Accounts and sign-in 0.15.0
- Signed repositories: every public page, a person's or an organization's, has a repository in AT Protocol's format, signed with its own key. Anyone can check one of its posts against that key, and a person can download their whole repository as one file. Only what Pages already shows anyone is in it; follows and reactions stay private. Off until the service secret is made (SIGNED_REPOSITORIES=on in deploy.sh).
- Friends: a device can say its app takes chained messages (device-register chain), and device lists say which do, so a sender seals the new kind only for devices that can open it.
- The open network, its first part (ADR-0061). POST /identity/native/repo/network {on} (the native credential; 10 an hour per account) puts a person's page on AT Protocol's network or takes it off. Joining sends the identity kept since phase 1 to the public did:plc directory, then an update when its handle, signing key or host changed; leaving stops serving it. Handles are <username>.alelyon.com: GET /identity/repo/atproto-did?host= (the front's /.well-known/atproto-did) and /identity/repo/tls-ask?domain= (asked before a handle's certificate). The network's reads, public and from any origin (600 a minute per source), for pages on the network only: /xrpc/com.atproto.server.describeServer, identity.resolveHandle, repo.describeRepo, getRecord and listRecords, sync.getRepo, getRecord, getLatestCommit, getRepoStatus and listRepos, /xrpc/_health and /.well-known/did.json. GET /identity/repo/identity now says published: true once the directory holds the identity. hosted_repo_network goes with account deletion (ADR-0047 rows).
- SLOs and dashboards: objectives on a developer's measured calls (availability, or latency within a threshold counted exactly) over 7, 30 or 90 days, with attainment, error budget left and burn rates; and saved dashboards of widgets (a metric over time, top routes or keys, an SLO, the monitors).
- Records the Privacy Notice of 2026-10-23.3 (dashboards and SLOs) with each sign-up.
- The status page's checks: the outside prober's signed reports (Ed25519, only its public key on the server) of the website, accounts, Sign in with Alelyon, the MCP server and free chat, kept as checks, daily uptime and incidents; a public `GET /identity/status/uptime` with each component's state, uptime over 24 hours to 90 days, 90 daily bars, incidents and notices.
- Endpoint checks: a developer's webhook endpoints checked with a signed ping every 5 minutes to every hour, their results kept 30 days, and monitors on failed checks and the success rate.
- The developer console's monitors can watch one webhook endpoint as well as all of them.
- Records the Privacy Notice of 2026-10-23.3 (endpoint checks) with each sign-up.
- console:read: a key may read the developer console's own data (calls, usage, metrics, events, monitors, SLOs, dashboards, webhooks, checks, the audit) at the console's routes with Authorization: Bearer; never a change, a secret or the keys, never from a web page.
- The console's audit: every change made in the console (webhooks, channels, monitors, SLOs, dashboards, checks) kept a year, never a secret.
- An organization's usage by service account (calls, refusals, failures, p95 over 1, 7 or 30 days) for its owners and admins; a service account's key may have console:read.
- Records the Privacy Notice of 2026-10-23.3 (the console's change record) with each sign-up.
- The developer console's boards, kept with the account: POST /identity/native/console-boards/list, save, remove and merge (each with client_id and refresh_token, checked without rotation). A board is a name (1-60 characters), the time it shows (one of the console's windows, the past 15 minutes to the past 90 days), what every tile on it is narrowed to, and its charts' names and settings: what each counts (the console's measures, Apdex at one of its targets, rate-limit use), what it is narrowed to (a kind of call, a key or app, a route, by name), how it is shown (a number, a line, bars by route or by how calls ended, as its measure allows), what it is set against (the time just before, or a week before) and when it warns; never a call or a figure. At most 20 boards an account, 24 charts and 16 KiB a board; merge adds a browser's own pinned charts once, at sign-in, to a board of their own. Reads 240 a minute, writes 600 an hour, per account. hosted_console_boards goes with account deletion (ADR-0047 rows).
- deploy after the website release that carries the Privacy Notice of 23 October 2026 (version 2026-10-23.2: this text follows the short links' 2026-10-23); this deploy makes the secret alelyon-identity-repo-key once (SIGNED_REPOSITORIES="on" in packaging/identity/deploy.sh) and records Privacy version 2026-10-23.2.
- deploy the identity service at the version's commit, with PRIVACY_VERSION 2026-10-23.3 (the one text that holds this stage's and the rest of the branch's with main's), after a data-disk snapshot and after the website release that carries that text.
- deploy the identity service at the version's commit, with PRIVACY_VERSION 2026-10-23.3 (the one text that holds this stage's and the rest of the branch's with main's) and PROBER_PUBLIC_KEY set to the prober's public key (`python tools/status_prober.py init`), after a data-disk snapshot and after the website release that carries that text. Then install the prober (`python tools/status_prober.py install`).
- deploy the identity service at the version's commit, with PRIVACY_VERSION 2026-10-23.3 (the one text that holds this stage's and the rest of the branch's with main's), after a data-disk snapshot and after the website release that carries that text.
- The store's own migration makes hosted_console_boards; no client calls these routes until the website release that carries the console's Boards. PRIVACY_VERSION is 2026-10-23.2 (the Boards paragraph, which the owner approved on 2026-10-23): a sign-up records the version it was shown, so deploy the service with 2026-10-23.2 only after the website release that carries that text; the routes themselves may deploy before it with the version then live.