Flow alerts on the phone: per job, on success or failure, end-to-end encrypted over FCM issue #16 open andymccall opened this 10 days ago · 1 comment

Andy (2026-10-25): monitor Flow pipelines with alerts, turned on or off per job for success and for failure; FCM, but end-to-end encrypted.

Design (agreed in chat):

• Keys: not the user's Oxygen key (a signing key, and it would have to live on the phone). The app makes a device key pair in the Keystore (key agreement, the private half never leaves it) when alerts are turned on, and registers the public half with the hub with its push token and its choices.
• Each alert: the hub encrypts the payload (repository, run, job, result, time) to the device key (HPKE-style: an ephemeral key agreement and an AEAD) and signs it with the hub's own key, the one oxy pins, so the phone drops anything not from its hub. Google sees an opaque blob and unavoidable metadata (when, how big, which device).
• Transport pluggable: FCM for oxygenhub.io; UnifiedPush (ntfy) for sovereign hubs that cannot use Google; the same sealed payload either way.
• Choices: per repository and per job: on success, on failure (default failure only); kept on the hub with the device, editable from the app's Flow screens; a device can be removed from the web too (Settings, Devices).
• App: Flow runs and jobs (list, a run with its jobs, live logs, re-run), the alert toggles beside each job, notifications that open the run.

Needs from Andy: a Firebase project (adding Firebase to oxygenhub-gcp is simplest), the Android app io.oxygenhub.android registered and its google-services.json, and a service account the hub may send FCM with (keyless on the GCP VM; a key on Earth for now). Hub side tracked in its own issue when started.