-[x] H1 Dashboard for signed-in users: my repositories, proposals needing me, issues assigned to me, recent activity across repositories I can see (pushes, proposals, issues, releases).
- [x] H11 Help pages: getting started (install oxy, clone, push, tokens, CA, delegating to the hub), keyboard shortcuts, glossary for people coming from GitHub.
-[x] V1 oxygenhub-vscode: proposal files in native diff editors (target state against projected state through a content provider), with review threads in them.
- [x] O3 Crash safety audit: every write goes through write_atomic or the store's batch; a test that interrupts commit and push at each step and proves the repository still opens and fscks.
- [x] O10a Heads at scale (first part of O10): `State::maximal` compared every pair of heads (quadratic; about 1.5 s per call at 4 500 heads, called three times per commit); now one walk. Commit reuses the snapshot's base state instead of loading it again.
- [x] O10b Parallel snapshot work: rendering the base state's files, building file graphs from a checkpoint, and reading working-copy files now run on every core (rayon).
- [x] O12 `log_for_path_in` and `blame_in` rebuild and re-render the whole state on every call, and walk every change: take an already loaded state, stop at the first change touching the path when only the newest is wanted, and benchmark it (found in H16).
- [x] O10c Snapshot cost in the in-memory state: faster graph hashing, no unused predecessor map, inline successor sets, lines moved not copied; `OXY_TIMINGS=1` phase timings.
- [x] O10d Skip reading text files whose stat matches a manifest that recorded them equal to the base (racy entries, those modified at or after the manifest was written, are still read); test that no edit is ever missed.
- [x] F1a **Priority (Andy, 2026-09-28): dogfood OxygenFlow.** Every push to oxygen, oxygenhub, oxygenflow and both extensions lints, tests and builds through OxygenFlow on Earth, with results as checks on OxygenHub. F1a: ephemeral scratch mounts in jobs (`ephemeral://tmpfs`, `ephemeral://disk`) so builds have room; `make deploy-runner`.
- [x] F1b A build image for the runner: a rootfs with the Rust toolchain (stable, rustfmt, clippy), Node, e2fsprogs-free build basics, and every crate of the oxygen, oxygenhub and oxygenflow lock files vendored with cargo pointed at them (jobs have no network); a script that rebuilds it when lock files change; imported on Earth and measured on a real cargo test of oxygen in a microVM.
- [x] F4a oxygenflow's pipeline gains fmt, clippy and tests, with oxygen as its pinned subrepo; oxygenhub builds against the oxygen that oxygenflow pins (one oxy-core), and claims follow subrepos of subrepos.
- [x] F4b Extension pipelines (oxygen-vscode, oxygenhub-vscode): typecheck, bundle, tests and package, offline. Needs the npm packages in the build image, and `oxy` for oxygen-vscode's tests (built in the job from a pinned oxygen). The hub client tests skip without a hub binary.
- [ ] F6 Faster runs: the runner takes one job at a time (oxygenhub is about 14.5 min to green, 8.5 of them the release build), so run independent jobs in parallel within the runner's CPU and memory, and reuse a build tree between jobs of one run (clippy, test and build compile the same crates).
- [ ] F5 Required checks: each repository's default bookmark requires its pipeline's checks to land, and the work loop pushes and waits for green instead of gating only locally.
66
- [x] O10e Checkpoint payload version 2: large file graphs as shared blobs named from an index, read and decoded in parallel; readers accept both versions (spec §11). Agreed by Andy on 2026-09-28.
- [ ] P1 **Conflict resolution on OxygenHub** (Andy's list, item 1). A resolver page for a conflicted state:
68
- Per conflict region: pick a side, several sides, or none; edit freely; tree conflicts too (keep a candidate).
69
- Commit the result as a `kind = resolution` change on the bookmark, through the web-edit path. Signing: sealed when the author next pushes, or "resolve in VS Code" hands off to oxygen-vscode.
70
- Shareable link to a conflict.
71
- First single-user, then P1b.
72
- [ ] P1b Real-time collaboration on the resolver: presence, live edits merged between viewers (SSE or WebSocket), and whoever is viewing sees the resolution land.
- oxy-core: a history query over a set of atoms (the changes that inserted or deleted any of them, with deleted atoms included).
75
- Hub: function boundaries by tree-sitter for the languages we host (Rust, TypeScript, Python, shell).
76
- Clicking a function on a file page shows every ChangeId that touched its lines, as a list and a small graph; exact because atoms keep identity across edits and moves.
77
- The cross-file semantic graph stays out; noted as future work.
78
- [ ] P3 **Swimlanes** (item 3):
79
- Hub: a bookmark's changes drawn as lanes of independent changes (oxy-core `lanes`), with dependencies as edges and no merge nodes.
80
- P3b: drag and drop on proposal bookmarks only. Dropping a change onto another proposes a squash, dragging a dependent chain proposes a rebase. The hub produces a plan and the author's oxy or oxygen-vscode applies and signs it (V6 has split, squash and rebase). Reordering independent changes means nothing and is not offered.
81
- [ ] P4 **Signed Flow receipts**:
82
- A `receipt` object type in the Oxygen spec.
83
- A runner identity whose key (composite Ed25519 + ML-DSA-65) signs each receipt.
84
- Receipts stored in the repository and verified by the hub.
85
- Flow `output` and artifacts, so a release asset links to the receipt that built it.
86
- [ ] P4b **Trust dashboard** (item 4): per release and asset, a graph of authors' identities and signatures, the runner and its pinned environment, inputs (state, scope hash), and receipts, with a one-click audit view and export.
87
- [ ] P5 **Web workspaces** (item 2), in parts:
88
- P5a: flow-casfs, a read-only FUSE mount of a state from CAS chunks, measured.
89
- P5b: "Open in Workspace" on a change. openvscode-server (MIT, unmodified) with oxygen-vscode inside a Firecracker microVM per workspace, the state mounted read-only through casfs with an ephemeral overlay for edits, and commits back through oxy. Boot time measured, aiming under 100 ms for the mount.
90
- A fork ("oxycode") only if an extension cannot do what we need; decided with Andy.
91
- [ ] P5c Import microsoft/vscode's full Git history with `oxy git import` into a local scratch repository (not published): about 130 000 commits as a stress test of import, log, blame and status at scale, recorded in docs/benchmarks.md.
- [ ] O10f Load file graphs lazily from a version 2 checkpoint: a state keeps unread graphs by reference and reads one when first needed.
93
- [ ] O10g Render only what a snapshot needs: the manifest records, per file, the graph blob it matched, so an unchanged file whose graph is untouched since the checkpoint is neither read nor rendered; cache materialized states.
- [x] O6 Error messages audit: every user-facing error says what to do next; `oxy doctor` checks identity, config, remotes, CA files, hub reachability.
- [x] O11 Line placement found by O8: in 5 of 539 tetriblox commits (all non-merge; e.g. 43de61fac554 src/banked/code_bank_07.c, 021ad78791a2 code_bank_03.c, 2721670b49af code_bank_02.c, 435fbe1d5fac scripts/x16_unchanged.py, d17c19b22748 test/test_memory_guards.py) one line lands elsewhere than in Git with no conflict reported, so an insertion is anchored between atoms that are not adjacent in the base. Reproduce with `oxy git verify` on a scratch mirror; find which edit of the importer's diff (build_from_entries/text_edits) anchors non-adjacently, add a debug assertion for anchor adjacency, fix, re-verify.
- [x] O9 Portability review for macOS and Windows: path separators, executable bits, case-insensitive file systems, CRLF; tests where it can be exercised on Linux.
-2026-09-28 H1 done: signed-in dashboard at `/` (review queue, own proposals, assigned issues, repositories, activity feed filtered to visible repositories); test `dashboard_shows_what_needs_the_viewer`; deployed to Earth.
- 2026-09-28 O1 done: `crates/oxy-core/tests/commutativity.rs` (proptest, 32 cases): diverging clones with random edits, rebuilt in shuffled and random dependency orders, checkpoint round trip, and push in random order to a fresh clone; all give identical checkpoints, heads and trees. About 80% of generated cases conflict. No defects found. Workspace tests all green (oxy-core 129 + new).
- 2026-09-28 H2 done: empty repositories show a quickstart (remote named after the host, e.g. `earth`; CA download and `remote.X.ca` when self-signed; token placeholder; push; start from nothing; `oxy git import`); readers get a plain notice. Tests: `empty_repository_shows_a_quickstart` and a remote-naming unit test; hub spec §6 row updated; deployed.
- 2026-09-28 V1 done: hub API `GET /proposals/{n}/files` and `/proposals/{n}/content/{base|head}/{path}`, and anchored comments now carry their current `line` (deployed). oxygenhub-vscode 0.2.0: proposals expand to files, native diff editor per file, View Changes multi-diff, review threads on the projected side; installed in Default and Rust profiles (Developer: Reload Window to pick it up). Tests: hub api test extended; extension pass 6 fail 0 against a real hub.
- 2026-09-28 O3 done: new `oxy_core::durable` (unique temp, fsync, rename, directory fsync) for every durable write; **real bug fixed**: inside a write batch the op head moved before the batch (including the new op object) was on disk, so a crash there left an unopenable repository; `Store::flush` now runs before the head moves. Test stops commit (20 steps) and push (32 steps) at every step: both repos open, fsck clean, command retries. Spec §13.6. Hub rebuilt and redeployed with the fix. Not covered: working-copy file writes during checkout are still plain writes (user files, recoverable by snapshot).
- 2026-09-28 H3 done: header theme switch (dark/light/auto) and Settings → Appearance, theme cookie; auto follows the system live. Light-mode pass by headless Chrome screenshots of dashboard, overview, file, proposal, issue, settings, changes: found and fixed highlighted code drawing boxes in both themes (syntect scope `comment` colliding with the page `.comment` class; classes now `sy-` prefixed) and the band ADMIN link unreadable in light. Test `theme_is_chosen_in_settings_and_remembered_in_a_cookie`; hub spec §6.1; deployed. The code editor picks its theme at load, not live.
- 2026-09-28 O4 done: harness `crates/oxy-core/tests/bench.rs` (ignored; run by hand) and `docs/benchmarks.md`. Full run on disk took 5 h 14 min. **Andy: status and commit are slow at scale**: at 10 000 files / 5 000 changes a commit averages 3.8 s, a 10-file commit 9.1 s, a clean status 3.0 s, blame 2.9 s, peak memory 1.4 GiB; push 0.8 s, clone 3.4 s, log 0.4 s are fine. Cause: every snapshot loads and materializes the whole base state. New item O10 (moved ahead of O5) fixes it.
- 2026-09-28 V2 done: hub API `GET /notifications`, `POST /notifications/{id}/read`, `POST /notifications/read` (scope user:read; deployed). oxygenhub-vscode 0.3.0: status-bar bell with unread count across hubs, new-notification messages, Open Inbox quick pick that marks read and opens proposals/issues in the editor. Installed in both profiles (Reload Window). Tests: hub api test extended; extension pass 7 fail 0.
- 2026-09-28 O10a done: `State::maximal` was quadratic in heads (4 500 heads in the benchmark); now one walk, with a property test against the old definition. Commit reuses the snapshot's base. At 10 000 files / 5 000 changes: commit 3.8 s to 0.86 s, 10-file commit 9.1 s to 0.86 s, status 3.0 s to 0.80 s, blame 2.9 s to 0.81 s, memory 1.4 to 1.1 GiB; benchmark run 5 h 14 min to 1 h 12 min. Hub redeployed with it. O10b (manifest fast path, lazy base) remains for the per-file cost.
- 2026-09-28 V3 done: oxygenhub-vscode 0.4.0: `#` and `@` completion in the Oxygen commit box and comment editors, hover on `#N`; repository from the SCM root. Parsing tested in Node (pass 10, fail 0). Installed in both profiles.
- 2026-09-28 O10b done: rayon for materialize, checkpoint file graphs and working-copy reads. At 10 000 files: clean status about 800 to 460-580 ms, commit 861 to 550-605 ms. Remaining cost is loading the whole base (O10c, needs a checkpoint format change in the spec, so left for Andy to agree). Hub redeployed.
- 2026-09-28 H4 done: `/{owner}` profile (identicon, display name, bio, location, website, keys, organisations, visible repositories, activity by that person; never the email) and organisation page (description, members and roles, teams with sizes, repositories, activity); `/avatar/{name}` identicons also in the header and feeds; migration 0008 (bio, website, location) and Settings fields (http(s) websites only); `avatar` and `help` reserved. Test `profile_and_organisation_pages`; screenshot checked; deployed (andymccall profile 200 on Earth).
- 2026-09-28 O5 done. **Real bug fixed**: concurrent commands overwrote `.oxy/ops/head`, so the loser's operation (and its commit on the bookmark) vanished; a two-workspace test lost about half its commits every run. The head now moves by compare-and-swap under a short `.oxy/ops/lock`, and a mover that lost the race records a merge op (two parents, three-way merged view; bookmarks keep both sides' heads), as spec §12.1 described; undo refuses on a moved head. Tests: concurrent two-workspace commits with pushes lose nothing (5/5 runs), deterministic merge of two ops from one parent; two real oxy processes x 25 commits keep all 50 (39 merges). Spec §12.1 updated. Hub redeployed.
- 2026-09-28 O6 done: `oxy doctor [--offline] [--json]` (op log and stale locks, identity object/secret/expiry, author defaults, each remote: plain HTTP, token, CA file, reachability and repository id) with a next step per problem; every failed remote request now carries a hint (untrusted certificate, 401, 403, 404, refused, DNS, timeout) and transport errors no longer repeat the URL; clearer messages for different-repository remotes, pull-first pushes (still contains "pull first", which oxygen-vscode matches), unauthorized keys, and no repository. Tests: hint table and doctor scenarios. Clean on oxygen and oxygenhub checkouts. Spec §21.2, guide. Hub redeployed.
- 2026-09-28 O7 done: `oxy completions SHELL` (clap_complete) and `oxy man [--dir]` (clap_mangen 0.3, 104 pages); help text written for 112 bare commands and arguments with a test that every one has help; oh-my-bash plugin loads bash completions; guide section. Tests `cli_docs` (every shell, pages, argument help on the page). Andy: `oxy completions bash > ~/.local/share/bash-completion/completions/oxy` to enable.
- 2026-09-28 O7 note: the O7 commit went in before clippy finished (two lints in the new help test); fixed in the next commit. The gate now runs to completion before every commit.
- 2026-09-28 H7 done: stars (toggle, counts), watcher counts on the overview, repository topics in settings (validated) shown as chips, Explore filter by text and topic and sort by activity/stars/name with per-row stars and topics; migration 0010. Tests: topic parsing unit test and `stars_topics_and_explore`. Gate fully green before commit; deployed.
- 2026-09-28 O8 done. `oxy git verify GIT_DIR` checks an import commit by commit (content, exec bits, symlinks, pins; conflicts named with their changes; first differing line). On a scratch mirror of tetriblox (539 commits, 208 merges, 880 gitlinks; the live repo was only read by `git clone --mirror`): import 36 s, tip tree round-trips exactly, and verification found **real core bugs that also affect ordinary commits**, now fixed: (1) insert after a line, then delete that line, left a delete/insert conflict (deletions now depend on the inserters of the lines right after them); (2) a binary or submodule reverted to an earlier blob lost it, and replacements had no dependency (now depend on the change that set their old blob; causal supersession, legacy records keep the old rule); (3) merges of independently replaced binaries/submodules stayed conflicted (importer resolves to the merge's blob). Mismatching commits went from 50+ (verification stopped early) to 5, now O11. Tests: 3 regressions (sequential insert/delete, binary revert, Git binary merge + verify). Spec Draft 0.8i §8.1, §9.3, §23. Hub redeployed.
- 2026-09-28 H8 done: open counts on the Proposals and Issues tabs (from the repository lookup), issue `author:` filter and sorts (newest/oldest/updated/comments), proposal filter (`author:`, `label:`, `target:`, words) with labels shown and sorts (updated/newest/oldest), 25-per-page pager keeping filter and sort. Test `lists_filter_sort_page_and_count`; spec §6.3 rows; deployed.
- 2026-09-28 O9 done: `portable::Platform` (detected, overridable in tests); no exec bits: snapshot keeps the recorded bit (it was recording a mode change on every Windows snapshot); no symlinks: a plain file holding the target stays the symlink (spec §7.7 required it, the code converted it); checkout lists case collisions and Windows-invalid names on affected platforms and `oxy doctor` does everywhere; CRLF already handled by the eol attribute; separators verified (components joined with /). Tests simulate Windows and macOS. Follow-up: normalise `\` in paths typed on Windows command lines. Spec §7.7. Hub redeployed.
- 2026-09-28 V4 done: oxygenhub-vscode 0.5.0 "New Issue from Selection" (context menu): quotes the selection under a permalink (head-pinned when single-headed and saved), TODO/FIXME lines suggest the title and can be annotated `TODO(#N)`, then the issue opens; line-range links. Tests pass 13 fail 0. Installed in both profiles.
- 2026-09-28 O11 done: root cause in `text_edits`: similar's capture_diff_slices runs a Compact hook that slides deletions along equal lines and can leave an insertion with an earlier old index, anchoring a block one line early (a brace on the wrong side). Now uses the diff with only the Replace hook. Randomized replay test (2 000 repetitive files; fails on the old code). tetriblox scratch import verifies all 539 commits, 95 585 files. Note: that commit also picked up Andy's new docs/xenon_spec.md and fix.py, fix2.py, format_xenon.py from the working copy; left for Andy to decide.
128
- 2026-09-28 UI request from Andy (between items): repository page centred with the sidebar, README as wide as the file table, clone command in the top bar; repository, organisation and account settings get a sticky list of sections on the left and equal-width boxes. Screenshot-checked, deployed.
- 2026-09-28 V5 done: oxygenhub-vscode 0.6.0 Releases view (releases per repository with latest/pre-release, assets with size and downloads, source archives) and Draft Release…: pick an unreleased tag, title from the tag message, notes generated from the changes since the newest full release's tag, pre-release suggested from the tag name. End-to-end test tags with oxy and releases through the client. Tests pass 15 fail 0; extension spec §8.2. Installed in both profiles.
- 2026-09-28 H9 done: file page tree sidebar (path expanded, 200 per directory then "N more", hidden under 900 px); state addresses `h1+h2` (sorted full hashes, at most 32) so any state has a permalink; `y` on file and tree pages switches to it; a line-range bar with Copy lines and Copy permalink; blame shaded in ten age steps and each run links "blame before this change" (the state of its dependencies). Tests: view unit tests (sidebar order and limit, state addresses) and browse end to end. Hub spec §6.3, §6.6, §6.13. Deployed; health ok.
-**OxygenHub naming.** The name is written OxygenHub everywhere people read it (hub, both extensions: oxygenhub-vscode 0.6.1, oxygen-vscode 0.7.1).
133
-**OxygenFlow M0, built and running on Earth.** Xenon was renamed to OxygenFlow, in the separate oxygenflow repository. It has:
134
- flow-core: KDL pipeline, validation with lines, canonical CBOR, receipts, runner API types
135
- flow-init, as the guest's PID 1
136
- the Firecracker microVM tier
137
-`flow check/run/rootfs/runner`
138
- a microVM conformance test
139
-**Hub side.** Pushes start runs, a runner API with repo-scoped read-only job tokens, jobs mirrored as `flow/<job>` checks, and a Flow tab with the SVG job graph and live logs. Hub spec §13.2; migration 0011; tests/flow.rs.
140
-**Earth.** Firecracker v1.17.0, kernel 6.1.155 and the Alpine 3.24.2 rootfs, pinned in ~claude/flow. `flow-runner.service` is hardened. `hub.toml` gained `[flow]` limited to `andymccall/*` (backed up as hub.toml.before-flow).
141
-**Result.** oxygenflow's own pipeline passes (runs 1 and 2). Andy's spec is committed, renamed to OxygenFlow, with a README.
- 2026-09-28 Flow state stamps instead of CI badges (oxygenhub#1, closed by the change):
144
-`/flow/stamp/{ref}` is an SVG of the newest run of exactly that state, with receipt hashes in its metadata. For bookmarks and tags it redirects to the stamp of the current state.
145
- In READMEs, `[](.flow/run)` resolves against the state being viewed.
146
- Fixed oxygenhub#2 on the way: README images pointed at the HTML file page. There is now a `/raw/{ref}/{path}` route.
147
- The oxygenflow README shows its stamp (oxygenflow#1).
148
- From now on every item gets an issue on Earth and its commits say closes/refs #N.
149
- Gaps the workflow exposed became H17 to H20 (oxygenhub#3 to #6).
- 2026-09-28 H10 done (oxygenhub#7, closed by the change):
151
- The compare page has base and head pickers (bookmarks and tags in a datalist; any change or state can be typed), a swap link, `/compare?base=&head=` as the form target, and `/compare` alone comparing the newest other bookmark against the default.
152
-**Propose this** shows for writers when both sides are bookmarks and head has changes; it becomes "proposal #N is open" when one exists.
153
- Tests in browse and proposals. Hub spec §6.3. Deployed.
- 2026-09-28 H11 done (oxygenhub#8, closed by the change):
155
-`/help` is a sectioned page with getting started, identity and key linking, pushing, cloning, proposals, delegating to the hub, pipelines and state stamps, the keyboard, and a GitHub glossary.
156
- Every command carries this hub's address, remote name and certificate step.
157
- It is linked from the band, the footer and the `?` sheet.
- 2026-09-28 H12 done (oxygenhub#9, closed by the change). Spec §5.1.1 first.
160
-**Account links.** 32 random bytes, stored as a BLAKE3 hash, single use and expiring. Migration 0012.
161
-**Verification.** Sent on registration and on every address change (48 h). It only verifies the address it was sent to. Settings shows the status and can resend: one every 2 minutes per address, 10 an hour per account.
162
-**Reset by email.** By username or verified email (1 h, one every 2 minutes). The answer is identical whether or not anything matched, and mail goes out in the background so timing leaks nothing.
163
-**Reset by an administrator.** From /admin (24 h, shown once, audited).
164
-**Using a reset link.** It rotates the session salt (every session ends) and voids other links. TOTP stays on; banned accounts are refused.
165
-**Mail.** A shared `mail` module with `file://` for development. Notification mail only goes to verified addresses.
166
-**Tests.** tests/recovery.rs covers the whole flow through a file mailbox.
167
-**Earth.** Earth has no SMTP, so resets there go through the admin link. Existing addresses count as unverified until verified.
- 2026-09-28 H13 done (oxygenhub#10, closed by the change):
169
- Notifications record their thread, repository and reason (participating or watching) and can be marked done. Migration 0013 backfills threads and repositories from the URLs.
170
- The inbox shows one row per thread, with updates and new counts.
171
- Filters: inbox, unread and done views, reason, kind family and repository, with counts.
172
- Per-thread read, unread and done. Done threads return when a new event arrives.
173
- Opening a row marks its thread read.
174
-`notify::add` takes a struct.
175
- Tests extended in tests/issues.rs. Hub spec §10.
176
- The API keeps per-item read; per-thread actions in the API are a follow-up for the VS Code inbox.
177
- 2026-09-28 Andy asked for uploaded profile pictures and organisation logos: added as H13b (oxygenhub#11), taken next.
- 2026-09-28 H13b done (oxygenhub#11, closed by the change):
179
- Upload a picture under Settings › Profile › Picture, or an organisation logo under its settings (owners only).
180
- PNG, JPEG or WebP, recognised by content; at most 5 MiB and 8 000 px a side.
181
- Every upload is decoded, centre-cropped, scaled to 400×400 and re-encoded (PNG if it has transparency, JPEG otherwise), so uploaded bytes are never served.
182
-`/avatar/{name}` serves the picture with an ETag, falling back to the identicon; Remove restores the identicon.
183
- Avatar CSS no longer pixelates photos.
184
- Unit tests for processing and refusals; end-to-end test in tests/accounts.rs. Hub spec §6.3. Deployed.
185
- This machine's disk filled up (0 bytes free) during the build. I removed the regenerable `target/debug/incremental` caches of oxygenhub and oxygen (33 GB) and build with CARGO_INCREMENTAL=0 from now on.
- 2026-09-28 H14 done (oxygenhub#12, closed by the change):
187
- Keyboard and screen readers: a focus ring on everything focusable; a skip link to `<main id="main">`; named landmarks (Account, Site, Repository and Settings navigation); `aria-current` on the current tab.
188
- Contrast: WCAG AA in both themes, enforced by tests/contrast.rs over the CSS variables.
189
- Light theme: mute, acc, ok, now and the string, function and comment syntax colours adjusted.
190
- Dark theme: comment colour adjusted.
191
- Text no longer uses `--dim`.
192
- Under 760 px: tab bars scroll on one line, the tree drops its message column, wide content scrolls inside its panel, sectioned pages stack, and the header search hides.
- 2026-09-28 H15 done (oxygenhub#13, closed by the change):
195
-**Organisation webhooks.** A Webhooks section in organisation settings: add, ping, enable or disable, delete, deliveries and redeliver.
196
- Repository and organisation webhooks now share one module (`web/webhooks.rs`) and one template macro.
197
- Every action checks that the hook belongs to the scope it is managed from.
198
-**Storage.**`/admin/storage` lists each repository's size, loose objects and packs. Maintenance runs `oxy gc` (grace period kept, write lock held) on one repository or all, and is audited.
199
- Tested in tests/accounts.rs. Hub spec §6.3, §12.2. Deployed.
200
- Earth's repositories can be maintained from /admin/storage now; I have not run it on Andy's data.
- 2026-09-28 H16 done (oxygenhub#14, closed by the change). Measured on Earth first (oxygenhub/docs/performance.md).
202
- The raw bytes of heavy files took 5 ms, but their pages took 196 to 428 ms: syntax highlighting, Markdown rendering, and above all the file's "last change", found by `log_for_path_in` rebuilding the state and reading every change on each view.
203
- Now cached, in memory-bounded LRUs keyed by content or by (state, path): rendered Markdown, highlighted files, last change and blame. Labels are still computed fresh.
- 2026-09-28 O12 done (oxygen#1, closed by the change; the first issue in the oxygen repository):
209
- oxy-core has `log_of(state)`, `log_for_path_of(state, path, limit)` and `blame_of(state, tree, path)`. They find the path in the tree view alone, with no full render, and the walk stops at `limit`.
210
-`log_for_path_in` and `blame_in` wrap them and load once instead of twice.
211
- Test `history_and_blame_of_a_loaded_state_match_the_full_walk`; gate green; release binary rebuilt.
212
- The hub uses them for last change, blame and tree rows.
213
- Cold file pages on Earth: 196/400/317/428 ms (before any caching) → 146/256/121/88 ms; warm 8–24 ms (oxygenhub/docs/performance.md).
- 2026-09-28 H17 done (oxygenhub#3, closed by the change):
215
-`POST /issues` takes labels, assignees and a milestone (triage). Unknown names are refused before anything is created.
216
- New `PATCH /issues/{n}`: title and body for the author or triage; the whole label set, assignees and milestone for triage; each change goes on the timeline.
217
-`POST /labels` creates or changes a label and `DELETE /labels/{name}` removes it (triage).
218
- hub-api types `IssueEdit` and `NewLabel`; TS regenerated (the extension's copy follows with its next change). Test `api_issue_triage_and_labels`; hub spec §12.1.
219
- Dogfooding:
220
- Each Earth repository now has the labels bug, feature, performance, accessibility, security and gap.
221
- Every issue so far is labelled.
222
- The work log's issue helper sets labels from now on.
- 2026-09-28 H18 done (oxygenhub#4, closed by the change):
224
- Any bare `#N` in a pushed change's message, on any bookmark, adds "referenced by change <hash> on <bookmark>" to that issue's or proposal's timeline, with the hash linked.
225
-`closes #N` still records only "closed by change"; `owner/name#N` from other repositories is left alone.
226
-`refs::references` has a unit test; the issues end-to-end test covers issue and proposal timelines. Hub spec §8.
227
- From now on, the `refs #N` lines in work commits show on the Earth issues.
- 2026-09-28 H19 done (oxygenhub#5, closed by the change). Spec §8.2 first.
229
- Projects belong to a person or organisation: `/projects/{owner}` and `/projects/{owner}/{n}` ("projects" is now a reserved name).
230
- Columns start as Backlog, Doing and Done; they can be added, renamed, moved and removed (their cards go to the first column; the last column stays).
231
- Cards are issues or proposals of the owner's repositories (by `repo#N`, or `#N` with a repository picked) or notes. Each can be on a project only once. They move, reorder and are removed without JavaScript.
232
- Visibility: public or private (owner, organisation members and admins). Cards from repositories the viewer cannot read are not shown at all.
233
- A closed project is read-only; deleting one leaves the issues.
234
- Issue and proposal pages list their projects; profiles and organisation pages link to them.
235
- Migration 0015. Test `project_boards` plus reference parsing. Screenshot-checked on a scratch hub.
236
- The screenshot tool now disables the browser cache (an earlier shot had served a stale style.css).
237
- Gap found: no projects API → H21 (oxygenhub#15).
- 2026-09-28 H20 done (oxygenhub#6, closed by the change): relative links and images in issue, comment and proposal Markdown resolve against the repository's default bookmark; release notes resolve against the release's tag. Test `issue_markdown_follows_the_default_bookmark`.
239
- 2026-09-28 Webhooks, from Andy's report (oxygenhub#16 and #17, closed by the change):
240
-**Why Discord got nothing.** Every delivery, ping included, was the OxygenHub envelope, which Discord rejects ("Cannot send an empty message").
241
-**Formats.** Hooks now have a format: `oxygenhub`, `discord` (an embed with the event's summary; mentions disabled so user text cannot ping) or `slack`. It is picked from the URL; migration 0016 switched existing Discord and Slack hooks.
242
-**Settings.**
243
- The URL is masked (long path segments and query cut short, since chat webhooks keep a token there; the audit log records the same masked form) and wraps inside the panel.
244
- The table shows the last delivery result.
245
- Each hook has an edit form; a blank URL or secret keeps the current one.
246
-**Also found.** Issues opened, commented on, closed or reopened in the web interface emitted no webhook events at all; now they do.
247
-**Tests.** Unit tests for the formats and masking; end-to-end test `webhook_formats_editing_and_web_issue_events`. Hub spec §12.2.
- 2026-09-28 Repository overview, from Andy's review (oxygenhub#18, closed by the change):
255
- The heads and conflicts strips sit inside the main column.
256
- Clone is a button beside search: a popup with a selectable command, copy, and the bare URL.
257
- Contributors box: authors counted from the state's changes, linked to hub accounts through linked keys; unsigned changes with no author show as "Unattributed changes".
258
- Languages box: bytes per language (an extension table plus syntect), with Linguist's colours. Prose, lock files and vendored paths are left out; under 1% folds into Other.
259
- A public, internal or private badge by the repository name.
260
- Tests in browse.rs and a unit test for detection. Screenshot-checked on Earth.
261
- Andy's key is not linked to his account yet (Settings › Keys), so his contributor entry is not a link.
- 2026-09-28 V6 done (oxygen-vscode#1, closed by the change). oxygen-vscode 0.8.0:
263
- The History graph's change picker, and a right-click menu on its rows (webview context menus), offer:
264
- Split for heads with several files: pick files; they become the first change.
265
- Squash into a dependency, picked when there are several.
266
- Rebase onto a bookmark, or a change or tag typed in.
267
- Each asks first, then shows oxy's summary with an Undo button (`oxy undo`).
268
- Client methods `split`, `squash` and `rebase`, tested against the real oxy with undo. check green (9 tests); packaged and installed into the Rust profile.
- 2026-09-28 V7 done (oxygen-vscode#2, closed by the change). oxygen-vscode 0.9.0:
270
-**Amend mode** (pencil or close icon in the Source Control title bar): Ctrl+Enter amends; the box starts from the last change's message.
271
-**Previous Commit Messages**: remembered per repository in workspace state, 30 kept.
272
-**Signing indicator**: the placeholder says signed, sealed at push, or unsigned, read from `oxy identity show` at most every 30 s.
273
-**Conflict marker warning** on commit, commit-selected and amend: files oxy reports with markers left, plus any changed text file with lines opening or closing a conflict (Oxygen's or Git's). The dialog can open the first one.
274
- Pure logic in `src/commitbox.ts` with unit tests; `identity()` tested against the real oxy. check green (14 tests); installed into the Rust profile.
- 2026-09-28 V8 done (oxygen-vscode#3, closed by the change). oxygen-vscode 0.10.0 and oxygenhub-vscode 0.6.2:
276
- The line-number gutter (`editor/lineNumber/context`) and the editor context menu offer Open on Remote, Copy Remote Link and Copy Permalink.
277
- The link covers the clicked line or the selection (`#L10-L20`).
278
- A permalink uses OxygenHub's state address: the bookmark's heads, sorted and joined with `+`. Checked live: an 11-head address for oxygen/README.md opens with 200 on Earth.
279
- A note appears when uncommitted edits may shift the lines, or when remote links point past unpushed changes.
280
-`stateSpec` and `linkedLines` are unit-tested; the hub extension keeps `+` readable (tested) and its API types are brought up to date (issue editing, labels, projects). Both checks green; both installed into the Rust profile.
- Every CHANGELOG entry is dated from the history.
287
-`test/docs.test.mjs` in both fails if a setting is missing from the README or the newest CHANGELOG entry is not the package version. Both checks green (18 tests each).
- 2026-09-28 O10c done (oxygen#2, closed by the change), after splitting it.
289
-**Measured first.** New `OXY_TIMINGS=1` phase timings, documented in the guide. At 10 000 files and 200 changes, loading the base state was about 790 of 1 230 ms. A checkpoint did not help: decoding it took 680 ms, like replaying the history, since both build the same in-memory graphs.
290
-**Fixed without a format change:**
291
- A seeded fast hasher for the graph maps (`fasthash.rs`, tested).
292
- The predecessor map was written for every line and read nowhere; it is removed.
293
- An inline edge set replaces a `BTreeSet` per vertex.
294
- Lines are moved in with one lookup each.
295
-**Result.** Both builds run alternately on the same load, medians: clean status 0.96 s to 0.52 s, one-file commit 0.99 s to 0.51 s, peak memory 657 MB to 239 MB (docs/benchmarks.md).
296
- Gates green for oxygen and oxygenhub; release binary rebuilt; hub redeployed.
297
- The rest is split into:
298
- O10d: skip reading files that are clean by the manifest; next.
299
- O10e: per-file checkpoints, a spec §25 format change. **Andy: this one waits for your agreement.**
300
- Also this iteration: V6 to V8 had been installed into the Rust profile only; now into the default profile too, as the loop asks.
- 2026-09-28 O10d done (oxygen#3, closed by the change):
302
- A text file whose size and mtime match the manifest (outside the 2 s racy window), and whose recorded hash equals the base's rendering of it, takes the base's bytes instead of being read.
303
- At 10 000 files, a clean status opens none of the files (checked with strace).
304
- With a warm cache the walk falls only from about 75 to 56 ms, since traversal and stat remain. The gain is larger on a cold cache or a slow disk.
305
- Test `stat_cache_takes_unchanged_text_from_the_base_and_misses_no_edit`, using unreadable files to prove what is and is not read:
306
- an older uncommitted edit is always read, never replaced by the base;
307
- a same-size edit made just now is caught by the racy window;
308
- after a commit the edits become the base.
309
- Spec §12.4. Gate green; release binary rebuilt. The hub (bare repositories) is unaffected.
310
- Next is O10e, which waits for Andy's agreement to change the checkpoint format.
- 2026-09-28 O10e done (oxygen#4, closed by the change). Spec §11, Draft 0.8j.
312
-**Format.** Payload version 2: a file graph encoded in 2 KiB or more is a blob of its own, named from an index; smaller ones stay inline. Blobs are content addressed, so unchanged files are shared between checkpoints.
313
-**Compatibility.** Readers accept both versions; writers produce version 2. gc keeps the graph blobs, fsck checks them against a full load in the payload's own version, and shallow-clone bundles carry them.
314
-**Speed.** The first cut was slower than version 1, because it read 10 000 blobs one at a time. So the store gained `get_many`, which reads loose objects in parallel and packed ones in parallel after one index pass, and the graphs are decoded in parallel.
315
-**Result at 10 000 files, 216 changes** (the same binary reading both versions, alternated, medians): load through a checkpoint 615 ms (v1) to 342 ms (v2). The index is 2.4 MB against a 62 MB v1 payload. A second checkpoint after a one-file edit took 0.63 s against 1.08 s.
316
-**Tests.** Unit tests for the v2 round trip, determinism, missing blobs and unknown versions, and `get_many` over loose, packed and missing objects. A repository test covers a large file's graph blob through gc, fsck, a shared second checkpoint, the shallow bundle, an old v1 checkpoint still loading, and a lost blob failing loudly.
317
- Gates green for oxygen and oxygenhub; release binary rebuilt; hub redeployed.
318
-**Andy:** oxy older than this cannot read checkpoints written from now on. Rebuild every copy, as ~/.local/bin/oxy already is.
319
-**New priority from Andy:** dogfood OxygenFlow on every push (F1–F5, ahead of O10f and O10g).
320
- The runner is live on Earth, but only oxygenflow has a pipeline, of light shell jobs in a 256 MiB, one-CPU Alpine microVM.
- 2026-09-28 F1a done (oxygenflow#2, closed by the change). Andy said go ahead with the Earth work for F1.
323
-**Mounts.** Jobs may now declare up to 4 ephemeral scratch mounts:
324
-`ephemeral://tmpfs` uses guest memory; `ephemeral://disk` is a fresh sparse ext4 disk per job, attached as vdc onward.
325
- Targets are clean paths strictly under /src or /tmp and may not nest; sizes run from 16 MiB to 64 GiB. Other sources and settings are refused as not in M0.
326
- Mounts are part of the canonical job (field 6, only when present, so existing pipeline hashes are unchanged) and of the receipt environment.
327
-`flow-init` creates mount points owned by the job's user.
328
-**Deployment.**`make deploy-runner` builds `flow` and the static `flow-init`, installs them under /home/claude/flow keeping `.prev` copies, re-pins `flow-init` in flow.toml and restarts flow-runner.
329
-**Checked on Earth** with `flow run` in a real microVM (no hub involved): the job (uid 1001) owns the mounts, a 2 GiB disk took a 300 MiB write, a 64 MiB tmpfs refused 100 MiB, and scratch was cleaned. The next real push of oxygenflow passed on the new runner.
330
- Tests: 2 new flow-core tests (parsing, refusals, hash stability) and a runner test for guest device numbering. Gates green for oxygenflow and oxygenhub; hub redeployed (it validates pipelines with flow-core).
331
- Andy also confirmed that only he and I use oxy, so there is no need for backward compatibility before the release.
- 2026-09-28 F1b done (oxygenflow#3 and oxygen#6, closed by the changes).
333
-**The build image** (`oxygenflow/images/rust`):
334
- Rust 1.97.1 with rustfmt and clippy, and Node 24.21.0 (SHA-256 checked).
335
- Every crate of the oxygen, oxygenhub and oxygenflow lock files, vendored, with cargo pointed at them via /.cargo/config.toml and `offline = true`.
336
- Toolchain binaries are linked into /usr/local/bin, so no rustup is needed at run time.
337
-`build.sh` builds it; Docker is only a file-system builder on the workstation (Andy agreed). Imported on Earth as `cas://blob/3ba0779a55b1d66fce10adf5a01585624c9aab089f590d228368c38fd3e65a46` (2.2 GiB).
338
- Rebuild it when a Cargo.lock changes.
339
-**Running oxygen's gate in it found three real problems:**
340
-`flow-init` called glibc's `execvpe`, which searches PID 1's own (empty) PATH rather than the job's, so programs outside /bin and /usr/bin were not found. It now resolves them itself (tested).
341
- Tests serving on 127.0.0.1 need a loopback interface. `network "loopback"` (already in the spec) is now in M0: `flow-init` brings up `lo`, with still no device leaving the guest (tested).
342
- oxygen's `git_import_reproduces_trees` only passed where git has a user identity, because one merge lacked `-c user.name`. Fixed; it now also asserts the merge started.
343
-**Result:** oxygen's full gate (fmt, clippy -D warnings, every test) passes in a microVM on Earth in 135 s cold, with 8 GiB, 4 CPUs and a 24 GiB disk mount.
344
- Runner and hub redeployed; Earth scratch cleaned.
- 2026-09-28 Andy agreed the order for his five ideas: F2–F5 first, then conflict resolution (P1, P1b), function history (P2), swimlanes (P3), signed receipts and the trust dashboard (P4, P4b), then web workspaces (P5, P5c).
346
- Decisions from the discussion:
347
- Web workspaces start from openvscode-server unmodified, not a VS Code fork.
348
- Hub-side history rewrites are plans applied and signed by the author's client, only on proposal bookmarks.
349
- Function history uses atom identity rather than the semantic-deps hook.
350
- Andy asked the loop to carry straight through all of it.
- 2026-09-28 F2 done (oxygen#6, closed by the change).
352
-**The pipeline** (`.flow/pipeline.kdl`) runs on every push to oxygen:
353
-`fmt` in a small sandbox (1 GiB, 1 CPU, isolated);
354
- then `clippy -D warnings`, `test --workspace` and a release `build`, each with `--locked` in the build image (8 GiB, 4 CPU, loopback) with a 24 GiB scratch disk for target/.
355
-**First run** (#6, passed): fmt 13 s, clippy 46 s, test 1 min 37 s, build 2 min 7 s; 4 min 44 s end to end. The runner runs one job at a time.
356
- The jobs show as checks on the change. Required checks come with F5.
357
- The run shows "site token" as its pusher: Andy asked why pushes are not attributed to him. They use the site push token from hub.toml, set up before accounts existed.
358
- Waiting on Andy for a personal access token (Settings › Tokens, repo:write) to put in every repository's `earth` remote.
359
- Then, with his OK, remove the site token from hub.toml.
- 2026-09-28 Pushes now use a personal access token for Andy's account in every repository's `earth` remote, not the site push token, so the hub records them as andymccall. The site token stays in hub.toml until Andy agrees to remove it.
- 2026-09-28 F3 done (oxygenhub#19, oxygenflow#4, oxygen#8, closed by the changes). Andy chose pinned subrepos.
362
-**Subrepos.** oxygenhub pins oxygen and oxygenflow as subrepos in deps/ and builds against them.
363
-`make pins` pulls them to main on Earth; the next commit records the new pins.
364
- A Cargo `paths` override that kept local builds on the sibling checkouts warned that it will become a hard error, so there is none: local, CI and deploy all build the pins.
365
-**OxygenFlow.**
366
- Claims list the state's pinned Oxygen subrepos that the pusher can read, and the job token may read those (and nothing else).
367
- The runner fetches and exports each at its path, inside the scope hash.
368
- Hub test `claims_carry_pinned_subrepos_and_the_job_token_reads_only_those`.
369
-**oxy fix.**`submodule add` probed URLs without OXY_TOKEN and OXY_CA, so a hub with its own CA, or a private repository, fell back to git. It now reports the Oxygen error too.
370
-**Formatting.**`cargo fmt --all` in oxygenhub also formats the path dependencies in deps/, with the hub's style, since oxygen has no rustfmt.toml. The pipeline and the loop's hub gate use `cargo fmt -p oxygenhub -p hub-api`.
371
-**First run** (#12, pushed as andymccall, passed): fmt 5 s, clippy 1 min 49 s, test 4 min 1 s, release build 8 min 26 s. The runner runs one job at a time → F6.
372
- Also this iteration: removed fix.py, fix2.py and format_xenon.py from oxygen (Andy's request, oxygen#7). Answered Andy's VS Code question: the extension is installed in both profiles and only shows in an Oxygen repository.
- 2026-09-28 F4a done (oxygenflow#5, oxygenhub#19, closed or referenced by the changes).
374
-**Pinning.** oxygenflow pins oxygen at deps/oxygen, with `make pins` and a README note.
375
-**oxygenflow's pipeline** adds fmt (this workspace only), clippy -D warnings and tests on the build image, before its summary. First run #14: all 8 jobs passed.
376
-**The hub's layout had to change.** oxygenflow's flow-core now points at its own deps/oxygen, so the hub keeping a second oxygen pin would give Cargo two different oxy-core packages. The hub now pins only oxygenflow and builds against deps/oxygenflow/deps/oxygen.
377
- The chain for newer code: push oxygen, then `make pins` in oxygenflow and push it, then `make pins` in oxygenhub.
378
-**Nested subrepos.** Hub claims follow subrepos of subrepos, parents first, joined paths, up to 3 deep, with the same read check. The hub test covers a pin inside a pin.
379
-**Result.** oxygenhub run #15 fetched deps/oxygenflow and deps/oxygenflow/deps/oxygen and passed: fmt 2 s, clippy 1 min 37 s, test 3 min 44 s, build 6 min 25 s.
380
-**Also fixed** for Andy: `oxy identity export` failed in a new repository, because identity lookups ignored the key directory. It now falls back to it, checked against the key, and the help names the file it writes (oxygen#9).
- 2026-09-28 F4b done (oxygen-vscode#5, closed by the change; oxygenhub-vscode references it).
382
-**Image.** The build image (now `85c744e5…`) also carries an npm cache of both extensions' lock files. `npm ci --offline --cache /opt/npm-cache` installs from it read-only; checked locally before building.
383
- oxygen, oxygenhub and oxygenflow still pin the previous image `3ba0779a…`; they move on their next re-pin.
384
- Rebuild the image when a package-lock.json or Cargo.lock changes.
385
-**oxygen-vscode** pins oxygen as deps/oxygen (kept out of the .vsix). Its `check` job builds oxy from the pin on a scratch disk and runs typecheck, bundle and the 18 tests against it; then `package`.
386
-**oxygenhub-vscode:** check and package. Its hub-client tests skip in the VM, since there is no hub binary there.
387
-**First runs:**`package` failed in both, because a job starts from a fresh workspace and had no dist/. It now builds first.