Spec 13.3: web workspaces, as designed before they are built (refs #69) 00cec4e18792

### 13.3 Web workspaces (planned)

**Open in Workspace** gives a signed-in user VS Code in the browser on a state of a repository, with Oxygen VCS inside, without cloning anything to their own machine. It is designed here before it is built (Oxygen backlog P5); parts are marked as they land.

- **What runs.** openvscode-server (MIT, unmodified) with the Oxygen VCS extension and `oxy`, in a Firecracker microVM per workspace on an OxygenFlow runner (a `workspace` job kind beside pipeline jobs), never on the hub's host. The image is a Flow rootfs like the build images, pinned by hash. A fork of VS Code is considered only if an extension cannot do what is needed.

- **Starting.** The button is on a bookmark's row and on a change page, for accounts that may read the repository. The hub records a workspace (account, repository, state, bookmark when opened from one, status) and queues a workspace job that only a runner whose scope covers the repository may claim (§13.2 scopes). One account has at most a few workspaces at once; the hub says which are open.

- **Files without a checkout.** The state is mounted read-only in the microVM by **flow-casfs** (OxygenFlow spec §5.1): the tree from the state index, each file's bytes from a cache of renderings keyed by graph key, rendered on first read and shared by every state in which that file has the same history. An overlay on the job's ephemeral disk holds edits. Opening a workspace on the Linux tree therefore costs listing a tree, not writing 96 000 files; the mount is to take under 100 ms.

- **History and commits.** The microVM's `oxy` repository fetches the state's history over the wire protocol with a token that reads this repository only, as job tokens do, and its working copy is the mount. Private keys never enter the hub or the microVM, so a commit is pushed to a workspace bookmark (`ws/{account}/{id}`) and signed there by the hub as the account's delegate, exactly as web edits are (refused with instructions until the account has delegated). From the bookmark the user proposes or lands as usual.

- **Access.** The hub proxies the editor (HTTPS and WebSocket) at `/{owner}/{name}/workspace/{id}/` to the workspace's owner only, checking the session on every request; the runner reaches the hub over a connection it opens itself, so runners behind NAT work, and accepts editor traffic for a workspace only from the hub with that workspace's secret. Nothing in a workspace is reachable from any other account, or from the network directly.

- **Lifecycle.** A workspace stops after 30 minutes without a connection (configurable) and on request. Its overlay is discarded when it stops: anything not pushed to its workspace bookmark is gone, and the editor says so before stopping. A stopped workspace reopens from its bookmark. The audit log records starts, stops and pushes.

- **Measured** when built: mount time, microVM boot, time to the editor's first paint, and a full read of the Linux tree through the mount.