oxy doctor says 'Everything looks right' in a repository with no trust policy issue #127 closed: completed andymccall opened this 16 days ago · 0 comments

Reported by RSTAR (2026-10-19): in their rstar-api checkout every fetch ends with

! oxygenhub has no trust policy; nothing fetched from it was verified

yet oxy doctor, run a second later in the same directory, reports identity, author, portability and both remotes good and ends "Everything looks right."

doctor never looks at the trust policy. A repository without one is supported (spec §16.4: everything is accepted unverified), but it is exactly the state a user should be told about.

Proposed: a trust line in oxy doctor:

• policy present: Ok, "policy #… serial N, R root(s), expires …" (Warn when it expires within 30 days, Fail when expired);
• no policy: Warn, "no trust policy: fetched changes and bookmark moves are not verified", with a hint naming who fixes it: the repository's owner runs oxy policy init, grants contributors (oxy policy grant) and keyless agents (oxy policy grant-subject --issuer <hub>/.well-known/oxyhub-key agent:NAME@ACCOUNT), and pushes;
• in --json too.