON can share a resource identifier while using different representations. An ActivityPub client asks for application/activity+json; an ordinary browser asks for HTML. Inspect the response Content-Type, not only the filename or status code. Caches must keep negotiated representations from being confused.
3. Classify subsequent requests narrowly
| Observed request | What it establishes |
|---|
| Receiver fetches actor or object JSON | Federation processing, not a search-crawler visit. |
| Browser fetches the diagram | A rendering resource was requested, not the linked HTML document. |
| A visitor claims a crawler User-Agent | A claim that still needs network verification. |
| Verified crawler successfully fetches the exact HTML URL | A document crawl, not search indexing or a future crawl guarantee. |
Keep the trace reproducible
Use a fresh opaque document URL for each independent trial. Preserve the first publication timestamp and record every later publication or edit, because those can change discovery. Keep an unpublished control. For a request behind a reverse proxy, trust its forwarded client address only when the connection comes from a configured trusted proxy.
For claimed Googlebot smartphone requests, compare the client IP with the operator's current common-crawler ranges and verify reverse DNS followed by matching forward DNS. Record those answers alongside the URL, time, status and User-Agent. Keep image requests separate from successful HTML requests.