Backlog 4: items 8 and 9 logged 0c15e4678479

7. - [ ] **The hub's open issues**: runner management (oxygenhub#41, backlog

   2's H12 parts), a pinned subrepo left out of a Flow job for lack of

   access (#56), faster CI (#29), required checks over the API (#20).

   review requests, mentions and landings; the organisation webhooks page.

   Email verification and password reset need SMTP on Earth, and passkeys

   are for 1.0: skip both unless Andy says otherwise.

   example `oxy seal --proposal` exists), and CHANGELOG files for oxygen,

   oxygenhub and oxygenflow like the extensions' (backlog 2's V2).

- 2026-10-01 02:20 **Device sign-in done** (oxygenhub#67, f8f35f5f, deployed, Flow run #62 passes): `/api/v1/device/code` and `/device/token` in RFC 8628's shape, the `/device` approval page (signed in, choose scopes, approve or deny), the token made on the next poll so none is stored in the clear; `oh auth login` signs in this way, `--token` still works. Live check on oxygenhub.io: a code is issued and `/device` asks a signed-out visitor to sign in. The Android feedback file says how the app can use it.

- 2026-10-01 03:10 **Hub issues** (item 7): #56 done (a Flow job's log names the pinned subrepos it was not given, and why; 1ffde26b), #41 part 2 done (runners scoped to the site, an owner or one repository; claims filtered in the query; ceaf0ed2), #20 and #29 closed as already done (the required-checks API and every Oxygen repository's required checks; CI without debug info and with prebuilt dependencies, build 270 s). oxygenhub-vscode#4 closed: the authentication provider has been declared since d6657e33. Skipped: item 4, the Android build image (it means accepting the Android SDK licences, Andy's to accept). All deployed; hub Flow runs #63 and #64 pass. H4 is running again on Earth: the 10 000-commit vscode slice now imports in 136 s and 2.2 GB, and the whole history was at 2.3 to 2.5 GB after 20 minutes.