Proposal: A Commerce Lexicon for AT Protocol #4862
Replies: 3 comments 9 replies
|
As far as I know, Open Market is similar to this. It is different that it has a higher affinity with the existing marketplace than your proposal, but it seems to have a concept that is close in that it focuses on discovery rather than payment. |
|
@auadix would be the maintainer of open market. It seems to be a good start, if they would be interested in joining in. Was looking at implementing some of this myself (in a bit, still trying to get another semi-related project working). I might base it off openmarket, but it's missing a few aspects I'd add in. Some notes:
|
|
Hey, glad @kayakyakr tagged me. I'm the maintainer of Open Market (openmkt.app) and I do agree that what I have is probably the closest thing to what you're describing that currently exists in production on AT Protocol. The core record type I use is app.openmkt.marketplace.listing, and it covers most of what you have in your listing schema: title, description, price, currency, condition, category, images, location, and createdAt. A few things I've arrived at differently through building the app that might be useful for the draft: The "External URL" vs. "Checkout URL" distinction. I noticed your draft leans toward a native checkout model, which is a great direction for a protocol-native economy. In building Open Market, I started with an externalUrl approach to act as a discovery bridge for existing Etsy and Shopify stores. The goal was to avoid payment processing at all costs while allowing sellers to index their current inventory without changing their workflow. I can see how a dedicated checkoutUrl would be the foundation for a more integrated transaction layer, but perhaps the lexicon could support both: a primary checkout endpoint and a fallback discovery link. Service and commission listings. Your schema is currently goods-oriented. I added fields like slotsAvailable and turnaroundTime to accommodate the large community of digital artists on the network. Right now, I have these in a loose metadata object, but I believe there is demand for a "service" extension that a goods-only schema doesn't naturally cover. The hideFromFriends privacy toggle. One thing I implemented to keep privacy in mind is a way for sellers to hide listings from their direct followers. This is almost a self-serving feature to create a bit of separation between our social profile and our marketplace activity, although this only works when we also hide it from logged-out users. Category taxonomy. I’ve already built out a taxonomy with ~25 top-level categories and subcategories. I’m happy to share that as a starting point if you want to standardize the category field. On the social trust piece: I currently use a "follows-of-bot" mechanism as a verified seller signal. It's a manual bootstrapping process for now, but it aligns with your idea of using social graph distance to provide accountability. The biggest thing I'm missing that you've thought about more carefully is reviews. I have no review record type yet. Your design, where the buyer publishes to their own PDS linked via AT URI, is architecturally spot on. I hesitated because the "verified purchase" problem felt like a blocker since I can't track it, but your point about DID-anchored reviews being valuable regardless of a "verified" badge is a great way to handle it. I'd be genuinely interested in collaborating toward a shared Lexicon. If we use the Open Market schema as a draft, we can all iterate on it together. Moving toward lexicon-community makes a lot of sense to me, and I would be open to moving Open Market to a standardized namespace. If you want to look at the full lexicon (github.com/openmkt-app/marketplace) or feel free to poke at the live implementation, let's talk! :) Best, |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Status: Early draft — looking for feedback, collaborators, and people who've already thought about this
Author: Niizuki
Date: April 2026
Why I'm posting this
I've been following AT Protocol's development with growing excitement, mostly from the identity and decentralization angle. At some point it occurred to me that the same properties that make AT Protocol compelling for social networking — portable identity, user-owned data, application-agnostic records — are equally compelling for commerce. Nobody seems to be working on this seriously yet, or if they are I haven't found it.
This is not a finished proposal. It's a structured thinking-out-loud that I hope will either surface existing work I've missed, attract people who want to build this together, or at least generate useful criticism of the approach. All three outcomes are good.
The problem worth solving
Online commerce today has a platform tax problem. Whether you sell on Amazon, Etsy, or through a Facebook shop, you are renting access to an audience that you have no genuine relationship with. The platform can change its algorithm, increase its fees, or simply remove you, and you lose everything — your reviews, your reputation, your customer relationships. The customer has the same problem in reverse: their purchase history, their trust signals, their preferences are locked inside walled gardens that don't interoperate.
This isn't just inconvenient. It has structural consequences. Amazon's dominance comes partly from logistics (genuinely hard to replicate) and partly from owning the recommendation and review layer (not hard to replicate — just currently locked up). Facebook Marketplace works as a discovery mechanism but provides essentially zero trust infrastructure, which is why it's full of scams. The people who lose most from this fragmentation are small independent sellers and buyers who don't have the scale to negotiate better terms.
The internet was supposed to make commerce more efficient by removing geographic constraints. Instead it replaced geographic monopolies with platform monopolies. AT Protocol suggests a different path.
What AT Protocol enables for commerce
Applied to the commerce problem specifically:
Portable seller identity. A shop's reputation, reviews, and catalog live in their PDS, not on any platform. A seller who built a reputation on one storefront app carries that reputation to any other app that reads the same Lexicon. No starting from zero on every marketplace.
Portable social trust. Your social graph already exists on AT Protocol. If someone you follow recommends a product, that signal is real — it comes from a person with a verifiable identity and a genuine social relationship with you, not from a gamed review system. This is a higher quality trust signal than anything Amazon or Google currently provides.
Application-layer competition. Multiple storefront apps can read the same underlying commerce records. A minimalist shop, a full-featured marketplace, a niche category-specific browser — they all operate on the same data. Sellers don't have to choose a platform; they publish once and reach any front end that supports the standard.
No mandatory platform tax. A platform can still offer value-added services — better UX, logistics integration, promoted placement — and charge for those. But the underlying relationship between buyer and seller doesn't require the platform's permission to exist.
What a commerce Lexicon would need to define
At minimum, three record types:
commerce.*.shop— seller profile recordA shop's identity record, stored in their PDS. Distinct from their social profile, though linked to it via DID.
{ "lexicon": 1, "id": "app.commerce.shop", "defs": { "main": { "type": "record", "key": "self", "record": { "type": "object", "required": ["name", "createdAt"], "properties": { "name": { "type": "string", "maxLength": 128 }, "description": { "type": "string", "maxLength": 2048 }, "logo": { "type": "blob", "accept": ["image/*"] }, "website": { "type": "string", "format": "uri" }, "location": { "type": "object", "properties": { "country": { "type": "string" }, "region": { "type": "string" }, "city": { "type": "string" } } }, "createdAt": { "type": "string", "format": "datetime" } } } } } }commerce.*.listing— product listing recordThe core commerce record. Intentionally keeps fulfillment details out of scope — the listing describes what is being sold, not how it will be delivered. A
checkoutUrlprovides the escape hatch to wherever the actual transaction happens.{ "lexicon": 1, "id": "app.commerce.listing", "defs": { "main": { "type": "record", "key": "tid", "record": { "type": "object", "required": ["title", "price", "availability", "createdAt"], "properties": { "title": { "type": "string", "maxLength": 256 }, "description": { "type": "string", "maxLength": 8192 }, "images": { "type": "array", "items": { "type": "blob", "accept": ["image/*"] }, "maxLength": 16 }, "price": { "type": "object", "required": ["amount", "currency"], "properties": { "amount": { "type": "integer", "description": "Amount in minor units (cents, haléře, etc.)" }, "currency": { "type": "string", "description": "ISO 4217 currency code" } } }, "availability": { "type": "string", "knownValues": ["in_stock", "out_of_stock", "pre_order", "discontinued"] }, "condition": { "type": "string", "knownValues": ["new", "used_like_new", "used_good", "used_fair", "refurbished"] }, "categories": { "type": "array", "items": { "type": "string" }, "maxLength": 8 }, "sku": { "type": "string", "maxLength": 128, "description": "Seller's internal product identifier" }, "checkoutUrl": { "type": "string", "format": "uri", "description": "Where to actually purchase this item" }, "createdAt": { "type": "string", "format": "datetime" }, "updatedAt": { "type": "string", "format": "datetime" } } } } } }commerce.*.review— review recordReviews are published by buyers into their own PDS — not stored by the seller. This is the key difference from Amazon's model. A review is a first-class social object with a verifiable author, linked to a specific listing or shop via AT URI.
{ "lexicon": 1, "id": "app.commerce.review", "defs": { "main": { "type": "record", "key": "tid", "record": { "type": "object", "required": ["subject", "rating", "createdAt"], "properties": { "subject": { "type": "string", "format": "at-uri", "description": "AT URI of the listing or shop being reviewed" }, "rating": { "type": "integer", "minimum": 1, "maximum": 5 }, "title": { "type": "string", "maxLength": 256 }, "body": { "type": "string", "maxLength": 4096 }, "verified": { "type": "boolean", "description": "Whether the reviewing DID is linked to a confirmed purchase — to be defined" }, "createdAt": { "type": "string", "format": "datetime" } } } } } }What this deliberately leaves out of scope
Some things belong at a layer above or below the Lexicon:
Transactions and payments. The protocol shouldn't try to own payment flows.
checkoutUrlis the bridge to whatever payment infrastructure the seller uses — their own shop, Stripe, an existing marketplace. Trying to standardize payments at the Lexicon level would create unnecessary complexity and legal exposure.Fulfillment and logistics. Same reasoning. Who ships the item, how, and when is an operational concern between buyer and seller. The Lexicon describes the product and establishes the relationship; the logistics layer is pluggable.
Dispute resolution. This requires legal jurisdiction and human judgment. It can't be protocolized cleanly. My suggestion is that trust here comes from identity accountability (your DID is persistent and your review history is public) combined with external mechanisms — regional consumer law, voluntary insurance, logistics provider guarantees.
Verified purchase linking. The
verifiedfield in the review record is a placeholder. How you cryptographically prove a purchase happened without leaking transaction data is an unsolved problem worth a separate discussion.Review integrity and the fake review problem
This deserves its own section because it's the obvious attack vector and "reviews live in the buyer's PDS" doesn't automatically solve it.
The core problem: nothing in the schema prevents a seller from creating sock puppet accounts, having them purchase products, and writing glowing verified reviews. This is the same problem Amazon has, and they've spent billions failing to fully solve it.
A few structural properties of AT Protocol make this harder than on Amazon, though not impossible:
All PDS data is public and auditable. Unlike Amazon's opaque review system, every account's full history — posts, follows, interactions, review patterns — is publicly visible. A network of sock puppets created in the same week with no social graph and no other activity is visibly suspicious. Any app consuming the Lexicon can implement basic heuristic scoring on this data without any special protocol support.
Social graph distance as a trust signal. A review from someone two hops away in your follow graph carries fundamentally more weight than a review from a stranger with no connection to you. This is computable from public AT Protocol data. Fake review networks would tend to cluster at infinite social distance from real buyers in your network — making them easy to deprioritize in any well-designed storefront UI.
Labeler services as fraud detection. An independent labeler specializing in commerce fraud detection — flagging suspicious review patterns, newly-created accounts with concentrated review activity, coordinated behavior across accounts — would be visible to any app consuming the Lexicon. This doesn't require protocol changes, just someone building it.
The verified purchase problem specifically. The
verifiedfield in the review record is a placeholder. The cleanest practical solution I can think of is a logistics receipt token: when a package is delivered, the logistics provider issues a signed cryptographic receipt to the buyer. The buyer can optionally attach this receipt reference to their review, providing unforgeable proof of purchase without leaking transaction details. This requires logistics provider participation — it's an adoption dependency — but it's architecturally clean and doesn't require solving zero-knowledge proofs at the protocol layer.None of this fully eliminates fake reviews. But it shifts the problem from "undetectable inside an opaque platform" to "visible and auditable in a public graph" — which is a meaningful improvement in the underlying threat model.
Ecosystem implications if this works
A working commerce Lexicon would make a few interesting things possible:
The shop-as-PDS model. A small independent seller could run their entire public catalog in their PDS, visible to any storefront app that reads the Lexicon. No Shopify subscription required for basic presence, though value-added frontends could still charge for features.
Portable reputation across marketplaces. A seller who builds a review history in one app carries it to every other app. This directly attacks the cold start problem that currently keeps small sellers locked into established platforms.
Social commerce without surveillance. Recommendations flowing through the AT Protocol social graph are attached to real verifiable identities. No fake reviews, no algorithmic amplification of sponsored content disguised as organic recommendation. Just your actual follows telling you what they actually bought.
Logistics providers as commodity services. If the social and identity layer is open and standardized, logistics becomes genuinely pluggable. A Maersk or a regional carrier could offer fulfillment APIs that any storefront consuming the Lexicon could integrate with. The platform tax disappears because there's no platform owning the audience — there's just infrastructure.
The namespace question
The schemas above use
app.commerce.*as a placeholder. The real namespace needs to be anchored to a domain someone controls. Options:commerce.example→example.commerce.*)lexicon-communityGitHub organization, which already maintains a collection of community Lexicons (awesome-lexicons) and has an established process for community schema development — this seems like the most natural home for a shared commerce standardOn the question of experimenting before committing: the AT Protocol team has documented a convention for exactly this situation — using
.temp.in the name hierarchy (e.g.,app.temp.commerce.listing) to signal that a schema is in active development in the live network without implying stability. This seems like the right approach while this proposal is being discussed. Builds against a.temp.namespace can be treated as prototypes; once the schema stabilizes through community discussion, it migrates to a permanent namespace.This is worth discussing before anyone builds anything serious against a stable namespace.
Open questions I don't have good answers to
Category taxonomy. The listing schema has free-text categories right now. Should there be a standardized taxonomy Lexicon, or is free-text plus convention sufficient? A standard taxonomy enables better cross-app discovery but is hard to get right and slow to evolve.
Verified purchase. The logistics receipt token approach described above seems promising — a signed delivery confirmation issued by a logistics provider, optionally attached to a review. But it requires logistics provider buy-in. Is there a simpler intermediate approach? Is unverified-but-DID-anchored review data valuable enough to build on first, with verified purchase as a later addition?
Seller verification. The shop record has no identity verification mechanism beyond the DID itself. In practice buyers want to know a seller is a real business with legal accountability. Does this need to be in the Lexicon, or is it a layer above (labelers, verification services, regulatory compliance)?
Pricing complexity. The current price field is a single amount. Real commerce needs variants (size, color), tiered pricing, sale prices, VAT handling. How much complexity belongs in the base Lexicon versus application-level extensions?
Is this the right layer? The most fundamental question. AT Protocol might not be the right place for commerce records at all — maybe the right answer is AT Protocol for identity and social graph, with commerce living at a higher layer that just uses DIDs as identifiers. Genuinely uncertain and would value opinions from people with more protocol design experience.
Prior art and community
Before posting this I searched for existing commerce Lexicon work and found nothing substantial. If you know of something I've missed, please say so immediately — I'd genuinely rather join an existing effort.
The Bluesky team has confirmed that using Lexicons outside the
app.bsky.*namespace is intended and supported. The main dependency is the Lexicon Resolution system, which is designed but not yet fully shipped — meaning now is actually a good time to be drafting this, before the resolution mechanism locks in conventions.What I'm hoping for from this discussion
The goal isn't to own a standard. It's to have this exist. If this discussion produces a better proposal that someone else runs with, that's the best possible outcome.
All reactions