Compare main … agents-in-readme

# The CI profile (oxygen#139): every test runs, and a JUnit report is

# written to target/nextest/ci/junit.xml for the hub's test report

# (the job's `junit` artifact).

[profile.ci]

fail-fast = false

[profile.ci.junit]

path = "junit.xml"

// Cheap checks on the WASM tier (oxygenflow#96): OxygenFlow's checks module,

// copied from oxygenflow/.flow/checks.wasm (built there from

// crates/flow-checks; copy it again when it changes). No image and no KVM,

// so any runner with the WASM tier takes it: a phone, plex, windows-1.

sandbox "wasm" {

    runtime "wasm"

    memory-limit "64MiB"

}

// The changelog's shape, and a section for the version Cargo.toml says, so a

// release never finds its notes missing.

job "changelog" {

    sandbox "wasm"

    scope "CHANGELOG.md" "Cargo.toml" ".flow/checks.wasm"

    exec ".flow/checks.wasm" "changelog" "CHANGELOG.md" "Cargo.toml"

}

    rootfs "cas://blob/836461b613019f62399a960c61a25c482eb74e30054ff2cd44d5594c3305872b"

    rootfs "cas://blob/836461b613019f62399a960c61a25c482eb74e30054ff2cd44d5594c3305872b"

// The riscv64 build image on narvi-1 (oxygenflow#69): Ubuntu 24.04 riscv64

// with Rust 1.97.1 and the same vendored crates, in the syscall tier (the

// board has no hardware virtualisation, so no microVM). `runs-on` keeps it

// on a RISC-V runner.

sandbox "rust-riscv64" {

    runtime "syscall"

    rootfs "cas://blob/b4edba9173ddf63aa1df46222e6a59b265071b19f2815c89d0153b593835c616"

    runs-on "riscv64"

    memory-limit "4GiB"

    cpu-limit 6

    network "loopback"

    env {

        CARGO_INCREMENTAL "0"

        CARGO_PROFILE_RELEASE_DEBUG "0"

        CARGO_BUILD_JOBS "4"

    }

}

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

    // One build identity for every CI state, so the cached target stays

    // fresh from one push to the next (oxygenflow#52).

    env {

        OXY_BUILD "ci"

    }

// The tests, run under cargo-nextest and cargo-llvm-cov: a test report

// (JUnit, kept whether or not they pass; #139) for the hub's Tests tab and

// line coverage (LCOV, oxygenhub#113) for its Coverage tab, from one run.

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

    // One build identity for every CI state, so the cached target stays

    // fresh from one push to the next (oxygenflow#52).

    env {

        OXY_BUILD "ci"

    }

    exec "cargo" "llvm-cov" "nextest" "--workspace" "--locked" "--profile" "ci" "--lcov" "--output-path" "/src/target/lcov.info"

    output {

        artifact "junit" {

            path "/src/target/nextest/ci/junit.xml"

            when "always"

        }

        artifact "coverage" {

            path "/src/target/lcov.info"

        }

    }

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

        artifact "oxy-src.tar.gz" {

            path "/src/target/dist-flat/oxy-src.tar.gz"

        }

        }

    }

}

// The native RISC-V check (oxygenflow#69): oxy built and used on narvi-1,

// a real riscv64 board, so each release is known to run there and not

// only to cross-compile (dist). Like dist, a push runs it only when it

// touches these paths; "Run pipeline" and reruns always do. Its target

// directory is cached between passing runs (oxygenflow#70).

job "riscv64" {

    sandbox "rust-riscv64"

    depends-on "fmt"

    scope "Cargo.toml" "scripts/dist.sh" "packaging/**" ".flow/riscv64-check.sh"

    timeout "3h"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "16GiB"

        // Kept from this job's last passing run in the syscall tier too

        // (oxygenflow#70): the first build is cold (~40 min on narvi-1),

        // later ones build only what changed.

        cache "target"

        key "Cargo.lock"

    }

    exec "sh" ".flow/riscv64-check.sh"

    output {

        artifact "oxy-linux-riscv64-native" {

            path "/src/target/release/oxy"

#!/bin/sh

# The native RISC-V check (oxygenflow#69): on narvi-1, a riscv64 board,

# build oxy natively and use it, so a release is known to work on real

# RISC-V hardware, not only to cross-compile for it (dist does that).

set -eu

uname -m

cargo build --release --locked -p oxy

oxy=/src/target/release/oxy

"$oxy" --version

# A repository's life in miniature: an identity, a signed change, a

# bookmark, a merge, and a full integrity check.

export OXY_HOME="$(mktemp -d)"

cd "$(mktemp -d)"

"$oxy" --plain init

"$oxy" --plain identity create --name "narvi-1 check" --email [email protected]

"$oxy" --plain config --user core.sign change

echo one > a.txt

"$oxy" --plain commit -m "first"

"$oxy" --plain bookmark create side

"$oxy" --plain bookmark switch side

echo two > b.txt

"$oxy" --plain commit -m "second, on side"

"$oxy" --plain bookmark switch main

"$oxy" --plain merge side

"$oxy" --plain log

"$oxy" --plain verify

"$oxy" --plain fsck

test -f b.txt

echo "oxy works natively on $(uname -m)"

# oxygen#145: two changes adding changelog entries keep both.

CHANGELOG.md merge=union

## 0.11.0 (2026-11-04)

- **Changed: the changelog is checked on the WASM tier.** A `changelog` job in the pipeline runs OxygenFlow's checks module on any runner with the WASM tier, failing when the changelog's sections are out of shape or Cargo.toml's version has none.

- **Changed: moved subrepo pins are named (#162).** A pin moved by work inside a subrepo is a pin bump the parent's next commit records, and it used to go in unsaid. `oxy status` now lists it under *Subrepo pins* (old → new), and a subrepo's own uncommitted edits, which the parent does not record; a bare `oxy commit` that records a moved pin says so and how to leave it out (`oxy commit PATHS`).

- **Added: `oxy submodule remove --delete` (#164).** It deletes the subrepo's directory too, read-only object files and all, and refuses while the subrepo has uncommitted edits (`--force` to delete them anyway); without it, removal says the directory is left and how to delete it. A directory moved by hand used to fail halfway, after the copy, on the read-only files.

- **Changed: an agent's commit says "awaiting seal", not "unsigned" (#165).** In a checkout that signs keyless under an agent grant, a change of its own author that the next push will seal shows `◌ awaiting seal` in `oxy log` and `oxy show`; "unsigned" is kept for changes nothing will sign.

- **Fixed: a stale `author.key` can no longer fork your identity (#163).** A checkout that pinned `author.key` to a key a rotation made elsewhere had already succeeded built a second successor of it on `oxy identity delegate add`, splitting the identity in two. `rotate`, `renew` and `delegate add`/`remove` now refuse to start from a key that already has a successor in your home, naming the newest key and the `oxy config` that points at it; their report says which key they started from and which config named it; and `oxy identity show` warns when the configured key is not the newest, and names the key where an identity forks.

## 0.10.0 (2026-11-01)

- **Fixed: fetch, pull and clone are far faster with many bookmarks (#158).** They fetched each bookmark in its own exchange with the hub, and changes that bookmarks share were sent again for each one; a pull with nothing new still asked for a bundle per bookmark. Now every bookmark's heads are fetched in one exchange, and none when nothing is new. On a 47 MB repository with 160 bookmarks: a pull with nothing new 169 s → 3.5 s, a clone 324 s → 26 s. `OXY_TIMINGS` now also shows the refs, transparency log and per-bookmark checks of a fetch.

- **Added: `oxy git colocate`, a `.git` beside `.oxy` (oxygenhub#355).** Your editor's Git features (blame, history, gutter marks) and other Git tools now work on an Oxygen checkout: oxy keeps a `.git` there with the current bookmark exported after every command, Git's index at its tree so `git status` shows only your uncommitted work, and `.oxy/` excluded. One way: commit with oxy. `--off` stops it.

- **Changed: `.git` is never content.** oxy no longer picks up a `.git` directory at a checkout's top, and checkout refuses a path with a `.git` component at any depth (as Git does), so a change cannot plant Git hooks.

- **Added: a Git export from the change graph (oxygenhub#355).** oxy-core's `git_export_graph` writes every bookmark and tag to a bare Git repository so that the same changes give the same commits wherever it runs: each change a commit whose parents are its dependencies, each bookmark a branch (a merge of its heads when it has several), tags as tags, incrementally. It is what OxygenHub serves to `git clone`. (`oxy git export` still follows the checkout's own history.)

- **Added: `oxy mcp`, Oxygen for AI agents (#159).** An MCP server over stdio for a repository: an agent calls typed tools (status, diff, log, show, cat, blame, bookmarks, tags, conflicts, op log, identity, commit, amend, describe, fetch, pull, push, tlog verify) and gets each command's JSON back instead of reading a shell. It signs as the identity its environment configures, so started with an agent home every change is sealed via the agent with nothing to forget per command, and says who in its `initialize` reply. Commits name their paths (or `all: true`); undo and forced pushes are off unless started with `--allow-destructive`. The protocol itself is oxy-core's `mcp` module, for `oh mcp` to reuse. See docs/mcp.md.

- **Icons for HaikuDepot (#157).** `packaging/haikuports/icons/` has oxy's and oh's icons as HVIF (Haiku's vector format) with 16, 32 and 64 px PNGs, written by `make-icons.py`: the Oxygen mark on a pale tile for oxy, on OxygenHub's dark tile for oh, the same family as the VS Code extensions.

## 0.9.0 (2026-10-29)

- **Releases carry their source (#157).** Each release now has `oxy-VERSION-src.tar.gz`, the source as released, reproducible (sorted, fixed times and owners, gzip without a timestamp), listed in SHA256SUMS, for packagers to fetch at a fixed checksum. `packaging/haikuports/make-recipe.py oxy|oh TARBALL VERSION` writes the haikuports recipe from it (oh's from OxygenHub's source tarball); the 0.8.0 recipe, which used the on-demand archive, is gone.

- **Added: a haikuports recipe for oxy (#156).** `packaging/haikuports/` holds the recipe that builds oxy for HaikuDepot from the release source and every crate in `Cargo.lock`, and the script that writes it for a new release; the 0.8.0 recipe builds with haikuporter on Haiku R1/beta6.

- **Fixed: an expired checkout token no longer hides your sign-in (#155).** A checkout's own token for a remote (`remote.NAME.token`) is used first, so when it expired every fetch, pull and push answered 401 although `oxy auth login` had a good sign-in for the same hub. A checkout token the hub no longer knows (401) now falls back to that sign-in, with a warning naming `oxy config --unset remote.NAME.token` to drop the stale one; never to another checkout's token, and not when the token is refused for permission (403, 404), so a narrowly scoped token is never swapped for a wider sign-in. When both are refused, the error says to sign in again and unset it.

- **Added: the `artifact` object type (Cylinder C1, #108).** An artifact is now an object of its own in the store (oxy-core's `artifact` module), named by its object hash as every object is, and `oxy fsck` checks it; its tree stays a blob. Stores written before read as they did: the type is a new one at the end of the list.

- **Added: artifacts (Cylinder, step C1, #108).** `oxy artifact pack DIR --kind archive|package|container|runner-image|report [--arch --os --entrypoint --env K=V --label K=V]` packs a directory into an artifact: each file an ordinary blob of the repository's store, so files and chunks it holds already cost nothing, under a tree and an artifact encoding in canonical CBOR, named by the BLAKE3 of that encoding (docs/cylinder.md §4.1). `oxy artifact list | show NAME | unpack NAME DEST | verify NAME` (any unique prefix of six characters or more; `--json` on list, show and pack), and `oxy gc` keeps every artifact's blobs. The new `cylinder` crate holds the model.

- **Added: oxy on Haiku (#154).** oxy builds and runs on Haiku R1/beta6 (x86_64) with HaikuPorts' Rust; `oxy-VERSION-haiku-x86_64.tar.gz` is on the releases page from 0.8.0, with its own `SHA256SUMS-haiku`. The README says how to install it and how to build it (`ZSTD_SYS_USE_PKG_CONFIG=1`).

- **Fixed: a subrepo put back after its removal is pinned in the change that registers it (#152).** `oxy submodule remove` leaves a marker so the next snapshot drops the node while the directory stays; the snapshot cleared it only after reading it, so when nothing looked at the working copy between the removal's commit and the subrepo's return, the change that registered it again in `.oxymodules` left it out and a second commit was needed. A marker is now dropped before it is read once the removal is recorded or the path is registered again.

- **Fixed: `oxy identity create` needs no repository (#144).** Outside one it makes a user identity: the secret and identity go to the oxy home's keys and the user file names it as the author, so a new user or machine sets up an identity first; a repository made or cloned afterwards signs with it. Only `--local` needs a repository, and inside one it is kept there too, as before.

## 0.8.0 (2026-10-27)

- **A server can add a note to a reference a push moved (#148).** `oxy-server`'s `Backend` has a `push_notes` step: each note is added to that accepted reference's result, which `oxy push` shows in place of "updated". OxygenHub will use it to say when a push moves the bookmark of a proposal that has already landed (oxygenhub#329).

- **Identical sides settle by themselves (#146).** Two bookmarks that each resolved the same conflict to the same text conflicted again when merged, both sides the identical lines. A conflict whose sides are byte-identical now settles as `merge=union` adjacent insertions do (#145), in any file and keeping one side: a checkout writes it once ("kept one of its identical sides") and the next commit records the resolution, and a host landing a proposal settles it too.

- **A subrepo at its pinned state is unmodified on any bookmark (#147).** A subrepo whose heads were exactly its pin's but which sat on another bookmark than the pin named counted as modified, so `oxy bookmark switch` refused ("the working copy has changes"). Only the state counts now: the same repository at the same heads, or the same Git commit; the recorded pin stands.

- **A shallow clone fetches its checkpoint in parts (#137).** The checkpoint of a big state came as one answer, the whole state's graph blobs in one body (about 2 GB for the VS Code history), built and held whole on both sides. A server now answers `checkpoint-index` (the checkpoint and its history, no graphs), and the client fetches the graph blobs it lacks with `objects`, 2,048 at a time; `objects` reads them in pack order. An older server answers 404 and gets the one-piece request as before.

- **A keyless agent follows its owner's newest identity (#82).** Every delegation rotates its owner's identity, so the `author.key` an agent's home was given goes stale, and its changes named an identity two rotations old (verifying only because a grant from before a rotation still counts). With `author.for = ACCOUNT` in the home, the hub sends the account's newest linked identity with each certificate, with its chain back to the grant's key; oxy keeps it in the home (`keys/author.for`), stores the chain beside the change so the grant checks, and authors as it from then on. A repository's own `author.key` pin still wins.

- **Changelogs stop conflicting (#145).** A file marked `merge=union` in `.oxyattributes` (`CHANGELOG.md merge=union`) has its adjacent insertions settled by the checkout itself: both sides kept, the earlier change's first, as `oxy resolve --both` does, and the next commit records the resolution. Only adjacent insertions: where two changes changed the same lines, the markers stay. Oxygen's own changelog is marked so.

- **Two changes adding lines at the same place are settled with one command (#121).** Like Git, oxy leaves a conflict when two changes each add lines after the same line, since either order can be wrong for code; settling it meant editing out the markers by hand. `oxy resolve --both [PATH]…` now keeps every side of each such *adjacent insertion*, the earlier change's first (`--reverse` for the other order), and `oxy status` says which conflicts qualify. It leaves the markers where the sides changed the same lines (keeping both would keep two versions of them) or where the lines between the markers were edited. Conflict markers now list their sides earliest change first, not in hash order.

## 0.7.0 (2026-10-26)

- **Many objects are read in pack order (#137):** `Store::get_many` (a clone's checkpoint, a fetch's objects) reads packed objects by pack and offset, each thread a run of them, so a spinning disk sweeps instead of seeking across the packs; results keep the asked order. The server's gathering of a VS Code-sized checkpoint (tens of thousands of objects in ~95 packs) was the slow part of a depth-0 clone on Earth.

- **Windows paths print plainly (#143):** a repository's root showed as `\\?\C:\work\demo` in every message, Windows' verbatim form from `canonicalize`; oxy now drops the prefix where the plain path says the same (`oxy_core::portable::canonical`). Found running the shipped Windows build on a Windows 11 VM.

- **Oxygen's CI writes a test report beside its coverage (#139):** the test job runs under cargo-nextest (`.config/nextest.toml`, profile `ci`) as well as cargo-llvm-cov, keeping a JUnit report whether or not the tests pass, for the hub's Tests tab.

- **Pushing a new bookmark sends only what the remote lacks (#142).** A push was worked out against the remote's heads for that bookmark alone, so a bookmark new to the remote sent its whole history again: slow on a big repository, and OxygenHub's push protection scanned all of it (and refused a proposal's bookmark for an example key in a change main had had for weeks). The heads of every bookmark the remote lists now count as already there.

- **A binary file's or subrepo pin's conflict can be settled from the command line (#140).** Two changes that replaced the same binary file, or moved the same subrepo pin, leave a replace conflict with no markers to edit, and every commit was refused until it was settled, which only a hosted edit could do. `oxy resolve PATH…` now settles it with what the working copy holds at the path (the file, or the subrepo's pin): the next commit is a resolution replacing every version with it. A path with no replace conflict is refused, and a choice is forgotten once committed.

- **The object store works where hard links are refused (#141).** Android forbids apps hard links in their own storage, so the OxygenHub app's phone runner could clone nothing (`Permission denied`). Where a link is refused, objects are renamed into place with `renameat2(RENAME_NOREPLACE)`: as atomic, and still never over a name that is taken.

- **Rendering a big tree is many times faster, and clone, pull, switch and `oxy workspace add` stop rendering it twice (#137).** Measured on the VS Code history's depth-0 clone (19,545 files, 166,425 changes), `oxy workspace add` took 467 s on Earth and 176 s on an 8-core workstation, 11 GB at its peak; it now takes 7.5 s and 1.8 GB on the workstation. Three causes: (1) whether one change depends on another, which rendering asks about every deleted line, was answered by a depth-first walk that compared a change with the one sought only on coming back up to it, so it went through thousands of changes first although the answer is nearly always a direct dependency (spec §8.1): 262,678 questions took 4.4 billion steps and 838 CPU-seconds, and now take 5 CPU-seconds, with the same answers; (2) finding the subrepos rendered every file of the tree, after every clone, pull, switch and `workspace add`, where reading the tree and the subrepos' pins is enough; (3) a new workspace started on the target state with an empty directory, so the checkout's first snapshot found the whole tree deleted and rendered it to say so. `OXY_TIMINGS=1` now also says how a checkout's files were ordered (`graph: single order`…) and how its blobs were read.

- **`oxy serve` takes a push of more than 2 MB (#138).** It set no request limit of its own, so axum's default of 2 MB applied, and a larger push part was cut off with `Broken pipe` at the client and nothing in the server's log. It now takes up to 4 GiB a request (`oxy_server::BODY_LIMIT`), OxygenHub's default `push_body_limit`; OxygenHub was not affected.

- **A push no longer sends a replaced or removed binary file's old content again (#136).** A bundle carried both the old and the new blob of every binary file a change replaces, so a change removing ~1,100 tracked cache files (oxygenhub-android's set-up) pushed all of them again, over 100 MB, though the hub stored each when it was added. The old blob is always the new blob of a change the replacement depends on, which the receiver already holds or which the same bundle carries, so pushes and fetch answers now carry only the new one.

## 0.6.0 (2026-10-25)

- **A shallow clone of a big repository works, and quickly (#137).** `oxy clone --depth 0` of the VS Code history failed after eleven minutes ("object … not found"): the blobs of the state's binary files are named only by the changes that set them, which a depth-0 clone does not take, so nothing brought them. They are now fetched with the checkpoint (in parts), or left to be fetched on read under `--max-blob`. The checkpoint itself was stored object by object, each written loose and flushed (57,498 objects at 27 a second); it is now stored in one batch, as a fetch's objects are.

- **A checkpoint is served faster, and says where its time goes (#137).** A server gathered a checkpoint's graph blobs and their chunks one read at a time: six minutes for the VS Code state's 57,000. They are now read in two parallel batches. `OXY_TIMINGS=1` now times the checkpoint's phases on both sides (`checkpoint: gather its objects`, `serve: encode the checkpoint`, `remote: checkpoint answer`, `shallow: store the checkpoint` and the rest).

- **A depth-0 clone takes no change (#137).** `oxy clone --depth 0` took the head changes themselves (the VS Code import's main has 33,835 heads), though the checkpoint already holds every change's metadata, so depth 0 now takes none (spec §17's "a checkpoint plus zero history"): its heads become the shallow boundary, and commit, push and pull on top work as before (a shallow repository takes and builds on changes below what it cloned, which the remote holds).

- **A push no longer passes a proxy's request limit (#133).** A push to a hub behind Cloudflare, which takes at most 100 MB in one request, was refused `HTTP 413` with Cloudflare's HTML page printed raw: parts of a long push were about 256 MiB, and one change's blobs went in one request however many there were. Parts are now about 64 MiB (`push.batch-bytes`), a part whose blobs pass that sends them first in parts of objects alone, an HTML error page is shown by its title, and a 413 says how to push in smaller parts.

- **A keyless agent's grant survives its owner's key rotation (#135).** Every delegation an owner adds or removes renews their identity, and a repository that names the newest key as `author.key` read every change their agent sealed as INVALID ("key … is neither the author nor a delegate"), and its pushes were refused, because the agent's grant was signed by the owner's earlier key. A grant by a key the author's identity was rotated or renewed from now counts when it was made before that rotation; one an old key made after it does not.

- **A tag can be withdrawn, by a signed withdrawal (oxygenhub#301).** There was no way to remove a tag anywhere: a mistaken release tag stayed for good. `oxy tag delete NAME [-r REASON]` records an `untag` attestation naming the tag's state, signed like a tag (a ten-minute keyless key too), and the next `oxy push` sends it to a remote that still has the tag; `oxy push --delete tags/NAME` does both at once. A receiver under a policy accepts it only from a key that may create the tag, keeps it beside the tag's creation, and lists withdrawn tags in its refs answer (key 8), so a `fetch` withdraws the tag there too (`tag v1 was withdrawn on origin, and here`). A withdrawn name is never used again, so a tag name never names two states. `oxy-server`'s `Backend` gains `vet_tag_withdrawal` (OxygenHub refuses while a release uses the tag), and `Repo::host_tag_create` and `host_tag_withdrawal` let a host make or withdraw a tag for a signed-in user. The wire change is additive, but an older server refuses a withdrawal (wrong attestation kind), and an older client keeps a withdrawn tag.

- **A keyless agent's changes verify in a repository that has never seen its owner (#134).** An agent's ten-minute key is certified under its owner's signed grant, and a change it signed only verified where the owner's identity was already stored: in a new repository, or one the owner had not pushed to since a key rotation, `oxy log --verify` and the hub said INVALID ("grant is by an unknown author"). OxygenHub now sends the grant's signer with the certificate (`grantor_identity`, additive), `oxy` keeps it (else uses `<oxy home>/keys/<key>.identity`, or refuses with how to put it there), and a push brings it beside the certificate, so the receiver can check the grant.

## 0.5.1 (2026-10-20)

- **oxy 0.5.0 and older can clone a repository again after a keyless agent tagged it (#131).** Since #129 a release tag may be signed by a ten-minute certified key, which released clients do not know how to authorize: they refused the tag (`key … may not create tags/v0.5.0 under this repository's policy`), and with it the whole clone, fetch or `oxy submodule update`. Clients now send `User-Agent: oxy/<version>` and declare what they understand in `Oxy-Features` (`certified-tags` so far; docs/protocol.md, *Client capabilities*). Under a policy, a server leaves out of its refs answer to a client that does not declare `certified-tags` every tag that only a certificate authorizes, so that client clones the rest as if the tag did not exist. The rule is `Repo::refs_for_client` in oxy-core; `oxy-server` gains a `Backend::adjust_refs` hook, given the request headers, whose default applies it, so `oxy serve` and every embedding host do.

- **Keyless agents can create release tags (#129).** `oxy tag create` and `oxy push` under a keyless home was refused "unknown key": the push did not carry the tag signer's identity and certificate, and tags were authorized only by keys the policy names, never by a certificate under a subject grant. The push now carries them, and a receiver authorizes a short-lived key's tag by a subject grant at its own clock, as it does a bookmark move, and records when it accepted it (OxygenHub signs that with its key). A fetch checks such a tag at that acceptance, or at its integrated time when the hub's log gives one, so a release tag made with a ten-minute key is still fetched months later. A fetch never checks it at the time the tag claims: without an acceptance the tag is left out with a warning (`tags/NAME not updated`), and the rest is fetched. A client keeps the acceptance and serves and pushes it with the tag, so a tag passed on to another remote, or cloned from a clone, keeps its time. The wire change is additive: tags in `refs` and `push` gain keys 4 to 6 (acceptance, log place, cosigned checkpoints), which older readers ignore.

## 0.5.0 (2026-10-20)

- **A repository kept in a bucket finds signatures and seals without a LIST each (#116).** Every lookup of an object's signatures, seals, receipts, approvals or certificate listed a prefix in the bucket, and most of these lookups found nothing. Writers now also add each such entry to a journal (`pack-entries`, updated by compare-and-swap), and `oxy gc` folds them all into one list. Once a store has been folded, a reader reads the lists and the journal when it opens it, and again after 30 seconds (as long as the pack listing is kept), and looks everything up from them. Another writer's entry is seen within 30 seconds, as its pack would be, even by a handle a server keeps open. The first `oxy gc` also copies the one-list keys of much older stores (`sigs/`, `seals/`, `certs/`, …) into the current layout and marks them folded, so readers stop requesting them; until now nearly every lookup made one of these requests and found nothing. On the test store, 40 lookups went from 85 requests (40 LISTs) to 7 (one journal read and no LIST). Older readers are unaffected, because every entry still has its own key. Entries written by oxy 0.4.6 or older after the fold are missed until the next `oxy gc`, so upgrade every client that writes to the bucket first, then run `oxy gc` once. A server's `/health` counts journal reads as `read_journal`. A repository's own directory works as before.

- **A server can refuse a push by what it adds (oxygenhub#268).** `oxy-server`'s `Backend` has a `vet_push` step, called with the push's changes before anything is stored or moved; OxygenHub uses it for push protection (secret scanning). The refusal reaches `oxy push` as the server's own text, several lines included, and a refusal that mentions a certificate or a timeout no longer picks up a misleading hint.

- **Fetch checks the hub's transparency log (oxygenhub#238).** A hub that keeps a log sends its latest checkpoint with every refs answer, and each bookmark's attestation with its log entry and inclusion proof. The first fetch pins the hub's log key in `<oxy home>/tlog/<hub>` with the last checkpoint seen. A later checkpoint must be signed by that key and extend the last one: a smaller log, another root at the same size or a failed consistency proof fails the fetch, saying the hub showed two histories. An attestation not logged yet, or not proved, is only a note for now, printed by `fetch` and `pull` and in `--json`. A hub that comes back with a new log key (a new key, a reused address, a rename) is a loud note, and the new key is pinned. Older hubs and clients ignore the new fields.

- **`oxy tlog verify` audits a hub's whole log (oxygenhub#238).** It accepts the hub's checkpoint by the same rules as fetch, downloads every entry and requires them to make the root the checkpoint signs, then lists this repository's entries, a key's (`--key`) or all of them (`--all`); `--json` too. It also shows which witnesses cosigned and when.

- **Trusted time from witnesses (oxygenhub#240).** An entry's integrated time is the earliest time a trusted witness cosigned a checkpoint that holds it, by the witness's clock, so a hub can only make it later, never earlier. A fetch pins the hub's witnesses beside its log key (`<oxy home>/tlog/<hub>.witnesses`; a new or changed witness key is a note), counts a cosignature only when it verifies against a pinned key, and checks a delegate's delegation and a short-lived key's certificate at that time. Without one it checks them as before, at the hub's acceptance or the attestation's own time. A claimed time more than 10 minutes off the integrated time is noted, not refused, for now. The wire change is additive.

- **`oxy witness serve`: a witness anyone can run (oxygenhub#238).** `oxy witness serve --name HOST --log ORIGIN=FILE …` serves the C2SP tlog-witness `add-checkpoint` call. It cosigns, with this oxy home's key and its own clock, each checkpoint that verifies with the log's key and extends the last one it cosigned, and refuses a fork. What it cosigned is kept per log in `--state`, so it survives a restart.

- **`oxy show --stat` (#119).** Lists the files a change touched instead of its diff: each path with lines added and removed and its kind, renames as from → to, and a total. `--json` gives each file's counts.

- **`oxy merge` takes a remote's bookmark (#117).** `oxy merge oxygenhub/develop` said "no bookmark": merge looked only at local bookmarks, so merging what a remote has meant switching to it, pulling and switching back. It now takes a remote's tracking bookmark as last fetched, as revsets do, and says where it looked when neither exists.

- **Commit a resolution by paths, and amend only some paths (#118).** A conflict resolution can be committed by paths, leaving other work uncommitted on top of the resolved state, as long as the paths include every file it resolves, whole; otherwise the refusal names them. `oxy amend PATH…` folds only those paths into the head and leaves the rest uncommitted.

- **`oxy doctor` checks the trust policy (#127).** A repository with no policy was "Everything looks right" while every fetch warned that nothing was verified. Doctor now has a trust line: no policy is a warning that says who sets one and how; a policy shows its serial, roots, rules and expiry, warns within 30 days of expiry and fails once it has expired.

- **The same file added on both sides is one file (#101).** The same path added on two bookmarks with identical content (files, symlinks, or subrepos at the same pin) now merges with no conflict and nothing to resolve. Every peer and the hub show it the same way whatever order the changes came in, and it stays one file through later edits, moves, removals and partial commits. Different content or a different mode is still a name conflict, and directories are not unified. The stored and signed formats are unchanged.

- **A bookmark nobody can verify no longer breaks every fetch (oxygenhub#266, oxygenhub#271).** A delegate or short-lived key that moved a bookmark without signing any of its changes left every client failing the whole fetch with "unknown key". A fetch now carries the identities and certificates of the keys that signed every bookmark's latest attestation and every tag's, so clients, older ones included, can verify the move. A client that still cannot verify a bookmark other than the current one leaves that bookmark as it was, warns naming it and why, and fetches the rest. The current bookmark (the one a pull takes or a clone checks out) still fails, as does a missing, unauthorised or rolled-back attestation. The signers are gathered once per operation, not on every fetch call: a repository in a bucket with 145 bookmarks had taken 14 s a fetch.

- **Readers never wait for a push or gc (oxygenhub#249).** A repository can now be read safely while another process writes it. A handle reads the operation head once and keeps it, so one request never mixes two views. A read that misses reloads the pack list and tries once more. A repack retires the packs and loose objects it replaces instead of deleting them, and `gc` deletes them only an hour later; `oxy gc` says what it deleted or kept for readers. A forge no longer needs to hold readers back while it pushes or collects garbage.

- **A repository kept in a bucket lists its packs less often (#116).** Every open listed the bucket's packs, and a forge opens the store once per request. The pack listing is now kept for 30 seconds and forgotten the moment this process writes or deletes a pack, so its own packs are never hidden; another writer's new pack is seen within 30 seconds. Opening a store no longer sends a request per pack, and a bucket store's stat is a HEAD of the key, not a listing. A server's `/health` counts pack listings, kept listings and other listings apart.

- **Text that looks like a conflict marker no longer blocks a resolution (#126).** A file that showed oxy's own conflict markers, such as documentation or a test fixture, could never be committed as resolved ("markers remain"). A file now still has markers only when it holds a marker line oxy wrote for its conflicts. A real marker left behind is still caught.

- **A carried switch no longer says carried files were removed (#120).** After a switch that carried the working copy's changes, oxy said new files were "removed from disk" although they were still there. Carried files are now left out of what was removed, and the switch names what it carried.

## 0.4.6 (2026-10-17)

- **A keyless agent's grant token is its only credential (oxygenhub#241).** A home holding an agent grant token and no hub token now offers the grant to that hub, which accepts it for fetch and push as an agent's token of the owner's account (writing when the grant gives `refs`). The agent pushes its own work, so its seal is its own; it needs no personal access token.

- **Agents' signatures say whose they are.** A short-lived key is named by the subject it was certified for, so `oxy log` shows `via agent:claude@andymccall` and `oxy verify` shows `signed by agent:claude@andymccall`, rather than the author's name with an unfamiliar key.

- **`oxy config --unset core.sign` works.** It failed with "core.sign must be change or seal"; unsetting now returns to the default.

## 0.4.5 (2026-10-17)

- **Agents sign with no key of their own (oxygenhub#241).** With `author.signer = keyless`, oxy signs with a fresh key the hub certifies for ten minutes whenever it must sign, kept in memory only. The agent proves itself with a grant token its owner made with `oh agent grant NAME` and `oxy auth grant` keeps. The owner's own key signs the grant, which travels inside every certificate issued under it, so the agent's commits count in the owner's name without trusting the hub for authorship. The owner revokes the grant on the hub, and there is no key left to rotate or leak. `keyless.hub` names the hub (default: the default remote's).

- **Certificates for short-lived keys (spec §14.7).** A hub's key certifies a fresh key for a subject such as `repo:OWNER/NAME:bookmark:B` or `agent:NAME@ACCOUNT`, with a scope and a window of at most an hour. Pushes and fetches carry the certificates of the keys that signed what they bring. `oxy receipt verify` reads receipts that OxygenFlow runners sign with such keys.

- **Policies grant subjects an issuer certifies.** `oxy policy grant-subject SUBJECT --issuer IDENTITY --scope SCOPES` lets keys certified for a subject sign changes and move bookmarks. A push is checked at the receiver's clock. A fetch is checked at the time the issuer says it accepted the update, a countersigned `accepted` attestation the hub serves with the bookmark, so an expired key cannot backdate one.

- **A push seals for the author it signs for.** A delegate or a certified key set as `author.signer` now seals the author's unsigned changes at push, so it no longer has to sign each change at commit (`core.sign = change`).

- **gc keeps short-lived keys' certificates** for every change and attestation it keeps, not only receipts', so a fresh clone can still check a certified bookmark after a gc.

## 0.4.4 (2026-10-17)

- **A fresh clone takes tags made before a key rotation (#114).** A tag's signature was checked against the current trust policy with no regard for rotation, so every tag signed by a key since rotated away from was refused, and a fresh `oxy clone` of a repository with such a tag failed (this repository's own v0.1.0). A tag signed by a predecessor of a key the policy names is accepted when it is dated before that key's successor was made; a superseded key makes no new ones, and revoked keys never count.

- **SLSA provenance of a receipt (oxygenhub#239).** `oxy receipt export --format slsa` writes what a valid receipt says as an in-toto Statement with an SLSA provenance v1 predicate, in a DSSE envelope signed with your key, the runner's signed receipt riding along inside it. `oxy identity export --pem` writes the public key cosign and other DSSE verifiers check it with.

- **Repositories kept in a bucket answer quickly (oxygenhub#228, #234).** A forge serving a repository from GCS or S3 opened a new client for every request, read large packs by range without keeping what it read, asked the bucket for a loose copy of every packed object it read, and asked again and again about objects it lacked. Clients are now shared per bucket and credentials, ranges and sizes are kept on disk, packs are looked in first, and a key found missing is taken as missing for 30 seconds unless this process writes it. On a hosted repository in GCS, negotiate went from 7-10 s to well under a second and bucket requests from about 540 a minute to about 30. The store counts its requests by kind, for a server to show.

- **A quicker log and an instant clean diff (#94).** The workspace's state index keeps its changes newest first, and the log takes them as a list, with no map of every change and no sort. A diff whose working copy changes nothing is empty without loading the base. On VS Code at 20 000 commits, `log -n 20` went from 34 ms to 30 ms and a clean `diff` from 48 ms to 30 ms.

- **A credential helper that does not read its input works (#115).** An `erase` that exits without reading what oxy sends it failed now and then with Broken pipe; a closed pipe is no error now, as in Git.

- **gc leaves a fully packed store as it is.** gc repacks at its harder compression level, and a store that was already one such pack with nothing loose was rewritten every time, the same pack again: 37 seconds for this repository's 48 000 objects on a forge, nightly, under the repository's write lock. Such a store is now left alone.

- **A switch names what it takes off disk (#102).** `oxy bookmark switch` and `oxy checkout` printed only how many files they removed, easy to miss when a switch to a bookmark lacking 80 files took an editor's project file with them. They now name the first few removed files, with a warning when twenty or more go.

- **Binary files' current versions found without whole closures (#107).** Which replacement of a binary file is live was decided by building each replacing change's entire closure; on a history as long as VS Code's (166,000 commits) each is a hundred thousand changes, the memo could not keep them, and `oxy git verify` spent its day rebuilding them. A bounded walk that keeps nothing answers the same.

- **`--carry` takes work the target already has (#100).** Switching bookmarks or checking out with `--carry` refused when uncommitted files were byte-for-byte what the target state holds, as after a proposal of that work landed, leaving only `--discard`. Such work is now already applied: no conflict, nothing to carry, and the rest of the work comes along.

- **Full hashes as `--json` prints them (#103).** A change named by its full 64-digit hash without the `#`, as `oxy bookmark show --json` and the hub's API print heads, resolves wherever a change is named (`bookmark set`, `bookmark create`, `checkout`, …), so JSON output feeds back into commands.

- **Large new files are not snapshotted unseen, and past snapshots expire (#98).** A 1 GB image left untracked in a working tree was taken in by the next `status` and kept by the operation log for good: deleting the file and running `gc --now` freed nothing. Now a new, untracked file over `snapshot.max-new-file-size` (default 100 MiB) is left out and named by `status`, with how to ignore it or raise the limit; tracked files and files already in the working copy are unaffected. Past working-copy snapshots keep their files only for `core.snapshot-retention` (default 7 days), so `gc` prunes what only they held, and `oxy gc --expire-snapshots --now` does it at once. `undo` and `op restore` to an operation whose working copy has expired keep the files as they are.

- **`oxy undo` undoes this workspace's last command (#99).** It undid the repository's newest operation, whichever workspace made it: in a repository with several workspaces an undo could take back another workspace's commit or merge, and it said only which operation it went back to. Operations now record their workspace, and undo takes back this workspace's last command, leaving other workspaces' work as it is. On a bookmark both share, only its own heads go; a change another workspace built on it, or the workspace it would take away, refuses the undo and names it. Undo now says which command it undid and what that changed, passes over pushes (the remote keeps what it was sent), and warns when an undone commit is already on a remote. `oxy amend` warns when it rewrites a change a remote already has, so the next push will need `--force`.

- **gc can keep what a host names (oxygenhub#126).** `Repo::gc_keeping` keeps extra blobs and their chunks beside what history reaches, so a forge's job artifacts, referenced only from its own database, survive garbage collection.

- **`oxy remote remove` removes all of a remote (#86).** It blanked the URL alone: the token, CA and store settings stayed in the config and the remote's tracking bookmarks in the view, read later as if current. Now every `remote.NAME.*` key goes, with its tracking bookmarks and a store remote's mirror; an unknown name is refused.

## 0.4.3 (2026-10-10)

- **Claim your own commits in a Git import (#97).** `oxy git import --claim` and `oxy git fetch --claim` set `git.claim`: a commit whose Git author email is your identity's email is authored with your key (and sealed by you on push), so a forge credits it to your account; anyone else's commits keep the zero key, as before.

- **Git imports of long histories much faster (#96).** Rendering a file asks whether the changes that deleted and inserted neighbouring lines depend on each other; in a deep history each answer was a walk through thousands of changes, asked again for every line, under a lock every rendering thread queued on. Answers are now remembered for the file being rendered, the shared memos are read without excluding other threads, and a merge renders its files on every core. On VS Code past 66 000 commits, 500 commits imported in 261 s rather than 734 s, with the same history.

- **A long push goes in parts (#95).** `oxy push` sent a whole history in one request, held in memory on both sides; the full VS Code import would have passed a hub's 4 GiB limit. It now sends parts of about `push.batch-bytes` (default 256 MiB) in dependency order, objects alone, and the last part moves the bookmark; the spinner says which part is going. A server stores a part and reports it as `objects`.

- **A state index read only as far as it is used (#94).** Each file's history in the workspace's state index is stored after the rest with a hash of its own, and is read and checked only when a command builds that file, so a diff or a one-file cat no longer reads and hashes the histories of every file (67 MB of an 84 MB index on VS Code at 20 000 commits). Changes added on top of an index no longer decode the histories they touch. A history found damaged is an error that says so, and the index is removed and rebuilt by the next command. Under load on that repository, `diff` went from 85 ms to 63 ms and `cat`/`blame` from 102 ms to 80 ms.

- **Removing a file removes every copy of it (#88).** When two lines of history each put a file back in the same place, it has two placements there and shows as one file. Removing or moving it retired only one, so the other stayed behind, and once its directory went it was an orphan: a conflict in the state. It is the one difference the Git import of VS Code had in its first 31 000 commits. Both now go together, in a commit and in a Git import.

- **A quicker log and diff on long histories (#94, first part).** `oxy log` no longer reads the working copy's metadata through the store's cache, walks the history with a fast hash and without copying each change's metadata, and works out the shortest unique id prefixes for the changes it shows rather than for every change. The state index is read without copying the file histories in it, and its change list is checked on every core. On VS Code at 20 000 commits, `log -n 20` went from 74 ms to 40 ms and loading the state index from 43 ms to 28 ms, with the same output.

- **Faster commits, and the state index after a checkpoint (#93).** A state loaded through a checkpoint read the changes after it whole, text included, so it could never be saved as the workspace's state index and every command after a checkpoint loaded history the long way (25 s for the first commit on VS Code at 20 000 commits). It now reads them as the index needs them. `oxy commit PATHS` no longer takes a second snapshot to count what it left when it took everything. A one-file commit on VS Code went from about 450 ms to 300 ms; 70 ms of that is the store's fsync, which stays.

- **Reading one file reads one file (#92).** `oxy cat` rendered every file of the state to print one. It now builds only that file, from the workspace's state index when it reads the working copy's base or the state it is on. On VS Code at 20 000 commits, `cat package.json -r main` went from 26 s to 0.10 s and at a change from 2016 from 0.66 s to 0.16 s; on the full 166 000-change history it takes 1.9 s and 1.3 GB, where it ran for minutes and used 9 GB.

- **A file's history in a fraction of a second (#91).** `oxy log --path` rendered every file of the tree twice just to find the path, and both it and the `touches()` revset decoded every change of the history, its text included, to see what each one touched. They now read the path from the tree alone and keep the nodes each change touches in a cache beside the store (`.oxy/index/touched`, rebuilt if missing). On VS Code at 20 000 commits, `log --path package.json` went from 53.6 s to 0.16 s (Git: 0.15 s) and `touches("package.json")` from 3.4 s to 0.16 s, with the same output.

## 0.4.2 (2026-10-09)

- **`pull` brings a working copy that fell behind up to its bookmark (#89).** The working copy followed a pull only from exactly the bookmark's old heads, and not at all when the pull brought nothing new, so one left behind by `bookmark set`, a landing or a pull from another workspace stayed on old code while `status` said clean. It now follows whenever its base is part of the bookmark's state, clean or carrying uncommitted work, and `status` says when the working copy is behind its bookmark and by how many changes.

- **Faster merges in a Git import (#80).** A merge is built from only the paths it can change, as an ordinary commit is: on VS Code at 139 000 commits merges import 3.2 times faster (9.5 s against 30.9 s on average) and the import as a whole 2.7 times faster, with exactly the history the whole-tree path builds. `OXY_IMPORT_WHOLE_MERGES=1` takes the old path.

- **A binary file changed and made executable at once keeps both (#87).** `oxy commit` and the Git import dropped the executable bit when a binary file got new contents in the same change.

- **Several remotes and no origin (#83).** `core.remote` names the default remote; `bookmark list` compares with a remote that has the bookmark and names it; the error without a default says what to do.

- **No i386 notice from apt (#85).** The .deb's apt source names the machine's own architecture, and an upgrade adds it to a source written before, so a system with i386 enabled no longer warns on every update.

- **Clearer messages.** A missing author identity says which config set it and how to pin the right one (#82); `oxy git verify --max-differences N` and a summary of what differs by kind.

## 0.4.1 (2026-10-08)

- **The prompt agrees with status in a repository with subrepos (#75).** Straight after a commit or a merge, `oxy prompt` took a subrepo's directory for a recently changed file and showed `*` until a full `oxy status` ran. Subrepos are now compared by their pins.

- **Catching up a stale bookmark (#74).** `oxy bookmark switch` brings a bookmark that is only behind its remote up to it first, rather than checking out the stale state. `oxy pull` takes uncommitted work along when the pulled changes leave its files alone, instead of leaving the working copy behind, and `checkout --carry` no longer counts a subrepo already at the target's pin as a change.

- **`bookmark set` fast-forwards (#78).** Moving a bookmark onto work built on its newest head keeps the older changes it held that the new one doesn't depend on, as `--upto` does, and says so. A head the bookmark already holds is still refused without `--upto` or `--only`.

- **A bookmark's heads by name (#73).** `oxy bookmark show [NAME]` lists each head, newest first; `bookmark list -v` does it for every bookmark, and `bookmark list` names the newest head's subject. `bookmark(NAME)` in a revset is a local or remote bookmark's heads and nothing else.

- **Clearer messages.** `submodule status` and `update` name `.oxymodules` entries that were never added, with the command that pins them, and `update` exits 1 (#72). `oxy cat -r CHANGE`'s help and error say that a change means its dependency closure, and suggest `-r BOOKMARK` or `--at-op` (#76).

- **A long Git import can stop and carry on (#77, #79).** An import moves its bookmark to the commits done so far every 2 000 commits, so `oxy git fetch` resumes it. `oxy git recover` rescues an import that stopped before its first checkpoint, or ran on an older oxy: it indexes the objects already written (each checked, a torn last one cut off) and points the bookmark at them. It recovered 139 086 commits of VS Code in under two minutes. `oxy git fetch ../path` with a relative path works.

- **`oxy git verify` in bounded memory (#81).** It held the ancestry of every commit and ran out of memory on VS Code; it now holds only the commits whose children are still to come, and checks 120 000 commits in under 1 GB. On an import not finished yet it stops at the last imported commit, counts `--last` from there, and says how many are still to come.

- **Measuring an import (#80).** `OXY_IMPORT_STOP_AFTER=N` ends an import cleanly after N commits with its timings; the trace gives each commit's time and which path each merge took. Merges built from only the paths they can change are in, behind `OXY_IMPORT_PARTIAL_MERGES=1` until verified at depth: on VS Code a small merge goes from about 18 s to under a second. An import stopping early no longer dies of SIGPIPE.

- **Cloud stores take credentials handed over (#68).** `oxy_strata::Credentials` (an S3 access key, a Google service account key, an Azure service principal) can be given when a store is opened, and a program can register a lookup for the stores it opens by URL. With them, nothing from the environment or the providers' files is used, which lets a hub keep each repository's credentials itself. Their debug form never shows a secret.

- **A repository kept on a store (#68).** `oxy init --store URL` keeps a repository's objects and operation log on `dir://`, S3, GCS or Azure, behind a local cache of `storage.cache` bytes (2 GiB by default) that can be deleted at any time. Checked against the real services: a commit takes 0.5 to 0.9 seconds, and reopening with no cache about half a second.

- **A caching store, and the operation head on a store (#68).** `strata::CachingStore` puts a local directory in front of any store: reads are kept, writes go to the remote first, the cache stays under a size limit by removing what was used least recently, and references always come from the remote. A repository kept on a store other than this disk's directory now holds its operation head there, moved by compare-and-swap with merge and retry.

- **A large merge's file no longer imports empty (#71).** When a merge rendered its files in batches, a file whose graph the import had already built came out empty, so the merge recorded the whole file as inserted again and conflicted with itself: VS Code's history failed verification from 2016 on. Built graphs are now copied. The 10 412-commit reproducer imports and verifies every commit.

- **Git import holds a budget of graph memory (#25).** A long-lived file's graph keeps every line it ever had, and the import shed a kept state's graphs only past 2 000 of them; it now also sheds them past 1.5 million atoms, and gives freed memory back after each merge. A 28 637-commit slice of VS Code imports at 5.1 GB instead of 16.9 GB, in 36 minutes instead of 61, with the same verify result. The dependency check no longer memoises every queried change's whole ancestry.

name = "cylinder"

version = "0.11.0"

dependencies = [

 "blake3",

 "oxy-core",

 "tempfile",

 "thiserror 1.0.69",

]

[[package]]

 "const-oid",

version = "0.11.0"

 "cylinder",

version = "0.11.0"

 "serde_json",

 "sha2",

version = "0.11.0"

 "tower",

version = "0.11.0"

members = ["crates/oxy-core", "crates/oxy-server", "crates/oxy-strata", "crates/cylinder", "."]

version = "0.11.0"

cylinder = { path = "crates/cylinder" }

[![OxygenFlow](https://oxygenhub.io/andymccall/oxygen/flow/badge.svg)](https://oxygenhub.io/andymccall/oxygen/flow) [![coverage](https://oxygenhub.io/andymccall/oxygen/coverage/badge.svg)](https://oxygenhub.io/andymccall/oxygen/coverage)

An agent can also work through `oxy mcp`, an MCP server for the repository: typed tools instead of a shell, signing as the identity it was started with, and nothing destructive unless you allow it (see [docs/mcp.md](docs/mcp.md)).

Builds for Linux, macOS, Windows and Haiku are on the [releases page](https://oxygenhub.io/andymccall/oxygen/releases). These are early releases: the macOS and Windows builds are not signed and have had little testing.

- **Haiku** (R1/beta6, x86_64): unpack `oxy-VERSION-haiku-x86_64.tar.gz` and copy `oxy` to `~/config/non-packaged/bin`. It is built in a Haiku guest rather than by OxygenFlow, so it has its own `SHA256SUMS-haiku` and no build attestation.

On Haiku, install `rust_bin` and `zstd_devel` with pkgman and build with `ZSTD_SYS_USE_PKG_CONFIG=1 cargo build --release`: zstd-sys then links Haiku's libzstd, since a system library also references zstd and ld refuses the bundled copy's hidden symbols.

**Changelog:** a commit that changes code adds a line under `## Unreleased` in CHANGELOG.md (Added, Changed, Fixed or Security, with the issue number); versions change only at release. `scripts/changelog-check.sh [PATH...]` checks it for the paths a commit takes (the working copy's changes without any) and runs in the gate; `NO_CHANGELOG=1` for code changes users won't notice.

| `docs/mcp.md` | `oxy mcp`: the repository as tools for AI agents |

    // The heads name the build only when OXY_BUILD does not: a CI job that

    // sets it stays fresh from one state to the next (oxygenflow#52).

    if !std::env::var("OXY_BUILD").is_ok_and(|b| !b.trim().is_empty()) {

        println!("cargo:rerun-if-env-changed=FLOW_HEADS");

    }

[package]

name = "cylinder"

version.workspace = true

edition.workspace = true

license.workspace = true

description = "Cylinder: artifacts as trees of Oxygen chunks (docs/cylinder.md)"

[dependencies]

oxy-core = { path = "../oxy-core" }

blake3 = "1"

thiserror = "1"

[dev-dependencies]

tempfile = "3"

//! Cylinder, step C1 (docs/cylinder.md §4.1): an **artifact** is an

//! immutable, content-addressed object naming a tree of files, each kept as

//! an ordinary Oxygen blob of FastCDC BLAKE3 chunks. An image rebuilt with

//! one changed file moves only that file's changed chunks, and a binary in

//! a release archive and in a runner image is the same chunks.

//!

//! The model is oxy-core's ([`oxy_core::artifact`]): an `artifact` object

//! in canonical CBOR, named by its object hash, whose tree is a blob. This

//! crate packs a directory into one, opens, verifies and unpacks it, and

//! keeps it: `.oxy/artifacts/NAME` records each artifact this repository

//! keeps, which garbage collection keeps with its tree and files

//! ([`roots`]).

use oxy_core::hash::{ObjectRef, ObjectType};

use oxy_core::repo::Repo;

use std::collections::BTreeMap;

use std::path::{Path, PathBuf};

pub use oxy_core::artifact::{

    Artifact, DirTree, Entry, Kind, MODE_EXEC, MODE_FILE, MODE_LINK, VERSION,

};

#[derive(Debug, thiserror::Error)]

pub enum Error {

    #[error(transparent)]

    Repo(#[from] oxy_core::repo::RepoError),

    #[error("io: {0}")]

    Io(#[from] std::io::Error),

    #[error("not an artifact: {0}")]

    Object(#[from] oxy_core::objects::ObjectError),

    #[error("store: {0}")]

    Store(#[from] oxy_core::store::StoreError),

    #[error("{0}")]

    Bad(String),

}

pub type Result<T> = std::result::Result<T, Error>;

fn bad<T>(msg: impl Into<String>) -> Result<T> {

    Err(Error::Bad(msg.into()))

}

/// What to pack a directory as.

#[derive(Clone, Debug)]

pub struct Spec {

    pub kind: Kind,

    pub arch: Option<String>,

    pub os: Option<String>,

    pub entrypoint: Option<Vec<String>>,

    pub env: BTreeMap<String, String>,

    pub labels: BTreeMap<String, String>,

}

impl Spec {

    pub fn new(kind: Kind) -> Spec {

        Spec {

            kind,

            arch: None,

            os: None,

            entrypoint: None,

            env: BTreeMap::new(),

            labels: BTreeMap::new(),

        }

    }

}

/// An artifact kept in a repository, with its name.

#[derive(Clone, Debug)]

pub struct Kept {

    pub name: String,

    pub artifact: Artifact,

    /// Its object (its name, as a reference).

    pub object: ObjectRef,

}

fn kept_dir(repo: &Repo) -> PathBuf {

    repo.oxy_dir().join("artifacts")

}

/// Every file under `dir`, by relative path: regular files and links, in

/// path order. `.oxy` and `.git` directories are not part of an artifact.

fn walk(dir: &Path) -> Result<Vec<(String, PathBuf, std::fs::Metadata)>> {

    let mut out = Vec::new();

    let mut stack = vec![(dir.to_path_buf(), String::new())];

    while let Some((d, rel)) = stack.pop() {

        for e in std::fs::read_dir(&d)? {

            let e = e?;

            let name = e

                .file_name()

                .into_string()

                .map_err(|n| Error::Bad(format!("{n:?} is not UTF-8")))?;

            let path = if rel.is_empty() {

                name.clone()

            } else {

                format!("{rel}/{name}")

            };

            let md = std::fs::symlink_metadata(e.path())?;

            if md.is_dir() {

                if name != ".oxy" && name != ".git" {

                    stack.push((e.path(), path));

                }

            } else if md.is_file() || md.file_type().is_symlink() {

                out.push((path, e.path(), md));

            }

        }

    }

    out.sort_by(|a, b| a.0.cmp(&b.0));

    Ok(out)

}

#[cfg(unix)]

fn mode_of(md: &std::fs::Metadata) -> u32 {

    use std::os::unix::fs::PermissionsExt;

    if md.file_type().is_symlink() {

        MODE_LINK

    } else if md.permissions().mode() & 0o111 != 0 {

        MODE_EXEC

    } else {

        MODE_FILE

    }

}

#[cfg(not(unix))]

fn mode_of(md: &std::fs::Metadata) -> u32 {

    if md.file_type().is_symlink() {

        MODE_LINK

    } else {

        MODE_FILE

    }

}

/// Pack the files under `dir` into an artifact of `spec`'s kind in

/// `repo`'s store: each file a blob, so files and chunks the store holds

/// already cost nothing; then its tree and its encoding, kept under its

/// name.

pub fn pack(repo: &Repo, dir: &Path, spec: &Spec) -> Result<Kept> {

    if !dir.is_dir() {

        return bad(format!("{} is not a directory", dir.display()));

    }

    let mut tree = DirTree::default();

    for (path, full, md) in walk(dir)? {

        let mode = mode_of(&md);

        let bytes = if mode == MODE_LINK {

            std::fs::read_link(&full)?

                .to_string_lossy()

                .into_owned()

                .into_bytes()

        } else {

            std::fs::read(&full)?

        };

        let blob = repo.store_blob(&bytes)?;

        tree.entries.push(Entry {

            path,

            mode,

            blob,

            size: bytes.len() as u64,

        });

    }

    let artifact = Artifact {

        kind: spec.kind,

        arch: spec.arch.clone(),

        os: spec.os.clone(),

        tree: repo.store_blob(&tree.encode())?,

        entrypoint: spec.entrypoint.clone(),

        env: spec.env.clone(),

        labels: spec.labels.clone(),

        total_size: tree.entries.iter().map(|e| e.size).sum(),

        receipt: None,

    };

    let object = repo.store().put(ObjectType::Artifact, &artifact.encode())?;

    let name = object.to_hex();

    std::fs::create_dir_all(kept_dir(repo))?;

    std::fs::write(kept_dir(repo).join(&name), b"")?;

    Ok(Kept {

        name,

        artifact,

        object,

    })

}

/// The names of the artifacts kept in `repo`, sorted.

pub fn list(repo: &Repo) -> Result<Vec<String>> {

    let mut out = Vec::new();

    match std::fs::read_dir(kept_dir(repo)) {

        Ok(rd) => {

            for e in rd {

                let n = e?.file_name().to_string_lossy().into_owned();

                if n.len() == 64 && n.bytes().all(|b| b.is_ascii_hexdigit()) {

                    out.push(n);

                }

            }

        }

        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}

        Err(e) => return Err(e.into()),

    }

    out.sort();

    Ok(out)

}

/// The kept artifact `name` names, or a unique prefix of it (at least six

/// characters), read from the store, which checks it against its name.

pub fn open(repo: &Repo, name: &str) -> Result<Kept> {

    let name = name.to_ascii_lowercase();

    if name.len() < 6 {

        return bad("name an artifact by at least six characters of its name");

    }

    let found: Vec<String> = list(repo)?

        .into_iter()

        .filter(|n| n.starts_with(&name))

        .collect();

    let full = match found.as_slice() {

        [one] => one.clone(),

        [] => {

            return bad(format!(

                "no artifact {name} here; `oxy artifact list` shows them"

            ))

        }

        _ => {

            return bad(format!(

                "{name} names {} artifacts: give more of the name",

                found.len()

            ))

        }

    };

    let object = ObjectRef::from_hex(&full).map_or_else(

        || bad(format!("artifact {full}: its record is damaged")),

        Ok,

    )?;

    // The store checks the bytes against the object's name as it reads.

    let bytes = repo.store().get_typed(&object, ObjectType::Artifact)?;

    Ok(Kept {

        name: full,

        artifact: Artifact::decode(&bytes)?,

        object,

    })

}

/// An artifact's tree.

pub fn tree(repo: &Repo, a: &Artifact) -> Result<DirTree> {

    Ok(DirTree::decode(&repo.read_blob(&a.tree)?)?)

}

/// Check that every file of `k` is in the store whole: its bytes read, at

/// the size its tree says. Answers how many files were read.

pub fn verify(repo: &Repo, k: &Kept) -> Result<usize> {

    let t = tree(repo, &k.artifact)?;

    let mut total = 0;

    for e in &t.entries {

        let n = repo.read_blob(&e.blob)?.len() as u64;

        if n != e.size {

            return bad(format!(

                "{}: {n} bytes, but the tree says {}",

                e.path, e.size

            ));

        }

        total += n;

    }

    if total != k.artifact.total_size {

        return bad(format!(

            "the files are {total} bytes together, but the artifact says {}",

            k.artifact.total_size

        ));

    }

    Ok(t.entries.len())

}

/// Write `k`'s files under `dest`, which must not exist or be empty.

pub fn unpack(repo: &Repo, k: &Kept, dest: &Path) -> Result<usize> {

    if dest.exists() && std::fs::read_dir(dest)?.next().is_some() {

        return bad(format!("{} is not empty", dest.display()));

    }

    let t = tree(repo, &k.artifact)?;

    for e in &t.entries {

        let out = dest.join(&e.path);

        if let Some(p) = out.parent() {

            std::fs::create_dir_all(p)?;

        }

        let bytes = repo.read_blob(&e.blob)?;

        if e.mode == MODE_LINK {

            #[cfg(unix)]

            std::os::unix::fs::symlink(String::from_utf8_lossy(&bytes).as_ref(), &out)?;

            #[cfg(not(unix))]

            std::fs::write(&out, &bytes)?;

            continue;

        }

        std::fs::write(&out, &bytes)?;

        #[cfg(unix)]

        if e.mode == MODE_EXEC {

            use std::os::unix::fs::PermissionsExt;

            std::fs::set_permissions(&out, std::fs::Permissions::from_mode(0o755))?;

        }

    }

    Ok(t.entries.len())

}

/// The blobs garbage collection must keep for the kept artifacts: each

/// one's encoding, its tree and its files (`Repo::gc_keeping`).

pub fn roots(repo: &Repo) -> Result<Vec<ObjectRef>> {

    let mut out = Vec::new();

    for name in list(repo)? {

        let k = open(repo, &name)?;

        out.push(k.object);

        out.push(k.artifact.tree);

        out.extend(tree(repo, &k.artifact)?.entries.iter().map(|e| e.blob));

    }

    Ok(out)

}

#[cfg(test)]

mod tests {

    use super::*;

    use oxy_core::cbor::{self, Value};

    fn repo(dir: &Path) -> Repo {

        Repo::init(&dir.join("repo")).unwrap()

    }

    #[test]

    fn a_directory_packs_into_an_artifact_and_back() {

        let t = tempfile::tempdir().unwrap();

        let r = repo(t.path());

        let src = t.path().join("out");

        std::fs::create_dir_all(src.join("bin")).unwrap();

        std::fs::write(src.join("README"), b"hello\n").unwrap();

        std::fs::write(src.join("bin/tool"), vec![7u8; 300_000]).unwrap();

        #[cfg(unix)]

        {

            use std::os::unix::fs::PermissionsExt;

            std::fs::set_permissions(src.join("bin/tool"), std::fs::Permissions::from_mode(0o755))

                .unwrap();

            std::os::unix::fs::symlink("bin/tool", src.join("tool")).unwrap();

        }

        let mut spec = Spec::new(Kind::Archive);

        spec.arch = Some("x86_64".into());

        spec.labels.insert("version".into(), "0.1.0".into());

        let k = pack(&r, &src, &spec).unwrap();

        assert_eq!(k.name, k.artifact.name().to_hex());

        assert_eq!(

            k.artifact.total_size,

            300_006 + if cfg!(unix) { 8 } else { 0 }

        );

        assert_eq!(list(&r).unwrap(), vec![k.name.clone()]);

        let again = open(&r, &k.name[..10]).unwrap();

        assert_eq!(again.artifact, k.artifact);

        let paths: Vec<(String, u32)> = tree(&r, &again.artifact)

            .unwrap()

            .entries

            .into_iter()

            .map(|e| (e.path, e.mode))

            .collect();

        assert_eq!(paths[0], ("README".into(), MODE_FILE));

        assert_eq!(

            paths[1],

            (

                "bin/tool".into(),

                if cfg!(unix) { MODE_EXEC } else { MODE_FILE }

            )

        );

        assert_eq!(verify(&r, &again).unwrap(), paths.len());

        let dest = t.path().join("back");

        unpack(&r, &again, &dest).unwrap();

        assert_eq!(

            std::fs::read(dest.join("bin/tool")).unwrap(),

            vec![7u8; 300_000]

        );

        #[cfg(unix)]

        assert_eq!(

            std::fs::read_link(dest.join("tool")).unwrap(),

            Path::new("bin/tool")

        );

        assert!(unpack(&r, &again, &dest)

            .unwrap_err()

            .to_string()

            .contains("not empty"));

        // The same files pack to the same name; garbage collection keeps it.

        assert_eq!(pack(&r, &src, &spec).unwrap().name, k.name);

        let keep = roots(&r).unwrap();

        assert!(keep.contains(&k.object) && keep.contains(&k.artifact.tree));

        r.gc_keeping(true, &keep, &mut |_| {}).unwrap();

        // An artifact is an object of its own, which fsck reads and accepts.

        let report = r.fsck().unwrap();

        let errors: Vec<_> = report

            .problems

            .iter()

            .filter(|p| p.severity == oxy_core::repo::Severity::Error)

            .collect();

        assert!(errors.is_empty(), "{errors:?}");

        assert_eq!(

            verify(&r, &open(&r, &k.name).unwrap()).unwrap(),

            paths.len()

        );

    }

    #[test]

    fn encodings_are_canonical_and_checked() {

        let a = Artifact {

            kind: Kind::RunnerImage,

            arch: Some("riscv64".into()),

            os: Some("linux".into()),

            tree: ObjectRef([1; 32]),

            entrypoint: Some(vec!["/sbin/init".into()]),

            env: [("PATH".to_string(), "/bin".to_string())].into(),

            labels: BTreeMap::new(),

            total_size: 42,

            receipt: Some(ObjectRef([2; 32])),

        };

        let bytes = a.encode();

        assert_eq!(Artifact::decode(&bytes).unwrap(), a);

        assert_eq!(

            a.name(),

            oxy_core::hash::hash_object(ObjectType::Artifact, &bytes)

        );

        assert!(Kind::parse("tarball")

            .unwrap_err()

            .to_string()

            .contains("runner-image"));

        let wrong = |v: Value| Artifact::decode(&cbor::encode(&v)).unwrap_err().to_string();

        assert!(wrong(Value::map([(0, Value::Uint(2))])).contains("version"));

        assert!(wrong(Value::map([(0, Value::Uint(1)), (10, Value::Null)])).contains("key 10"));

        let t = DirTree {

            entries: vec![Entry {

                path: "a".into(),

                mode: MODE_FILE,

                blob: ObjectRef([3; 32]),

                size: 1,

            }],

        };

        assert_eq!(DirTree::decode(&t.encode()).unwrap(), t);

        let entry = |p: &str, mode: u32| {

            Value::Array(vec![

                Value::Text(p.into()),

                Value::Uint(mode as u64),

                Value::Bytes(vec![0; 32]),

                Value::Uint(0),

            ])

        };

        let tree = |items: Vec<Value>| {

            DirTree::decode(&cbor::encode(&Value::map([

                (0, Value::Uint(1)),

                (1, Value::Array(items)),

            ])))

            .unwrap_err()

            .to_string()

        };

        assert!(tree(vec![entry("../x", MODE_FILE)]).contains("clean"));

        assert!(tree(vec![entry("b", MODE_FILE), entry("a", MODE_FILE)]).contains("order"));

        assert!(tree(vec![entry("a", 0o040000)]).contains("mode"));

    }

}

serde_json = "1"

sha2 = "0.11"

/// Give pages the program has freed back to the system. glibc keeps freed

/// memory in each thread's arena; after a large merge renders thousands of

/// files on many threads, that kept memory is most of the process's size

/// (#25). Elsewhere it does nothing.

pub fn release_freed_memory() {

    #[cfg(all(target_os = "linux", target_env = "gnu"))]

    // SAFETY: malloc_trim only returns free pages to the system; it is

    // safe to call at any time from any thread.

    unsafe {

        libc::malloc_trim(0);

    }

}

//! A person's approval of one job of one run, signed (oxygenhub#235): the

//! approval attestation, the signer's signature over it, and the signer's

//! identity, so it verifies with nothing else. The hub decides whether the

//! signer may approve; the signature makes the decision theirs, and binds

//! it to exactly that job, state, plan and environment.

use crate::attest::{Attest, AttestBody};

use crate::cbor::{self, Value};

use crate::hash::ObjectRef;

use crate::identity::{verify, Domain, Identity, SecretKey, Signature};

use crate::objects::{array, bytes, Hlc, ObjectError};

/// What is approved.

#[derive(Clone, Debug, PartialEq, Eq)]

pub struct Statement {

    pub repo: [u8; 16],

    /// The run, as its URL on the hub.

    pub run: String,

    pub job: String,

    /// The job's hash with its sandbox (OxygenFlow spec 6.2).

    pub job_hash: ObjectRef,

    pub state: ObjectRef,

    /// The blobs the job takes as inputs (a plan), any order.

    pub inputs: Vec<ObjectRef>,

    pub environment: String,

    pub approve: bool,

}

#[derive(Debug, thiserror::Error)]

pub enum ApprovalError {

    #[error("the attestation is not an approval")]

    NotApproval,

    #[error("no signature by the signer {0}")]

    Unsigned(String),

    #[error("the signature does not verify: {0}")]

    BadSignature(String),

    #[error("{0}")]

    Schema(String),

}

impl From<ObjectError> for ApprovalError {

    fn from(e: ObjectError) -> Self {

        ApprovalError::Schema(e.to_string())

    }

}

#[derive(Clone, Debug, PartialEq, Eq)]

pub struct SignedApproval {

    pub attest: Attest,

    pub sigs: Vec<Signature>,

    pub signer: Identity,

}

impl SignedApproval {

    pub fn sign(s: &Statement, signer: &Identity, sk: &SecretKey) -> SignedApproval {

        let mut inputs = s.inputs.clone();

        inputs.sort();

        inputs.dedup();

        let attest = Attest {

            repo: s.repo,

            hlc: Hlc::now(),

            body: AttestBody::Approval {

                run: s.run.clone(),

                job: s.job.clone(),

                job_hash: s.job_hash,

                state: s.state,

                inputs,

                environment: s.environment.clone(),

                approve: s.approve,

            },

        };

        let sig = sk.sign(Domain::Attest, &signer.hash(), &attest.hash());

        SignedApproval {

            attest,

            sigs: vec![sig],

            signer: signer.clone(),

        }

    }

    /// What was approved, read back from the attestation.

    pub fn statement(&self) -> Result<Statement, ApprovalError> {

        let AttestBody::Approval {

            run,

            job,

            job_hash,

            state,

            inputs,

            environment,

            approve,

        } = &self.attest.body

        else {

            return Err(ApprovalError::NotApproval);

        };

        Ok(Statement {

            repo: self.attest.repo,

            run: run.clone(),

            job: job.clone(),

            job_hash: *job_hash,

            state: *state,

            inputs: inputs.clone(),

            environment: environment.clone(),

            approve: *approve,

        })

    }

    /// It is an approval and the signer signed it. Whether the signer may

    /// approve is the reader's call.

    pub fn verify(&self) -> Result<(), ApprovalError> {

        self.statement()?;

        let key = self.signer.hash();

        let sig = self

            .sigs

            .iter()

            .find(|s| s.key == key)

            .ok_or_else(|| ApprovalError::Unsigned(key.short(12)))?;

        verify(&self.signer, sig, Domain::Attest, &self.attest.hash())

            .map_err(|e| ApprovalError::BadSignature(e.to_string()))

    }

    /// Whether `s` is what this approves (the time it was made aside).

    pub fn covers(&self, s: &Statement) -> bool {

        let mut want = s.inputs.clone();

        want.sort();

        want.dedup();

        self.statement().is_ok_and(|mine| {

            mine == Statement {

                inputs: want,

                ..s.clone()

            }

        })

    }

    /// `[attest, [Signature], identity]`, each object as its bytes.

    pub fn encode(&self) -> Vec<u8> {

        cbor::encode(&Value::Array(vec![

            Value::Bytes(self.attest.encode()),

            Value::Array(self.sigs.iter().map(|s| s.to_value()).collect()),

            Value::Bytes(self.signer.encode()),

        ]))

    }

    pub fn decode(b: &[u8]) -> Result<SignedApproval, ApprovalError> {

        let v = cbor::decode(b).map_err(ObjectError::from)?;

        let a = array(&v, "signed approval")?;

        if a.len() != 3 {

            return Err(ApprovalError::Schema(

                "signed approval: expected [attest, sigs, identity]".into(),

            ));

        }

        Ok(SignedApproval {

            attest: Attest::decode(bytes(&a[0], "attest")?)?,

            sigs: array(&a[1], "sigs")?

                .iter()

                .map(Signature::from_value)

                .collect::<Result<_, _>>()?,

            signer: Identity::decode(bytes(&a[2], "identity")?)?,

        })

    }

}

#[cfg(test)]

mod tests {

    use super::*;

    use crate::identity::SecretKey;

    fn statement() -> Statement {

        Statement {

            repo: [7; 16],

            run: "https://hub.example/andy/infra/flow/8".into(),

            job: "apply".into(),

            job_hash: ObjectRef([1; 32]),

            state: ObjectRef([2; 32]),

            inputs: vec![ObjectRef([4; 32]), ObjectRef([3; 32])],

            environment: "prod".into(),

            approve: true,

        }

    }

    #[test]

    fn an_approval_signs_exactly_one_job_state_plan_and_environment() {

        let sk = SecretKey::generate();

        let id = sk.identity("Andy", "[email protected]", 1);

        let sa = SignedApproval::sign(&statement(), &id, &sk);

        sa.verify().unwrap();

        let back = SignedApproval::decode(&sa.encode()).unwrap();

        assert_eq!(back, sa, "round trip");

        assert!(back.covers(&statement()), "inputs in any order");

        for other in [

            Statement {

                inputs: vec![ObjectRef([9; 32])],

                ..statement()

            },

            Statement {