Browse lexicons

• dev.andreijiroh.labs.blogroll.publication object not from the namespace authority A custom lexicon for sharing publications in a blogroll, forked from the site.standard.publication lexicion.

• dev.atfs.describeServer query Report what this instance can accept and how to reach it over libp2p, before a client hands it a single byte. Sits beside dev.atfs.server rather than under dev.atfs.repo.* with the file methods, because it describes the instance itself, not a repo. Deliberately a separate call from the did:web identity document: a DID document is an identity record, not a capability advertisement, and mixing the two would constrain both — this one is free to grow new capability fields without touching identity r
• dev.atfs.file object An embeddable reference to a file hosted on an atfs instance and addressed by IPFS content-addressing. Deliberately not the native `blob` lexicon type: a PDS scans records for blob refs and rejects any whose blob isn't in its own blob store, which an atfs-hosted file structurally isn't. Embed this object in place of a blob field instead; field names (mimeType, size) are kept identical to blob refs for familiarity.
• dev.atfs.repo.deleteFile procedure Release the caller's claim on a file previously uploaded to — or pinned by — this atfs instance. The semantics are pin removal, not unconditional deletion: several accounts can hold independent claims on the same cid (see dev.atfs.repo.uploadFile, which merges an idempotent re-upload's claim rather than rejecting it), and the underlying bytes — its raw block plus any UnixFS DAG artifacts built for it — are physically deleted only once the last claim on it goes. A caller's own claim is always gon
• dev.atfs.repo.getFile query Fetch a file previously uploaded to this atfs instance. Compatible with com.atproto.sync.getBlob — also mounted, unmodified, under that name, for callers that have no reason to know atfs has its own name for it — with one deliberate difference: did is optional here. Requiring a did the way a PDS does is a repo-scoping artifact (a PDS's blobs live inside a specific account's repo); atfs content is content-addressed by cid alone, and the /ipfs/<cid> gateway path already serves it that way, so a di
• dev.atfs.repo.listFiles query Enumerate every file this instance directly claims — the whole instance, not scoped to any one account, since atfs has no per-repo notion to scope by. This exists so another atfs instance can replicate pins: a follower walks every page, diffs the resulting cid set against its own mirror of this instance, dev.atfs.repo.pinFile whatever's new, and releases whatever's vanished. It's a poll rather than a subscription deliberately — the store keeps no event log, so there's nothing for a websocket-sty
• dev.atfs.repo.pinFile procedure Pin a file that already exists on the IPFS network, as if the caller had uploaded it to this instance: the bytes are fetched, verified against the reference's blessed cid, stored, served, and announced, and the caller ends up holding an ordinary claim on them (see dev.atfs.repo.deleteFile). A dev.atfs.file reference is the whole request — it already names the cid the fetched bytes must hash to (which is what makes the fetch trustless whatever the source), the ipfsRoot to fetch, the size to refus
• dev.atfs.repo.uploadFile procedure Upload a file to be served by this atfs instance over IPFS and plain HTTP. Intentionally fully wire-compatible with com.atproto.repo.uploadBlob — same binary request body, same inter-service auth mechanism, same response shape — so any uploadBlob client works against this endpoint unchanged, by switching only the NSID in the request path and the `lxm` claim of its auth token. This method is also mounted, unmodified, as com.atproto.repo.uploadBlob itself, for callers that have no reason to know a
• dev.atfs.server record An atfs instance's own configuration, read at boot — and re-read whenever it changes, the instance having subscribed to the owner's repo — by the instance whose libp2p peer ID is the record key (rkey) — at://{owner-did}/dev.atfs.server/{peer-id}. One owner repo can configure many instances this way. Changes to accounts, serviceDid and follows apply without a restart; the did:web document atfs serves for a bare-domain serviceDid is bound at startup and needs one to pick up a change. Unknown field

• dev.atvouch.graph.vouch record not from the namespace authority a vouch on atvouch.dev. the rkey of the record must be equal to the subject of the record, which must be a did. records that do not follow this should be considered invalid

• dev.baileytownsend.demo.authBasicFeatures permission-set An example simple permission set
• dev.baileytownsend.demo.example record An example record for showing permissions ets
• dev.baileytownsend.demo.illegal permission-set An example simple permission set
• dev.baileytownsend.health.calories record A record of daily intake and burned calories.
• dev.baileytownsend.health.rings record A record of daily activity rings (Apple Fitness), including move, exercise, and stand goals.
• dev.baileytownsend.health.steps record
• dev.baileytownsend.health.workout record

• dev.bastienrobert.memory.record record A single durable memory belonging to the user. Deliberately one generic type: specialising into fact/preference/project/event types is premature until real requirements demand it. Retrieval-specific state (BM25 scores, vector ids, index cursors, caches) MUST NOT be stored here — it is derived data owned by whichever memory engine indexes this record. Consumers MUST preserve properties they do not recognise: an implementation that rewrites a record after dropping unknown fields destroys data writ
• dev.bastienrobert.memory.space space A private space holding the user's agent memory. Any application granted access reads and writes the same records, so the memory engine indexing them is replaceable without moving the data.

• dev.blinkers.getView query Read the blink a lens produces from a record.
• dev.blinkers.lens record Lets holders of a blinkers key read, change and optionally create selected records in this repo.
• dev.blinkers.putView procedure Write a blink back through a lens, or create a record from one.

• dev.cartridge.actor.getProfile query Get a Cartridge profile with roles. Wraps games.gamesgamesgamesgames.getProfile and appends a roles array.
• dev.cartridge.analytics.getGameAnalytics query not from the namespace authority Owner-facing analytics for a single game. Authenticates the caller, verifies they own the game, then merges ClickHouse rollups with record-creation trends from HappyView. Fractional metrics use `unknown` because atproto lexicons have no float type.
• dev.cartridge.analytics.listMyGamesAnalytics query not from the namespace authority Headline analytics for every game the authenticated caller owns. Powers the multi-game dashboard overview. Fractional metrics use `unknown` because atproto lexicons have no float type.
• dev.cartridge.authActor permission-set
• dev.cartridge.authClaims permission-set
• dev.cartridge.authMigration permission-set
• dev.cartridge.claim record A claim for ownership of game or organization records.
• dev.cartridge.claimReview record A review of a claim for ownership of game or organization records.
• dev.cartridge.claims.authClaims permission-set
• dev.cartridge.claims.claim record A claim for ownership of game or organization records.
• dev.cartridge.claims.claimReview record A review of a claim for ownership of game or organization records.
• dev.cartridge.claims.createClaim procedure Submit a new ownership claim for game or organization records.
• dev.cartridge.claims.getClaim query Get details of an ownership claim.
• dev.cartridge.claims.getMigrationStatus query Get the status of a migration background job.
• dev.cartridge.claims.listClaims query List ownership claims, optionally filtered by status.
• dev.cartridge.claims.migrateClaim procedure Enqueue migration of game records based on an approved claim.
• dev.cartridge.claims.reviewClaim procedure Submit a review decision for an ownership claim.
• dev.cartridge.claims.setupAdmin procedure Bootstrap the claims admin space or add a member to it. Creates the admin space on first call; subsequent calls can add new admin DIDs.
• dev.cartridge.createClaim procedure Submit a new ownership claim for game or organization records.
• dev.cartridge.createVerificationRequest procedure Submit a verification request to flag your account as a studio, developer, publisher, or game.
• dev.cartridge.getClaim query Get details of an ownership claim.
• dev.cartridge.getMigrationJobStatus query Get the status of a migration background job.
• dev.cartridge.getVerificationRequest query Get a verification request. Non-admins can only view their own requests.
• dev.cartridge.getVerificationStatus query Check whether a DID or handle has been verified by the Cartridge verifier. Does not require authentication.
• dev.cartridge.graph.verification record A Cartridge-specific verification record for studios, developers, publishers, and games. Written by the Cartridge verifier account.
• dev.cartridge.listClaims query List ownership claims, optionally filtered by status.
• dev.cartridge.listVerificationRequests query List verification requests. Admin only.
• dev.cartridge.migrateClaim procedure Enqueue migration of game records based on an approved claim.
• dev.cartridge.reviewClaim procedure Submit a review decision for an ownership claim.
• dev.cartridge.reviewVerificationRequest procedure Approve or deny a verification request. Admin only. On approval, writes verification records from the verifier account.

• dev.cocore.account.createApiKey procedure Mint a new cocore API key for the authenticated account. Authenticate with either a console session cookie or an existing `Authorization: Bearer cocore-...` key. The full secret is returned exactly once in `secret` and is never retrievable again — only its SHA-256 hash is stored. Use the returned key to authenticate subsequent automated requests (inference, the record proxy, and these key-management methods themselves).
• dev.cocore.account.defs defs Shared type definitions for dev.cocore.account.* methods.
• dev.cocore.account.deleteApiKey procedure Hard-delete one of the authenticated account's API keys, removing the row entirely (no audit trail recovery afterwards). For most flows revokeApiKey is preferable; use this to clean up revoked or expired keys you no longer want listed. Scoped to the caller's DID. Idempotent: deleting an unknown key returns `deleted: false`.
• dev.cocore.account.friend record A one-way declaration that the publishing DID trusts the subject DID enough to route private (friends-only) compute jobs to them. Friending is *not* mutual and *not* a permission grant for the subject — it's the friender's own routing preference. The subject does not need to consent, sign anything, or even be aware. Published to the friender's PDS; multiple records for the same subject are tolerated (the rkey is `tid`) but the console deduplicates on upsert so steady state is one record per (fri
• dev.cocore.account.getProfile query Full profile-page payload for one DID: account fields, machines they own, activity counts, and incoming-friends count, in a single round-trip. When the DID has not published a `dev.cocore.account.profile` record locally, handle/displayName/avatar are hydrated from the public Bluesky AppView.
• dev.cocore.account.listAccounts query Discovery directory of every signed-up DID (any DID with a record under `dev.cocore.*`), joined with profile + provider counts so a card grid can render without further fan-out. DIDs without a local profile record are hydrated from the public Bluesky AppView.
• dev.cocore.account.listApiKeys query List every API key belonging to the authenticated account, most-recently-created first. The owning DID is derived from the credential presented (session cookie or `Authorization: Bearer cocore-...`); there is no way to list another account's keys. Secrets are never returned — see `apiKeyView`.
• dev.cocore.account.listFriendEdges query Every directed trust edge in the network (friender → subject), for the explorer's friend graph. A cheap, pure edge list with no handle/avatar hydration.
• dev.cocore.account.listIncomingFriends query Every `dev.cocore.account.friend` record whose subject equals the queried DID — "who has trusted me with work?". Newest first; frienders are hydrated to a handle via the public Bluesky AppView when no local profile exists.
• dev.cocore.account.listProfiles query List every indexed `dev.cocore.account.profile` record (capped at 500). Used to render display-name + avatar chips for the DIDs hosting machines.
• dev.cocore.account.profile record A user's cocore-side profile. Auto-provisioned at first sign-in from the user's Bluesky public profile (so they don't see an empty card on first visit), then editable from /account. Independent from any bsky.app profile — the user can change their cocore display name or avatar without affecting their bsky one. One record per DID; the upsert flow uses rkey=`self` to keep it that way.
• dev.cocore.account.revokeApiKey procedure Revoke one of the authenticated account's API keys. The key stops authenticating immediately, but the row is retained with `revokedAt` set so it stays visible in listApiKeys as a revoked key (audit trail). Use deleteApiKey to remove it entirely. Scoped to the caller's DID — you cannot revoke another account's key. Idempotent: revoking an already-revoked or unknown key returns `revoked: false`.
• dev.cocore.account.tokenGrant record Records that an exchange has issued its one-time signup token grant to a recipient DID. Written by the exchange to its own PDS on the first balance event for a given DID — receipt as either side, top-up, or admission check. Issued exactly once per (exchange, recipient) pair. A consumer reconstructing balances offline starts each DID at this grant amount; absence of a tokenGrant record means the DID has never interacted with the exchange.
• dev.cocore.account.tokenPatronage record Records a patronage rebate: a periodic distribution of treasury balance back to an active member in proportion to their patronage (consumer spending + provider earnings) during the rebate period. Written by the exchange to its own PDS when the distribution fires. One record per (recipient, period) pair — the exchange MUST NOT distribute twice for the same (recipient, period). Direct analog of REI's annual member dividend or a credit union's quarterly capital credit: every term is visible, the ma
• dev.cocore.app.registration record not from the namespace authority How an application announces itself to co/core so it can connect users' accounts with one click ("Sign in with co/core"). Published by the application on ITS OWN account (a did:plc or did:web with a repo), one record per DID at rkey `self` — there is no central app registry. When the app calls `dev.cocore.devicePair.start` with `appDid`, the AppView reads this record from the app's PDS: `name` is what the approve screen shows, and `returnUrls` are the only places the approve screen may send the
• dev.cocore.compute.attestation record A snapshot of a provider machine's hardware and software state, signed by its Secure Enclave. Content-addressed: many receipts strong-ref the same attestation record until the underlying state changes (binary upgrade, OS update, key rotation).
• dev.cocore.compute.defs defs Shared type definitions for dev.cocore.compute.* records.
• dev.cocore.compute.dispute record An exchange-signed adjudication of a complaint about a settled receipt. Published in the exchange's repo. The exchange's DID is the only DID permitted to publish a record at this NSID for a given settlement; any record at this NSID outside the exchange's repo is invalid by construction. The dispute lifecycle is open->resolved (terminal); resolution carries the outcome the exchange has already enacted (e.g. a refund settlement) and a signed rationale. Verifiers reading a settlement see status=dis
• dev.cocore.compute.exchangeAttestation record An exchange's self-published statement of operating posture: software commit, public signing key fingerprint, fee policy in effect, audit posture. The provider/requester analog of `dev.cocore.compute.attestation` for the exchange role. Settlements MAY strong-ref the active attestation so verifiers can pin which exchange-software / signing-key combination produced the record.
• dev.cocore.compute.exchangePolicy record An exchange's published terms of service. Records every parameter that affects how this exchange computes settlements and maintains per-DID token balances: fee schedule, supported currencies, self-loop rules, processor identifiers, and the token-accounting parameters (onboarding grant, balance floor, weekly refresh, monthly patronage distribution, treasury identity). A settlement record strong-refs the active policy so verifiers can re-derive the payout numbers offline. Policies are immutable pe
• dev.cocore.compute.job record A request for computational work. Published by the requester in their own repo before the work runs, so the provider has something to commit a receipt against.
• dev.cocore.compute.latency query Network latency rollup derived purely from indexed receipts' signed `startedAt`/`completedAt` pairs — the last ≤100 per group (overall, per-provider, per-model). No side metrics store: the receipts are the source of truth, so the numbers cannot drift from them.
• dev.cocore.compute.listJobs query Indexed `dev.cocore.compute.job` records authored by a requester (capped at 500). `requester` is required; omitting it returns no jobs.
• dev.cocore.compute.listProviders query List every indexed `dev.cocore.compute.provider` record (capped at 100). Read-only cache over the firehose; the provider's PDS is authoritative.
• dev.cocore.compute.listReceipts query Indexed `dev.cocore.compute.receipt` records (capped at 200), optionally filtered by provider DID, requester DID, and/or job URI.
• dev.cocore.compute.listSettlements query Indexed `dev.cocore.compute.settlement` records (capped at 200), optionally filtered by the settled receipt URI and/or the requester DID (matched against the authorization URI prefix).
• dev.cocore.compute.modelActivity query Aggregate receipt activity per model and per time window. Walks the most-recent indexed receipts (capped at 5000), groups by `body.model`, and tallies requests + tokens across the hour/day/week/month windows, with per-provider breakdowns. The scan cap is reported back as `scanned`/`scanLimit`/`truncated` so consumers can tell an exact total from a lower bound; `oldestScannedAt` is the earliest receipt that contributed to any window.
• dev.cocore.compute.paymentAuthorization record A requester's signed authorization permitting a named exchange to charge them up to a ceiling for a specific job. Published in the requester's repo before any work runs. Settlement records strong-ref this authorization to prove consent.
• dev.cocore.compute.provider record A compute provider's public profile. One record per physical machine. The DID owning the record is the provider's billable identity; the same DID may own multiple provider records (one per machine).
• dev.cocore.compute.receipt record A signed receipt of a single completed compute job. Published by the provider in its own repo. Strong-refs the requester's job and the active attestation. Carries an additional Secure-Enclave-bound signature so it remains verifiable across PDS migrations.
• dev.cocore.compute.settlement record An exchange's signed proof of payment for a receipt. Published by the exchange in its own repo. Strong-refs both the receipt being settled and the requester's payment authorization, so the full chain is independently verifiable.
• dev.cocore.compute.termsAcceptance record A user's affirmative acceptance of an exchange's terms of service / privacy policy. Published on the user's PDS so the record is portable + auditable + survives the user disconnecting from any one exchange. Clients prompt for re-acceptance whenever the active exchange policy's `termsVersion` doesn't match the version on the user's most recent acceptance for that exchange.
• dev.cocore.compute.verifyReceipt query Verify an indexed receipt offline-equivalently: structural checks against its job + attestation, a P-256 ECDSA signature check of `enclaveSignature` against the attestation public key, lexicon-schema validation, and — when an MDA cert chain is present — a hardware-attestation check bound to the signing key. `trustLevel` rises to `hardware-attested` only when a valid Apple chain certifies the receipt-signing key.
• dev.cocore.compute.verifySettlement query Verify an indexed settlement against its receipt and the requester's payment authorization: confirms the settlement chain is internally consistent and signed by the settling repo. Returns the verification verdict plus any findings.
• dev.cocore.defs defs not from the namespace authority Request + token counts within a single time window.
• dev.cocore.devicePair.confirm procedure Approve or deny a pending device-pairing attempt, identified by the `userCode` the device displayed. Called from the verification UI by a signed-in user. Approving requires the provider `session` to grant to the device. When the requester supplied an allowlisted `returnUrl` at `start`, an approval echoes it back so the verification UI can send the browser there.
• dev.cocore.devicePair.describe query Describe a pending pairing attempt by its `userCode`, so the approve screen can say who is asking and for what. Public: it only echoes what the requester supplied at `start` (application name, key name, return URL) plus the attempt's status and remaining lifetime. It never returns the `deviceId` or a session.
• dev.cocore.devicePair.poll query Poll a device-pairing attempt by `deviceId`. While the user has not acted, returns `pending`. On approval, returns `session` together with the granted provider session. Terminal negative states are `denied`, `expired`, and `consumed`. An unknown `deviceId` is `unknown`.
• dev.cocore.devicePair.start procedure Begin a device-pairing flow (OAuth 2.0 device-authorization style). Returns a `deviceId` plus a short human-typable `userCode` and the `verificationUri` where a signed-in user approves the pairing. The caller then polls `dev.cocore.devicePair.poll` until approval. The optional input lets an application (rather than a provider machine) say who it is: `appName` is shown on the approve screen, `keyName` names the minted API key so the user can recognise and revoke it, and `returnUrl` is where the a
• dev.cocore.inference.dispatch procedure Submit an inference request and stream the result back as Server-Sent Events. Authenticates the requester, runs the dispatch core, and emits typed SSE frames. Unlike `submit` (which returns URIs to poll), `dispatch` drives the full request and streams plaintext output chunks until completion. Confidentiality: by default the AppView seals the prompt to the chosen provider on the caller's behalf (`best-effort` tier) — convenient, but the AppView is in the plaintext path. A caller that needs priva
• dev.cocore.inference.status query Poll for the outcome of a submitted job. Returns `pending` until a matching receipt is indexed, `received` once the receipt lands, and `settled` once a settlement also lands. Receipt and settlement are returned as indexed records when present.
• dev.cocore.inference.submit procedure Submit an inference request for the authenticated requester. Builds a (paymentAuthorization, job) pair scoped to the configured exchange, publishes both to the requester's PDS, and returns the job/authorization URIs so the caller can poll for a receipt via `dev.cocore.inference.status`.

• dev.engineered.memory.core space not from the namespace authority What your agents have learned about you. Preferences, facts, people.
• dev.engineered.memory.team space not from the namespace authority Memory shared with everyone who can commit to this repo.
• dev.engineered.memory.work space not from the namespace authority Project memory your agents share across your machines.

• dev.fisl.at record An announcement that the content identified by the DASL or BDASL CID in the record key is retrievable at one or more URLs, until an expiry time.

• dev.frogspace.stacks.collection record a named collection of saved citations. items reference collections by their record AT-URI in the item's collections field. ordering is a client concern.
• dev.frogspace.stacks.item record citation record. the annotation author comes from the verified repo context. no subject content or snapshots are stored.
• dev.frogspace.stacks.library space declaration for a library of citations and personal annotations. membership is set when creating the space.
• dev.frogspace.stacks.query record a named saved query: a structured filter over the owner's saved citations, evaluated client-side. no free-text grammar.

• dev.fudgeu.experimental.atforumv1.admin.admingrant record not from the namespace authority Grants another user an extension of this superadmin's admin powers
• dev.fudgeu.experimental.atforumv1.admin.hidepost record not from the namespace authority Hides a post. This post will not be visible to other users.
• dev.fudgeu.experimental.atforumv1.admin.hidereply record not from the namespace authority Hides a reply. This reply will not be visible to other users.
• dev.fudgeu.experimental.atforumv1.admin.hideuser record not from the namespace authority Hides a user. Their content will not be visible to other users.
• dev.fudgeu.experimental.atforumv1.feed.post record An initial post that starts a discussion
• dev.fudgeu.experimental.atforumv1.feed.question record An initial question that starts a discussion
• dev.fudgeu.experimental.atforumv1.feed.reply record An initial post that starts a discussion
• dev.fudgeu.experimental.atforumv1.feed.vote record An initial post that starts a discussion
• dev.fudgeu.experimental.atforumv1.forum.announcement record A forum-wide announcement
• dev.fudgeu.experimental.atforumv1.forum.category record A method of grouping posts into a single 'category'
• dev.fudgeu.experimental.atforumv1.forum.group record Defines a group of categories
• dev.fudgeu.experimental.atforumv1.forum.identity record Defines what the forum is - name, description, etc.

• dev.gitosphere.authRepository permission-set Alpha OAuth permission set for managing Gitosphere repositories, issues, issue comments, and pull request comments.
• dev.gitosphere.defs defs Shared public Gitosphere XRPC wire definitions.
• dev.gitosphere.repository record not from the namespace authority
• dev.gitosphere.repository.adoptIssueBaseline procedure Manages authorization, acceptance, and migration of Issue changes.
• dev.gitosphere.repository.authorizeOperation query Revalidates an authorized Repository resolution immediately before direct PDS record access.
• dev.gitosphere.repository.commitIssueMutation procedure Manages authorization, acceptance, and migration of Issue changes.
• dev.gitosphere.repository.getIssueMutation query Manages authorization, acceptance, and migration of Issue changes.
• dev.gitosphere.repository.issue record Alpha issue record stored in its Gitosphere repository Space.
• dev.gitosphere.repository.issueComment record A comment on one Issue. body is its canonical Markdown.
• dev.gitosphere.repository.issueCreateRequest record not from the namespace authority A repository-lifetime idempotency receipt for an issue creation intent.
• dev.gitosphere.repository.issueMutation record Append-only record of an authorized Issue change. Only changes accepted by the server take effect.
• dev.gitosphere.repository.issueNumber record not from the namespace authority A permanent repository-local issue number reservation and lookup index.
• dev.gitosphere.repository.issueRelation record An append-only mutation of the Issue relation graph.
• dev.gitosphere.repository.issueState record not from the namespace authority An append-only state transition for a Gitosphere issue.
• dev.gitosphere.repository.issueStateClosed token not from the namespace authority Token representing a closed Gitosphere issue.
• dev.gitosphere.repository.issueStateOpen token not from the namespace authority Token representing an open Gitosphere issue.
• dev.gitosphere.repository.mergePullRequest procedure Merges one reviewed native Pull Request through the server-authoritative Git transaction boundary.
• dev.gitosphere.repository.prepareIssueMutation procedure Manages authorization, acceptance, and migration of Issue changes.
• dev.gitosphere.repository.preparePullRequestIssueClose procedure Manages preparation for, and failure records of, closing an Issue by the original merge actor.
• dev.gitosphere.repository.pullRequestComment record A comment or typed finding bound to one Pull Request round. body is its canonical Markdown.
• dev.gitosphere.repository.pullRequestReview record An immutable review decision and verification evidence bound to one Pull Request round.
• dev.gitosphere.repository.pullRequestThreadDecision record A verdict on a blocking Pull Request thread, bound to the round it was given in. Comment records are immutable, so verdicts accumulate as separate records. Whether a verdict decides the thread or only proposes is derived from its author's role when it is read: the thread's author and repository admins decide; the Pull Request author can only propose addressed or noLongerApplies.
• dev.gitosphere.repository.recordPullRequestIssueCloseFailure procedure Manages preparation for, and failure records of, closing an Issue by the original merge actor.
• dev.gitosphere.repository.space space Permissioned Data boundary for one Gitosphere repository.

• dev.goalbot.spike.event record Throwaway probe record for the issue #32 federation spike. NOT the real GoalBot lexicon — the production record family is designed in its own spike (see specs/atmosphere-direction.md).

• dev.happyview.adminFull permission-set

• dev.herisson.test.actor.profile record A declaration of a [to be defined] account profile.
• dev.herisson.test.torrent.listing record A BitTorrent torrent listing with optional typed content metadata.
• dev.herisson.test.trust.grade record Record declaring a 'grade of trust' a user has for a given identity

• dev.jazco.boards.board space A private message board: posts, threaded comments and votes from its members.
• dev.jazco.boards.comment record
• dev.jazco.boards.defs defs
• dev.jazco.boards.getBoard query A board's settings and counts. Viewers authenticate with a space credential for the board (Authorization: Atproto-Space, audience = this appview's DID).
• dev.jazco.boards.getImage query A post image's bytes, fetched by the appview with its own credential (space.getBlob). Viewers authenticate with a space credential for the board (Authorization: Atproto-Space, audience = this appview's DID).
• dev.jazco.boards.getKarma query A member's karma in a board: the scores of their posts and comments. Viewers authenticate with a space credential for the board (Authorization: Atproto-Space, audience = this appview's DID).
• dev.jazco.boards.getPostThread query A post and its comment tree (comments best first). Viewers authenticate with a space credential for the board (Authorization: Atproto-Space, audience = this appview's DID).
• dev.jazco.boards.getPosts query A page of a board's posts. Viewers authenticate with a space credential for the board (Authorization: Atproto-Space, audience = this appview's DID).
• dev.jazco.boards.indexBoard procedure Ask the appview to index a board. Its owner first adds the appview's account as a read-only member; the appview then registers for the board's notifies and syncs it. Owner auth: a space credential issued to the board's owner.
• dev.jazco.boards.post record
• dev.jazco.boards.settings record A board's settings. Only the copy in the board owner's (the space authority's) repo at rkey 'self' counts.
• dev.jazco.boards.vote record One vote per member per subject: the rkey is derived from the subject URI, so a changed vote is a putRecord and an unvote a deleteRecord.

• dev.kanad.lexicon-test-2026-02-26.exampleCatLexicon record some example cat lexicon

• dev.keytrace.claim record An identity claim linking this DID to an external account
• dev.keytrace.profile record Keytrace profile settings. Singleton record stored in the user's ATProto repo.
• dev.keytrace.reverseLookup query Find the ATProto DIDs (and the at-uris of their keytrace claim records) that have verifiably claimed a given external identity, keyed by claim type and subject. Matching is exact (case-sensitive) on the subject. Only non-retracted claims whose attestation signatures validate against a known keytrace server key are returned.
• dev.keytrace.serverPublicKey record A signing key for claim attestations. It effectively hosts a JWK on a user's ATProto repo.
• dev.keytrace.signature object A cryptographic signature attesting to a claim
• dev.keytrace.statement record A public statement signed by one of the user's own published public keys (dev.keytrace.userPublicKey).
• dev.keytrace.userPublicKey record A user-published public key.

• dev.knotless.acceptTransfer procedure Takes up a repository offered to the account logged in to this appview's pages.
• dev.knotless.addAgent procedure Names an account among a repository's agents.
• dev.knotless.addEmail procedure Claims an email address as the account logged in to this appview's pages.
• dev.knotless.addReaction procedure Reacts to a pull, an issue or a comment as the account logged in to this appview's pages.
• dev.knotless.addRunner procedure Names an account among a repository's runners, as its owner logged in to this appview's pages.
• dev.knotless.archiveRepo procedure Archives a repository, making it read only, or unarchives it.
• dev.knotless.assignItem procedure Assigns a pull or an issue to an account, or asks it to review a pull, or no longer, as the account logged in to this appview's pages.
• dev.knotless.assignment record Whom one of a repository's maintainers assigns a pull or an issue to, and asks to review a pull.
• dev.knotless.autoMerge record A pull set to merge by itself once its checks pass, or that setting cancelled.
• dev.knotless.awaitDelegation procedure Waits a while for the account logged in to this appview's pages to approve a delegation dev.knotless.delegateWrites started.
• dev.knotless.awaitSpaceWrites query A runner's ask of the appview for the private repositories written to, as soon as one is.
• dev.knotless.block record An account a repository's owner keeps out, as app.bsky.graph.block blocks one.
• dev.knotless.blockActor procedure Blocks an account as the account logged in to this appview's pages.
• dev.knotless.cancel record A repository owner's request that its runners cancel the runs of a ref or a pull still going.
• dev.knotless.check record What a workflow did at a commit a ref pointed at, or at the head of a pull, as the runner that ran it reports.
• dev.knotless.claim record The move of a ref off one generation: its key is the compare-and-swap, its body the reflog entry.
• dev.knotless.comment record A comment on a pull or issue. With a verdict it is a review; with a line, a comment on lines of a pull's diff, starting a thread there; with a reply, an answer in such a thread.
• dev.knotless.compactRepo procedure Folds a repository's packs into one.
• dev.knotless.createBranch procedure Creates a branch of a repository.
• dev.knotless.createComment procedure Comments on a pull or an issue, or on lines of a pull's diff, or answers a comment, or reviews a pull, as the account logged in to this appview's pages.
• dev.knotless.createCommit procedure Commits file changes to a branch through a gateway its owner has delegated writes to, without a clone. Commits to one branch that arrive together are built into one chain and written as one ref update. Requires a service token from the caller's PDS, audience the gateway's DID, for this method; the caller must be the owner or a collaborator.
• dev.knotless.createIssue procedure Opens an issue on a repository, as the account logged in to this appview's pages.
• dev.knotless.createOrgRepo procedure Creates a repository in an organization's account, through the gateway the organization delegated writes to, which makes it as the organization, as `knotless repo create` does. The caller must be an admin of it who joined. Requires a service token from the caller's PDS, audience the gateway's DID, for this method.
• dev.knotless.createPull procedure Opens a pull on a repository, as the account logged in to this appview's pages.
• dev.knotless.createRepo procedure Creates a repository in the account logged in to this appview's pages.
• dev.knotless.createReport procedure Reports an account, a repository, or what someone wrote about one, to the moderation service, as the account logged in to this appview's pages.
• dev.knotless.createTheme procedure Publishes a theme as the account logged in to this appview's pages.
• dev.knotless.defineLabel procedure Defines a label pulls and issues of a repository may carry.
• dev.knotless.defs defs Definitions shared by the knotless lexicons.
• dev.knotless.delegateWrites procedure Starts delegating the writes of the account logged in to this appview's pages to the appview's gateway, as `knotless account delegate` does.
• dev.knotless.deleteAccountData procedure Deletes every knotless record from the asking account, then has the appview forget it.
• dev.knotless.deleteBranch procedure Deletes a branch of a repository.
• dev.knotless.deleteComment procedure Takes back a comment or review, as its author, logged in to this appview's pages.
• dev.knotless.deleteOrg procedure Ends the organization the account logged in to this appview's pages is, as `knotless org delete` does.
• dev.knotless.deleteRepo procedure Deletes a repository and everything in it.
• dev.knotless.deleteSecret procedure Deletes the secrets dev.knotless.putSecret left for a repository the caller owns, or administers as an organization's admin who joined: those of a name, those sealed to a runner, or both; with neither, all of the repository's. Requires a service token from the caller's PDS, audience the appview's DID, for this method, or the appview's own pages' login, as their writes take it.
• dev.knotless.deleteTheme procedure Takes back a theme the account logged in to this appview's pages published.
• dev.knotless.describeServer query What an appview offers the clients that use it.
• dev.knotless.dismissReview procedure Dismisses a reviewer's standing review of a pull, as the account logged in to this appview's pages.
• dev.knotless.editItem procedure Changes what a pull, an issue or a comment says, as its author, logged in to this appview's pages.
• dev.knotless.emails record The email addresses an account's commits are authored as, so pages can show those commits as the account's.
• dev.knotless.endOrgMembership procedure Leaves an organization as the account logged in to this appview's pages, or declines its invitation, as `knotless org leave` does.
• dev.knotless.follow record An account one follows on knotless, to see what it does.
• dev.knotless.followActor procedure Follows an account as the account logged in to this appview's pages.
• dev.knotless.forkRepo procedure Forks a repository into the account logged in to this appview's pages.
• dev.knotless.getAccountData query What knotless data the asking account holds, before it deletes it.
• dev.knotless.getActorActivity query How much an account did on each day, as an appview has indexed it.
• dev.knotless.getActorRepos query The repositories an account holds, read from its PDS.
• dev.knotless.getActorStars query The repositories an account starred.
• dev.knotless.getAttachment query Something a pull, an issue or a comment attaches, such as a picture its body shows.

133 more under dev.knotless ›

• dev.lavalva.photos.library space A personal photo library. Holds social.grain.photo records, which are defined by grain.social rather than by this app.

• dev.malpercio.cards.deck record An owner-curated collection of their own cards (binder, deck, showcase). Purely user-side; a verifier checks each item resolves to a valid give held by this DID.
• dev.malpercio.cards.give record Issuance of a single card instance or a sealed pack, written by the provider into its own repo. This record is the root of a card's provenance chain and its at-URI is the card's permanent identity. The rkey is a TID, so issuance order is implicit.
• dev.malpercio.cards.item record A card (or sealed pack) held by the repo owner. Not authoritative on its own: validity comes from the chain of strongRefs back to a provider give whose recipient matches the current owner at each hop. Blobs are the owner's local copies and must hash to the CIDs on the root give.
• dev.malpercio.cards.set record A card set manifest, published by a provider. Declares every card in the set with its rarity, supply cap, and canonical art. Print runs are auditable against this record.
• dev.malpercio.cards.transfer record Written by the current owner to hand a card to another DID. The recipient completes the transfer by writing a dev.malpercio.cards.item whose 'via' strongRefs this record. Repos are mutable, so an appview indexing the firehose resolves conflicting transfers of the same give (first seen wins).
• dev.malpercio.cards.witness record An appview's signed observation of a card changing hands, written into the appview's own repo. Triggered by a dev.malpercio.cards.item appearing on the firehose. Accepted witnesses form a prev-linked chain per give; exactly one accepted witness exists per (give, hop). Rejected witnesses explain why a claimant's item is not recognized. The chain is durable against player-side deletions and auditable by replaying the firehose.

• dev.mccue.jvm.module record A JVM Module published for wider consumption.
• dev.mccue.repository.mavenArtifact record A singular artifact in a maven repository
• dev.mccue.repository.release record Releases a set of artifacts atomically.

• dev.mkizka.test.example record A test record for dev.mkizka.test.example.

• dev.nekono.skyshare.defs defs not from the namespace authority A fixed, human-facing manifestation of a source record.
• dev.nekono.skyshare.entry record not from the namespace authority A share entry that represents another AT record with a derived asset.

• dev.npmx.actor.profile record A declaration of an npmx account profile.
• dev.npmx.feed.like record A like of a package on npmx

• dev.ocbwoy3.blueboard.board record This record defines a board on Blue Board (e.g. /at/, /pic/, etc.)
• dev.ocbwoy3.blueboard.post record This record defines a post on Blue Board
• dev.ocbwoy3.crack.alterego record An alter ego profile record for use on "Bluesky on Crack".
• dev.ocbwoy3.crack.defs defs Private preferences for Bluesky on Crack.

• dev.openplaylist.defs defs Shared object definitions for Open Playlist records. Track metadata field names follow fm.teal.feed.defs so teal.fm and Rocksky tooling can read them without a mapping layer.
• dev.openplaylist.playlist record A collaborative playlist. Holds metadata only; tracks are dev.openplaylist.playlistItem records that point back at this record with a strong reference, the same shape used by fm.teal.feed.social.playlist and app.rocksky.playlist.
• dev.openplaylist.playlistItem record One track in a dev.openplaylist.playlist. Lives in the same repo as the playlist when added through the hosting app; a signed-in contributor may later write one into their own repo pointing at someone else's playlist.

• dev.pcvera.temp.badge.acceptance record Recipient accepts a pending badge grant.
• dev.pcvera.temp.badge.def record Badge definition: metadata plus a reference to PNG artwork stored as a blob on the issuer PDS.
• dev.pcvera.temp.badge.grant record Issuer grants a badge definition to a recipient; may include an optional HTTPS more-info link.
• dev.pcvera.temp.badge.rejection record Recipient rejects a pending badge grant.

• dev.pythonplayer123.music.follow record Schema-v1 music follow, separate from app.bsky.graph.follow. This ID is fixture-only.
• dev.pythonplayer123.music.love record Schema-v1 loved track (ADR 0005 §6.3, B12, B13). This ID is fixture-only; production requires an owner-controlled prefix.
• dev.pythonplayer123.music.scrobble record Schema-v1 scrobble. This ID is fixture-only; production requires an owner-controlled prefix.
• dev.pythonplayer123.music.scrobbleBatch record Candidate schema for an unpublished container of completed listens. The production namespace must publish and review this schema separately before enabling batch writes.
• dev.pythonplayer123.music.settings record Schema-v1 indexing settings (ADR 0004 §5.3, A10). This ID is fixture-only; production requires an owner-controlled prefix.

• dev.redstar071.project record A project shown on redstar071.dev. The record key is the project's slug, and the site falls back to content/projects/*.yml when no records are readable.

• dev.regnault.webfishing.fish record
• dev.regnault.webfishing.save record Record declaring a save data of the game webfishing
• dev.regnault.webfishing.savefile record Record declaring a savefile of Webfishing.

• dev.roe.ama record An anonymous question, optionally with a published answer. While unanswered the question text is encrypted server-side (private to roe.dev). Once published, the question is rewritten in plaintext alongside the answer and per-platform URLs.
• dev.roe.entity record A person or organisation referenced by AMA responses via @-mentions. Holds the canonical name plus per-platform social handles so the publisher can rewrite mentions correctly for each platform.
• dev.roe.invite record An invitation link that grants access to a private GitHub repository. Both the URL slug and the repo name are sensitive (knowing the slug equals being granted access), so the entire payload is encrypted server-side before being written to the PDS.
• dev.roe.location record Current location (singleton; rkey is always 'self').
• dev.roe.project record A project on the /projects page, belonging to a dev.roe.projectCategory.
• dev.roe.projectCategory record A category on the /projects page. Projects belong to a category via dev.roe.project.category.
• dev.roe.sync record Dedupe marker for a syndication pipeline. One record per (provider, canonical URL) pair that has been submitted; presence of a record means we've already synced and shouldn't re-submit.
• dev.roe.talk record A talk, podcast appearance, workshop, stream, or similar event.
• dev.roe.talkGroup record A talk given at one or more events. Holds the canonical title/description shared across performances; per-event details (date, source, video, etc.) live on dev.roe.talk records that strong-ref this group.
• dev.roe.usesCategory record A category on the /uses page. Items belong to a category via dev.roe.usesItem.category.
• dev.roe.usesItem record A single item on the /uses page, belonging to a dev.roe.usesCategory.

• dev.scopetrail.auditReceipt record A wrapper record publishing a signed OBO Audit Receipt to an AT Protocol repository. The signed receipt (a W3C Verifiable Credential, eddsa-jcs-2022 proof) is stored verbatim as an opaque JSON string in receiptJson — the only trusted field. All other properties are untrusted indexed mirrors, duplicated for discovery only; a verifier must re-parse receiptJson, check the mirrors match, then verify the Ed25519 proof before trusting anything. See PRD_ARCH.md §8.3 (Decision D-1).

• dev.sensorthings.datastream record Groups Observations of one ObservedProperty by one Sensor on one Thing. Carries all context needed to interpret observation results.
• dev.sensorthings.featureOfInterest record The real-world feature that an Observation is about.
• dev.sensorthings.multiObservation record A composite observation bundling multiple co-produced results from a single act of sensing. Each entry carries its own ObservedProperty, unit, and scale metadata. Use this instead of separate Observations when the results are genuinely co-produced (e.g. wave statistics from spectral processing) and have no independent existence.
• dev.sensorthings.observation record A single act of observation. The result type is determined by the $type discriminator on the result object.
• dev.sensorthings.observationBatch record A batch of observations for a single Datastream, covering a contiguous time window. Trades individual addressability for reduced commit overhead.
• dev.sensorthings.observationFrame record The new or changed readings from one collector tick, for many Datastreams in the same repo. Created once and never updated. After the correction horizon has passed, the readings are sealed into dev.sensorthings.observationBatch day records and the frame is deleted. Apply frames in record key order: a later entry for the same datastream and phenomenonTime replaces an earlier one. The record key is the tick time to the millisecond and a three-digit shard number, for example 20260925T100700000Z-000
• dev.sensorthings.observedProperty record The phenomenon being observed (e.g. air temperature, PM2.5 concentration).
• dev.sensorthings.operator record Roster entry for an approved sensor-network operator. Our attestation that an operator was admitted, under a stated open licence, at a stated time. Held in a central registry repo we control, not in the operator's own data repo, so a sovereign operator cannot rewrite their own admission status. Carries org-level facts only; contact details and operational configuration are kept in the private moderation store, not on this public record.
• dev.sensorthings.quality defs Observation passed QC checks.
• dev.sensorthings.sensor record An instrument or procedure that produces observations.
• dev.sensorthings.thing record A physical object (station, platform, device) capable of hosting sensors.

• dev.serendipty01.impro.accountNotes space Private notes the account owner keeps about other accounts, one per subject DID. One space per account (skey self).
• dev.serendipty01.impro.bookmarks space Private bookmarks kept by the Impro fork. One space per account (skey self), readable only by its owner.
• dev.serendipty01.impro.calendar space Private calendar events in the community.lexicon.calendar.event shape, plus one dev.serendipty01.impro.calendarList record (rkey self) naming the calendars and their colours. One space per account (skey self).

• dev.skytick.list record not from the namespace authority A list of tasks.
• dev.skytick.recurrence record not from the namespace authority A rule that adds a task to a list again and again.
• dev.skytick.todo record A task on a list.
• dev.skytick.vault space not from the namespace authority Private Skytick lists, tasks and recurring tasks.

• dev.svelte.playground.private space Private Svelte playground apps: only the owner can read them.

• dev.sylfr.feed.getPosts query Gets post views for a specified list of posts (by AT-URI). This is sometimes referred to as 'hydrating' a 'feed skeleton'. Mirror of `app.bsky.feed.getPosts`.
• dev.sylfr.feed.like record Record declaring a 'like' of a piece of subject content. Mirror of `app.bsky.feed.like`.
• dev.sylfr.graph.defs defs A list of actors used for curation purposes such as list feeds or interaction gating.
• dev.sylfr.graph.follow record Record declaring a social 'follow' relationship of another account. Duplicate follows will be ignored by the AppView. Mirror of `app.bsky.graph.follow`.

• dev.tsunagite.chart record Definitions related to charts included in games hosting leaderboards via Tsunagite.
• dev.tsunagite.createChart procedure Create a record for a chart in a game hosting leaderboards via Tsunagite. If the chart already exists, update its data.
• dev.tsunagite.createGame procedure Create a record for a game that will host leaderboards via Tsunagite. If the game already exists, update its data.
• dev.tsunagite.createSong procedure Create a record for a song in a game hosting leaderboards via Tsunagite. If the song already exists, update its data.
• dev.tsunagite.defs defs Assistant data types for Tsunagite lexicons.
• dev.tsunagite.difficulty record Definitions related to difficulty slots in games hosting leaderboards via Tsunagite.
• dev.tsunagite.game record Definitions related to games hosting leaderboards via Tunagite.
• dev.tsunagite.getChart query Single-record chart fetch
• dev.tsunagite.getDifficulty query Single-record difficulty fetch
• dev.tsunagite.getGame query Single-record game fetch
• dev.tsunagite.getLeaderboard query Defnitions related to querying leaderboards hosted via Tsunagite.
• dev.tsunagite.getSong query Single-record song fetch
• dev.tsunagite.listCharts query Batch chart fetch
• dev.tsunagite.listGames query Batch game fetch
• dev.tsunagite.listSongs query Batch song fetch
• dev.tsunagite.permissions defs Common permission sets used for Tsunagite setups.
• dev.tsunagite.profile record Definitions related to player profiles in games hosting leaderboards via Tsunagite.
• dev.tsunagite.score record Definitions related to scores in games hosting leaderboards via Tsunagite.
• dev.tsunagite.song record Definitions related to songs included in games hosting leaderboards via Tsunagite.
• dev.tsunagite.submitScore procedure Definitions related to submitting scores to games hosting leaderboards via Tsunagite.
• dev.tsunagite.translatable object A piece of text with multiple translations, transliterations, or localizations into different languages.

• dev.vielle.dnd.astral record Schema for storing astral powers. Used for dnd.vielle.dev
• dev.vielle.dnd.authAstral permission-set Auth for dev.vielle.dnd.astral records
• dev.vielle.dnd.power string Tokens for all dev.vielle.dnd.astral powers
• dev.vielle.guestbook.authEntry permission-set Permission to create a new signature for a guestbook
• dev.vielle.guestbook.book record Book for guesbook signing. dev.vielle.guestbook.entry records will refer to this. The rkey should be nsid (reverse dns) for the domain this is a guestbook for
• dev.vielle.guestbook.entry record Signature for a guestbook. This references the dev.vielle.guestbook.book record for the given website. The rkey should be nsid (reverse dns) for the domain this is a signature for

• dev.zicklag.authArbiterDemo permission-set