Hi all, new here. I write about and build at the intersection of local-first software and shared infrastructure. On the local-first side, I’ve been working with Automerge and Keyhive. An earlier prototype published from a Keyhive-protected Automerge document to Bluesky, keeping a record of each crossing, and was featured in This Month in Automerge for August 2026 (This Month in Automerge: August '26). I’m now building a local-first social native app that keeps private data in Automerge and Keyhive and uses AT Protocol for identity and for anything that goes public.
Governed Crossing is the AT Protocol half of that work: a small set of lexicons for recording when a person’s data crosses from their own system into shared infrastructure. Before I formalize it further, I’d like some lexicon-design-savvy folks to review it. This post asks for any feedback on one draft for recording access changes, open until Monday 26 October 2026.
A governed crossing record is evidence that data crossed from a person’s own system into shared infrastructure: what was authorized to cross, by whom, when, under what exposure claim, and where it landed. The canonical record stays on the person’s own system. When the crossing is public, the full record may be published over AT Protocol; when it is private, at most a small commitment is. The first binding is a set of lexicons in the org.governedcrossing.temp.* namespace, with conformance rules alongside.
The use this draft covers: a change in who can see or act on data where the data itself does not move. A permissioned space made public, a member added to a private group, a grant issued or revoked. The live conformance rules say these are not yet covered. The draft proposes how to record them: a record of the gate check that authorized the change, a record of the change as observed in effect, a four-property description of the access regime before and after, and rules for what may be published.
It is a draft for feedback, not the specification. It’s only had internal reviews, and four points have had no review at all. Those are the first four questions:
- Is the emitter’s own agent grant, taken alone, the right test of who counts as its agent?
- Should one value,
access-change-observed, carry two meanings, or should a gated change that diverged get its own value? - Should a gated change that produced something other than what the gate authorized be allowed a public commitment?
- Is the last sentence of the live
CONFORMANCE.mdline 66 accurate and clear? - (Optional) Does a grantee giving a whole group access to a document read as an access change, and to what?
Draft: governedcrossing/drafts/access-change.md at main · jediwright/governedcrossing · GitHub
Replies are welcome right here, or in the GitHub Discussion (Feedback: recording access changes (draft) · jediwright/governedcrossing · Discussion #1 · GitHub) if you’d rather comment next to the draft. I’ll read both and keep them together.
Please answer any subset by question number. One line is plenty, and “this is fine as written” is useful. Nothing is decided during the window, and I’ll weigh responses after it closes on Monday, 26 October 2026, end of day US Eastern. If you need more time, say so here or in the Discussion, and I can extend the window.
If I can make the Lexicon Community call on Thursday, 1 October, 1 PM ET, I can speak to anything further.