Agents sign with fresh keys the hub certifies under their owner's grant
(author.signer = keyless), policies grant certified subjects, and the
hub's acceptance dates certified updates. See CHANGELOG.
Refs oxygenhub#241
- **Agents sign with no key of their own (oxygenhub#241).** With `author.signer = keyless`, oxy signs with a fresh key the hub certifies for ten minutes whenever it must sign, kept in memory only. The agent proves itself with a grant token its owner made with `oh agent grant NAME` and `oxy auth grant` keeps. The owner's own key signs the grant, which travels inside every certificate issued under it, so the agent's commits count in the owner's name without trusting the hub for authorship. The owner revokes the grant on the hub, and there is no key left to rotate or leak. `keyless.hub` names the hub (default: the default remote's).
6
+
7
+
- **Certificates for short-lived keys (spec §14.7).** A hub's key certifies a fresh key for a subject such as `repo:OWNER/NAME:bookmark:B` or `agent:NAME@ACCOUNT`, with a scope and a window of at most an hour. Pushes and fetches carry the certificates of the keys that signed what they bring. `oxy receipt verify` reads receipts that OxygenFlow runners sign with such keys.
8
+
9
+
- **Policies grant subjects an issuer certifies.** `oxy policy grant-subject SUBJECT --issuer IDENTITY --scope SCOPES` lets keys certified for a subject sign changes and move bookmarks. A push is checked at the receiver's clock. A fetch is checked at the time the issuer says it accepted the update, a countersigned `accepted` attestation the hub serves with the bookmark, so an expired key cannot backdate one.
10
+
11
+
- **A push seals for the author it signs for.** A delegate or a certified key set as `author.signer` now seals the author's unsigned changes at push, so it no longer has to sign each change at commit (`core.sign = change`).
12
+
13
+
- **gc keeps short-lived keys' certificates** for every change and attestation it keeps, not only receipts', so a fresh clone can still check a certified bookmark after a gc.
14
+
3
15
## 0.4.4 (2026-10-17)
4
16
5
17
- **A fresh clone takes tags made before a key rotation (#114).** A tag's signature was checked against the current trust policy with no regard for rotation, so every tag signed by a key since rotated away from was refused, and a fresh `oxy clone` of a repository with such a tag failed (this repository's own v0.1.0). A tag signed by a predecessor of a key the policy names is accepted when it is dated before that key's successor was made; a superseded key makes no new ones, and revoked keys never count.
Claude Code <[email protected]> · delegate for changes, until 2026-11-13 19:00Z · key ea5f78160088