OXYGENHUB

Changes up to # 060d459ff6c6 touching crates/flow-core/src/lib.rs · 12

See as swimlanes (independent work side by side)

Sealed alerts: flow_core::alert encrypts what a phone is told to an X25519 key it made (fresh key per alert, HKDF-SHA256, ChaCha20-Poly1305), from crates already in the tree (refs oxygenhub-android#16) mainv0.5.1v0.5.2v0.5.3 head
Andy McCall via agent:claude@andymccall agent ·
◈ 060d459ff6c6
Approval gates in the pipeline: approval { by; others-only; expires }
Andy McCall via Claude Code agent ·
✔ e20897216221
Artifacts between jobs: input { artifact "x" from "job"; path "/src/x" }
Andy McCall via Claude Code agent ·
✔ 46fe2c815cc3
Allow-listed egress over vsock: network "egress" { allow "host"... }
Andy McCall via Claude Code agent ·
✔ ea81796bb757
Report outputs: a directory with report.toml, uploaded file by file with a manifest newer-pipelinepush-uses-login
Andy McCall ·
✔ 6d53fb7d00ec
Architecture awareness: image manifests, arch on a sandbox, archs on the claim
Andy McCall ·
✔ 1abadd4a2fa6
A job's identity: identity blocks name an audience and a mount path
Andy McCall ·
✔ 720eb8191059
Secrets mount as files: secret blocks, the claim's secrets, flow-init writes them
Andy McCall ·
✔ e2c125610f43
pipeline.kdl: on { push; tag; manual; schedule } for the pipeline and each job
Andy McCall ·
✔ bf7bb1b80fa3
Build identity in flow --version and runner reports
Andy McCall ·
✔ 2d025bbf9842
Ephemeral scratch mounts in M0: ephemeral://tmpfs and ephemeral://disk (a sparse disk per job), checked targets and sizes, in the canonical job and the receipt; flow-init mounts them for the job's user; make deploy-runner
Andy McCall ·
✔ fc10d9e80383
OxygenFlow M0: pipeline parser and canonical job graph, receipts, the runner API types, flow-init, the Firecracker tier, flow check, run, rootfs import and runner
Andy McCall ·
✔ e0918b887850