Releases 1

Agents sign with no key of their own (oxygenhub#241). With author.signer = keyless, oxy signs with a fresh key the hub certifies for ten minutes whenever it must sign, kept in memory only. The agent proves itself with a grant token its owner made with oh agent grant NAME and oxy auth grant keeps. The owner's own key signs the grant, which travels inside every certificate issued under it, so the agent's commits count in the owner's name without trusting the hub for authorship. The owner revokes the grant on the hub, and there is no key left to rotate or leak. keyless.hub names the hub (default: the default remote's).

Certificates for short-lived keys (spec §14.7). A hub's key certifies a fresh key for a subject such as repo:OWNER/NAME:bookmark:B or agent:NAME@ACCOUNT, with a scope and a window of at most an hour. Pushes and fetches carry the certificates of the keys that signed what they bring. oxy receipt verify reads receipts that OxygenFlow runners sign with such keys.

Policies grant subjects an issuer certifies. oxy policy grant-subject SUBJECT --issuer IDENTITY --scope SCOPES lets keys certified for a subject sign changes and move bookmarks. A push is checked at the receiver's clock. A fetch is checked at the time the issuer says it accepted the update, a countersigned accepted attestation the hub serves with the bookmark, so an expired key cannot backdate one.

A push seals for the author it signs for. A delegate or a certified key set as author.signer now seals the author's unsigned changes at push, so it no longer has to sign each change at commit (core.sign = change).

gc keeps short-lived keys' certificates for every change and attestation it keeps, not only receipts', so a fresh clone can still check a certified bookmark after a gc.