OXYGENHUB

Changes up to # 9ff1fb9f2865 touching crates/flow-core/src/pipeline.rs · 21

See as swimlanes (independent work side by side)

Sealed approvals: approval { sealed } and the oxygen pin
Andy McCall via Claude Code agent ·
✔ 2be1fe4ad345
Environments: environment "prod" on a job
Andy McCall via Claude Code agent ·
✔ f4e51e63582d
Approval gates in the pipeline: approval { by; others-only; expires }
Andy McCall via Claude Code agent ·
✔ e20897216221
Artifacts between jobs: input { artifact "x" from "job"; path "/src/x" }
Andy McCall via Claude Code agent ·
✔ 46fe2c815cc3
Allow-listed egress over vsock: network "egress" { allow "host"... }
Andy McCall via Claude Code agent ·
✔ ea81796bb757
A build cache: disk mounts that carry a build forward
Andy McCall ·
✔ d60aac6c3f8a
Report outputs: a directory with report.toml, uploaded file by file with a manifest newer-pipelinepush-uses-login
Andy McCall ·
✔ 6d53fb7d00ec
Artifacts: when "always" keeps a failing job's report
Andy McCall ·
✔ 9a6fac2b40a9
Architecture awareness: image manifests, arch on a sandbox, archs on the claim
Andy McCall ·
✔ 1abadd4a2fa6
A job's identity: identity blocks name an audience and a mount path
Andy McCall ·
✔ 720eb8191059
Secrets mount as files: secret blocks, the claim's secrets, flow-init writes them
Andy McCall ·
✔ e2c125610f43
pipeline.kdl: on { push; tag; manual; schedule } for the pipeline and each job
Andy McCall ·
✔ bf7bb1b80fa3
pipeline.kdl: timeout on a job or a sandbox
Andy McCall ·
✔ 02b127d2c721
Pipelines: runs-on asks for runner labels (refs andymccall/oxygenhub#41, part 3)
Andy McCall ·
✔ e576e08617dc
flow check points at \u{1b} for ANSI colours
Andy McCall ·
✔ b647ab72d51e
Job artifacts: output declarations, extraction and upload
Andy McCall ·
✔ a67b97e9a717
Sandbox env, and an image's own environment
Andy McCall ·
✔ a72abeeedd78
Guest /dev/fd links; jobs are told what they build
Andy McCall ·
✔ c4285535b03a
Build image for Rust and Node jobs (images/rust: toolchain, rustfmt, clippy, Node 24, vendored crates, offline cargo); flow-init finds the program in the job's PATH (glibc's execvpe used PID 1's own); network "loopback" in M0
Andy McCall ·
✔ eb5c4db673e5
Ephemeral scratch mounts in M0: ephemeral://tmpfs and ephemeral://disk (a sparse disk per job), checked targets and sizes, in the canonical job and the receipt; flow-init mounts them for the job's user; make deploy-runner
Andy McCall ·
✔ fc10d9e80383
OxygenFlow M0: pipeline parser and canonical job graph, receipts, the runner API types, flow-init, the Firecracker tier, flow check, run, rootfs import and runner
Andy McCall ·
✔ e0918b887850