Kryphocron

About

Privacy-first ATProto substrate primitives. Threat-model invariants enforced structurally, not as policy.

Kryphocron is a Rust crate of building blocks for private content on the AT Protocol: public and private tiers checked by the type system, capability proofs that can't be forged, an audit trail of what actually happened, service-to-service auth, and encoding for private records at rest. The aim is to make the wrong path the hard one. Misuse fails at compile time where possible, at runtime otherwise, and never silently.

Design

Tier is structural Public and private are types, not runtime checks. Public-facing code can't accept a private-tier value.
Unforgeable capabilities Proofs are sealed. Safe code outside the crate can't construct one.
Audit reflects action Events fire when a capability is actually used, not when it's issued.
Closed namespace Only tools.kryphocron.* NSIDs are known. An unknown NSID is an error, never a default to public.

On encoding at rest: private records are encoded by default with laquna, a friction encoding. It is not encryption and doesn't provide confidentiality. Operators who need that can install an authenticated-encryption codec through ContentCodec.

Crates

kryphocron library

The substrate itself: tiers, capabilities, auth context, audit pipeline, inter-service auth, and at-rest codecs.

kryphocron = "0.4"

github crates.io docs.rs MPL-2.0

kryphocron-lexicons lexicons

Lexicon JSON for tools.kryphocron.*, generated Rust types, and the compiled-in tier registry. Usable on its own by any service that reads these records.

kryphocron-lexicons = "0.3"

github crates.io docs.rs MPL · CC0

Lexicons

tools.kryphocron.feed.postPublic public Public post, field-compatible with app.bsky.feed.post
tools.kryphocron.feed.postPrivate private Post visible only to an audience list
tools.kryphocron.feed.like public Like, field-compatible with app.bsky.feed.like
tools.kryphocron.feed.repost public Repost, field-compatible with app.bsky.feed.repost
tools.kryphocron.feed.threadgate public Who can interact with a thread
tools.kryphocron.graph.block private Block, kept private
tools.kryphocron.graph.mute private One-directional mute
tools.kryphocron.policy.audience private An audience list, used to gate private posts

Plus procedure lexicons for writing private-tier records, such as feed.createPostPrivate and policy.manageAudience.