OXYGENHUB

Changes up to # 2814f4213e7c +4 touching crates/flow-core/src/pipeline.rs · 24

See as swimlanes (independent work side by side)

2814f4213e7cd997f4319b8e4eb56dfe78479480319b480742ea5998b9a2b8d2+494a1b9a8ac268416c2fb9b53cf0277143685bdcacd64a00643abcec506b549c+85275e1ef3b757806addfbb309ed663d825bc085764ddd29692d595a20b3668a+a083cc802892c7b532f19bd852a5f82a32d283719fada2c46c050bd4fac3c090+c90dd8d5fc36bc3cc6d52a0c48b4b39becc2415c97602577838bfb850ebc826f has 5 heads. The graph shows their union; heads are marked.
Checkpoints: a handed-back job resumes (refs #77)
Andy McCall via agent:claude@andymccall agent ·
◈ f201e1bc5bcd
The WASM tier: WASI modules run by wasmtime on any runner (closes #75)
Andy McCall via agent:claude@andymccall agent ·
◈ 28cc603f737d
pipeline.kdl: priority lowers a job's place in the queue, never raises it v0.2.0v0.3.0v0.3.1
Andy McCall via Claude Code agent ·
✔ e87c1c138187
Sealed approvals: approval { sealed } and the oxygen pin
Andy McCall via Claude Code agent ·
✔ 2be1fe4ad345
Environments: environment "prod" on a job
Andy McCall via Claude Code agent ·
✔ f4e51e63582d
Approval gates in the pipeline: approval { by; others-only; expires }
Andy McCall via Claude Code agent ·
✔ e20897216221
Artifacts between jobs: input { artifact "x" from "job"; path "/src/x" }
Andy McCall via Claude Code agent ·
✔ 46fe2c815cc3
Allow-listed egress over vsock: network "egress" { allow "host"... }
Andy McCall via Claude Code agent ·
✔ ea81796bb757
A build cache: disk mounts that carry a build forward
Andy McCall ·
✔ d60aac6c3f8a
Report outputs: a directory with report.toml, uploaded file by file with a manifest newer-pipelinepush-uses-login
Andy McCall ·
✔ 6d53fb7d00ec
Artifacts: when "always" keeps a failing job's report
Andy McCall ·
✔ 9a6fac2b40a9
Architecture awareness: image manifests, arch on a sandbox, archs on the claim
Andy McCall ·
✔ 1abadd4a2fa6
A job's identity: identity blocks name an audience and a mount path
Andy McCall ·
✔ 720eb8191059
Secrets mount as files: secret blocks, the claim's secrets, flow-init writes them
Andy McCall ·
✔ e2c125610f43
pipeline.kdl: on { push; tag; manual; schedule } for the pipeline and each job
Andy McCall ·
✔ bf7bb1b80fa3
pipeline.kdl: timeout on a job or a sandbox
Andy McCall ·
✔ 02b127d2c721
Pipelines: runs-on asks for runner labels (refs andymccall/oxygenhub#41, part 3)
Andy McCall ·
✔ e576e08617dc
flow check points at \u{1b} for ANSI colours
Andy McCall ·
✔ b647ab72d51e
Job artifacts: output declarations, extraction and upload
Andy McCall ·
✔ a67b97e9a717
Sandbox env, and an image's own environment
Andy McCall ·
✔ a72abeeedd78
Guest /dev/fd links; jobs are told what they build
Andy McCall ·
✔ c4285535b03a
Build image for Rust and Node jobs (images/rust: toolchain, rustfmt, clippy, Node 24, vendored crates, offline cargo); flow-init finds the program in the job's PATH (glibc's execvpe used PID 1's own); network "loopback" in M0
Andy McCall ·
✔ eb5c4db673e5
Ephemeral scratch mounts in M0: ephemeral://tmpfs and ephemeral://disk (a sparse disk per job), checked targets and sizes, in the canonical job and the receipt; flow-init mounts them for the job's user; make deploy-runner
Andy McCall ·
✔ fc10d9e80383
OxygenFlow M0: pipeline parser and canonical job graph, receipts, the runner API types, flow-init, the Firecracker tier, flow check, run, rootfs import and runner
Andy McCall ·
✔ e0918b887850