Jetstream consumer watches the atproto firehose for email.atmos.attestation
records. For each attestation, verifies domain control (handle match or DNS
TXT) and mail DNS configuration (MX, SPF, DKIM, DMARC). Issues signed
atproto labels (secp256k1/DAG-CBOR) via standard XRPC endpoints.

- queryLabels (HTTP/JSON) and subscribeLabels (WebSocket/CBOR)
- SQLite persistence with WAL mode, cursor-based crash recovery
- Reconcile-based label management for multi-domain correctness
- Periodic re-verification scheduler (24h default)
- Rate limiting (global + per-DID)
- Input validation (strict DID format, domain bounds, selector limits)
- Tangled CI pipeline (Spindle shared runners)
- MIT license

All 9 packages pass with -race.

Preliminary atproto lexicon schemas (email.atmos.attestation, email.atmos.defs)
published to invite feedback on the cooperative's record types and label vocabulary.