[svc-agent]

Implements TECH-789. Every hypercerts-lexicon record certified.app writes (app.certified.*, org.hypercerts.*, org.hyperboards.*) carries an app.certified.signature.defs#createdVia signature, following the ATProtocol Attestation Spec. app.bsky.* and org.impactindexer.* stay unsigned.

What changed

• Signing points:

  • the xrpc proxy, for own-repo create and put;
  • groupServiceFetch, for every group service create and put, bound to the group DID;
  • the first-sign-in profile seed.

  Signing fails open and never blocks a write.

• Group activity route: it called the group service with a raw fetch. It now goes through groupServiceFetch, so group activities are signed too.

• /.well-known/did.json: serves the per-host did:web document. It returns 200 when a key is set, 404 when signing is off, and 500 when the key is malformed.

• Same-session reads: getRecord and listRecords return lexToJson output, so $bytes survives the edit round trip. Legacy blobs keep their shape.

• Docs: env vars, AGENTS.md §16a and the public keys for both environments.

• Tests:

  • a contract test that pins the signing points;
  • scripts/verify-created-via.mjs, which verifies a stored record the way a third party would.

Keys

Environment	DID	Public key
staging	did:web:staging.certified.app	did:key:zQ3shkw7ytTFdJmn3epcWaqTXED3tZFu8SbsCwZBfGAWFA868
production	did:web:certified.app	did:key:zQ3shirLmopLSHcwUNnfBaoPMNCrtLWxLZtup2UpiX7oEV56P

The production CREATED_VIA_SIGNING_KEY and CREATED_VIA_DID are set in Vercel, scoped to Production only.

Verified on staging

staging.certified.app/.well-known/did.json returns 200 without authentication and serves the recorded key. scripts/verify-created-via.mjs passes for each record below: the CID matches the PDS and the signature verifies for the right repository.

• personal activity: created, then edited
• group activity: created, then edited, signed for the group DID
• app.certified.actor.profile: saved in the app

After merge

• curl https://certified.app/.well-known/did.json should return 200 with zQ3shirLm….
• Verify one new activity on certified.app.

Follow-up issue: server-side verification and a "Created via certified.app" badge.

🤖 Generated with Claude Code

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking compatibility fix needed in the verification script.

Findings

1.  Full service references fail ▶

Fix with agent prompt

### Issue 1
scripts/verify-created-via.mjs:82
`verify-created-via.mjs` only finds a PDS service whose `id` is exactly `#atproto_pds`. A valid DID document can use the full reference, such as `did:plc:abc#atproto_pds`. Those records fail with “no #atproto_pds service” before verification starts. Accept both forms, as `resolvePdsUrl` already does.

```suggestion
  const pds = repoDoc.service?.find(
    (s) => s.id === "#atproto_pds" || s.id === `${repo}#atproto_pds`,
  )?.serviceEndpoint
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds #createdVia signatures to personal writes, group writes, and the first-sign-in Certified profile seed.

• Supported Certified records now carry a signature for their repository.
• Group record writes now carry a signature for the group DID.
• The public DID endpoint now publishes the signing key.
• Same-session record reads now keep bytes usable in edits.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Personal create or put] --> D[signCreatedVia]
  B[Group create or put] --> C[groupServiceFetch]
  C --> D
  E[First-sign-in profile seed] --> D
  D --> F{Signing succeeds?}
  F -->|Yes| G[Write with fresh createdVia]
  F -->|No| H[Write without createdVia]
  I[did.json] --> J[Publish public signing key]

Loading

_{Reviews (1) · Last reviewed commit: "Merge main into staging (#259, groups sp..." · Reviewed by Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
certified-app	Ready	Preview	Oct 29, 2026 8:27am UTC
certified-app (staging)	Ready	Preview	Oct 29, 2026 8:27am UTC

[coderabbitai]

Caution

Review failed

The pull request is closed.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	server-only@​0.0.1
	@​atproto/​lex-cbor@​0.1.7
	@​atproto/​lex-json@​0.1.7
	@​atproto/​lex-data@​0.1.8
	@​atproto/​crypto@​0.5.7

View full report

[greptile-apps]

Full service references fail

verify-created-via.mjs only finds a PDS service whose id is exactly #atproto_pds. A valid DID document can use the full reference, such as did:plc:abc#atproto_pds. Those records fail with “no #atproto_pds service” before verification starts. Accept both forms, as resolvePdsUrl already does.

Suggested change

	const pds = repoDoc.service?.find((s) => s.id === "#atproto_pds")?.serviceEndpoint
	const pds = repoDoc.service?.find(
	(s) => s.id === "#atproto_pds" || s.id === `${repo}#atproto_pds`,
	)?.serviceEndpoint

Prompt To Fix With AI

This is a comment left during a code review.
Path: scripts/verify-created-via.mjs
Line: 82

Comment:
**Full service references fail**

`verify-created-via.mjs` only finds a PDS service whose `id` is exactly `#atproto_pds`. A valid DID document can use the full reference, such as `did:plc:abc#atproto_pds`. Those records fail with “no #atproto_pds service” before verification starts. Accept both forms, as `resolvePdsUrl` already does.

```suggestion
  const pds = repoDoc.service?.find(
    (s) => s.id === "#atproto_pds" || s.id === `${repo}#atproto_pds`,
  )?.serviceEndpoint
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.