OXYGENHUB

Log P4d2 (release assets link to receipts) as done d82f153bdf7e

Author
Andy McCall @andymccall <[email protected]>
When
· 2026-09-29 08:24 UTC
Signature
✔ signed by Andy McCall
Hash
d82f153bdf7ec85655f2255741daa84f072ccfa93fb6563bfe47b51be6efa3c7
Depends on
28fee1c9eb6c 75036530b621 9df6217f5f47
Depended on by
4960d87af58b
In bookmarks
agents-in-readme bare-hashes carried-not-removed carry-identical doctor-trust identical-sides keyless-tags main merge-remote-bookmark only-help-103 paths-for-resolutions-and-amend push-notes show-stat subrepo-pin-state switch-says
In tags
v0.1.0 v0.10.0 v0.11.0 v0.2.0 v0.3.0 v0.3.1 v0.4.0 v0.4.1 v0.4.2 v0.4.3 v0.4.4 v0.4.5 v0.4.6 v0.5.0 v0.5.1 v0.6.0 v0.7.0 v0.8.0 v0.9.0
Edits
3 atoms, 0 tree operations, 1 file

Browse the tree at this change

hide whitespace changes
modified docs/backlog-overnight-2.md +7 −2
… 
107 unchanged lines
108 108 
- [x] P4a The `receipt` object and attestation in the Oxygen spec and oxy-core: a signed receipt verifies on its own; the repository keeps receipts by state; `oxy receipt list|show|export|verify|import` (first part of P4, below).
109 109 
- [x] P4c The runner signs each receipt with its own identity; the hub verifies it against its known runner keys, keeps it in the repository, and shows it on the run, the check and the change.
110 110 
- [x] P4d1 Flow `output` and artifacts: a job's declared outputs become repository blobs named by its signed receipt, listed and downloadable on the run page.
111 - 
- [ ] P4d2 A release asset links to the receipt that built it (by content), and an artifact can be attached to a release from its run.
112 - 
- [ ] P4 **Signed Flow receipts**:
111 + 
- [x] P4d2 A release asset links to the receipt that built it (by content), and an artifact can be attached to a release from its run.
112 + 
- [x] P4 **Signed Flow receipts**:
113 113 
  - A `receipt` object type in the Oxygen spec.
114 114 
  - A runner identity whose key (composite Ed25519 + ML-DSA-65) signs each receipt.
115 115 
  - Receipts stored in the repository and verified by the hub.
… 
602 unchanged lines
718 718 
  - **Hub:** uploads go through `POST /api/v1/flow/jobs/{id}/artifacts/{name}` and must be declared. The hub keeps each one as a repository blob and records it in `flow_artifacts` (path, size, BLAKE3). A receipt must name exactly the uploaded blobs. Run pages list artifacts and link `/flow/{n}/artifacts/{job}/{name}`.
719 719 
  - **Dogfood:** oxygen's build job keeps `target/release/oxy`. Live, run 67's 16 MB binary downloads and runs, and the build job's signed receipt names it as its output.
720 720 
  - **Tests:** parsing, debugfs read-back from an ext4 image, and a hub end-to-end test. All runs are green.
721 + 
- 2026-09-29 **P4d2 done** (oxygenhub#39). P4 is complete (P4a, P4c, P4d1, P4d2).
722 + 
  - **Built by:** a release asset links to the passed job whose artifact has the same BLAKE3 (`flow_artifacts.content`, indexed). A job with a kept signed receipt comes first, then the newest run. The release page shows the run, job, signed receipt and signer, and the API gives `built_by` on each asset (hub-api `AssetBuild`).
723 + 
  - **Attach:** on the run page, writers can attach an artifact to a release. It becomes an asset named after the artifact's path.
724 + 
  - **Tests:** the hub artifacts end-to-end test now also signs in, attaches through the form, and checks the release page and the API. The hub run is green.
725 + 
  - **Not tried live:** oxygen has no releases on Earth yet, and I did not create one on Andy's repositories.