The protocol · live since the first commit
Under every food app is a map of who grows what, and every company that ever drew one locked it in a database and called it an asset. We think that map is a commons. So the Foodshed writes it in public: many farms, many markets, eventually many co-ops, adding up to one living picture of what the land is producing — readable by anyone, owned by no one.
That makes the whole thing behave less like a marketplace and more like an organism. A marketplace has an operator; an organism has a metabolism. Co-ops, chefs, and households come and go like cells, and the record of the foodshed persists underneath them. The technical name for that record is the Open Foodshed protocol. Open Food is the idea it serves.
The farm holds the pen
When Ollin Farm’s chard shows up in our app, the fact of that chard does not become our property. It lives as a record under the farm’s own identity — a DID, the same portable identity standard underneath Bluesky — published only when the farm says yes. The co-op’s app is one reader of that record. It will never be the only one.
A farm’s profile, catalog and reputation are addressed to the farm’s DID, not to our tables. If the farm switches platforms, moves towns, or outlives us, the records go along.
Nothing publishes until the farm has claimed its page and separately said yes to publishing. Until both are true, the record stays on our side of the wall: ours to keep, theirs to correct.
Our app renders these records. So can a peer co-op, a market app, a food hub, or a researcher with curl, through the same endpoints, without asking us.
Provenance, or: how honest is this offer
Every offer carries a label saying how we know. seeded means we typed it in from a market census. observed means a crew member saw it on the table last Saturday. expected means the crop calendar says it should be there. held, declared and committed mean the farm itself set some aside, told us its availability, or promised a harvest. Same record, same code path either way; the label changes what a reader may promise on top of it. A menu planned on expected chard is a plan. One planned on declared chard is close to a guarantee. The protocol makes that difference legible instead of leaving it to marketing.
Running right now
Vision pages are cheap, so here is the actual surface. These are the same endpoints our own public directory renders from. No keys, no signup, CORS open. The point of a commons is that reading it requires nobody’s permission, including ours.
GET · public · JSON-LD
curl "https://foodshed.app/api/dfc/enterprises"Every consenting farm, in the Data Food Consortium vocabulary, the same standard the Open Food Network speaks. curl this; it’s live.
GET · public · ATProto XRPC
curl "https://foodshed.app/api/xrpc/com.atproto.repo.listRecords?repo=<did>&collection=org.foodshed.catalog.item"One farm’s catalog, read over the standard com.atproto.repo.listRecords contract. Swap <did> for any DID in the response above.
| Collection | What it holds |
|---|---|
| org.foodshed.enterprise.profile | Who a farm is: name, story, practices, certifications |
| org.foodshed.catalog.offer | What’s offered this cycle, provenance label included |
| org.foodshed.menu.recipe | A chef’s recipe, each ingredient a real product type |
Prefer prose to JSON? The open library is the human-readable reader of these same recipe records — every dish on it fetched from the endpoints above, each ingredient resolved to the farms that have it this week.
Three of twelve record types. The full set — profiles, offers, menus, attestations, charters, governance — is versioned JSON in packages/lexicons, DFC term mappings alongside.
Rule 0
An open record of a food system is only trustworthy if everyone can see exactly where openness ends. So the boundary is the first rule in the codebase: an allow-list checked in code on every publish, not a paragraph in a privacy policy.
Public, when the farm consents
Private, permanently
Not encrypted-public. Not anonymized-public. Not on the protocol at all.
Off means off
Consent here is a switch the farm owns, and it works in both directions. Flip it off and every published record is withdrawn from the protocol layer — deleted, not hidden behind a flag — because a consent you can’t take back was never consent. That behavior is a function you can read in the open source, not a support ticket you have to win.
The organism
Nothing in this design needs us at the center of it. A second foodshed — Fort Collins, Tucson, the Willamette — runs the same open-source stack, keeps its own books and its own governance, and reads the same commons of public records. Each new instance makes the picture more alive for everyone already in it.
Peer co-ops on the same rails index each other’s public records and cross-list a producer’s offers, with the producer’s yes each time. What federates is the public catalog. Boxes, addresses, wages and balances stay home, in whichever co-op holds them.
With university protocol researchers we’re scoping an open recipe standard: every ingredient tagged to a real product type, so a dish can ask what the Front Range has in the third week of August and get live offers back. A recipe is a record under its chef’s DID, and a member’s cooking history lands in their own data store, portable to any app that reads the standard.
The lexicons and the Rule 0 discipline are headed out of this repo and into a nonprofit whose one job is keeping the standard open. A standard held by a single operator, even a friendly one, is a moat with a nice sign on it. Handing it to a neutral steward means no platform — ours included — can ever fence it.
Public records federate between co-ops. Everything on the private side of Rule 0 stays with the co-op that holds it.
Take some
For developers
The read surfaces above are live and the org.foodshed.* lexicons are in the repo. You could have a reader working this afternoon, and you don’t need to tell us.
For co-ops elsewhere
The whole stack is AGPL: the weekly cycle, the routing, the append-only ledger, the market census tools. This pattern is yours to run: your market, your books, your name on your boxes. And your public records join the same picture.
For eaters and farms
The place to feel all this is the box. Walk the demo, or, if you sell at the market, claim your stall’s page from the card we leave at your table; it takes about a minute. If you want the first instance to exist at scale, that’s the invest page.
Stewardship of the standard is headed to a nonprofit. The records were never ours to begin with.