Here are some discoveries about bluesky:

1. Clients and servers use the same API endpoints.

2. The "Lexicon" methods described at https://atproto.com/guides/lexicon correspond directly to API routes on the path /xrpc/:method

3. These routes all require authentication. Eg `curl "https://bsky.social/xrpc/app.bsky.actor.getProfile?actor=xkcd.bsky.social"` results in `{"error":"AuthenticationRequired","message":"Authentication Required"}`

4. The auth requirement is hardcoded, so even if I started an atproto development server I'd have to modify the code to remove that restriction before I could build a bridge against it.

This thing might be capable of federation, but at the moment it's not even ready for content to be mirrored.