From af59e28b8d63b9735013eb30feb69e4efb74380f Mon Sep 17 00:00:00 2001 From: zzstoatzz Date: Thu, 20 Aug 2026 16:13:31 -0500 Subject: [PATCH] docs: spaces alpha references, policy union shapes, operator note Co-Authored-By: Claude Fable 5 --- docs/operations.md | 5 ++++- docs/permissioned-data.md | 10 +++++++--- docs/references.md | 13 +++++++++++++ 3 files changed, 24 insertions(+), 4 deletions(-) diff --git a/docs/operations.md b/docs/operations.md index 3d6c544..608b7a0 100644 --- a/docs/operations.md +++ b/docs/operations.md @@ -152,7 +152,10 @@ Common deployment settings: - `ZDS_PERMISSIONED_DATA`: set to `true` to opt into experimental permissioned-data routes. Default: disabled. ZDS exposes protocol reads and writes under `com.atproto.space.*`, and baseline PDS-managed space management - under `com.atproto.simplespace.*`. The implementation remains experimental: + under `com.atproto.simplespace.*`, tracking the lexicons published for the + [spaces alpha](https://atproto.com/blog/atproto-spaces-alpha). Enable it if + residents want to use alpha apps such as + [Bulletin](https://bulletin.my). The implementation remains experimental: reader/group semantics should stay in application policy, while `simplespace` only provides the small required baseline. Use `just smoke-permissioned` for the experimental smoke lane. diff --git a/docs/permissioned-data.md b/docs/permissioned-data.md index 462f29d..5c41f87 100644 --- a/docs/permissioned-data.md +++ b/docs/permissioned-data.md @@ -134,9 +134,13 @@ with service auth and fails closed on resolution, transport, or response errors. The generic PDS implementation of that method returns `authorized: false`; policy services replace it with their own application-layer decision. -`appAccess` follows the proposal's lexicon-union wire shape: -`{"$type":"com.atproto.simplespace.defs#open"}` or -`{"$type":"com.atproto.simplespace.defs#allowList","allowed":[...]}`. +`policy` and `appAccess` use the lexicon-union wire shape on every +`simplespace` route: `{"$type":"com.atproto.simplespace.defs#memberListPolicy"}`, +`{"$type":"com.atproto.simplespace.defs#managingAppPolicy","managingApp":"did:…#svc"}`, +`{"$type":"com.atproto.simplespace.defs#open"}`, or +`{"$type":"com.atproto.simplespace.defs#allowList","allowed":[...]}`. A +`managingApp` must be a DID with an optional service fragment; anything else is +`UnsupportedPolicy`. Delegation tokens identify the user, not the app. For allow-list spaces, ZDS verifies the separately supplied `clientAttestation` against the client's published metadata and JWKS before using its `client_id`. Credential issuance diff --git a/docs/references.md b/docs/references.md index 18646a4..4aa046c 100644 --- a/docs/references.md +++ b/docs/references.md @@ -136,6 +136,19 @@ Useful for migration behavior and PLC rotation-key handling as observed by real PDS moves. When migration behavior is confusing, check this alongside the official PDS before assuming what key material should be stored or exposed. +### spaces alpha (permissioned data) + +Links: +[announcement](https://atproto.com/blog/atproto-spaces-alpha), +[permissioned-data branch](https://github.com/bluesky-social/atproto/tree/permissioned-data), +[Bulletin](https://github.com/bluesky-social/bulletin) + +The lexicons under `lexicons/com/atproto/{space,simplespace}` on the branch are +the contract for `com.atproto.space.*` and `com.atproto.simplespace.*`; ZDS is +listed in the announcement as a compatible PDS. Bulletin is the smallest real +client and the fastest interop check: sign in from a zds account and create a +board. See [permissioned data](permissioned-data.md) for the ZDS-side notes. + ## test and workload references - [alice.mosphere.at/atproto-smoke](https://tangled.org/alice.mosphere.at/atproto-smoke): -- 2.51.2