DID syntax, DID documents and handle validation now come from `atproto-identity`. They were taken from didbot, which is not the protocol — it is one server that implements it, and an indexer compiled against a producer can only ever read that producer. What stays local is what no specification covers: an agent DID is a did:web one label under its server's zone, and containment is checked label by label. The service DID is now asked for rather than rebuilt from a minting rule this index only believed didbot followed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Change-Id: I4cdccda0e3f64a98099fde6b83feb788225c76d3