ATProto: Engine of Software 2.0

In 2022 I started a survey of the software landscape, trying to figure out what I needed to be working on.

My search revealed three key (albeit somewhat obvious) areas:

Security

AI/ML

Web3 (aka Decentralized Identifiers and the space around them)

The intersection of these therefore being the highest value target for potentially having impact.

As with many things, what links these three areas is graphs (ba dum tss). Dependency graphs, knowledge graphs, social/identity graphs. Together, they seemed naturally a perfect fit.

But what makes Web3 so special and why not use other graphs? Decentralized Identifiers (DIDs). The power of this trinity is unlocked via distinct graphs and grafting. Grafting meaning cordoning off subgraphs so as to create isolated views. DIDs, being decentralized, allow us to easily spin up new distinct roots of trust, distinct isolated views of the world.

Isolated OpenSSF S2C2F aligned secure software factories.

Isolated knowledge graphs.

Isolated identity, auth, and permissions graphs.

Software development is in many ways a repeated exercise in identifying and isolating an issue or problem space, working within that to come to a solution, then integrating into the larger picture.

Enter the Graphtrix

One of the biggest problems we run into in real world environments is access. Sometimes you have it, sometimes you don’t.

Everybody has a testing environment. Some people are lucky enough enough to have a totally separate environment to run production in.

- Michael Stahnke

Fine tuning deployment context / execution environment (dev, CI, cloud agents, etc.) is an exercise in grafting. We're pulling off parts of what we know works, and putting them into a place where we don't know if they work yet. Or we're pulling parts that don't work and replicating them in an environment where our goal is to make them work.

When we focus on reducing iteration time for drive-by PRs via CI/CD, devcontainers, AGENTS.md, or etc. we are trying to foster an environment where onboarding overhead is minimal. This is important in open-source and inner-source environments.

What we're really looking for here is the ability to create faithful mirror dimensions. Spaces that accurately depict the system context. Spaces which ideally deviate minimally from each other so that we can effectively develop, test, debug, and deploy - while being able to modify the environment transparently when we need additional hooks or to simulate changes within external systems outside of our control within the non-mirror dimension (prod).

ATProto's architecture, when fully operationalized within the software development space, will provide a clean backbone from which to mint fresh mirror dimensions for arbitrary system contexts.

Take for instance the demo shown within the socialweb.computer market flow (a simplified version is shown in the mermaid diagram below). We have 3 Actors, 9 Services, and auth touch points between each of them.

Actors

Alice (the Requester)

Bob (the VM Builder)

John (inference RAM)

Services

Network Relay - iroh.computer (soon, currently custom)

PLC Directory

ATProto Relay (listReposByCollection)

ATProto PDS - Alice

ATProto PDS - Bob

XRPC Service: Requester - Alice

XRPC Service: Bidder - Bob

XRPC Service, REST API - CoCore

REST API: Secret Service - Alice

This entire stack is trivially replicated into a mirror dimension by swapping out the global plc.directory for an alternate instance.

The socialweb.computer stack itself also happens to be a useful primitive which enables creation of mirror dimensions in that it can be used to spin compute, etc. resources to facilitate creation of arbitrary network topologies.

In an agent native world Decentralized Identity and ATProto are ideal because we can quickly mint new identities and configure access for agents created within arbitrary contexts, enabling easy network level isolation.

Living Threat Models

In security we talk a lot about Threat Modeling. What's most important when threat modeling is understanding context. Context determines what threats are present and what mitigations are needed or relevant.

AT URIs and backlinking are powerful tools to enable traceability across applications. We have record formats for RFC documents, Pull Requests, Issues, Infrastructure, etc. These can be seen as they come across relay or PDS event streams so that the current state of a project can be accurately tracked in real time. Here are some examples of different records that are fundamental to software development and deployment:

RFC

Requested

Repo

at://johnandersen777.bsky.social/sh.tangled.repo/test-repo-0001

Issue

Can't see date of commit #585

Pull Request

appview/commit: show full commit datetime #1615

Here's what its record JSON looks like, it has an at:// URI pointing to the above issue which it fixes:

at://smitp.cc/sh.tangled.repo.pull/3mmu6rewmbf22

Virtual Machine

at://aliceoa.bsky.social/com.publicdomainrelay.temp.compute.vm/3mswc2j2nsk2t

Tracking all aspects of a software project through it's lifecycle enables us to synthesize and accurate threat model depicting the real state of the code, the gaps, and the deployment context.

The Holy Grail

The eventing primitives provided by ATProto give us full visibility into the software development lifecycle.

The Decentralized Identity foundation it stands on allows us to easily create mirror dimensions for dev, CI, agent, etc. environments and configure/modify actor and service access easily per context.

An ATProto backed software development lifecycle therefore makes it easy for us to understand the current state of our software system's context and in real time evaluate the health of it's security development lifecycle.

We continuously index and monitor:

Upstream: N state

Actively running system context

Overlay: N+1 state

Mirror dimension we okay'd for promotion

Orchestrator: What's executing the system

Infrastructure, trust relationships, etc.

Inversely, we can begin to attach via backlinks and other methods metrics which define success of the system. Allowing for humans and agents alike to measure the alignment of a project to it's purpose / intent. Providing an ideal backbone to close the loop for Software 2.0 and usher in self healing code bases. Code bases which are the active fulfillment of continuous alignment to their purpose.