Production and federation plan #

This document is the completion checklist for turning cpds from a local, single-account protocol implementation into a reliable Personal Data Server that can participate in the public AT Protocol network. A checked box must be backed by code, an automated local test, and the operational evidence named in that section. Passing the current test suite alone does not imply production readiness.

The intended first production topology remains deliberately small: one hosted account, one process, SQLite, and a filesystem blob store behind an HTTPS reverse proxy. Multi-account hosting and object storage are useful extensions, but they are not prerequisites for a production-grade personal server. The repository, sync, identity, authorization, recovery, and operational contracts are prerequisites.

The normative references for this work are the AT Protocol specifications for repositories, sync, event streams, accounts, DIDs, handles, and OAuth. Canonical Lexicons and language-neutral test vectors come from the reference repository. The ATrium adoption evaluation defines which Rust building blocks CPDS will compose, the trust boundaries around them, and the fixture and dependency gates required before they carry production data.

Current baseline #

The current implementation already provides:

• zero-configuration loopback startup with one development account;
• SQLite persistence and atomic filesystem publication for blobs;
• password hashing, one-time OAuth authorization codes, S256 PKCE, and hashed opaque bearer tokens;
• public record create/get/list/delete and blob upload/get endpoints;
• official-fixture-matched schema-independent AT Protocol data-model encoding, native DAG-CBOR CID links/bytes, and deterministic record CIDs;
• a did:web document with an atproto signing key and PDS service endpoint;
• an extensive alpha Spaces implementation with granular scopes, signed commits, DPoP-bound space credentials, CAR recovery, and authenticated notifications;
• local unit, adapter-contract, and router-level integration tests.

The complete baseline gate is:

cargo fmt --all -- --check
cargo clippy --all-targets -- -D warnings
cargo test --all-targets --locked
cargo deny --locked check

The public repository and OAuth implementations are intentionally smaller than the network protocols they resemble. They must not be advertised as federating until the federation gates below pass.

Gap and acceptance matrix #

1. Local and network-safe configuration #

Current gap: development values are implicit in every environment. A process can listen publicly while retaining a development password, signing key, HTTP origin, relative data paths, or static test client registration.

Completion evidence:

• An explicit local/production mode keeps zero-config local startup while production startup fails closed on missing or unsafe identity, secret, URL, storage, and proxy settings.
• The public URL is one canonical origin. Production requires HTTPS, no credentials/query/fragment, and well-known endpoints derived without path ambiguity.
• The configured signing secret is a valid secp256k1 scalar and differs from the published development key; secret values are never logged.
• Database, blob, and event adapters are checked before the listener accepts traffic. Startup also verifies every initialized signed repository graph and its SQL record index. File and directory permission expectations are documented.
• Startup diagnostics name the invalid variable without echoing its value.
• Unit tests cover every default, required field, parse failure, unsafe production value, and canonical URL rule.
• Process-level integration tests start the otherwise-default local mode on an isolated loopback address and prove unsafe production configuration exits before creating storage or binding its requested socket.

2. Durable repository-v3 state #

Current state: public creates, updates, and deletes now use a signed repository-v3 MST and an atomic SQLite write batch. Schema-independent data validation and canonical encoding match the official interoperability fixtures. The remaining work includes per-Lexicon schema validation, apply-writes semantics, and the broader official fixture and multi-write failure matrix.

Completion evidence:

• Records are validated against the schema-independent AT Protocol data model and their exact canonical DAG-CBOR block bytes are stored by CID. Every official valid/invalid fixture passes, and encoding fixtures match byte-for-byte, including native CID links and bytes. The write adapter reuses ATrium's typed link/blob models and repository reads reuse its DataModel.
• Records are validated against known collection Lexicons when validation is requested; unsupported schemas report their limitation honestly.
• A repository-v3 MST maps canonical collection/rkey paths to record CIDs using the specified key ordering, fanout, and node encoding.
• Every mutation produces a commit with did, version, data, rev, prev, and low-S secp256k1 signature fields matching the specification.
• Record blocks, MST blocks, the commit, repository head, operations, and an outbound event are committed in one SQLite transaction.
• createRecord, putRecord, deleteRecord, and applyWrites support the required swapCommit/swapRecord conflicts and return current commit data. The three single-record methods are complete; atomic batches remain.
• Generated revisions remain monotonically increasing across concurrent writes, clock rollback, and process restart.
• Blob references in records are validated against owned blob metadata; orphan accounting and garbage collection are explicit and safe. Create and put reject malformed or legacy references, missing uploads, and MIME/size mismatches through ATrium's current typed blob model. An atomically maintained public/Space reference index now provides exact accounting. A bounded, configurable collector durably claims and deletes aged orphans and resumes interrupted deletion. Hidden metadata is reserved before object publication and becomes available only after durable bytes, closing the untracked-object crash window.
• Unit tests use official interoperability vectors for DAG-CBOR, CIDs, TIDs, MST operations, commits, and signatures. The official data-model, DID/handle/AT-identifier/NSID/record-key/TID/datetime/language syntax, repository-MST, firehose commit-proof, and signature sets are integrated; broader generic CID/URI/AT-URI, signed-commit, and CAR fixture coverage remains. The current CID syntax fixture is intentionally not treated as a semantic link-acceptance oracle because it is broader than both ATrium's CID parser and the specification's blessed set.
• Database tests cover atomic multi-write rollback, compare-and-swap races, restart persistence, corruption detection, and schema migration.

Implemented foundation: schema version 9 includes content-addressed repository blocks, one signed head per account, ordered operation rows, a durable replay stream, ordered per-commit block membership for CAR diff/firehose recovery, and a public/Space per-record blob-reference index with durable upload and deletion states. Version 7 generalizes the outbox so lifecycle and commit events share one constrained sequence without inventing commit roots or revisions for lifecycle rows; version 8 adds a constrained durable account status with active as the backward-compatible upgrade default. Version 9 repairs skipped legacy stream-table upgrades while preserving issued sequence numbers, and adds indexed OAuth credential expiry cleanup. Bounded repository-block collection uses ATrium's exported reachable graph and preserves current heads plus retained sync-event membership before deleting historical blocks. Fresh databases create all schema generations in one transaction; version 1 through 8 upgrades preserve existing rows, version 5 blobs become available in place, version 6 commit rows move into the constrained stream schema without renumbering, and version 7 accounts become active in place. Reference-index migrations use the shared ATrium scanner and all migrations roll back on incompatible state. Current databases recompute both indexes at startup and fail closed on drift. Historical version-2 outbox rows intentionally have no guessed block membership and replay as signed #sync reset points. New versioned outbox payloads retain the prior revision and MST root required for inductive firehose events. The public write path stages ATrium blocks in memory, filters legacy backfills to the reachable graph, persists incremental write sets, verifies block bytes against their CIDs on every read and write, and publishes the whole mutation with a SQLite head compare-and-swap. Tests cover transaction rollback, block corruption, concurrent creates, restart monotonicity, signature verification, legacy-row backfill, and startup rejection of reachable-block corruption, SQL/MST record-index drift, or retained event metadata, sequence, inductive-chain, block-membership, and head drift.

3. Public sync surface and durable event stream #

Current state: getBlob, getLatestCommit, getRepoStatus, full getRepo, and proof-oriented getRecord use canonical generated request types. CAR responses delegate traversal, proof extraction, and v1 framing to ATrium, reverify the locally stored head signature, and enforce a 64 MiB writer limit. Interoperability tests reopen the archives through ATrium, verify the signed root, read included records, and prove a record archive omits an unrelated value block. Incremental getRepo exports retain the current signed head as the CAR root while including only blocks assigned to repository revisions newer than since; they fail closed when a legacy event lacks exact block membership. Every new mutation has a durable ordered outbox row and its exact ATrium write set. getBlocks permits at most 1,000 requested CIDs, proves each is reachable from the current signed graph before accessing the shared block table, and returns an ATrium CAR with the reference implementation's empty roots array. listBlobs queries the atomically maintained reference index populated through ATrium's typed and legacy blob-reference parser, provides bounded CID pagination, and never lists unattached uploads. subscribeRepos now backfills and polls the durable outbox over binary WebSockets, serializes generated ATrium #identity, #account, #commit, and #sync models as the two concatenated DAG-CBOR objects required by the event-stream specification, and returns FutureCursor as a stream error. On the first repository commit, the same transaction assigns consecutive identity, active-account, and commit events in the recommended order. The identity event includes the canonical stored handle; local mode derives it from the validated local document and production substantiates it before binding. Retained historical events are not rewritten. Historical rows and commit diffs above two megabytes become signed #sync reset points. The transport limits handshakes by peer, caps global and per-peer live connections and inbound frames, and disconnects stalled consumers after a bounded send. The transactional outbox keeps a configurable bounded window; stale consumers receive generated #info/OutdatedCursor and incremental exports fail closed when their block history is no longer retained. listRepos exposes initialized signed heads through generated ATrium types and the reference time/DID cursor. listReposByCollection reuses that stable cursor and returns only repositories whose current records contain the requested canonical NSID and whose account is active. getRepoStatus, listRepos, and getSession report durable account state through generated ATrium models. Authenticated activation and deactivation atomically append idempotent #account events; inactive states suppress public records, blobs, exports, and future repository commits, while SQLite rechecks state in commit and blob-publication statements to close authorization races. describeRepo exposes the canonical DID document and collection inventory through generated ATrium types and reports the hosted handle as correct only after the deployment-mode identity gate succeeds. listMissingBlobs uses ATrium's current and legacy blob scanner to group unresolved references by CID and return a representative record URI through the generated Lexicon shape. An explicit operator command now asks bounded configured relays to crawl the PDS using ATrium's generated request type. A separate offline, storage-verified operator command applies host account states and reversals with atomic retained events. Periodic production handle checks now publish confirmed handle.invalid and recovery transitions. Secure data erasure, DID-document lifecycle, and crawl metrics remain absent. One fake relay now carries the served identity through crawl, gap repair, and resumed live ingestion using the same public endpoints a network relay uses. The separate in-process EventSink remains best-effort and is not part of relay delivery.

Completion evidence:

• Implement getLatestCommit, getRepoStatus, getRecord, getBlocks, getRepo, listBlobs, listMissingBlobs, listRepos, listReposByCollection, and describeRepo with canonical Lexicon request/response shapes.
• Full and incremental CAR exports contain a verifiable commit, all required MST nodes, and referenced record blocks without unrelated private data.
• A SQLite outbox assigns durable, monotonically increasing stream sequence numbers in the same transaction as each repository mutation.
• subscribeRepos serves binary CBOR WebSocket frames for #commit, #sync, #identity, #account, and #info, enforces the 5 MiB frame limit, and supports cursor backfill. The first repository transaction durably emits identity, active-account, then commit; future-cursor errors and #info for expired cursors use generated ATrium models.
• Slow subscribers have bounded queues and a defined disconnect/resync behavior; event retention and cursor-expiry behavior are configurable and observable. Direct sends have a bounded configurable deadline and log the last durable cursor before disconnecting a stalled consumer. Retention is bounded, expired cursors have a canonical resync response, and a forced slow-consumer test proves replay after disconnect. Stream metrics remain.
• Restart cannot lose committed events. Delivery failure cannot cause a successful repository mutation to be reported as failed. An on-disk restart test replays the committed cursor over a real WebSocket and then observes the next monotonically ordered live event.
• Router integration tests verify every implemented sync endpoint and CAR block.
• A relay-consumer test opens streamed commit CARs with ATrium, verifies their signatures and roots, and resolves the announced record through the MST.
• Real-WebSocket tests verify live delivery, ordered backfill, reconnect from a cursor, stale cursor handling, forced slow-consumer disconnect/replay, graceful cursor-bearing shutdown, and restart.
• A relay-style recovery test forces a cursor outside retention, consumes #info/OutdatedCursor, opens the full getRepo CAR with ATrium, verifies the signed head and every current MST record, then resumes the live stream and verifies the next inductive commit.

4. Identity, handle, account state, and relay discovery #

Current gap: the server derives and validates its canonical local did:web document, resolves public handles and DIDs, verifies its production identity bidirectionally before binding, exposes generated resolveHandle, emits initial identity and active-account events, durably implements user activation and deactivation, and reports verified repository identity and hosting status. It periodically revalidates the hosted handle and emits durable invalidation and recovery events. It does not track later DID document/key/service transitions, securely erase deleted account data, support did:plc operation workflows, or exercise the production resolver against injected fake DNS/HTTPS/PLC services.

Completion evidence:

• Startup resolves or locally derives the configured DID document, verifies the #atproto signing key and #atproto_pds endpoint, and distinguishes the special local environment from network identity.
• Handle resolution supports preferred DNS TXT and HTTPS well-known fallback, rejects conflicting valid DNS DIDs, supports did:plc plus conformant path-bearing did:web, and is verified bidirectionally against the DID document before production accepts network writes. DNS/HTTP work has bounded cache TTLs, timeouts, redirects, response bytes, and public-address SSRF policy. New initial #identity events atomically include the verified handle.
• Durable account states (active, deactivated, suspended, takendown, and deleted) report through generated session/sync models and consistently gate records, blobs, exports, OAuth-backed Space calls, and future repository events. User activation/deactivation is idempotent, cannot override a host-enforced state, and emits an atomic retained #account event.
• A bounded, configurable production timer revalidates the hosted handle. Confirmed bidirectional invalidity atomically stores handle.invalid and a retained generated #identity event without changing the DID or account status; recovery restores the configured handle with another event. Transient DNS/HTTPS failures preserve the last confirmed state, and local mode remains network-free.
• An offline operator command applies suspension, takedown, deletion-state, and reversal without letting account credentials override host policy. It requires the service account's existing storage and secrets, verifies all storage before and after the atomic status/outbox transition, never binds a listener, and repeats production identity verification before activation.
• Define and implement irreversible account erasure, including authorization, retention/legal-hold policy, backup handling, secret destruction, physical repository/blob/event deletion, and recovery tests. The current deleted status is intentionally reversible access suppression.
• did:web hosting instructions and did:plc rotation/signing-key custody are documented. Private rotation material is never required by the serving process unless an explicitly authorized PLC operation is being performed.
• Relay endpoints are bounded, validated configuration. request-crawl is an explicit idempotent operation that contacts all relays in parallel, refuses redirects, retries only bounded transient failures, logs per-relay attempts, returns aggregate process status, and never opens storage.
• Relay crawl attempts, last success/failure, and age are exported as metrics rather than existing only in command logs and exit status.
• A local fake relay resolves the DID and handle, requests a crawl, subscribes to the stream, verifies commit signatures/MST/CAR content, and repairs an induced gap through getRepo. Its HTTP half now verifies the generated crawl payload, hostname/port, multi-relay delivery, transient retry, permanent rejection, redirect refusal, and no storage side effects. Its consumer half now forces an expired cursor, validates the repaired full CAR, resumes live, and validates the next inductive commit. The combined proof receives the real crawl request, reads the PDS DID document, resolves its advertised handle through generated XRPC, derives the repository key from the document, and carries that trust decision through repair and live resumption.

5. AT Protocol OAuth profile #

Current gap: the local browser flow has useful OAuth primitives, but network OAuth requires pushed authorization requests (PAR), dynamically fetched client metadata, DPoP with server nonces, refresh-token rotation, revocation, and profile-complete metadata. Current bearer tokens are not suitable for public deployment.

Completion evidence:

• Client metadata URLs are resolved dynamically with exact document/client ID matching, declared redirect/scope validation, bounded caching, response limits, timeouts, and hardened SSRF policy. Localhost exceptions exist only in local mode.
• PAR is mandatory and authorization pages consume one-time request_uri values rather than accepting free-standing authorization parameters.
• PAR, token, and resource requests require valid ES256 DPoP proofs and a rotating server nonce; method, URL, key thumbprint, token hash, time, and JTI replay constraints are enforced.
• Access and rotating refresh tokens belong to a revocable session. Refresh reuse revokes the session; logout/revocation and expired-row cleanup exist.
• Authorization-server and protected-resource metadata advertise only implemented capabilities, including PAR and DPoP fields required by the profile.
• CORS is narrowly enabled on the profile-required endpoints. Authorization UI responses have CSRF protection, secure session/cookie behavior where applicable, anti-clickjacking policy, and no secret-bearing logs.
• Unit tests cover metadata validation, SSRF targets, JWT/DPoP validation, nonce rotation, replay, clock skew, token rotation/reuse, and scope parsing.
• A local OAuth client integration test completes discovery, PAR, browser approval, DPoP token exchange, an authenticated XRPC call, refresh, and revocation without external network access.

6. Storage lifecycle, backup, and recovery #

Current gap: production scheduling, retention, off-host transfer, and separate secret protection remain operator work. SQLite has versioned migrations and an explicit durability policy, filesystem blobs use verified crash-durable publication, cpds backup captures the database and CID-verified blobs behind a write barrier, and cpds verify runs the complete startup proof without collection or socket bind.

The bundled SQLite version must remain at 3.51.3 or newer (or an official fixed backport) before WAL is enabled. Earlier versions contain the documented WAL-reset corruption race under concurrent writers/checkpoints.

Completion evidence:

• Ordered, transactional, forward-only migrations carry a schema version; startup refuses unknown newer schemas and tests upgrade every released fixture.
• SQLite enables and verifies foreign keys per connection, WAL mode, an explicit synchronous policy, busy timeout, integrity checks, and bounded maintenance/checkpoint behavior.
• Database access has defined concurrency/backpressure rather than holding a blocking mutex unpredictably on async executor threads. A 2026-08-22 review found that tokio-rusqlite 0.7 pins rusqlite 0.37 and deadpool-sqlite 0.13 pins 0.38, while CPDS uses 0.40.2 for its bundled SQLite safety floor. Do not downgrade or add a second SQLite stack merely to hide the mutex. Move the database call surface cohesively to a reviewed compatible dedicated-thread adapter, with bounded admission and cancellation tests, when one is available or a driver change is explicitly accepted.
• Blob writes use safe permissions, collision-safe temporary creation, content verification, file sync, rename, and parent-directory sync where the platform supports it. Stale temporary files are recovered.
• A consistent backup includes repository database state, blobs, config metadata, and separately protected signing/rotation keys. Restore verifies referential integrity, CIDs, MST roots, and commit signatures before serving. Native SQLite capture, private CID-verified blob copy, a non-secret config manifest, create-only targets, and the fail-closed restore check are complete. Restore rejects an unsupported manifest or drift in public origin, DID, handle, event retention, or the standard database/blob pairing. A populated restore test proves a signed repository, referenced blob and index, retained event, CAR export, and ordinary readback from new paths. Separate signing-key protection and production retention/off-host automation remain.
• Bounded repository-block collection preserves current ATrium graphs and retained replay history, then converges through startup and periodic passes.
• Export/import supports migration without relying on a filesystem snapshot.
• Fault-injection tests cover database busy/error, blob write/rename failure, partial mutation rollback, outbox retry, abrupt restart, and restore.

7. HTTP and process hardening #

Current gap: all current request classes are bounded for the supported single-process topology. A future multi-process deployment would need to move principal budgets to a shared limiter.

Completion evidence:

• Structured requests and blob uploads have explicit, endpoint-appropriate limits enforced by Axum before buffering, with exact boundary tests.
• Global request timeout, concurrency, and load-shed behavior are bounded and tested; overloads return 503 with Retry-After instead of queueing.
• Authentication, authorization, OAuth, metadata fetches, and expensive sync endpoints have appropriate account/IP/service rate limits and Retry-After.
• Proxy headers are ignored. Forwarded host/proto cannot change discovery; the external origin always comes from validated configuration.
• Official blob CSP/nosniff isolation, conservative cache policy, OAuth browser CORS, and baseline browser security headers are boundary-tested.
• Every framework rejection and unknown XRPC route uses the standardized JSON error shape; success content types remain covered per endpoint.
• /health is a dependency-free liveness check; /ready verifies the live database policy/schema, blob storage writability, immutable startup key construction, and event adapter without mutating user data.
• Readiness verifies an outbox query and actionable backlog age separately from the best-effort EventSink adapter. The bounded outbox cursor/oldest-timestamp query and failure behavior are complete; surfacing actionable age through metrics remains.
• SIGTERM/SIGINT stop admission, drain in-flight HTTP work for at most 30 seconds, force-close after the bound, and checkpoint/truncate the SQLite WAL.
• Stream shutdown explicitly sends a bounded WebSocket going-away close with each subscriber's last durable resumption cursor before HTTP draining; a live test verifies the close code, reason, cursor, and clean server exit.
• Structured request logs include server-generated correlation IDs and only method, path without query, status, and latency; process tests prove request passwords, codes, tokens, proofs, cookies, and caller IDs are not logged.
• Stream logs add correlation and resumption identifiers without logging private event content. The server-generated request ID, initial cursor, and last durable disconnect/backpressure cursor are implemented in a dedicated stream span, and a real-process WebSocket test checks those fields while rejecting caller IDs and credential headers from logs. Completion evidence still requires that loopback test to pass in an execution environment that permits socket binding.
• A process-level test starts the real binary, observes readiness, delivers SIGTERM, verifies a clean exit/checkpoint, and restarts the same data paths.
• Process tests cover bind failure and a live blob-storage readiness transition; runtime tests cover stop-admission, drain, and forced close.

8. Observability and operations #

Current gap: request tracing is structured but console-only. There are no service-level indicators, metrics, alert thresholds, deployment artifact, or rehearsed operator runbook.

Completion evidence:

• Metrics cover request latency/error/rate, auth failures and throttling, SQLite latency/busy state/WAL size, blob bytes/errors, repository head/rev, outbox depth/age, stream clients/lag/disconnects, and relay crawl status.
• Logs and metrics expose build/version/schema identity and readiness without exposing private account content or credentials.
• Operator runbooks cover install/upgrade/rollback, TLS and DNS, DID/handle setup, relay discovery, backup/restore, key rotation, disk pressure, database integrity, desynchronization, and incident credential revocation.
• A minimal hardened service artifact (container or native service unit) runs unprivileged, uses read-only application files, persists only declared data paths, has resource limits, and exposes a reproducible version.
• CI runs formatting, linting, tests, dependency/license/security policy, build reproducibility, and the federation harness. Release artifacts are built from a tagged, reviewed commit with checksums and an upgrade note. Formatting, strict Clippy, the all-target locked suite, and a pinned cargo-deny advisory/license/source policy now run on Rust 1.88 with read-only repository permissions. Reproducible release builds, the complete federation harness, signed/checksummed artifacts, and tagged release evidence remain.
• A soak test exercises writes, reads, stream subscribers, checkpoints, backup, and restart long enough to expose descriptor, memory, and queue leaks.

Local testing architecture #

All protocol behavior must be testable locally and deterministically. Tests must not require the public PLC directory, DNS, a public relay, or an existing Bluesky account.

1. Pure unit tests cover parsers, canonical encoders, CIDs, TIDs, MST operations, commit signing/verification, cursor logic, scopes, OAuth/DPoP, configuration, and state transitions. Time, randomness, and DNS/HTTP lookup are injected at these boundaries.
2. Adapter contracts run identical behavior against memory/test and production adapters: blob stores, block stores, outboxes, identity resolvers, client metadata resolvers, clocks, and event subscribers.
3. SQLite component tests use temporary on-disk databases, close/reopen them, run migrations, force conflicts, and validate invariants directly. In-memory SQLite alone is insufficient for WAL/restart behavior.
4. Router integration tests send complete HTTP requests through the Axum router and assert status, headers, JSON/CBOR/CAR bodies, authorization, size limits, and observable committed state.
5. Process integration tests spawn the compiled binary with an isolated temporary data directory and dynamically allocated loopback listener. They test startup failure, readiness, real TCP/WebSocket behavior, signals, and restart. Child processes always receive explicit cleanup guards.
6. Federation end-to-end tests run a fake DNS/HTTPS identity service, OAuth client, relay, and consumer. The relay crawls the PDS, verifies its identity, subscribes, validates every repository block and signature, intentionally disconnects, resumes, detects a gap, and repairs through a full CAR export.
7. Interop tests consume pinned upstream, language-neutral fixtures with provenance and licensing recorded. Generated local fixtures never replace upstream vectors for wire compatibility.
8. Fault and concurrency tests exercise write races, clock rollback, database contention, slow stream consumers, full queues, I/O failures, retries, abrupt shutdown, corruption, backup, and restore.

Tests that bind loopback sockets are still local tests. They may require a test runner environment that permits loopback binding, but never public network access.

Sequenced implementation #

Each item below should normally be one commit: one observable behavior, its tests, and the smallest documentation update needed to keep claims accurate. Dependencies may reveal a smaller prerequisite commit, but unrelated items must not be bundled.

Phase A — make the existing server safe to operate #

1. Add explicit local/production configuration modes and exhaustive config unit tests.
2. Canonicalize the public origin and derive all externally visible URLs from it; add metadata/URL integration tests.
3. Add versioned SQLite migrations and on-disk migration/restart tests.
4. Apply and verify SQLite durability/contention pragmas with tests.
5. Harden filesystem blob publication and recovery with fault-oriented adapter tests.
6. Add body, timeout, concurrency, and basic authentication rate limits with boundary tests.
7. Add liveness/readiness and graceful shutdown process tests.

Phase B — build the public repository as one atomic domain #

1. Pin atrium-crypto, run official signature fixtures, and remove superseded AT Protocol multikey and signing code.
2. Pin atrium-api with default features disabled and migrate standard public XRPC wire types endpoint by endpoint.
3. Implement an atomic SQLite block-store adapter for atrium-repo; prove MST, DAG-CBOR, CID, commit, and CAR output against official fixtures.
4. Store exact canonical DAG-CBOR record blocks and validate blob references. Schema-independent data-model validation, native CID-link/byte encoding, exact official-fixture bytes/CIDs, a one-megabyte encoded-record bound, typed reference ownership/metadata validation, and atomically maintained public/Space reference indexes are complete. Per-Lexicon validation remains. Blob publication is durably staged and orphan collection is bounded, configurable, and crash-resumable. Repository-block collection is also bounded and retains both the current ATrium graph and the durable sync replay window.
5. Add signed repository-v3 commit construction and verification around the ATrium repository mechanism and explicit CPDS identity trust policy.
6. Persist block store, repository head, operation log, and event outbox in one transaction.
7. Implement putRecord, applyWrites, and swap constraints; move existing create/delete through the same transaction.
8. Add restart, race, rollback, clock-skew, malformed-import, resource-bound, and corruption tests for the full repository mutation path. Startup now uses ATrium's MST enumerator to verify signed heads, every reachable record block, and exact SQL index parity before binding; remote-import and broader fault coverage remain.

Phase C — expose verifiable sync and relay integration #

1. Implement and test repository status/latest-commit/block/record endpoints.
2. Implement and verify full/incremental CAR repository exports. Complete for locally generated versioned repository history; legacy rows without block membership fail closed.
3. Build durable outbox sequence allocation, retention, and restart behavior. Allocation and replay survive restart; bounded retention and canonical stale cursor recovery are complete.
4. Implement CBOR event frames and WebSocket subscribeRepos with backfill. Generated #commit/#sync models, real-WebSocket backfill, live delivery, future-cursor errors, and restart recovery are complete.
5. Add identity/account/sync/info events and slow-consumer behavior. Initial identity/account, commit, sync, and outdated-cursor info events are complete, and a real stalled consumer proves bounded disconnect and replay. User activation/deactivation and offline host enforcement now emit retained account-state events; later identity changes remain.
6. Add the fake-relay federation harness, gap detection, and CAR repair test. The explicit generated-payload relay crawl operation and its fake HTTP relay contract are complete. A relay-style real-WebSocket test now forces an expired cursor, repairs through getRepo, validates the signed MST with ATrium, resumes live, and validates the next inductive event. The combined fake relay now receives the crawl, validates the served DID/handle/key, and carries that identity into the repair and resumed live commit.

Phase D — complete network identity and OAuth #

1. Introduce deterministic DID/handle resolver ports backed by atrium-identity and CPDS-owned safe transport/cache adapters. The shared resolver, bounded production transport, generated resolveHandle, injected orchestration-policy contract, and pure negative tests are complete. Fake DNS/HTTPS/PLC wire services must still exercise the production adapters.
2. Enforce bidirectional identity and account-state gates. Production startup identity verification plus durable user activation/deactivation, offline host transitions, periodic invalid-handle/recovery events, and read/write/event account-state gates are complete.
3. Add hardened dynamic client metadata resolution.
4. Add PAR storage/endpoints and one-time request URI handling.
5. Add OAuth DPoP nonce, proof, replay, and token binding.
6. Add rotating refresh tokens, session revocation, cleanup, and CORS/security headers.
7. Drive a profile-complete local client flow with atrium-oauth while retaining focused server-side negative tests.

Phase E — recovery, operations, and release proof #

1. Add backup/restore verification and account export/import tests. Startup verification of each signed ATrium graph, reachable record block, and SQL record index is complete. It also verifies every stored blob byte and rebuilds the retained event chain through ATrium's generated models and CAR writer, including sequence, inductive-link, block-membership, and latest-head checks. cpds verify runs that complete proof against existing restored storage, checks configured account identity, and exits without maintenance or a listener. cpds backup holds writes across SQLite's native snapshot and verified blob copy; a process test restores that output to different paths and runs the verifier. A populated-state test additionally restores and reads a signed repository, referenced blob/index, retained event, and CAR export. Production backup scheduling, separately protected secrets, and account export/import remain.
2. Add metrics, redaction tests, correlation, and operator diagnostics.
3. Add the deployment artifact and install/upgrade/rollback runbook.
4. Add dependency policy, CI, federation interop, fault, concurrency, and soak gates.
5. Rehearse a clean network deployment: identity and handle validation, OAuth client login, relay crawl, live event ingestion, disconnect/resume, full repair, backup, restore, upgrade, rollback, and key/session revocation.

Release gates #

cpds may describe itself as federation-capable only when Phases A through D pass locally and the fake relay verifies the entire repository/event chain. It may describe itself as production-grade only when Phase E also passes and the following evidence is recorded for the release candidate:

• all checked items in this document have a test or named operational proof;
• formatting, Clippy, unit, component, router, process, federation, interop, fault, concurrency, and restore suites pass from a clean checkout;
• no endpoint or metadata document advertises an unimplemented capability;
• a clean deployment and upgrade preserve a valid repository and stream cursor;
• a backup restores to a different directory and re-verifies every CID, MST root, commit signature, blob, account state, and pending event;
• an independent local consumer can discover the account and reconstruct its complete current public record set from only the documented network surface.