My understanding is that:
- OStatus is a decentralized social networking protocol made up of several other protocols (Atom feeds, Activity Streams, PubSubHubbub, Salmon, and WebFinger)
- GNU Social and Mastodon are two server software applications that implement OStatus
- pump.io API is an interface to the pump.io server software (Activity Streams, OAuth, Web Host Metadata)
- identi.ca is a pump.io instance (not accessible right now), GNU MediaGoblin is a server application that currently uses a pump-like API
- ActivityPub is a proposed decentralized social networking protocol
- GNU MediaGoblin is a server application that will likely implement ActivityPub
How do these protocols interoperate? Does ActivityPub completely replace OStatus, or only the Activity Streams component?
OStatus is a decentralized social networking protocol which - as you say - is made up of several other protocols: Atom feeds, Activity Streams (version 1.0), PubSubHubbub, Salmon, and WebFinger.
pump.io is an engine with an API that exposes Activity Streams (version 1.0). Pump.io was meant as a successor to StatusNet.
- Identi.ca switched from StatusNet to pump.io in 2013.
- Pump.io intends to deprecate their API and move to ActivityPub (see Developer docs).
Activity Streams is for the serialization of a stream of social activities using the JSON(-LD) format.
- Version 1.0 was created by a working group that had Google, Facebook and Microsoft backing. It uses JSON as serialization format.
- Version 2.0 was a sanitized version derived from 1.0 and uses JSON-LD as serialization format. It has become a W3C Recommendation that comes in two parts: Core and Vocabulary.
ActivityPub is a decentralized social networking protocol that is based upon Activity Streams 2.0 and it is the basis of the Fediverse. It is also a W3C Recommendation.
- The ActivityPub specification is intentionally incomplete and flexible in a number of places. In order to create full-blown fediverse apps it should be combined with:
- Webfinger (to find federated accounts)
- HTTP- and/or JSON-LD Signatures (for server-2-server communication)
- OAuth 2.0 (client credentials, authorization scopes).
- For a long and ever-growing list of ActivityPub applications see the Feneas ActivityPub Watchlist.
So in summary OStatus, pump.io API and ActivityPub are three separate incompatible means to create federated social applications (that have nonetheless some common denominators). Of these ActivityPub offers the best way forward, and is the protocol you should choose from this list going forward.
PS. The best places to ask questions as an ActivityPub implementer are the SocialHub and Feneas forums. And see also the Guide for new ActivityPub implementers at SocialHub.