The protocol spec

Record types

All records live in AT Protocol repositories. Cross-record references use com.atproto.repo.strongRef — a {$type, uri, cid} pointer that content-addresses the target.

All NSIDs carry the com.publicdomainrelay.temp.* prefix (pre-release namespace).

cpus: 2
mem: 4G
disk: 40G
network: 500G
role: my-cool-role
user_data: |
  #cloud-config
  runcmd:
    - [sh, -c, "echo hi"]
location: {country: USA, region: west}

payload:
  uri: at://did:plc:alice/compute.vm/3mm3d
  cid: bafyrei...vm
policy?: {uri: ..., cid: ...}
submitBid?: did:plc:alice#pdr_temp_market
signatures: [...]

cost: 0.10
currency: USDC
frequency: hourly
prepay: true
url: https://compute-contract.bob.example/receipt

cost: 0
reason: "provided at no cost"
signatures: [...]

rfp: {uri: ..., cid: ...}
payload: {uri: ..., cid: ...}
config?: {uri: ..., cid: ...}
submitAccept?: did:plc:bob#pdr_temp_market
signatures: [...]

rfp: {uri: ..., cid: ...}
bid: {uri: ..., cid: ...}
payload?: {uri: ..., cid: ...}
submitEvent?: did:plc:alice#pdr_temp_compute_event
signatures: [...]

rfp: {uri: ..., cid: ...}
bid: {uri: ..., cid: ...}
accept: {uri: ..., cid: ...}
payload?: {uri: ..., cid: ...}
submitEvent?: did:plc:bob#pdr_temp_compute_event
cid: bafyrei...binding
signatures: [...]

Record graph

Every envelope points backward by strong reference — follow the arrows from a receipt and you can rebuild the whole contract.

State machine

A contract moves through one path to Settled, or exits early to Rejected if scoring finds no bid it will accept.

Authority & validation

Rules a provider checks before it will settle a contract.

• Accept.rfp and Bid.rfp strongRefs must be identical (uri AND cid). Enforced atomically by refsEqual. Error: ContractGraphError 'Accept.rfp does not match Bid.rfp' (HTTP 400).
• The bid must carry a valid inline network.attested.signature by the bidder. Error: ContractGraphError 'Bid is missing a valid badge.blue signature'.
• The RFP must carry a valid inline network.attested.signature by the requester. Error: ContractGraphError 'RFP is missing a valid badge.blue signature'.
• The service-auth token issuer must be the record author (per submit handler). Error: 'service-auth token issuer must author the referenced record' (HTTP 403). For vm.delete: issuer must match market.accept author. Error: 'only the market.accept issuer may delete' (HTTP 403).
• Receipt's proof CID must bind to the referenced accept record (verified by verifyRemoteProof).

Settlement

Two modes, both producing a signed market.receipt with the full contract chain and a proof CID binding accept → receipt.

VM lifecycle events

market.event records submitted via submitEvent, each referencing the receipt it pertains to. The accept-author check only applies to vm.delete events. Other events (vm.started, vm.onNetwork) are accepted from any authorized issuer.

On vm.delete, the provider checks the receipt is active and the issuer DID matches the accept author, calls computeProvider.destroy(), and fires onContractChange({ type: "terminated" }). Events are handled asynchronously — the provider responds 200 immediately.

Compute types

The RFP's compute.vm record is the one worked through above, but the same market, bid and receipt records carry other compute shapes too — a bidder can offer a Deno Worker instead of a VM. See the gateway page for both.

More on the protocol