Guide: setting an agent up as a delegate, step by step 445ce913ba56
The agent's identity file is the one identity create leaves beside its secret; identity show and export follow the checkout's author.key, so they are not the way to find it. The agent's author.key must be the identity that lists it, which is the successor delegate add makes.
- Author
- Andy McCall @andymccall <[email protected]>
- via
- agent
Claude Code <[email protected]> · delegate for changes, until 2026-10-04 20:12Z · key ea5f78160088
- When
- · 2026-10-04 12:14 UTC
- Signature
- ✔ signed by Claude Code
- Hash
445ce913ba566d30414f1fba0d7668ca5cebe09d87c8ac4aa4719a92fb06b58d- Depends on
- 7ba155f20aa0 ee06a6c557b7 ff1a64f81c1c
- Depended on by
- c895bc52e4e0 614f55e14eee
- In bookmarks
- agents-in-readme bare-hashes carried-not-removed carry-identical doctor-trust identical-sides keyless-tags main merge-remote-bookmark only-help-103 paths-for-resolutions-and-amend push-notes show-stat subrepo-pin-state switch-says
- In tags
- v0.10.0 v0.11.0 v0.4.0 v0.4.1 v0.4.2 v0.4.3 v0.4.4 v0.4.5 v0.4.6 v0.5.0 v0.5.1 v0.6.0 v0.7.0 v0.8.0 v0.9.0
- Edits
- 2 atoms, 0 tree operations, 1 file
Browse the tree at this change
modified docs/guide.md +25 −1
| … | 330 unchanged lines |
||
| 331 | 331 | oxy identity rotate # fresh key pair; old signatures stay valid |
|
| 332 | 332 | oxy identity renew --expires 365 # same keys, new expiry in days (0 = never) |
|
| 333 | 333 | oxy identity delegate add agent.identity --expires 8h # sign changes for me today |
|
| 334 | - | # …and in the agent's own shell: OXY_HOME=~/.oxy-agent oxy config --user author.signer <its key> |
|
| 335 | 334 | oxy identity delegate add ci.identity --scope changes,refs # sign and push for me |
|
| 336 | 335 | oxy identity delegate remove 3f2a… |
|
| 337 | 336 | oxy identity revoke 3f2a… --reason "agent host compromised" # a key you delegated to |
|
| 337 | + | ``` |
|
| 338 | + | ||
| 339 | + | Setting an agent up takes a home of its own, so it never holds your |
|
| 340 | + | secret key. In the agent's shell, inside any checkout: |
|
| 341 | + | ||
| 342 | + | ``` |
|
| 343 | + | export OXY_HOME=~/.oxy-agents/claude |
|
| 344 | + | oxy identity create --name "Claude Code on my laptop" --email [email protected] |
|
| 345 | + | # prints the agent's KeyId; its identity file is keys/<KeyId>.identity in that home |
|
| 346 | + | oxy config --user author.name "Your Name" # the agent authors as you… |
|
| 347 | + | oxy config --user author.email "[email protected]" |
|
| 348 | + | oxy config --user author.key <YOUR KeyId> |
|
| 349 | + | oxy config --user author.signer <THE AGENT's KeyId> # …and signs as itself |
|
| 350 | + | oxy config --user core.sign change |
|
| 351 | + | ``` |
|
| 352 | + | ||
| 353 | + | Then, in your own shell, in the repository: `oxy identity delegate add |
|
| 354 | + | ~/.oxy-agents/claude/keys/<KeyId>.identity --scope changes --expires 8h` |
|
| 355 | + | (this rotates your identity; put the new KeyId in the agent's |
|
| 356 | + | `author.key`, and re-link it on your hub). Every commit the agent makes |
|
| 357 | + | carries you as author and its signature: `oxy log -r 'delegated()'` |
|
| 358 | + | lists them, `oxy verify` names the agent, and its own `oxy push` is |
|
| 359 | + | refused under any policy, so you land its work. |
|
| 360 | + | ||
| 361 | + | ``` |
|
| 338 | 362 | oxy identity revoke # retire your own key |
|
| 339 | 363 | oxy identity revoke 3f2a… --reason "laptop stolen" # any key, if you hold a root |
|
| 340 | 364 | ``` |
|
| … | 189 unchanged lines |