Why AT Protocol Traded Local-First for Federated Scale

Bluesky's engineering team deliberately departed from local-first design — a tradition rooted in p2p projects like SSB and Beaker Browser — when building AT Protocol. The driver was scale: hitting 2022 Twitter-level numbers, roughly 240 million daily active users and thousands of events per second, made pure peer-to-peer architectures impractical.

The team's key insight was to treat the public WAN as functionally equivalent to an unusually unreliable internal datacenter network. Where a typical high-scale service uses Kafka for durable, replayable data replication across microservices, AT Protocol builds that same replication directly into the protocol via a network of Personal Data Servers (PDS). Each PDS hashes JSON writes into a merkle tree and signs them, letting relays forward data across the open internet while preserving verifiable authenticity — the origin of the name 'authenticated transfer protocol.'

The resulting pull-based sync model keeps applications loosely coupled: a write is considered committed once acknowledged by the PDS, and other apps replicate it asynchronously at their own pace. For engineers, the takeaway is that starting design from hard scale requirements doesn't have to sacrifice openness or user autonomy — it just changes which architectural patterns get used to preserve them.