- io.atcr.authFullApp permission-set
- io.atcr.hold.abortUpload procedure Cancel a multipart upload and cleanup any temporary data.
- io.atcr.hold.captain record Represents the hold's ownership and metadata. Stored as a singleton record at rkey 'self' in the hold's embedded PDS.
- io.atcr.hold.completeUpload procedure Finalize a multipart upload and move the assembled blob to its final location.
- io.atcr.hold.crew record Crew member in a hold's embedded PDS. Grants access permissions to push blobs to the hold. Stored in the hold's embedded PDS (one record per member).
- io.atcr.hold.deleteUserData procedure Delete all user data from this hold (GDPR compliance). Deletes crew record (if not captain), layer records, and stats records. Does NOT delete actual blob data from S3 - only PDS records.
- io.atcr.hold.exportUserData query Export all user data from this hold (GDPR compliance). Returns all records stored on this hold's PDS that reference the authenticated user's DID.
- io.atcr.hold.getLayersForManifest query Returns layer records for a specific manifest AT-URI.
- io.atcr.hold.getPartUploadUrl procedure Get a presigned URL or endpoint info for uploading a specific part of a multipart upload.
- io.atcr.hold.getQuota query Get storage quota information for a user. Calculates total unique blob storage by iterating layer records and deduplicating by digest.
- io.atcr.hold.initiateUpload procedure Start a new multipart upload session for an OCI blob. Returns an uploadId to be used with subsequent part upload and completion endpoints.
- io.atcr.hold.layer record Represents metadata about a container layer stored in the hold. Stored in the hold's embedded PDS for tracking and analytics.
- io.atcr.hold.listTiers query List the hold's available tiers with storage quotas (no pricing info).
- io.atcr.hold.notifyManifest procedure Notify hold about a manifest push or pull operation. For pushes: creates layer records and optionally posts to Bluesky. For pulls: just increments stats. Always increments pull/push counts.
- io.atcr.hold.requestCrew procedure Request crew membership for the hold. Authorization depends on the captain record: if allowAllCrew is true, any authenticated user can join; otherwise, only the owner can join.
- io.atcr.hold.scan record Vulnerability scan results for a container manifest. Stored in the hold's embedded PDS. Record key is deterministic: the manifest digest hex without the 'sha256:' prefix, so re-scans upsert the existing record.
- io.atcr.hold.stats record Repository statistics stored in the hold's embedded PDS. Tracks pull/push counts per owner+repository combination. Record key is deterministic: base32(sha256(ownerDID + "/" + repository)[:16]).
- io.atcr.hold.subscribeScanJobs subscription Subscribe to vulnerability scan jobs via WebSocket. Scanners connect to receive pending scan jobs and send back results. Authenticated via shared secret (query parameter or X-Scanner-Secret header).
- io.atcr.hold.updateCrewTier procedure Update a crew member's tier. Only accepts requests from the trusted appview.
- io.atcr.manifest record A container image manifest following OCI specification, stored in ATProto
- io.atcr.repo.page record Repository page metadata including description and avatar. Users can edit this directly in their PDS to customize their repository page.
- io.atcr.sailor.profile record User profile for ATCR registry. Stores preferences like default hold for blob storage.
- io.atcr.sailor.star record A star (like) on a container image repository. Stored in the starrer's PDS, similar to Bluesky likes. Subject is an AT URI pointing to the repo page record being starred.
- io.atcr.sailor.webhook record Public webhook metadata stored in the user's PDS. Links to a private io.atcr.hold.webhook record on the hold where URL and secret are stored. Part of a two-record split: this record is visible via ATProto (Jetstream), the hold record is not.
- io.atcr.tag record A named tag pointing to a specific manifest digest
- io.kich.accomplishment record Record declaring that the user has earned an accomplishment (badge/milestone). One record per accomplishment type per user.
- io.kich.authBasic permission-set Permission set for kich.io write access.
- io.kich.cookinglog record Record declaring that the user cooked a public recipe.
- io.kich.graph.defs object Shared definitions for the graph namespace (follows, etc.).
- io.kich.graph.follow record A social follow. Record declaring that the repository owner follows another user.
- io.kich.grocery.defs object Shared definitions for the grocery namespace. Grocery lists have no record type — they live in the application database rather than on a PDS — so these views exist only as query output.
- io.kich.grocery.getCurrentList query The household's current shopping list and the recipes attached to it — which is what 'what are we cooking this week' means in this product. Read-only.
- io.kich.pantry.defs object Shared definitions for the pantry namespace. The pantry has no record type — it lives in the application database rather than on a PDS — so these views exist only as query output.
- io.kich.pantry.listItems query What is in a household's kitchen, soonest to turn first. Read-only.
- io.kich.profile record Profile record declaring that a repository uses the Kitchen app. This record acts as a declaration/signal for repository discovery.
- io.kich.recipe.collection record Record representing a public list of recipes. If it's on ATProto, it's public.
- io.kich.recipe.collectionfollow record Record declaring a follow of a public recipe collection.
- io.kich.recipe.collectionitem record Record representing a recipe's inclusion in a specific collection. One record per recipe per collection.
- io.kich.recipe.defs object Shared definitions for the recipe namespace.
- io.kich.recipe.like record Record declaring a 'like' (favorite) of a recipe.
- io.kich.recipe.listRecipes query A household's cookbook, most cookable first. Read-only.
- io.kich.recipe.recipe record A recipe record containing cooking instructions, ingredients, and metadata.
- io.kich.recipe.review record Record declaring a review (rating and optional comment) of a recipe. One review per user per recipe.
- io.kich.recipe.save record Record declaring a saved public recipe reference.
- io.zzstoatzz.phi.editorialContext record Singleton editorial-context record — phi's grounding notes for coral's LLM curator (the sibling firehose NER/trending project). Coral fetches this record each curation cycle and injects the note contents VERBATIM into its curator prompt as the 'Editorial context' block, replacing the old baked-in context_notes.txt. Notes are terse, factual grounding about currently-trending entities (who/what something is, why it is suddenly everywhere) — never opinions, instructions, or predictions. Pruned aggr
- io.zzstoatzz.phi.entityDirectives record Singleton entity-curation directives for coral's ingest pipeline. Unlike editorialContext (prose read by an LLM), these are EXECUTED MECHANICALLY: coral rewrites aliased entity text to its canonical form and drops suppressed entities entirely before they reach the graph, trending, or display. A wrong suppression makes a real entity invisible. Matching is case-insensitive against coral's normalized entity text; texts are capped at 64 bytes (coral rejects longer entries rather than truncating). Fu
- io.zzstoatzz.phi.getAbilities query Phi's currently-registered function tools, computed live from the running code rather than hand-maintained, so it cannot drift from what she can actually do. Every tool carries a risk declaration: a tool without one is not a valid tool, and the test suite refuses it. Served at /xrpc/io.zzstoatzz.phi.getAbilities; /api/abilities is kept as an alias.
- io.zzstoatzz.phi.influence record An influence selected on Phi's repo. The subject pins an actor profile version; its URI contains the stable actor DID. Retired choices remain readable. Background voice material cites the exact choice and source post versions.
- io.zzstoatzz.phi.mentionConsent record Singleton record listing handles that have opted in to being @mentioned by phi.
- io.zzstoatzz.phi.override record Singleton operator-override record. Lives on the OPERATOR's repo, not phi's — the bot reads it from the DID configured as owner_did, so repo ownership is the authorization: anyone can write this record to their own repo, but only the operator's copy has effect. While active, phi's outward-facing tools (post/like/repost) refuse with the operator's message, and the message renders as a banner in phi's system prompt and on the cockpit.
- io.zzstoatzz.phi.personality record Complete authored personality revision. Newest TID is active; earlier revisions remain available.
- io.zzstoatzz.phi.residue record Singleton residue record — what phi's recent runs left behind. Items are strictly descriptive (state of the world, never instructions or self-assigned tasks). Written automatically at the end of each agent run by a small synthesis pass (the periphery writes, the deliberate workspace reads); rendered into phi's system prompt as the [RESIDUE] block at the start of the next run. Capacity-limited and time-decaying: items expire days after they were last held, and carrying an item forward reinforces
- io.zzstoatzz.phi.self record Singleton self record — phi's own description of who she is, in her own words. Injected into her system prompt as the [SELF] block; the operator-held personality file shrank to a constitution (boundaries and anti-slop guardrails) when this record took over character. Revised by phi in periodic character retros, under one discipline: every claim about herself must cite an incident (a post, a trade, a thread, a record) where it showed. Public and versioned by design — the firehose keeps the histor