Bring spaces up to date with the 2026-09-10 alpha release #653

This brings the 0016 permissioned data implementation in line with the spaces alpha update, following bluesky-social/proposals#105 and #107, and bluesky-social/atproto#5469, #5496 and 907f41a7b.

Changes #

• Read/write split:
  • Spaces get separate readPolicy and writePolicy.
  • putMember gives each member separate read and write access. addMember remains as a deprecated alias.
  • Minting a credential checks read access, and notifyWrite checks write access.
  • Writing into your own repository is no longer gated on membership.
  • The client and the account portal support all of the above.
• Stricter CAR reads: a repository CAR may only hold dag-cbor roots and blocks. The space repository CAR verifier also checks record paths, index CIDs and record blocks.
• Identity:
  • #atproto_space_host is published with the AtprotoSpaceHost type.
  • atproto-pds-admin account backfill-space-host moves existing accounts onto it.
  • An invalid #atproto_space or #atproto_space_host entry is now an error instead of falling back to #atproto or #atproto_pds.
• Checks and parity:
  • A space type name no longer has an upper length limit.
  • RecordUri validates the record key.
  • sync.getBlob and space.getBlob answer BlobNotFound with 400.
  • DPoP htu is compared without its query or fragment, per RFC 9449.
  • New tests cover declaration updates reaching existing sessions and the space DPoP rules.
• Fix: writing through RepoWriter::new no longer deletes blob bytes that are still in use. The pds binary was not affected.

Operator note #

After deploying, run atproto-pds-admin account backfill-space-host --dry-run, then run it again without --dry-run. See the PDS README.