OXYGENHUB

Log P4c (signed Flow receipts on the hub) as done 7dc9f65b6546

Author
Andy McCall @andymccall <[email protected]>
When
· 2026-09-29 07:51 UTC
Signature
✔ signed by Andy McCall
Hash
7dc9f65b65465a7dd4d788eb377c42901c28c28d64e8711178d3b7642dbf16e3
Depends on
155313e68e15 75036530b621 fc1a466a1e66
Depended on by
9df6217f5f47
In bookmarks
agents-in-readme bare-hashes carried-not-removed carry-identical doctor-trust identical-sides keyless-tags main merge-remote-bookmark only-help-103 paths-for-resolutions-and-amend push-notes show-stat subrepo-pin-state switch-says
In tags
v0.1.0 v0.10.0 v0.11.0 v0.2.0 v0.3.0 v0.3.1 v0.4.0 v0.4.1 v0.4.2 v0.4.3 v0.4.4 v0.4.5 v0.4.6 v0.5.0 v0.5.1 v0.6.0 v0.7.0 v0.8.0 v0.9.0
Edits
3 atoms, 0 tree operations, 1 file

Browse the tree at this change

hide whitespace changes
modified docs/backlog-overnight-2.md +7 −1
… 
105 unchanged lines
106 106 
  - Hub: a bookmark's changes drawn as lanes of independent changes (oxy-core `lanes`), with dependencies as edges and no merge nodes.
107 107 
  - P3b: drag and drop on proposal bookmarks only. Dropping a change onto another proposes a squash, dragging a dependent chain proposes a rebase. The hub produces a plan and the author's oxy or oxygen-vscode applies and signs it (V6 has split, squash and rebase). Reordering independent changes means nothing and is not offered.
108 108 
- [x] P4a The `receipt` object and attestation in the Oxygen spec and oxy-core: a signed receipt verifies on its own; the repository keeps receipts by state; `oxy receipt list|show|export|verify|import` (first part of P4, below).
109 - 
- [ ] P4c The runner signs each receipt with its own identity; the hub verifies it against its known runner keys, keeps it in the repository, and shows it on the run, the check and the change.
109 + 
- [x] P4c The runner signs each receipt with its own identity; the hub verifies it against its known runner keys, keeps it in the repository, and shows it on the run, the check and the change.
110 110 
- [ ] P4d Flow `output` and artifacts: a job's declared outputs become blobs named by its receipt, and a release asset links to the receipt that built it.
111 111 
- [ ] P4 **Signed Flow receipts**:
112 112 
  - A `receipt` object type in the Oxygen spec.
… 
592 unchanged lines
705 705 
  - The repository indexes receipts by state. gc keeps them, their runners and their outputs while the state's changes live, and pruning a state drops its index.
706 706 
  - The CLI has `oxy receipt list|show|export|verify|import`.
707 707 
  - **Tests:** core round trip and tamper tests, a repo test (keep, refuse, gc, fsck) and a CLI end-to-end test. The oxygen run is green.
708 + 
- 2026-09-29 **P4c done** (oxygenflow#10, oxygenhub#37).
709 + 
  - **Runner:** the runner makes a composite key on first start (`runner.key` 0600, `runner.identity`). It signs each receipt for the state of the heads it fetched and for the run URL, and sends the result with `finish` as `signed_receipt`. Earth's runner key is 9006c60d4ecb.
710 + 
  - **Hub checks:** a receipt must verify, be the job's receipt, and be for the run's state and repository. It must also use the key the token first used; `flow_runner_keys` binds a token to its key on first use. If a check fails, the result still stands and the run page says why the receipt was not kept.
711 + 
  - **Storage and pages:** kept receipts go into the repository through `add_receipt`, under the repository's write lock. Run pages link them with the signer, change pages list their state's receipts, and `/{o}/{n}/receipts/{attest}` downloads one.
712 + 
  - **Tests:** a hub end-to-end test (kept, wrong key, wrong state, download, pages) and a runner key test. flow-core's receipt and the Oxygen object hash the same.
713 + 
  - **Deployed:** hub and runner. Live, hub run 30's four jobs all have signed receipts, and a downloaded one passes `oxy receipt verify`. Flow and hub runs are green.