The spec pins the identity surface precisely and none of it is checked yet:
- DID document shape:
#atprotoMultikey verification method,#atproto_pdsservice entry with strict URL shape (scheme + host + optional port only),alsoKnownAswithat://<handle> - Handle semantics: syntax rules, disallowed TLDs, bidirectional confirmation,
handle.invalidsentinel behavior - Legacy key encodings must be tolerated: the reference PDS's own DID docs still use uncompressed
EcdsaSecp256k1VerificationKey2019, whichparseMultikeyrejects; the harness already carries a legacy decode path (seedocs/interop-traps.md)
Mostly readonly checks; needs an account DID to inspect, which the discovery pass or a provisioned account provides.
Done when: DID-document and handle checks exist and pass against the oracle.