# October 1 Spaces contract

Lore 0.2.0 requires the October 1, 2026 Spaces alpha contract on both the
space authority and each writer's PDS. existing keys and entries are unchanged.

The Pi extension and website share the small HTTP-signature header encoder
in `space-signature.ts`. `@atproto/crypto` owns P-256 keys, DID encoding, and
signing. OAuth DPoP remains in the OAuth SDKs.

The published alpha Spaces SDK could not resolve its nested lex-data dependency
in this npm workspace: the alpha range selected a package containing
`workspace:*` dependencies. The local encoder was checked against the official
SDK's `verifySpaceSignature` from `0.0.0-spaces-alpha-20261001173819`, for
issuance, credential reads, and rejection of a changed audience. Reconsider
the SDK dependency when its published dependency graph installs normally.

## verification

On 2026-10-01, the live suite passed with bufo.uk on ZDS and
nate.spaces-alpha.bsky.network on the reference alpha PDS:

- real Pi sessions: join, remember, reread, unchanged prompt prefix;
- both authority directions: create, share, cross-host writes, automatic
  writer notification, read, unshare, and rejection of a fresh credential;
- 101 writer records plus one authority record, read by the website client;
- account-separated credential caches and reuse;
- explicit ZDS credential revocation, followed by one successful remint in
  both the extension and website client.

The live website-client test uses app-password sessions for authenticated
account requests; it exercises the production credential and read code over
real HTTP, but does not substitute for browser OAuth/CORS verification.
Throwaway spaces, entries, and registry bindings are cleaned up by the suite.

Run `source live/env.sh && npm run test:live` after installing both root and
site dependencies. Credentials come from the encrypted store and are never
logged. `npm run check` also checks signature integrity and account-independent
extension behavior; `npm run build --prefix site` checks browser packaging.