[READ-ONLY] Mirror of https://github.com/flo-bit/contrail. atproto backend in a bottle
flo-bit.dev/contrail/
fix docs more
+3
-3
+3
-3
docs/06-communities.md
+3
-3
docs/06-communities.md
···
8
8
9
9
## Two modes
10
10
11
-
- **Minted** — contrail creates a fresh `did:plc` for the community, holds the signing + rotation keys, publishes from it.
12
-
- **Adopted** — contrail takes over an existing DID whose rotation keys were handed over by the owner.
11
+
- **Minted** — contrail creates a fresh `did:plc` for the community, holds the signing key plus one rotation key (a second rotation key is returned to the creator once for recovery), and publishes from it.
12
+
- **Adopted** — contrail takes over an existing account by holding an **app password** issued from its PDS. The owner's identity, signing key, and rotation keys are unchanged; contrail just gets PDS write access via the app password.
13
13
14
14
Either way, the result is the same: a DID that multiple members can act through, gated by access levels.
15
15
···
49
49
50
50
- No per-record per-level ACLs. Model as spaces.
51
51
- No auto-rotation on key compromise yet.
52
-
- Adoption is irreversible without manual key surrender back to the owner.
52
+
- Adoption can be revoked unilaterally by the owner — they revoke the app password on their PDS and contrail loses write access. (Mint mode is the irreversible one: the creator's recovery rotation key, returned once at mint time, is the only path back if contrail's signing/rotation key is compromised.)
53
53
54
54
The design follows zicklag's [Arbiter design sketch](https://zicklag.leaflet.pub/3mjrvb5pul224) for group management on atproto. The post is an early design note; our implementation will track it as the spec firms up.