A delegate home naming an identity the repository lacks: say what to do, not 'object not found' issue #82 closed: completed andymccall opened this · 5 comments
The error half is done (oxy, not yet released): a missing author identity now names the key, the config that set it, where it looked, and the fix (pin with oxy config author.key). Still open: delegate homes that name whom they act for, so they follow the newest identity without a pin per repository.
andymccall referenced by change cbe8499a5a8c on main ·
Options for the remaining half (a delegate home that follows its human's newest identity), for Andy to choose (2026-10-14):
- Follow successors (no new config): when author.key names an identity this repository (or the home's keys directory) holds a newer successor of, by the
previouschain, sign as the newest successor, and say so once. Works where the chain is present; a repository holding only the newest identity, with no link back to the pinned one, still needs a pin. - Name the person:
author.for = andymccall(or an email) in the agent home; in each repository oxy uses the newest identity there with that name/email that lists this home's key as a delegate. Robust to rotations; matching by name is softer than by key. - Name the chain's root key:
author.root = f1add784…; oxy resolves the newest identity in the repository whosepreviouschain reaches it. Exact, but needs the chain in each repository (the hub could send it with pushes).
My recommendation: 2, checked by the delegation (the identity must list this home's signing key as a delegate), which is what makes it safe; 1 as a fallback when author.key is set.
andymccall set labels bug, gap ·
Decided (Andy, 2026-10-26): option 2, name the person. author.for = andymccall (or an email) in the agent home; in each repository oxy signs as the newest identity with that name that lists this home's signing key as a delegate (the delegation is the safety check). Following the previous chain stays as the fallback when author.key is set.
Refined (Andy, 2026-10-26): checked first, the 'object not found' failure no longer happens under a keyless home (its keys folder holds the identity author.key names, and pushes carry it, issue #134). What remains: homes author as an old identity (4cd9916c, two rotations back; Andy is d89664ce since 10-20), which verifies only by issue #135. Ask the hub: author.for = andymccall in a keyless home; when it gets its ten-minute certificate the hub also returns the account's current linked identity with its chain back to the grant's key; oxy authors as that and carries it with the push. A local scan stays out (rotations are recorded per repository).
andymccall referenced by change 2452b4407ab7 on main ·
Done: oxy 485fb445 (author.for, keys/author.for, the chain stored beside the change) and hub 2f9d839a (certify answers with author_chain); the hub's agent test rotates the owner and checks the agent then authors as the new identity, sealed and valid on the hub. To use it: after the next hub deploy and an oxy release, oxy config --user author.for andymccall in each agent home (~/.oxy-agents/claude, antigravity).
andymccall closed ·
From ~/oxygen_feedback.md issue #39 (supermarioland → rstar-api, 2026-10-07): an agent home's author.key named Andy's oxygen identity (710a5bac), which rstar-api does not hold, so every command there failed with 'object 710a5bac… not found'. Fixed by hand by pinning the current identity in the repository (oxy config author.key 8bc05e0a…). Wanted: an error naming the missing identity and the fix (pin the current key in this repository, or fetch it); and a delegate home that names whom it acts for, so it resolves the delegator's newest identity in any repository that identity has signed into, instead of a key pinned per home that goes stale with every rotation.