Compare newer-pipeline … main

# The CI profile (oxygenflow#82): every test runs, and a JUnit report is

# written to target/nextest/ci/junit.xml for the hub's test report

# (the job's `junit` artifact).

[profile.ci]

fail-fast = false

[profile.ci.junit]

path = "junit.xml"

// The cheap checks as one WASI module (#96): crates/flow-checks, built by

// scripts/checks-wasm.sh and committed as .flow/checks.wasm (the fmt job

// fails if it is not what the source builds). No image and no KVM, so any

// runner with the WASM tier takes them: the phone, plex, windows-1.

sandbox "wasm" {

    runtime "wasm"

    memory-limit "64MiB"

}

    sandbox "wasm"

    exec ".flow/checks.wasm" "layout" "Cargo.toml" "docs/m0.md" "crates/flow-core/src/pipeline.rs" "crates/flow-init/src/main.rs" "crates/flow/src/microvm.rs"

    sandbox "wasm"

    scope "crates/**" ".flow/checks.wasm"

    exec ".flow/checks.wasm" "todos" "crates"

}

// The changelog's shape, and a section for the version Cargo.toml says, so

// a release never finds its notes missing.

job "changelog" {

    sandbox "wasm"

    scope "CHANGELOG.md" "Cargo.toml" ".flow/checks.wasm"

    exec ".flow/checks.wasm" "changelog" "CHANGELOG.md" "Cargo.toml"

    sandbox "wasm"

    scope "crates/**" ".flow/checks.wasm"

    exec ".flow/checks.wasm" "size" "crates"

    rootfs "cas://blob/e52c41a173956b6bacc270eb81208a1b118b652412b84d15fa24708e6f8ec392"

    rootfs "cas://blob/e52c41a173956b6bacc270eb81208a1b118b652412b84d15fa24708e6f8ec392"

    // This workspace only (--all would reach the pinned oxygen in deps/),

    // and the checks' committed WASI module is what its source builds (#96).

    exec "sh" "-euc" "cargo fmt --check -p flow -p flow-core -p flow-init -p flow-casfs -p flow-checks && sh scripts/checks-wasm.sh --check"

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

    }

    // One build identity for every CI state, so the cached target stays

    // fresh from one push to the next (oxygenflow#52).

    env {

        OXY_BUILD "ci"

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

    // One build identity for every CI state, so the cached target stays

    // fresh from one push to the next (oxygenflow#52).

    env {

        OXY_BUILD "ci"

    }

    // The tests under cargo-nextest and cargo-llvm-cov (#82): a test report

    // (JUnit, kept whether or not they pass) and line coverage (LCOV) from

    // one run, for the hub's Tests and Coverage tabs.

    exec "sh" ".flow/warm-target.sh" "cargo" "llvm-cov" "nextest" "--workspace" "--locked" "--profile" "ci" "--lcov" "--output-path" "/src/target/lcov.info"

    output {

        artifact "junit" {

            path "/src/target/nextest/ci/junit.xml"

            when "always"

        }

        artifact "coverage" {

            path "/src/target/lcov.info"

        }

    }

// Runner builds for releases (oxygenhub#322): flow-linux-ARCH for x86_64,

// aarch64 and riscv64, which runners that update themselves are offered.

job "dist" {

    sandbox "rust"

    depends-on "fmt"

    scope "Cargo.toml" "scripts/dist.sh"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "24GiB"

        cache "target"

        key "Cargo.lock"

    }

    env {

        DIST_FLAT "/src/target/dist-flat"

        ZIG_GLOBAL_CACHE_DIR "/src/target/zig-cache"

    }

    exec "bash" "scripts/dist.sh"

    output {

        artifact "flow-linux-x86_64" {

            path "/src/target/dist-flat/flow-linux-x86_64"

        }

        artifact "flow-linux-aarch64" {

            path "/src/target/dist-flat/flow-linux-aarch64"

        }

        artifact "flow-linux-riscv64" {

            path "/src/target/dist-flat/flow-linux-riscv64"

        }

        artifact "flow-windows-x86_64.exe" {

            path "/src/target/dist-flat/flow-windows-x86_64.exe"

        }

        artifact "SHA256SUMS" {

            path "/src/target/dist-flat/SHA256SUMS"

        }

    }

}

    sandbox "wasm"

    exec ".flow/checks.wasm" "summary"

# oxygen#145: two changes that each add a changelog entry in the same

# place keep both, without a conflict.

CHANGELOG.md merge=union

images/android/dl/

images/android/app/

images/android/vendor/

images/android/*.tar

0.2.0 is OxygenFlow's first tagged release; until then the runners ran `main`. This file starts on 2026-10-01; earlier history is in `oxy log`.

## 0.5.3 (2026-11-04)

- **Added: a `changelog` check on the WASM tier.** `.flow/checks.wasm changelog CHANGELOG.md [MANIFEST]` checks the changelog's shape (`## Unreleased` first if at all, then `## X.Y.Z (YYYY-MM-DD)` sections newest first, none empty) and that the version a `Cargo.toml`, `.properties` or `package.json` says has its section, so a release never finds its notes missing. It is a job of OxygenFlow's pipeline, and of OxygenHub's, Oxygen's and the Android app's, any runner with the WASM tier taking it.

- **Added: `flow deps check` (#101).** Jobs have no network, so every crate a `Cargo.lock` needs must be vendored in the build image at that version. `flow deps check [Cargo.lock]` says whether it is, before the push: each missing crate with the versions the image does have and the `cargo update --precise` that pins one, exit 1. It reads the image's crate list (`--list`), a vendor directory (`--vendor`), or the lock files the image is built from (`--image-lock`, repeatable); inside a job, the image's own. `flow deps list` prints the set.

- **Changed: the build image publishes its crate list.** `images/rust/build.sh` writes `crates.txt` (`NAME VERSION` a line) beside the tarball and at `/opt/crates.txt` in the image.

- **What a runner is running, for its host (oxygenhub-android#8):** `flow::runner::running()` lists the jobs this runner is running now (`owner/name #run job`), each from just before it starts until it ends, so the Android app can show them on its card and notification.

- **`flow` builds and runs on FreeBSD (#99):** FreeBSD 15.1 with pkg's Rust 1.98 builds `flow` with the WASM tier (wasmtime runs there); the `noatime` check is Linux's only, as on Haiku. A FreeBSD machine can be a WASM runner (`flow tiers`: wasm available; the microvm and syscall tiers say they are Linux's).

## 0.5.2 (2026-10-29)

- **Runner builds through the swarm (#84):** a runner in a swarm fetches an offered build as the image its BLAKE3 names, from its site's peers and the hub together, as it fetches images, and checks its size and BLAKE3 before installing it; over HTTP as before when it is in no swarm, the hub has not shared the build yet, or the swarm cannot get it. The hub shares a build the first time it offers it (OxygenHub 0.9.15), so a site's runners fetch it from each other and the hub serves it about once per site. The build stays in the runner's images for its peers.

- **`flow` builds on Haiku (#91):** with `--no-default-features`, `flow` now builds natively on Haiku R1/beta6 (HaikuPorts' Rust 1.94): the syscall tier, the guest's job code and the load average are Linux's (and Android's) only, and the `noatime` check takes reads as recorded where statvfs has no such flag. It checks pipelines and runs `flow tiers`, which says no tier runs there yet: the host tier (#90) is next.

- **The WASM tier can be left out of a build (#91):** the `wasm` cargo feature (on by default) carries wasmtime; `--no-default-features` builds `flow` for systems wasmtime does not run on, such as Haiku, whose runners then offer no WASM tier and say why.

## 0.5.1 (2026-10-28)

- **Sealed alerts (`flow_core::alert`, oxygenhub-android#16):** what a phone is told about a job is encrypted to an X25519 key the phone made (a fresh key per alert, HKDF-SHA256, ChaCha20-Poly1305), so the push service carrying it sees only ciphertext. `seal` for the hub, `open` and `new_secret`/`public_key` for the phone, from crates already in the tree (curve25519-dalek, ring).

- **`flow runner register --ca` keeps the CA in the Flow home (#98):** it wrote the path as given, so `--ca hub-ca.pem` left `ca = "hub-ca.pem"` in runner.toml and a service started elsewhere could not find it. Register now copies the file to the home's `hub-ca.pem` and records that copy's absolute path, and a relative `ca` already in runner.toml is read against the home.

- **The cheap checks run as WASM (#96):** `layout`, `todos`, `size` and `summary` are one WASI module, `crates/flow-checks`, built by `scripts/checks-wasm.sh` and committed as `.flow/checks.wasm`, so they need no image or microVM and any runner with the WASM tier takes them (the phone, plex, windows-1); each runs in under 100 ms. The fmt job fails unless the committed module is what the source builds, and the build image has the wasm32-wasip1 target for that.

## 0.5.0 (2026-10-27)

- **A job's report says where its time went (#35).** The finish report carries `phases` in milliseconds: `image` (fetching its image, when the runner lacked it), `prepare` (its workspace and disks), `run` (the sandbox from start to stop) and `finish` (outputs, caches and receipt), so a slow job shows whether it waited on an image, a fetch or itself.

- **The swarm reads images in order (#97).** A fetcher took equally rare chunks at random, so a peer read its whole image in random order, a seek per chunk on a spinning disk: plex-1 got 2.3 GiB from earth-1 at about 2 MB/s. Neighbouring chunks now come in runs, shuffled so runners starting together still spread, and the picker no longer rescans what it has: picking a 142,244-chunk image went from 19 s to 0.35 s.

- **The swarm moves an image nobody pushed (#94).** A runner that serves its peers tells the hub, at start and every ten minutes, which images it holds, and sends the manifest of each the hub keeps none of: the manifest alone, not the image. With a hub that keeps such manifests (oxygenhub#342), runners in the same site fetch the image from it. A fetch told the hub holds no chunks asks peers alone, and fails plainly when none can serve it. Design: docs/jetstream.md §8.1.1.

- **A WASM job stopped while its module compiles stops (#93).** The time limit or a cancel moved the engine's epoch once; a store made after that set its deadline past it, so the job ran on forever (seen as a test spinning 35 minutes under load). Once stopped, the epoch now moves every tick until the job ends.

- **A runner claims only what its host can start (#92).** An idle runner told the hub it had no memory limit, so it was offered sandboxes bigger than its machine, fetched their images, and declined them one by one (mars-1, 7 GB, and the 8 GiB jobs). A claim now asks for the budget's room capped at the host's free memory.

- **`flow rootfs push` waits for the hub to check a big image (oxygenhub#341).** The hub reads the whole image before it accepts the manifest; the manifest request now waits up to an hour, not the 120 s every other request gets.

- **The Android image (#19).** `images/android`: OpenJDK 17, the Android SDK (command-line tools 23.0, platform 37.0, build-tools 36.0.0, NDK 30.0), Gradle 9.6.0, Rust with the Android targets and cargo-ndk, and the OxygenHub app's crates and Gradle dependencies, so the app builds and tests offline. Each download is checked against its published hash.

- **`flow runner bench` says when load is not measured (#83):** a Windows runner printed `load 0.00`; it now says `load not measured here`. Its kernel line reads `Windows 10.0.26300` (checked with 0.4.0 in the Windows VM).

## 0.4.0 (2026-10-26)

- **A Windows runner reports its Windows version (#83):** as its kernel fact (`Windows 10.0.26100`, from `RtlGetVersion`), shown on the hub's runner page and in `flow runner bench`. Built and linted for Windows; not yet run there.

- **`flow runner drain` (#83):** asks the home's running runner to drain, as SIGTERM does on Linux, through a `drain.request` file its loop reads: the way to stop a Windows runner without losing its job. A starting runner clears a stale request.

- **A Windows runner updates itself (#83, #85):** `flow runner update` on Windows checks a PE build, renames `flow.exe` to `flow.prev.exe` and `flow.new.exe` into its place with `MoveFileExW` (retrying while a virus scanner holds a new file; a running program cannot rename its own file, so a copy of it, `flow __rename`, does), tells the running runner through an `update.request` file in its home (no SIGUSR1 there), and the runner leaves and exits 75 so a Task Scheduler task set to restart on failure starts the new build, which proves itself by reaching the hub. Tried in the Windows VM: install, leave, exit 75, restart, proven. A rollback runs the restored build and ends with it. Spec §11.5.3.

- **`flow` builds for Windows (#83, step 2 begun):** `cargo build --target x86_64-pc-windows-gnu` gives a `flow.exe` that offers the WASM tier: the syscall tier, the guest helpers and the egress proxy are Linux's only (a Windows build says the syscall tier "runs only on Linux"), cache pruning by reads stays on Linux, and file modes, links and sizes go through a small `portable` module (modes are not kept on Windows). Its claims report free disk (`GetDiskFreeSpaceExW`); load and kernel are not measured there yet, and a Windows runner does not update itself. `dist` builds `flow-windows-x86_64.exe` too. Nothing changes on Linux or Android. Tried in the Windows VM on Earth: `flow.exe tiers` offers wasm, a local `flow run` of a 120-step WASM job passes, and registered as runner `windows-1` (label `windows`) it ran andymccall/windows-runner-demo's job from the hub (run #1). Helpers start from the running binary's path on Windows (`/proc/self/exe` on Linux and Android).

- **The syscall tier's loopback reaches TCP (#73):** with `network "loopback"`, a job may open IPv4 and IPv6 sockets, which in its own network namespace reach only its `lo`, so a server it starts on 127.0.0.1 answers it (a conformance suite over an emulator's HTTP control port, which skipped every test on narvi-1). With `network "isolated"` sockets other than `AF_UNIX` are still refused.

- **Runner builds in releases (oxygenhub#322):** a `dist` job (`scripts/dist.sh`, on a change to `Cargo.toml` or the script) builds `flow` stripped for Linux x86_64, aarch64 and riscv64 (glibc 2.28 and later) as `flow-linux-ARCH`, named by the architecture a runner reports, with `SHA256SUMS`: the files a release carries for runners that update themselves.

- **Runners ask the hub for their update (oxygenhub#322):** once the hub has answered a claim, and every 15 minutes, a runner asks `GET /api/v1/flow/runner/update`; when the hub offers a build, it downloads it (kept in the home's `updates/`), refuses it unless its size and BLAKE3 are those the hub attests, and installs it as `flow runner update` does, leaving within 600 s, or for a dry run checks it and says what would happen. What it did goes back to the hub once per outcome, and a proof or a rollback is told at the next start. `[runner.update] allow = false` refuses and says so; a hub without runner updates (404) is simply asked again later.

- **The runner update protocol's types (oxygenhub#322):** `UpdateAnswer`, `UpdatePolicy`, `UpdateOffer` and `UpdateReport` in flow-core, for `GET`/`POST /api/v1/flow/runner/update`: the policy that applies to a runner once every level is applied, and the release asset it should run.

- **`flow runner update --from FILE` (#85):** the runner's side of self-updating runners (docs/jetstream.md §8.2). It checks a new build (this machine's target, `--version`, a tier it can run here), keeps the installed one as `flow.prev`, swaps the new one in with a single rename, and tells the running runner (SIGUSR1, its pid in `runner.pid`) to leave within `--notice` seconds (600 by default): jobs that fit finish, the rest are handed back with their checkpoints, and the unit starts the new build. The new build proves itself by getting an answer from the hub; four starts or ten minutes without one put `flow.prev` back. `--dry-run` changes nothing; `[runner.update] allow = false` in `flow.toml` refuses every update; `updates.log` in the home records each install, proof and rollback. Spec §11.5.3.

- **A local `flow run` of a WASM or syscall job copies the workspace whole:** it copied into a directory it never made, so a file at the top of the workspace (a README) failed with `No such file or directory`.

- **Checkpoints: a handed-back job resumes (#77):** `checkpoint "/src/…"` on a job names directories that hold its progress; a runner handing the job back packs and keeps them (`POST …/checkpoint`), and the next attempt's runner restores them before running the same exec, so it carries on rather than starting again. The receipt lists the checkpoint among its inputs. WASM and syscall tiers for now. Spec §11.5.2.

- **A leaving runner finishes what fits its notice (#76):** a claim carries `expected_ms` (the median of the job's recent passing runs, from OxygenHub 0.9.4); `runner::leave_within(reason, notice)` finishes and reports a job whose expected rest fits the notice and hands back the others, and any still running when it is up. `runner::leave` is the same with no notice. Spec §11.5.2.

- **OxygenFlow's own CI writes a test report and coverage (#82):** its test job runs under cargo-nextest and cargo-llvm-cov (both in the Rust image, #81), keeping a JUnit report (whether or not the tests pass) and LCOV coverage for the hub's Tests and Coverage tabs; `.config/nextest.toml` has the `ci` profile.

- **A runner that leaves hands its jobs back (#76):** `runner::leave(reason)` (the runner as a library, as the Android app runs it) stops claiming, stops the jobs it holds, sends what they logged and hands them back with `POST /api/v1/flow/jobs/{id}/release`; the hub (OxygenHub #312) queues them again ahead of new work for another runner, and hands back the jobs of a runner silent for 3 minutes the same way. Spec §11.5.2.

- **A runner reads its load and kernel without /proc:** `sysinfo` and `uname`, the same numbers; an Android app may not read `/proc/loadavg` or `/proc/sys/kernel/osrelease`, so the phone runner was refused, and logged, at every claim (oxygenhub-android#8).

- **Built on oxygen's main with #140 and #141:** the runner's store puts objects in place where hard links are refused (Android, so the phone runner can clone), and the `deps/oxygen` pin conflict two replacements in one change left on main is settled with `oxy resolve deps/oxygen`.

- **The WASM tier (#75):** `runtime "wasm"` runs WASI preview 1 modules with wasmtime 49 on any runner (`flow tiers` offers `wasm` everywhere): no rootfs, no network, the job's files at `/src`, its mounts at their targets, the memory limit enforced by wasmtime. `exec` names a module or a glob of them (`target/wasm32-wasip1/debug/deps/*.wasm` runs each test binary in turn); the receipt names wasmtime's version and every module's hash. The tier phones and browsers will run (docs/handover.md). Secrets and identities are not offered in it yet.

- **The runner as a library, for the phone (oxygenhub-android#8):** `flow` is now a library and the command built on it, and the whole runner builds for Android (`aarch64-linux-android`); `runner::serve_embedded` and `runner::stop` run it inside an app and drain it. There the WASM tier runs modules in a thread rather than a child process (also with `FLOW_WASM_IN_PROCESS`), streaming their output from pipes, stopping them at the time limit or when the run is cancelled through wasmtime's epoch, and reporting the most memory they asked for. Two portability fixes on the way (the seccomp filter's BPF opcodes, for arm64 and x86_64, and an ioctl request type).

- **cargo-nextest in the Rust image (#81):** for JUnit test reports beside `cargo llvm-cov`'s coverage.

## 0.3.1 (2026-10-25)

- **Runners read repositories with oxy 0.6.0:** a tag withdrawn on the hub (oxygenhub#301) is dropped when a runner fetches, a keyless agent's changes verify in a repository that pins its owner's newest key (oxygen#135) or has never seen it (oxygen#134), and shallow clones of big repositories work (oxygen#137). The runner itself is unchanged.

## 0.3.0 (2026-10-21)

- **A runner's own metrics (#35):** `metrics = "127.0.0.1:9464"` under `[runner]` serves Prometheus text at `/metrics`: claims, declines, finished jobs by result, the seconds they ran, the jobs running now, version and uptime, optionally behind `metrics_token`. Off unless set.

- **Built with oxy 0.5.1.** A runner reads repositories whose release tags a keyless agent made (oxygen#129), and declares `certified-tags` to the hub (oxygen#131).

- **Build caches are pruned before they are kept (#72, spec §5.4).** A kept cache no longer grows until the job's disk is full. When a passing job's cache holds more than `cache_prune_percent` of its mount's size (runner config, default 60), the files the job did not read, write or share a cargo unit hash with are removed, oldest first, until it is under; one still over is not kept, and the next run starts empty. A microVM's guest init prunes its disk before it powers off; the runner prunes the syscall tier's directories. The job's log says how much was kept and pruned, or why the cache was not kept.

## 0.2.0 (2026-10-20)

- **Approval gates and environments (#57, #59, oxygenhub#235, spec §5.3.2, §5.3.3).** `approval { by "maintain"; others-only; expires "24h" }` on a job makes the hub hold it until a person with that role (write, maintain by default, or admin) approves it, and with `others-only` not the person who pushed. `approval { sealed #true }` asks for an approval signed with the approver's own key (`oxy seal --flow`), the default for a job that names an `environment "prod"`; the hub names the environment in the job's identity tokens only once it is approved. Both are part of the job's hash.

- **Artifacts between jobs (#58, spec §5.3.1).** `input { artifact "x" from "job"; path "/src/x" }` takes an artifact from a job named in `depends-on`, up to 8 per job. The runner fetches each from the hub, refuses the job when the blob is not the one the producer's receipt names, writes it at its path and lists it in the receipt's inputs.

- **Allow-listed egress (#55, spec §4.3.1).** `network "egress" { allow "host" "*.example.com" }` lets a microVM job reach those names on port 443 and nothing else. The VM still has no network device: a proxy on the runner takes only `CONNECT host:443` for an allowed name, refuses non-public addresses and logs every decision in the job's log; the job gets `HTTPS_PROXY`. Off unless a runner sets `egress = true` under `[runner]`; such jobs go only to runners that do.

- **Receipts signed with a key that dies with the job (oxygenhub#241).** With `keyless = true` under `[runner]`, the runner makes a fresh key just before signing a job's receipt, has the hub certify it with the job's token, signs, attaches the certificate and drops the key. If the hub cannot certify, the runner's own key signs and the job's log says why.

- **A pipeline may lower its jobs' priority (oxygenhub#244).** `priority "low"` (or `"normal"`) on a job, or at the top of the file for every job, puts it behind other work in the hub's queue. `high` and `urgent` are refused with the reason: they are the hub's to give.

- **Triggers (#24).** `on { push; tag; manual; schedule }` for the pipeline and each job: `push` and `tag` take globs, `manual` is Run pipeline, and `schedule` takes five-field cron lines. A job's own `on` wins over the pipeline's; without one a job runs on every push and by hand, as before.

- **Runner labels (oxygenhub#41).** A sandbox or a job may say `runs-on "LABEL"`; a job goes only to a runner that has every label it and its sandbox name (`flow runner register --label`).

- **Images by hash (#39, #44).** `flow rootfs push HASH` sends an image to a hub, only the chunks it lacks, and `flow rootfs pull HASH` fetches one. A runner whose job's image is missing fetches it before starting, saying so in the job's log, and keeps the chunks, so a rebuilt image costs only its changed chunks. Both commands use the login `oh auth login` saved when `OXY_TOKEN` is not set.

- **Runners say what they have and what jobs used (#40, #41).** Each claim carries the runner's free disk, load, kernel and a speed class from a short benchmark, taken at start and every 15 minutes while idle (`flow runner bench` prints them). A job's finish carries its peak disk and memory, for the hub to learn what its next run needs.

- **Reports (oxygenhub#127).** `report "NAME" { path "…"; when "…" }` in a job's output block uploads a directory holding `report.toml`, file by file with a manifest, within 2,000 files and 512 MiB; the receipt names the manifest.

- **Artifacts from a failing job (#37).** An artifact with `when "always"` is uploaded when the job fails or times out too, so a test report survives the failure it describes. It never goes in the receipt of a job that did not pass.

- **A cancelled run stops its jobs (#32).** A job whose run is cancelled is stopped: its microVM ends, or never boots if the job was still being prepared, and nothing more is sent.

- **The OpenTofu image (#56).** `images/tofu`: OpenTofu 1.13.1 with a provider mirror (hashicorp/google, cloudflare/cloudflare), TFLint with its Google ruleset, and curl, jq, xz, sfdisk and debugfs, for deploy jobs. Providers come only from the mirror, so `tofu init` and linting need no network.

- **Coverage in the Rust build image (oxygenhub#113).** `cargo-llvm-cov` and the toolchain's `llvm-tools` are on the guest's `PATH`, so a job can write an LCOV report for the hub's Coverage tab.

- **The syscall tier keeps its build caches too (#70, spec §5.4).** A cached `ephemeral://disk` mount in a `runtime "syscall"` job now starts from the directory a passing job of the same slot kept, and goes back into the runner's pool when the job passes, with the same order, bookmark rules, `cache_gb` eviction and claim reporting as the microVM tier's disks, so jobs go where their cache is on boards without KVM as well. Nothing kept is writable by others or set-id, and the pool is the runner's alone.

- **The build cache pays off (#51, #52, spec §5.4).** A cached disk keeps the content hashes and times of the sources it was built from, and the next job gives every unchanged file its old time back, so cargo rebuilds only the crates that changed instead of every path crate. Claims list the caches a runner holds, and the hub sends a job to the runner holding its cache, as it does for images.

- **Restarts cost no job (#49, #50, spec §11.5.1).** A job's uploads and declines wait out a hub that is away for up to three minutes (a deploy restarting it), through refused connections as well as server errors, and log lines it could not send go with the next batch instead of being dropped. A runner told to stop drains: it claims nothing more, finishes and reports the jobs it holds, then exits; a second signal stops it at once. With `KillMode=mixed` and a `TimeoutStopSec` longer than the longest job in its unit, deploying a runner no longer has to wait for it to be idle.

- **A build cache (#28, spec §5.4).** A disk mount may name a `cache` and the `key` files it depends on, such as `Cargo.lock`. The runner keeps passing jobs' disks and starts the next job of the same repository, job and bookmark from one, so builds carry their compiled dependencies forward; another bookmark copies it rather than taking it. Failing jobs' disks are never kept, the receipt names what a disk started from, and the pool stays under `cache_gb` (default 64 GiB).

- **Runners share images (#47, docs/jetstream.md §8.1).** A runner with a `[runner.swarm]` section serves the image chunks it holds to other runners in its site, and fetches an image it lacks from them and the hub together, rarest chunks first. The hub is asked only for chunks no peer has or is fetching, so runners starting together split its work. Peers talk over TLS: each runner keeps its own certificate, the hub hands its fingerprint on with the peer, and a fetcher trusts no other. Peers admit each other with a ticket the hub signs, and every chunk is checked against its hash. Uploads are capped (`upload_mib_s`, default 50) at 16 connections. Without the section a runner fetches from the hub alone, as before.

- **A busy runner still says it is there (oxygenhub#243).** A runner whose slots are full, or that is draining, claims nothing, so the hub showed it offline through a quiet job. It now sends a heartbeat every 30 s while it cannot claim.

- **One slow fetch no longer holds every job on a runner (#63).** Workspaces were prepared under one runner-wide lock, so a job fetching a large repository from a bucket held all the others (one waited 819 s, and another's token expired before its fetch began). Fetches and exports now take only their repository's lock, and the job's log says how long it waited and how long fetching took.

- **An image with no recorded architecture is read, not trusted (#53).** Such an image (imported before architectures were recorded, or fetched from a hub that did not know it) matched every runner, so a riscv64 runner could be handed an x86_64 image and fail. The runner now reads the architecture from the image's shell once, records it, reports it and declines a job for another architecture.

- **`flow check` says when a pipeline needs a newer flow (#43).** A pipeline that names a node, output or event this flow does not know was called "not valid". `flow check` and `flow run` now say it uses something this version of flow does not know, and that a pipeline written for a newer OxygenFlow needs a newer flow.

- **Pushing a large image works against any hub (oxygenhub#147).** `flow rootfs push` asked about 50,000 chunks at once, over a hub's 2 MB body limit, so an 11 GB image failed with 413. It now asks 20,000 at a time.

name = "addr2line"

version = "0.26.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "59317f77929f0e679d39364702289274de2f0f0b22cbf50b2b8cff2169a0b27a"

dependencies = [

 "gimli",

]

[[package]]

name = "allocator-api2"

version = "0.2.21"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"

[[package]]

name = "ambient-authority"

version = "0.0.2"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "e9d4ee0d472d1cd2e28c97dfa124b3d8d992e10eb0a035f33f5d12e3a177ba3b"

[[package]]

name = "arbitrary"

version = "1.5.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "3bc62ac97cc33321f50863d514c3bc38a453947a8f9e781137e47c7401020aed"

[[package]]

name = "asn1-rs"

version = "0.7.2"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8"

dependencies = [

 "asn1-rs-derive",

 "asn1-rs-impl",

 "displaydoc",

 "nom",

 "num-traits",

 "rusticata-macros",

 "thiserror 2.0.21",

 "time",

]

[[package]]

name = "asn1-rs-derive"

version = "0.6.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"

dependencies = [

 "proc-macro2",

 "quote",

 "syn 2.0.119",

 "synstructure 0.13.2",

]

[[package]]

name = "asn1-rs-impl"

version = "0.2.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"

dependencies = [

 "proc-macro2",

 "quote",

 "syn 2.0.119",

]

[[package]]

name = "async-trait"

version = "0.1.92"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"

dependencies = [

 "proc-macro2",

 "quote",

 "syn 3.0.6",

]

[[package]]

name = "base64"

version = "0.23.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"

[[package]]

name = "bit-vec"

version = "0.9.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"

dependencies = [

 "serde",

]

[[package]]

 "cpufeatures 0.3.1",

version = "0.10.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"

dependencies = [

 "generic-array",

]

[[package]]

name = "block-buffer"

name = "bumpalo"

version = "3.20.3"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"

dependencies = [

 "allocator-api2",

]

[[package]]

name = "bytes"

version = "1.12.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"

[[package]]

name = "cap-primitives"

version = "4.0.3"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "8b5f74729fd2f44701d1a8eb47e906cdb3ccd9ec0f02baad85a744b791940b18"

dependencies = [

 "ambient-authority",

 "fs-set-times",

 "io-extras",

 "io-lifetimes 3.0.1",

 "ipnet",

 "maybe-owned",

 "rustix",

 "rustix-linux-procfs",

 "windows-sys 0.61.2",

 "winx",

]

[[package]]

name = "chacha20"

version = "0.10.2"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"

dependencies = [

 "cfg-if",

 "cpufeatures 0.3.1",

 "rand_core 0.10.1",

]

[[package]]

name = "cobs"

version = "0.3.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"

dependencies = [

 "thiserror 2.0.21",

]

[[package]]

name = "core_detect"

version = "1.0.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"

[[package]]

name = "cpp_demangle"

version = "0.5.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "0667304c32ea56cb4cd6d2d7c0cfe9a2f8041229db8c033af7f8d69492429def"

dependencies = [

 "cfg-if",

]

[[package]]

name = "cpufeatures"

version = "0.2.17"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"

dependencies = [

 "libc",

]

[[package]]

name = "cranelift-assembler-x64"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "c9c587da2696fbaa58e7a2fa2e5bfdd365d0928219f36992304ac1f15e5bc254"

dependencies = [

 "cranelift-assembler-x64-meta",

]

[[package]]

name = "cranelift-assembler-x64-meta"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "f28a60027b7556b680b051651291053ec381edf4ffbc01784997ae51a64269bb"

dependencies = [

 "cranelift-srcgen",

]

[[package]]

name = "cranelift-bforest"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "62bfdb846acebfd591d601994ea283c98d525ac0bc9a84ca3f2c36bcf5b69ff1"

dependencies = [

 "cranelift-entity",

 "wasmtime-internal-core",

]

[[package]]

name = "cranelift-bitset"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "aa9f8cc1080739d5f72b4ee7e00aff7d589f1284beaf0a19472c07878be7f299"

dependencies = [

 "serde",

 "serde_derive",

 "wasmtime-internal-core",

]

[[package]]

name = "cranelift-codegen"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "d85417d493ecec833b5134546b4a252c78cc0bd5be11729a35d25dcff9e4e70b"

dependencies = [

 "bumpalo",

 "cranelift-assembler-x64",

 "cranelift-bforest",

 "cranelift-bitset",

 "cranelift-codegen-meta",

 "cranelift-codegen-shared",

 "cranelift-control",

 "cranelift-entity",

 "cranelift-isle",

 "gimli",

 "hashbrown 0.17.1",

 "libm",

 "log",

 "postcard",

 "pulley-interpreter",

 "regalloc2",

 "rustc-hash",

 "serde",

 "serde_derive",

 "sha2 0.10.9",

 "smallvec",

 "target-lexicon",

 "wasmtime-internal-core",

]

[[package]]

name = "cranelift-codegen-meta"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "d01c8ed0098360bae69ad6b82952d4247516799ce8050d45ad168d6689f4eae6"

dependencies = [

 "cranelift-assembler-x64-meta",

 "cranelift-codegen-shared",

 "cranelift-srcgen",

 "heck",

 "pulley-interpreter",

]

[[package]]

name = "cranelift-codegen-shared"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "04f9b86d809cec9c4e88b201f1b3ed3b0347674c9ccfbb8c355228669e34be81"

[[package]]

name = "cranelift-control"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "ce182038fb10b719841e65fdf5deeee258c684f63439f5be680c2be059274b58"

dependencies = [

 "arbitrary",

]

[[package]]

name = "cranelift-entity"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "7bca812b03a7b942796391f25bc02aa70a1a007fee3ce2756490c788429e9c39"

dependencies = [

 "cranelift-bitset",

 "serde",

 "serde_derive",

 "wasmtime-internal-core",

]

[[package]]

name = "cranelift-frontend"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "a0c30563d2aef95e8d1a00a920199c99117b350339599f0e9487a7a1cf5d59de"

dependencies = [

 "cranelift-codegen",

 "hashbrown 0.17.1",

 "log",

 "smallvec",

 "target-lexicon",

]

[[package]]

name = "cranelift-isle"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "9c54184333a275698edb1d3bdff226131a25d47133d792aa716e47e32b8b7f05"

[[package]]

name = "cranelift-native"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "eb67a4c8a3180b5f1d77dffcd6317c05386ced42e5a31c7004523a9d99dc85c1"

dependencies = [

 "cranelift-codegen",

 "libc",

 "target-lexicon",

]

[[package]]

name = "cranelift-srcgen"

version = "0.136.4"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "b533db1679b4b728568bd490da6533cf50974c48a4d7534e78f1e0e02bc39769"

[[package]]

version = "0.1.7"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"

dependencies = [

 "generic-array",

 "typenum",

]

[[package]]

name = "crypto-common"

 "cpufeatures 0.3.1",

 "digest 0.11.3",

name = "data-encoding"

version = "2.11.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"

[[package]]

name = "der-parser"

version = "10.0.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"

dependencies = [

 "asn1-rs",

 "displaydoc",

 "nom",

 "num-bigint",

 "num-traits",

 "rusticata-macros",

]

[[package]]

name = "deranged"

version = "0.5.8"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"

[[package]]

name = "digest"

version = "0.10.7"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"

dependencies = [

 "block-buffer 0.10.4",

 "crypto-common 0.1.7",

]

[[package]]

 "block-buffer 0.12.1",

 "const-oid",

 "crypto-common 0.2.2",

 "sha2 0.11.0",

name = "embedded-io"

version = "0.4.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "ef1a6892d9eef45c8fa6b9e0086428a2cca8491aca8f787c534a3d6d0bcb3ced"

[[package]]

name = "embedded-io"

version = "0.6.1"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"

[[package]]

name = "encoding_rs"

version = "0.8.42"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "8e985e0451871ad22fb8d2b6b076e2028a502a0d3950998c2c5c0a4f9b5d9679"

dependencies = [

 "cfg-if",

 "core_detect",

 "multiversion_no_op",

 "rustversion",

 "scopeguard",

 "simdutf8",

]

[[package]]

version = "0.5.3"

 "flow-init",

 "rcgen",

 "rustls",

 "wasmtime",

 "wasmtime-wasi",

 "wat",

 "windows-sys 0.61.2",

version = "0.5.3"

name = "flow-checks"

version = "0.5.3"

dependencies = [

 "tempfile",

]

[[package]]

version = "0.5.3"

 "curve25519-dalek",

 "ring",

 "thiserror 1.0.69",

version = "0.5.3"

 "tempfile",

name = "fnv"

version = "1.0.7"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"

[[package]]

name = "foldhash"

version = "0.2.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"

[[package]]

name = "fs-set-times"

version = "0.20.3"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "94e7099f6313ecacbe1256e8ff9d617b75d1bcb16a6fddef94866d225a01a14a"

dependencies = [

 "io-lifetimes 2.0.4",

 "rustix",

 "windows-sys 0.52.0",

]

[[package]]

name = "futures"

version = "0.3.34"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "9a31d2a3fbaaeb2af2368bbdd904aa8e812d3c04a1ee10d3171f52d556e5d0a3"

dependencies = [

 "futures-channel",

 "futures-core",

 "futures-io",

 "futures-sink",

 "futures-task",

 "futures-util",

]

[[package]]

name = "futures-channel"

version = "0.3.34"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"

dependencies = [

 "futures-core",

 "futures-sink",

]