| … | … | @@ -67,6 +67,21 @@ STRIP_VERSION -> string // consensus-critical (§10.3) |
| 67 | 67 | No dependencies beyond a CommonMark parser. Must run under Bare and Node alike (the daemon is |
| 68 | 68 | Bare; the tests are Node), so no Node-only builtins. |
| 69 | 69 | |
| 70 | ### 3.1 A record names its author by USER, never by DID |
| 71 | |
| 72 | Decided in `favela-identity/spec/identity.md` §5 (2026-09-02): favela's account root becomes a |
| 73 | `User` in its own IdentityRegistry autobase, and a DID becomes one credential attached to it. |
| 74 | |
| 75 | **Consequence for this package:** the canonical record carries a user reference, and the DID is |
| 76 | resolved at **projection time** — `at://<did>/<collection>/<rkey>` is atproto addressing and |
| 77 | nothing else. A DID in the record bytes would make rotating one a rewrite of every record, which |
| 78 | `record-vocabulary.md` §8 forbids outright. |
| 79 | |
| 80 | `project(record, 'bsky')` therefore needs the author's **designated atproto credential**. With none |
| 81 | it emits no projection and reports it in `loss[]` — fail-closed, exactly as §6 handles a non-public |
| 82 | `visibility`. With several and no designation it refuses: picking one silently would publish under |
| 83 | an identity the author did not choose. |
| 84 | |
| 70 | 85 | --- |
| 71 | 86 | |
| 72 | 87 | ## 4. Projection returns a loss report |