# Prior art

What already exists, what it proves, and what is left for Corpora to add.

## stream.place: a working `did:web` lexicon authority

**Verified live, 2026-08-02.** This is the closest existing thing to what Corpora deploys, and
it validates the design.

```console
$ dig +short TXT _lexicon.stream.place
"did=did:web:stream.place"

$ curl -s https://stream.place/.well-known/did.json
```

```json
{
  "id": "did:web:stream.place",
  "alsoKnownAs": [],
  "verificationMethod": [{
    "id": "did:web:stream.place#atproto",
    "type": "Multikey",
    "controller": "did:web:stream.place",
    "publicKeyMultibase": "zQ3shRvJrnKp4SWvoxkFyZqijahHcmvJLdViKzkwQKj7cWxVm"
  }],
  "service": [
    { "id": "#bsky_fg", "type": "BskyFeedGenerator", "serviceEndpoint": "https://stream.place" },
    { "id": "#atproto_pds", "type": "AtprotoPersonalDataServer", "serviceEndpoint": "https://stream.place" }
  ]
}
```

It serves permission-set lexicons and returns partial proof CARs from `sync.getRecord` (2,199
bytes for `place.stream.authFull`).

What this settles:

- **`did:web` works for a lexicon authority in production.** Not theoretical.
- **A lexicon authority needs no handle.** `alsoKnownAs` is empty, which answers whether any
  resolver insists on bidirectional handle verification. Apparently not.
- **Partial proofs, not full repo CARs,** are what a real authority returns.
- **Content type on `did.json` may not be strictly enforced.** stream.place serves `text/plain;
  charset=utf-8` and evidently works, contradicting a reported strict check. Do not copy this;
  serve `application/json`.

**What Corpora adds: stream.place signs live and holds the key on the server.** It is a running
service. Corpora moves signing offline so the serving tier holds no key and has no state.

Eli Mallon's writing on the Streamplace minimal PDS names "Static PDS" as a missing pattern
explicitly, including signing locally without exposing signing keys to a hosting provider. That
is precisely the gap here.

## cirrus: a PDS on Cloudflare Workers

<https://github.com/ascorbic/cirrus>

A single-user AT Protocol PDS on Workers, using Durable Objects with SQLite for the repository
and R2 for blobs. Full write path, OAuth 2.1 provider, passkeys, firehose, account migration.
Self-described experimental beta, roughly 9,600 lines of Worker-runtime code.

Useful in three ways, none of them code reuse:

**It confirms the right library call.** It does not reimplement the MST; its `sync.getRecord`
proof path calls `getRecords` from `@atproto/repo`, the same function Corpora's build uses.

**It quantifies what a full PDS costs.** Roughly 56% of its Worker code is OAuth and auth, 16%
the write path, 8% read-path handlers, 6% blobs. About 90% is machinery Corpora does not need.
Its 766-line `SqliteRepoStorage` is entirely unnecessary, since `MemoryBlockstore` already
implements that interface.

**It is the strongest argument for the precompute design.** Running `@atproto/repo` inside
workerd required five separate workarounds: aliasing `pino` to its browser build, forcing CJS
module conditions for `multiformats`, reaching into `BlockMap` and `CidSet` private fields to
dodge broken iterators, a `Buffer` polyfill for `@atproto/crypto`, and a 137-line CBOR
compatibility bridge. Corpora inherits none of it, because the library runs only in the offline
build. That is a large, concrete risk reduction.

## satrepo

A Python prototype for offline repo signing. Small and early (two stars at time of research).
The only prior art found for signing an AT Protocol repository offline, which suggests the
pattern is genuinely unestablished rather than solved and overlooked.

## atcr.io's hold service

A minimal PDS in Go, embedded in a container registry, whose lineage traces to the Streamplace
minimal PDS. Relevant here mainly as a reference implementation of the read path and DID
document construction, and as the source of the lexicons Corpora's first deployment will serve.

Its `RepoOperator` interface already exposes `GetRecordProof` and `ReadRepo`, which are exactly
the two artifacts a publisher pre-generates. That made it a plausible base while a Go
implementation was under consideration; with the Node decision it is reference material rather
than a dependency.

## Where that leaves Corpora

Everything in the chain has been demonstrated: `did:web` lexicon authorities work, the TypeScript
libraries build and sign a repo correctly, and Workers can serve the result. Nothing here is
research.

The unbuilt part was the combination: an authority whose signing happens offline, whose serving
tier is stateless and keyless, and which is packaged as a tool other people can point at their
own lexicons rather than a deployment of somebody's namespace.

**Built and demonstrated 2026-08-03.** A throwaway authority signed offline and served from a
Cloudflare Worker holding no key, no state and no bindings resolved through `goat`,
`@atproto/lexicon-resolver`, a third-party browser tool, and a real OAuth flow on a live PDS whose
consent screen rendered the permission set's own title and permissions.

The result worth recording is a negative one: **nothing on the read path noticed.** No consumer
cared that there was no database, no origin, and no signing key anywhere near the request. The
"Static PDS" pattern Eli Mallon named as missing is, for the read-only lexicon case, just a
compiler and a lookup table.