Revsets: trust predicates, and -r on show, verify and abandon 2c9ddac3c387

    /// Who authenticated each change, once asked (signature checks cost).

    auth: HashMap<ChangeHash, SignatureStatus>,

                    let hit = ev.names_key(&who, &m.author);

            // Trust (§2.4): what authenticated a change, and what vouched

            // for the states it is in.

            "signed_by" => {

                self.arity(name, args, 1)?;

                let who = self.text_arg(name, args, 0)?.to_string();

                self.filter_metas_with(within, |ev, h, m| match ev.auth(h, m) {

                    SignatureStatus::Valid { key, .. } => ev.names_key(&who, &key),

                    _ => false,

                })

            }

            "delegated" => {

                self.arity(name, args, 0)?;

                self.filter_metas_with(within, |ev, h, m| {

                    !m.author.is_zero()

                        && matches!(ev.auth(h, m), SignatureStatus::Valid { key, .. } if key != m.author)

                })

            }

            "unsigned" => {

                self.arity(name, args, 0)?;

                self.filter_metas_with(within, |ev, h, m| {

                    m.kind != ChangeKind::WorkingCopy

                        && !matches!(ev.auth(h, m), SignatureStatus::Valid { .. })

                })

            }

            "revoked" => {

                self.arity(name, args, 0)?;

                self.filter_metas_with(within, |ev, h, m| {

                    matches!(ev.auth(h, m), SignatureStatus::Valid { revoked: true, .. })

                })

            }

            "attested" => {

                self.arity(name, args, 1)?;

                let kind = self.text_arg(name, args, 0)?.to_string();

                self.attested(within, &kind)

            }

            "built" => {

                self.arity(name, args, 1)?;

                let job = self.text_arg(name, args, 0)?.to_string();

                self.built(within, &job)

            }

            }

        }

    }

    /// The authentication of a change: its signature or seal, checked once.

    fn auth(&mut self, h: &ChangeHash, m: &ChangeMeta) -> SignatureStatus {

        if let Some(s) = self.auth.get(h) {

            return s.clone();

        }

        let s = self

            .repo

            .authenticate_change_known(h, Some(m))

            .unwrap_or_else(|e| SignatureStatus::Invalid(e.to_string()));

        self.auth.insert(*h, s.clone());

        s

    }

    /// Whether `who` names key `key`: by hex prefix, `me`, or the name or

    /// email of its identity.

    fn names_key(&mut self, who: &str, key: &KeyId) -> bool {

        (who == "me" && Some(*key) == self.repo.config.author_key)

            || key.starts_with_hex(who)

            || self.who(key).is_some_and(|(n, e)| {

                let needle = who.to_lowercase();

                n.to_lowercase().contains(&needle) || e.to_lowercase().contains(&needle)

            })

    }

    /// The closure of the states whose heads these are, within `within`.

    fn closure_of(&mut self, mut heads: Vec<ChangeHash>, within: Option<&Set>) -> Result<Set> {

        heads.sort();

        heads.dedup();

        self.ensure(&heads)?;

        let set: Set = heads.into_iter().collect();

        let closure = self.ancestors(&set)?;

        Ok(match within {

            Some(w) => closure.intersection(w).copied().collect(),

            None => closure,

        })

    }

    /// The closure of every state that carries an attestation of `kind`:

    /// `tag` (tagged states), `receipt` (states a runner reported on) or

    /// `ref` (states a remote attested, as its tracking bookmarks hold).

    fn attested(&mut self, within: Option<&Set>, kind: &str) -> Result<Set> {

        let mut heads: Vec<ChangeHash> = Vec::new();

        match kind {

            "tag" => {

                for t in self.repo.tags()? {

                    heads.extend(t.heads);

                }

            }

            "receipt" => {

                for st in self.repo.store().receipt_states()? {

                    if let Ok(s) = self.repo.store().get_state(&st) {

                        heads.extend(s.heads);

                    }

                }

            }

            "ref" => {

                let view = self.repo.view()?;

                for bookmarks in view.remotes.values() {

                    for st in bookmarks.values() {

                        heads.extend(self.repo.store().get_state(st)?.heads);

                    }

                }

            }

            other => return Err(err(format!("attested({other:?}): use tag, receipt or ref"))),

        }

        self.closure_of(heads, within)

    }

    /// The closure of every state with a valid receipt for Flow job `job`

    /// from a runner whose key is not revoked.

    fn built(&mut self, within: Option<&Set>, job: &str) -> Result<Set> {

        let mut heads: Vec<ChangeHash> = Vec::new();

        for st in self.repo.store().receipt_states()? {

            let Ok(state) = self.repo.store().get_state(&st) else {

                continue;

            };

            let good = self

                .repo

                .receipts(&state.heads)?

                .into_iter()

                .any(|r| r.signed.receipt.job_name == job && r.problem.is_none() && !r.revoked);

            if good {

                heads.extend(state.heads);

            self.tick()?;

        self.closure_of(heads, within)

                "author"

                    | "description"

                    | "date"

                    | "kind"

                    | "touches"

                    | "all"

                    | "signed_by"

                    | "delegated"

                    | "unsigned"

                    | "revoked"

                    | "attested"

                    | "built"

            auth: HashMap::new(),

    // Trust predicates (§2.4): nothing is signed yet (core.sign = seal, no

    // push); then a signed change, a tag, and a revocation.

    assert_eq!(set("unsigned() & ::main"), sorted(&[a, b, c, d]));

    assert_eq!(set("signed_by(me)"), vec![]);

    repo.sign_change(&d).unwrap();

    assert_eq!(set("signed_by(me)"), vec![d]);

    assert_eq!(set("signed_by([email protected])"), vec![d]);

    assert_eq!(set(&format!("signed_by({})", key.short(12))), vec![d]);

    assert_eq!(set("unsigned() & ::main"), sorted(&[a, b, c]));

    assert_eq!(set("delegated()"), vec![]);

    assert_eq!(set("revoked()"), vec![]);

    assert_eq!(set("attested(tag)"), vec![]);

    repo.tag_create("v1", &[b], "first").unwrap();

    assert_eq!(set("attested(tag)"), sorted(&[a, b]));

    assert_eq!(set("attested(tag) & unsigned()"), sorted(&[a, b]));

    assert_eq!(set("attested(receipt)"), vec![]);

    assert_eq!(set("built(test)"), vec![]);

    let e = repo.revset("attested(seal)").unwrap_err().to_string();

    assert!(e.contains("tag, receipt or ref"), "{e}");

    repo.revoke_identity(&key, "test").unwrap();

    assert_eq!(set("revoked()"), vec![d]);

    assert_eq!(set("signed_by(me) ~ revoked()"), vec![]);

**Implemented (2026-10-04, oxygen#65):** `oxy log -r`, `oxy show -r`,

`oxy verify -r` and `oxy abandon -r` with the symbols, relations,

operators, `author`, `description` (substring), `date`, `kind`,

`touches`, `latest` and the trust predicates of §2.4 below, saved

revsets, and a time budget. Not yet: `independent()`, `conflicts()`,

`description(re:…)`, `diff -r`, `push -r`, `fold`, and the hub's `?r=`.

Other commands take a single change (a ChangeId prefix, a `#hash`

prefix or `@`) or a bookmark or tag name; symbols in a revset resolve

exactly as they do there.

| `signed_by(K)` | changes whose signature or seal is by key or identity K (a key prefix, a name, an email, or `me`), including a delegate such as an agent key |

| `attested(KIND)` | changes in states carrying an attestation of that kind: `tag`, `receipt`, or `ref` (states a remote attested, as its tracking bookmarks hold them) |

  selected set and refuses to act if it is empty. Above a threshold

  (five, for `abandon`) it refuses unless given `--yes`. `abandon -r`

  drops the newest first and finds each later member again by its

  ChangeId, since dropping a change rewrites what depended on it.

oxy log [-r REVSET] [-n N] [-v] [-L S,E:PATH]   oxy show CHANGE | -r REVSET

oxy split CHANGE [PATH]..           oxy abandon CHANGE | -r REVSET [--yes]   oxy resolve

oxy policy init|show|grant|revoke|root|sign                      oxy verify [CHANGE | -r REVSET]

pub fn verify(change: Option<&str>, revset: Option<&str>, as_json: bool) -> Result<i32> {

    let hashes: Vec<ChangeHash> = match (change, revset) {

        (_, Some(r)) => {

            let wc = repo.working_copy().ok().map(|(h, _)| h);

            repo.revset(r)?

                .hashes

                .into_iter()

                .filter(|h| Some(*h) != wc)

                .collect()

        }

        (Some(c), None) => vec![repo.resolve_change(c)?],

        (None, None) => repo

    /// Drop a change from the bookmark; its content stays on disk as uncommitted work

        /// The change to drop (ChangeId prefix, #hash prefix)

        #[arg(required_unless_present = "revset")]

        change: Option<String>,

        /// Drop every change a revset selects, newest first

        #[arg(short = 'r', long, value_name = "REVSET", conflicts_with = "change")]

        revset: Option<String>,

        /// Drop more than five changes without asking

        #[arg(long, short = 'y')]

        yes: bool,

    /// Show one change (ChangeId prefix, #hash prefix, or @), or those a revset selects

        #[arg(required_unless_present = "revset")]

        change: Option<String>,

        /// Show every change a revset selects

        #[arg(short = 'r', long, value_name = "REVSET", conflicts_with = "change")]

        revset: Option<String>,

        /// Verify every change a revset selects: `release..main & unsigned()`

        #[arg(short = 'r', long, value_name = "REVSET", conflicts_with = "change")]

        revset: Option<String>,

        Cmd::Abandon {

            change,

            revset,

            yes,

        } => workspace::abandon(change.as_deref(), revset.as_deref(), yes),

        Cmd::Show {

            change,

            revset,

            json,

        } => workspace::show(change.as_deref(), revset.as_deref(), json),

        Cmd::Verify {

            change,

            revset,

            json,

        } => identity::verify(change.as_deref(), revset.as_deref(), json),

pub fn show(change: Option<&str>, revset: Option<&str>, as_json: bool) -> Result<i32> {

    let Some(r) = revset else {

        let h = repo.resolve_change(change.unwrap_or("@"))?;

        return show_one(&repo, h, as_json, false);

    };

    // Several changes: a JSON array, or the changes one after another.

    let hashes = repo.revset(r)?.hashes;

    if as_json {

        print!("[");

        for (i, h) in hashes.iter().enumerate() {

            if i > 0 {

                print!(",");

            }

            show_one(&repo, *h, true, true)?;

        }

        println!("]");

        return Ok(0);

    }

    if hashes.is_empty() {

        println!("{}", ui::dim(format!("No change matches {r:?}.")));

        return Ok(0);

    }

    for (i, h) in hashes.iter().enumerate() {

        if i > 0 {

            println!();

        }

        show_one(&repo, *h, false, false)?;

    }

    Ok(0)

}

/// One change, as `oxy show` prints it; `inline` JSON goes without its

/// newline, for an array.

fn show_one(repo: &Repo, h: ChangeHash, as_json: bool, inline: bool) -> Result<i32> {

        let mut body = log_entry_json(repo, &entry)?;

        if inline {

            print!("{body}");

        } else {

            println!("{body}");

        }

            ui::author(author_name(repo, &oxy_core::state::ChangeMeta::of(&c)))

    println!("{}", ui::kv("sig", signature_line(repo, &h)?));

pub fn abandon(change: Option<&str>, revset: Option<&str>, yes: bool) -> Result<i32> {

    let Some(r) = revset else {

        let h = repo.resolve_change(change.unwrap_or_default())?;

        abandon_one(&repo, h)?;

        where_now(&repo);

        return Ok(0);

    };

    // A revset: say what it selects, refuse an empty set, ask above a few.

    let selected = repo.revset(r)?;

    let wc = repo.working_copy().ok().map(|(h, _)| h);

    let hashes: Vec<ChangeHash> = selected

        .hashes

        .iter()

        .copied()

        .filter(|h| Some(*h) != wc)

        .collect();

    if hashes.is_empty() {

        anyhow::bail!("{r:?} selects no change to abandon");

    }

    println!(

        "{} {} selects {}:",

        ui::section("abandon"),

        ui::id(r),

        plural(hashes.len(), "change")

    );

    for h in &hashes {

        if let Some(m) = selected.metas.get(h) {

            println!(

                "  {} {}  {}",

                ui::id(m.change_id.short(8)),

                ui::hash(format!("#{}", h.short(12))),

                subject_of(&m.message)

            );

        }

    }

    const ASK_ABOVE: usize = 5;

    if hashes.len() > ASK_ABOVE && !yes {

        anyhow::bail!("that is more than {ASK_ABOVE} changes; pass --yes to abandon them all");

    }

    // Newest first: abandoning a change rewrites what depends on it, so a

    // later member is found again by its ChangeId.

    let mut done = 0;

    for h in &hashes {

        let Some(m) = selected.metas.get(h) else {

            continue;

        };

        let now = match repo.resolve_change(&m.change_id.to_hex()) {

            Ok(h) => h,

            Err(_) => continue,

        };

        abandon_one(&repo, now)?;

        done += 1;

    }

    println!("{} {}", ui::done("Abandoned"), plural(done, "change"));

    where_now(&repo);

    Ok(0)

}

fn abandon_one(repo: &Repo, h: ChangeHash) -> Result<()> {

    Ok(())