Rotation writes author.key to the repository config when one is there, leaving other checkouts on an old key issue #69 closed: completed andymccall opened this 1 month ago · 0 comments

Found 2026-10-04 while setting up agents. oxy identity delegate add, rotate, renew and delegate remove each issue a successor identity and record its KeyId where author.key already lives: the repository layer when that checkout has one, else the user config. Once a checkout pins author.key at repository level, every rotation made there stays local to it, and every other checkout keeps resolving the user config's older key, which has none of the delegates. Here the oxygen checkout followed f1add784 → b760a68d → 710a5bac while vampirekiller, oxygenhub and the rest still signed as f1add784.

Wanted:

• Rotation updates the user config whenever the key it replaces came from there, and the repository layer only when that layer differs from the user's (and says so); or simpler, always the user config plus any repository layer that named the old key.
• oxy config --unset KEY (there is no way to drop a repository-level key today).
• oxy identity show warns when the repository layer pins a key that is a predecessor or successor of the user config's.
• oxy identity delegate add taking several identity files in one rotation, and a note in its output that agents configured with author.key need the new KeyId.