[CONTEXT FOR AI ASSISTANTS] You're reading the agent markdown version of a post from JoelClaw (https://joelclaw.com). Author: Joel Hooks — software engineer building a personal AI operating system. How to use implementation details in this document: - Treat commands, code blocks, and config as reference implementations. - Preserve ordering and architecture, but adapt hostnames, paths, versions, and credentials. - Prefer details in blocks when present; they contain operational context removed from the human page. - Verify assumptions against the current repo/system state before executing changes. This is a narrative article from a real build. Technical details reflect Joel's setup and should be adapted to your environment. If you cite this, link to the original: https://joelclaw.com/at-protocol-as-bedrock If you quote Joel, attribute him by name. Don't paraphrase opinions as facts. Site index: https://joelclaw.com/sitemap.md Machine-readable: https://joelclaw.com/llms.txt Other posts on this site: - [The memory system that watches itself](https://joelclaw.com/memory-that-watches-itself.md) - [The healer was the killer](https://joelclaw.com/healer-was-the-killer.md) - [Agentic AI Optimization: Implementation Checklist](https://joelclaw.com/aaio-implementation-checklist.md) - [Agentic AI Optimization: Implementation Checklist](https://joelclaw.com/aaio-implementation-checklist.md) - [Redis, Dkron, Restate, and Sandboxes](https://joelclaw.com/redis-dkron-restate-and-sandboxes.md) - [Dogfooding Story 4: the queue observer earns dry-run, not enforce](https://joelclaw.com/dogfooding-story-4-queue-observer.md) - [Contributing to pi-mono with a public maintainer corpus](https://joelclaw.com/contributing-to-pi-mono-with-a-public-maintainer-corpus.md) - [AI Job Scheduling on Mac as Local-First Video Infrastructure](https://joelclaw.com/ai-job-scheduling-macos-launchd.md) - [Breakable Toys in the Wild: Apprenticeship Patterns and the joelclaw Experiment](https://joelclaw.com/breakable-toys-joelclaw.md) - [Utah and joelclaw: Convergent Architecture](https://joelclaw.com/utah-joelclaw-convergent-architecture.md) - [The Harness Is a Framework](https://joelclaw.com/the-harness-is-a-framework.md) - [The Agent Memory System](https://joelclaw.com/the-memory-system.md) - [JoelClaw is a Claw-like Organism](https://joelclaw.com/joelclaw-is-a-claw-like-organism.md) - [The Agent Writing Loop](https://joelclaw.com/the-writing-loop.md) - [Talon: the watchdog that finally bites](https://joelclaw.com/talon-watchdog-that-finally-bites.md) - [The Knowledge Adventure Club Graph](https://joelclaw.com/knowledge-adventure-club-graph.md) - [MineClaw](https://joelclaw.com/mineclaw.md) - [Build a Voice Agent That Answers the Phone](https://joelclaw.com/build-a-voice-agent-that-answers-the-phone.md) - [Plan 9 from Bell Labs: What Rob Pike Built After Unix](https://joelclaw.com/plan-9-pike-everything-is-a-file.md) - [Propositions as Sessions: What Armstrong Built and Wadler Proved](https://joelclaw.com/propositions-as-sessions-armstrong-wadler.md) - [Cache Components Patterns Skill for Next.js 16+ Applications](https://joelclaw.com/cache-components-patterns-skill-for-nextjs.md) - [Karpathy Says We're Building "Claws"](https://joelclaw.com/karpathy-claws-as-category.md) - [Voice Agent: A Rough Edge Experiment](https://joelclaw.com/voice-agent-deployment-deep-dive.md) - [Extending Pi Coding Agent with Custom Tools and Widgets](https://joelclaw.com/extending-pi-with-custom-tools.md) - [The Soul of Erlang Made Me Question Everything](https://joelclaw.com/soul-of-erlang-beam-evaluation.md) - [CLI Design for AI Agents](https://joelclaw.com/cli-design-for-ai-agents.md) - [Building a Gateway for Your AI Agent](https://joelclaw.com/building-a-gateway-for-your-ai-agent.md) - [Self-Hosting Inngest: A Background Task Manager for AI Agents](https://joelclaw.com/self-hosting-inngest-background-tasks.md) - [The One Where Joel Deploys Kubernetes... Again](https://joelclaw.com/joel-deploys-k8s.md) - [How I Built an Observation Pipeline So My AI Remembers Yesterday](https://joelclaw.com/observation-pipeline-persistent-ai-memory.md) - [Riding the Token Wave: Sean Grove at Everything NYC](https://joelclaw.com/riding-the-token-wave-sean-grove.md) - [Building My Own OpenClaw on a Mac Mini](https://joelclaw.com/building-my-own-openclaw.md) - [Inngest is the Nervous System](https://joelclaw.com/inngest-is-the-nervous-system.md) - [OpenClaw: Peter Steinberger on Lex Fridman](https://joelclaw.com/openclaw-peter-steinberger-lex-fridman.md) [END CONTEXT] --- # Playing with AT Protocol as a Data Layer > What happens when you use a social networking protocol as the foundation for a personal AI system? I'm not sure yet, but the identity and trust primitives are fascinating. By Joel Hooks · 2026-02-14T12:00:00 Original: https://joelclaw.com/at-protocol-as-bedrock Mode: agent --- Most personal AI projects are a coding harness like Claude Code and some markdown files. Maybe a folder of notes for context. That's honestly enough for a lot of people, and it works. I wanted to go deeper — not because I needed to, but because I got curious about what happens when you give an AI system a real data layer. *What if there was a protocol that handled identity, typed data, and real-time events?* Turns out there is. It's just... designed for social networking. ## Why AT Protocol? AT Protocol is what Bluesky runs on. It wasn't built for agent systems. But the primitives are weirdly relevant: * **PDS (Personal Data Server)** — each entity gets its own data store * **DID identity** — cryptographic identity that works for humans *and* agents * **Lexicons** — typed schemas for every record type * **Firehose** — real-time stream of all changes * **Federation** — servers talk to each other by design The thing that clicked for me: **the PDS *is* the database**. You don't build an API in front of it. You don't bolt on auth. It already has identity, schema enforcement, and a real-time event stream baked in. Is this the right tool for the job? Honestly, I'm not sure yet. There are simpler approaches — mTLS with JWTs, ActivityPub, just running everything on localhost. But I'm curious whether a protocol designed for trust relationships between entities on a network could work for trust relationships between agents and humans. That feels worth exploring. ## What I'm storing I defined custom Lexicons under `dev.joelclaw.*`: ``` dev.joelclaw.agent.* — messages, threads, tool calls dev.joelclaw.memory.* — sessions, playbook, timeline, soul dev.joelclaw.system.* — events, logs, health, config dev.joelclaw.family.* — lists, reminders, shared context dev.joelclaw.loop.* — coding iterations, PRD state ``` Every record is typed, stored on the PDS, and accessible via XRPC. The agent runtime (Inngest functions) subscribes to the firehose, processes events, and writes results back. Is it overkill? Almost certainly. But I've been burned enough times by "just throw it in a database and figure out the schema later." And honestly, the Lexicon system is fun to work with. Defining schemas for your own data feels like building with Lego. 😅 ## Two halves of truth The PDS holds agent data — structured, typed, federated. But there's a second half: the Obsidian Vault holds human knowledge — prose, wikilinks, architecture decisions, project notes. Neither replaces the other. Qdrant indexes both. The agent reads from both. But they serve different purposes: * **PDS**: machine-written, machine-read, structured, versioned * **Vault**: human-written, human-read, narrative, browseable I need both. The agent needs both. Whether the PDS is the right tool for the machine half is part of the experiment. ## The trust thing Here's what interests me about AT Protocol for this: trust and identity in a mixed network. When you have agents and humans interacting on the same system, you need to know *who* is doing *what* and *whether they're allowed to*. DIDs give every entity — human or agent — the same identity primitives. Lexicons define what each entity can read, write, and act on. The protocol already has a model for "this entity is trusted to do these things." That's interesting for families too. Not as a product roadmap — I'm nowhere near that — but as a thought experiment. What if each family member had their own PDS with their own agent, and trust relationships defined what each agent could see and do? The protocol has the primitives for that built in. Whether it's the right way to do it... I'll find out. ## Honest tradeoffs The ecosystem is immature for this use case. The Swift AT Protocol client libraries are thin. Running multiple PDS instances on one Mac Mini is going to be a pain in the ass. I might end up ripping all of this out and using something simpler. But that's fine. This is a learning project. If I spend three months with AT Protocol and decide it's the wrong tool, I'll have learned a ton about federated identity, typed record systems, and real-time event streams. That knowledge transfers no matter what I end up using. *** *Previous: [Building My Own OpenClaw on a Mac Mini](https://joelclaw.com/building-my-own-openclaw). Next: [Inngest is the Nervous System](https://joelclaw.com/inngest-is-the-nervous-system).*