Delete bookmarks on a remote: oxy push REMOTE --delete NAME f8c695764c95

    /// A deletion (spec §16.4): `new_state` is zero. The bookmark must exist

    /// at `old_state`, is never the repository's own bookmark (its default),

    /// and under a policy needs an attestation by a key that may update it.

    /// The deletion's attestation stays the bookmark's latest, so an older

    /// one cannot be replayed to bring it back.

    fn apply_deletion(

        &self,

        view: &mut View,

        u: &RefUpdate,

        policy: Option<&crate::policy::Policy>,

    ) -> std::result::Result<(), String> {

        let Some(current) = view.bookmarks.get(&u.name).copied() else {

            return Err(format!("no bookmark {:?} to delete", u.name));

        };

        if current != u.old_state {

            return Err("stale: the remote bookmark has moved; pull first".into());

        }

        if u.name == self.config.bookmark {

            return Err(format!(

                "{:?} is this repository's default bookmark and cannot be deleted",

                u.name

            ));

        }

        if let Some(p) = policy {

            let Some(sa) = &u.attestation else {

                return Err(format!(

                    "deleting {:?} requires a signed reference attestation under this repository's policy",

                    u.name

                ));

            };

            let signer = sa

                .sigs

                .first()

                .map(|s| s.key)

                .ok_or("attestation carries no signature")?;

            if !p.authorizes(&signer, &u.name) && !self.delegate_authorized(p, &signer, &u.name) {

                return Err(format!(

                    "key {} may not delete {:?} under this repository's policy",

                    signer.short(12),

                    u.name

                ));

            }

        }

        if let Some(sa) = &u.attestation {

            let last = self

                .latest_ref_attest(&u.name)

                .map_err(|e| e.to_string())?

                .and_then(|(_, a)| match a.attest.body {

                    AttestBody::Ref { serial, .. } => Some(serial),

                    _ => None,

                });

            self.check_ref_attest(sa, &u.name, &u.old_state, &u.new_state, last, false)?;

            let r = self

                .store

                .put_attest(&sa.attest)

                .map_err(|e| e.to_string())?;

            for sig in &sa.sigs {

                self.store

                    .put_signature(&r, sig)

                    .map_err(|e| e.to_string())?;

            }

            self.set_ref_attest(&u.name, &r)

                .map_err(|e| e.to_string())?;

        }

        view.bookmarks.remove(&u.name);

        Ok(())

    }

        if u.new_state.is_zero() {

            return self.apply_deletion(view, u, policy);

        }

    /// Delete `bookmark` on a remote (spec §16.4): an update to the zero

    /// state, attested when we have an identity. The local bookmark, if

    /// any, is kept; only the remote-tracking entry goes.

    pub fn push_delete(&self, remote_name: &str, bookmark: &str) -> Result<Vec<RefResult>> {

        let remote = self.open_named_remote(remote_name)?;

        self.check_remote_id(remote.as_ref(), remote_name, true)?;

        let resp = remote.refs()?;

        let Some(r) = resp.refs.iter().find(|r| r.name == bookmark) else {

            return fail(format!("{remote_name} has no bookmark {bookmark}"));

        };

        if resp.policy.is_some() && self.secret_key()?.is_none() {

            return fail(format!("{remote_name} enforces a trust policy; deleting needs an identity (`oxy identity create`)"));

        }

        let attestation = match self.secret_key()? {

            Some(_) => Some(self.sign_attest(&Attest {

                repo: self.id()?,

                hlc: Hlc::now(),

                body: AttestBody::Ref {

                    name: bookmark.to_string(),

                    old_state: r.state,

                    new_state: ObjectRef::ZERO,

                    serial: r.last_serial.unwrap_or(0) + 1,

                },

            })?),

            None => None,

        };

        let results = remote.push(

            Bundle::default(),

            vec![RefUpdate {

                name: bookmark.to_string(),

                old_state: r.state,

                new_state: ObjectRef::ZERO,

                force: true,

                attestation,

            }],

            None,

            vec![],

        )?;

        if results.iter().any(|x| x.ok && x.name == bookmark) {

            let (op_ref, op) = self.head_op()?;

            let mut view = op.view.clone();

            if let Some(m) = view.remotes.get_mut(remote_name) {

                m.remove(bookmark);

            }

            self.record_op(

                &[op_ref],

                &format!("oxy push {remote_name} --delete {bookmark}"),

                view,

            )?;

        }

        Ok(results)

    }

                    serial: next_serial(last_serial),

    }

}

/// The serial of a reference's next attestation: one more than the last the

/// remote reports, or, for a bookmark the remote does not have, the clock in

/// milliseconds, so a bookmark created again after a deletion goes past the

/// deletion's serial the remote keeps.

fn next_serial(last: Option<u64>) -> u64 {

    match last {

        Some(l) => l + 1,

        None => Hlc::now().wall_ms.max(1),

    let serial_of = |att: &SignedAttest| match att.attest.body {

        AttestBody::Ref { serial, .. } => serial,

        _ => unreachable!(),

    };

    // A bookmark new to the remote starts at the clock (past any deleted

    // namesake's serial); later updates count up from there.

    let first = serial_of(&att);

    assert!(first > 1_000_000_000_000, "{first}");

    assert_eq!(serial_of(&att), first, "a no-op push does not attest again");

    assert_eq!(serial_of(&att), first + 1);

}

/// Deleting a bookmark on a remote (spec §16.4): attested like any update,

/// never the remote's own bookmark, and a bookmark created again later is

/// accepted although the deletion's attestation stays the latest.

#[test]

fn bookmarks_are_deleted_on_a_remote() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let origin = Repo::init(&root.join("origin")).unwrap();

    let url = root.join("origin").to_string_lossy().to_string();

    let mut repo = Repo::clone(&url, &root.join("r"))

        .unwrap()

        .with_home(root.join("home"));

    repo.create_identity("Ada", "[email protected]", IdentityScope::Repo)

        .unwrap();

    let r = root.join("r");

    write(&r, "a.txt", b"a\n");

    repo.commit("a", &[]).unwrap();

    assert!(repo.push("origin", false).unwrap()[0].ok);

    repo.bookmark_create("feature/x", None).unwrap();

    assert!(repo.push_bookmark("origin", "feature/x", false).unwrap()[0].ok);

    assert!(origin.resolve_heads("feature/x").is_ok());

    let res = repo.push_delete("origin", "feature/x").unwrap();

    assert!(res[0].ok, "{res:?}");

    assert!(!origin.view().unwrap().bookmarks.contains_key("feature/x"));

    let (_, att) = origin.latest_ref_attest("feature/x").unwrap().unwrap();

    assert!(

        matches!(att.attest.body, AttestBody::Ref { new_state, .. } if new_state.is_zero()),

        "the deletion is attested"

    );

    assert!(

        repo.view().unwrap().bookmarks.contains_key("feature/x"),

        "the local bookmark stays"

    );

    assert!(!repo

        .view()

        .unwrap()

        .remotes

        .get("origin")

        .is_some_and(|m| m.contains_key("feature/x")));

    // Pushing it again creates it again, past the deletion's serial.

    let res = repo.push_bookmark("origin", "feature/x", false).unwrap();

    assert!(res[0].ok, "{res:?}");

    assert!(origin.view().unwrap().bookmarks.contains_key("feature/x"));

    // Nothing to delete, and never the remote's own bookmark.

    assert!(repo.push_delete("origin", "nope").is_err());

    let res = repo.push_delete("origin", "main").unwrap();

    assert!(

        !res[0].ok && res[0].reason.contains("default bookmark"),

        "{res:?}"

    );

    assert!(origin.view().unwrap().bookmarks.contains_key("main"));

    /// The bookmark of `name` that pushes may never delete (its default),

    /// when the host keeps one apart from the repository's own config.

    fn default_bookmark(&self, _name: &str) -> Option<String> {

        None

    }

                }

                let protected = self.backend.default_bookmark(name);

                let (refused, updates): (Vec<_>, Vec<_>) = updates.into_iter().partition(|u| {

                    u.new_state.is_zero() && protected.as_deref() == Some(u.name.as_str())

                });

                let mut report = r.receive_push_report(bundle, updates, policy, tags)?;

                for u in refused {

                    report.results.push(oxy_core::protocol::RefResult {

                        name: u.name.clone(),

                        ok: false,

                        reason: format!(

                            "{:?} is this repository's default bookmark and cannot be deleted",

                            u.name

                        ),

                    });

- [x] M11 (feedback 12, Andy: urgent) Flow runs numbered per repository, not by the hub-wide id; existing runs renumbered and their check links rewritten by migration 0019 (oxygenhub#23).

- [ ] M12 (Andy) Delete a bookmark on a remote: `oxy push REMOTE --delete NAME` (a signed, attested deletion the server checks like any update; never the default bookmark), and a delete button on the hub's bookmarks page for writers.

| **Status** | Draft 0.8l |

**Deleting a reference.** An update whose `new_state` is the zero ObjectRef deletes the bookmark (`oxy push REMOTE --delete NAME`). The bookmark MUST exist at `old_state`, and a server MUST refuse to delete its default bookmark. The update is attested like any other: under a policy the attestation is required and its key MUST be authorized for the reference. The deletion's attestation stays the reference's latest, so an older attestation cannot be replayed to bring the bookmark back. The first attestation of a reference the remote does not list takes the client's clock in milliseconds as its serial, which is past the serial of any deleted namesake; later ones increment it. Changes of a deleted bookmark stay until unreachable (§21).

*Changelog.* Draft 0.8l (2026-09-28): deleting a reference on a remote; first serials from the clock (§16.4). Draft 0.8k (2026-09-28): the manifest records graph keys, so unchanged files are neither read nor rendered (§12.4). Draft 0.8j (2026-09-28): checkpoint payload version 2, file graphs by reference (§11).

        /// Delete this bookmark on the remote (never its default bookmark);

        /// the local bookmark is kept

        #[arg(long, value_name = "NAME", conflicts_with_all = ["bookmark", "force"])]

        delete: Option<String>,

            delete,

        } => match delete {

            Some(name) => sync::push_delete(remote.as_deref(), &name, json),

            None => sync::push(remote.as_deref(), force, bookmark.as_deref(), json),

        },

/// `oxy push [REMOTE] --delete NAME`.

pub fn push_delete(remote: Option<&str>, name: &str, as_json: bool) -> Result<i32> {

    let repo = open()?;

    let remote = remote_name(remote);

    let sp = ui::spinner(&format!("Deleting {remote}/{name}…"));

    let results = repo.push_delete(&remote, name)?;

    sp.clear();

    if as_json {

        println!(

            "{}",

            json::arr(results.iter().map(|r| {

                json::obj([

                    ("name", json::s(&r.name)),

                    ("ok", json::b(r.ok)),

                    ("reason", json::s(&r.reason)),

                    ("state", json::s("")),

                ])

            }))

        );

        return Ok(if results.iter().all(|r| r.ok) { 0 } else { 1 });

    }

    let mut code = 0;

    for r in results {

        if r.ok {

            println!(

                "{} {}",

                ui::done("Deleted"),

                ui::id(format!("{remote}/{}", r.name))

            );

        } else {

            println!(

                "{} {} {}{}{}",

                ui::err(ui::glyph("✖", "x")),

                ui::err("Rejected"),

                ui::id(format!("{remote}/{}", r.name)),

                ui::sep(),

                r.reason

            );

            code = 1;

        }

    }

    Ok(code)

}