Seals adopt anonymous changes; oxy seal command 05e71ed6cdf1 resolution

            (

        // The author-or-delegate rule (spec §14.4). A change whose author is

        // the zero key names nobody (Git imports, history from before an

        // identity existed), so any key may adopt it with a seal; policy

        // then authorises that key for the reference as usual.

        let authorised = change.author.is_zero()

            || sig.key == change.author

    /// Seal changes with the identity key (spec §14.4): a stored, indexed

    /// seal attestation over `hashes`, pushed with the next push. Returns

    /// the attestation's reference.

    pub fn seal(&self, hashes: &[ChangeHash]) -> Result<ObjectRef> {

        if hashes.is_empty() {

            return fail("nothing to seal");

        }

        if hashes.len() > crate::attest::MAX_SEAL_HASHES {

            return fail(format!("a seal covers at most {} changes", crate::attest::MAX_SEAL_HASHES));

        }

        for h in hashes {

            if !self.store.has(h) {

                return fail(format!("unknown change {}", h.short(12)));

            }

        }

        let mut sorted = hashes.to_vec();

        sorted.sort();

        sorted.dedup();

        let sa = self.sign_attest(&Attest::seal(self.id()?, sorted.clone()))?;

        let r = self.store.put_attest(&sa.attest)?;

        for sig in &sa.sigs {

            self.store.put_signature(&r, sig)?;

        }

        for h in &sorted {

            self.store.index_seal(h, &r)?;

        }

        Ok(r)

    }

    /// The changes of the current bookmark this identity can authenticate

    /// but has not: its own unsigned ones and anonymous ones.

    pub fn sealable(&self) -> Result<Vec<ChangeHash>> {

        let Some((key, _)) = self.secret_key()? else { return fail("no identity: run oxy identity create") };

        let heads = self.bookmark_heads()?;

        let state = self.load_state(&heads)?;

        let mut out = Vec::new();

        for (h, meta) in state.changes() {

            if (meta.author == key || meta.author.is_zero()) && !matches!(self.authenticate_change(h)?, SignatureStatus::Valid { .. }) {

                out.push(*h);

            }

        }

        out.sort();

        Ok(out)

    }

    fn check_remote_id(

        &self,

        remote: &dyn crate::protocol::Remote,

        remote_name: &str,

        allow_unbound: bool,

    ) -> Result<()> {

            return fail(format!(

                "remote {remote_name:?} is empty and unbound: push to it first"

            ));

        fail(format!(

            "remote {remote_name:?} is a different repository (repository IDs differ)"

        ))

            // Seal this author's changes that carry no valid authenticator,

            // and adopt anonymous ones (zero author, spec §14.4).

                if (c.author == key || c.author.is_zero())

            return fail(format!(

                "{url} is empty and unbound: push a repository to it first"

            ));

    // A signature by a key that is not the author or a delegate is rejected

    // when the change names an author; an anonymous change (made before any

    // identity, author zero) is adopted by whoever signs it (spec §14.4).

    write(root, "a.txt", b"a\nb\nc\nd\n");

    repo.config.set("core.sign", "seal").unwrap();

    let h3 = repo.commit("ada's, unsigned", &[]).unwrap();

    let forged = other.sign(Domain::Change, &other_key, &h3);

    repo.store().put_signature(&h3, &forged).unwrap();

        matches!(repo.verify_change(&h3).unwrap(), SignatureStatus::Invalid(m) if m.contains("neither the author"))

    let adopted = other.sign(Domain::Change, &other_key, &h0);

    repo.store().put_signature(&h0, &adopted).unwrap();

    assert!(

        matches!(repo.verify_change(&h0).unwrap(), SignatureStatus::Valid { name, .. } if name == "Mallory")

    );

    assert!(!a.quick_status().unwrap().dirty);

            tokio::task::spawn_blocking(move || server.respond(&name, endpoint, body, claimed))

                .await;

    fn respond(

        &self,

        name: &str,

        endpoint: Endpoint,

        body: Bytes,

        claimed: Option<[u8; 16]>,

    ) -> Result<Response, Failure> {

                                format!(

                                    "this repository is unbound; push with a client that sends {}",

                                    oxy_core::protocol::REPO_ID_HEADER

                                ),

    assert!(Repo::clone(&url, &root.join("early"))

        .err()

        .unwrap()

        .to_string()

        .contains("unbound"));

    assert!(

        local

            .fetch("origin")

            .err()

            .unwrap()

            .to_string()

            .contains("unbound"),

        "fetching an unbound remote is refused"

    );

    assert!(other

        .push("origin", false)

        .err()

        .unwrap()

        .to_string()

        .contains("different repository"));

}

/// History made before an identity existed (zero author) is adopted by

/// the pusher's seal, so it passes a server that enforces a policy.

#[test]

fn anonymous_history_is_adopted_by_the_pushers_seal() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let served = root.join("served");

    Repo::init_bare_unbound(&served.join("app")).unwrap();

    let base = start(&served, vec![]);

    let url = format!("{base}/app");

    // Two anonymous changes, then an identity and a policy naming it.

    let work = root.join("work");

    let mut local = Repo::init(&work).unwrap();

    write(&work, "a.txt", b"a\n");

    local.snapshot("test").unwrap();

    let anon = local.commit("before identity", &[]).unwrap();

    local.create_identity("Andy", "[email protected]", oxy_core::repo::IdentityScope::Repo).unwrap();

    local.policy_init().unwrap();

    write(&work, "b.txt", b"b\n");

    local.snapshot("test").unwrap();

    let mine = local.commit("after identity", &[]).unwrap();

    assert!(matches!(local.authenticate_change(&anon).unwrap(), SignatureStatus::Unsigned));

    local.config.set("remote.origin.url", &url).unwrap();

    local.save_config().unwrap();

    let results = local.push("origin", false).unwrap();

    assert!(results.iter().all(|r| r.ok), "{results:?}");

    // The server holds the policy and both changes verify: sealed by the adopter.

    let hosted = Repo::open(&served.join("app")).unwrap();

    assert!(hosted.current_policy().unwrap().is_some());

    for h in [anon, mine] {

        assert!(matches!(hosted.authenticate_change(&h).unwrap(), SignatureStatus::Valid { sealed: true, name, .. } if name == "Andy"), "{h}");

    }

    // A change that names another author still cannot be sealed by someone else.

    let stranger = root.join("stranger");

    let mut other = Repo::init(&stranger).unwrap();

    other.create_identity("Mallory", "[email protected]", oxy_core::repo::IdentityScope::Repo).unwrap();

    write(&stranger, "c.txt", b"c\n");

    other.snapshot("test").unwrap();

    let theirs = other.commit("mallory's", &[]).unwrap();

    assert!(matches!(other.authenticate_change(&theirs).unwrap(), SignatureStatus::Unsigned));

    let bundle = other.bundle_for(&[theirs]).unwrap();

    local.import_bundle(&bundle, false).unwrap();

    local.seal(&[theirs]).unwrap();

    assert!(matches!(local.authenticate_change(&theirs).unwrap(), SignatureStatus::Invalid(why) if why.contains("neither the author nor a delegate")));

- [x] Anonymous (zero-author) changes are adopted by the pusher's seal (spec §14.4), found when pushing oxygen's own pre-identity history to the hub.

| **Status** | Draft 0.8e |

**Verification.** A sealed change `C` is authenticated iff a seal `S` exists such that `hash(C) ∈ S.body.hashes`, `S` carries a valid signature from key `K`, and `K` equals `C.author` or is listed in `C.author`'s identity as a delegate (§14.2). The same author-or-delegate rule applies to individual change signatures. This rule is what stops a collaborator from sealing a change whose `author` field names someone else (§3.1). A change whose `author` is the zero KeyId names nobody (history imported from Git, §21, or made before an identity existed), so a seal from any key authenticates it: the sealer **adopts** it, and policy authorizes the sealer for the reference as usual. A push seals the pusher's own unauthenticated changes and adopts anonymous ones in the same seal. A seal's signer must additionally be authorized by policy for the reference being pushed.

oxy seal [CHANGE]..                 seal your unauthenticated and anonymous changes (§14.4)

*Changelog.* Draft 0.8e (2026-09-27): anonymous changes (zero author) are authenticated by a seal from any key, so imported and pre-identity history can be pushed under a policy (§14.4). Draft 0.8d (2026-09-27): unbound hosted repositories adopt the first pusher's id (§16.1). Draft 0.8c (2026-09-27): bare repositories (`oxy init --bare`, §12.2: no workspace, no working copy; hosting) and the reference server as an embeddable library (§15.1). Draft 0.8b (2026-09-27): the machine interface for editors (§24): `root`, `cat`, `version`, `hunks`, `discard`, and `--json` on the reporting commands.

/// `oxy seal [CHANGE..]`: seal the named changes, or every sealable one.

pub fn seal(specs: &[String], as_json: bool) -> Result<i32> {

    let repo = Repo::open(&std::env::current_dir()?)?;

    let hashes: Vec<_> = if specs.is_empty() {

        repo.sealable()?

    } else {

        specs.iter().map(|s| repo.resolve_change(s)).collect::<std::result::Result<_, _>>()?

    };

    if hashes.is_empty() {

        if as_json {

            println!("{{\"sealed\":[]}}");

        } else {

            println!("{} nothing to seal: every change you can authenticate already is", ui::done("Sealed"));

        }

        return Ok(0);

    }

    let mut refs = Vec::new();

    for chunk in hashes.chunks(oxy_core::attest::MAX_SEAL_HASHES) {

        refs.push(repo.seal(chunk)?);

    }

    if as_json {

        let list: Vec<String> = hashes.iter().map(|h| format!("\"{}\"", h.to_hex())).collect();

        let seals: Vec<String> = refs.iter().map(|r| format!("\"{}\"", r.to_hex())).collect();

        println!("{{\"sealed\":[{}],\"seals\":[{}]}}", list.join(","), seals.join(","));

    } else {

        println!("{} {} change{} in {} seal{}; they travel with your next push", ui::done("Sealed"), hashes.len(), if hashes.len() == 1 { "" } else { "s" }, refs.len(), if refs.len() == 1 { "" } else { "s" });

        for h in &hashes {

            let title = repo.store().get_change(h).map(|c| c.message.lines().next().unwrap_or("").to_string()).unwrap_or_default();

            println!("  {} {}", ui::hash(h.short(12)), title);

        }

    }

    Ok(0)

}

    /// Seal changes with your key: named ones, or every change on the current bookmark you can authenticate but have not

    Seal {

        changes: Vec<String>,

        #[arg(long)]

        json: bool,

    },

        Cmd::Seal { changes, json } => identity::seal(&changes, json),