Enforce the Content Security Policy (closes #227); show where a job's time went (refs oxygenflow#35); a Diffusion test waits up to 30 s 0468394734e9

## Unreleased

## 0.9.8 (2026-10-27)

- **Images only runners hold (#342, oxygenflow#94).** A runner that serves its peers sends the manifest of each image it holds that the hub lacks (`POST /flow/images/held`, `PUT /flow/images/{hash}/held`, runner tokens only); the hub keeps it as held by runners and offers the image's jobs to runners of the same swarm site, which fetch it from their peers (the announce says the hub is no seed for it). A pushed image replaces such a record. On 2026-10-25 a re-pinned image that was never pushed kept every Rust job on one runner for a day. Migration 0098 (`jet_images.source`, `holder`).

    /// What it took, as its runner reported (oxygenflow#41), in MiB.

    pub peak_disk_mib: Option<i64>,

    pub peak_memory_mib: Option<i64>,

    /// The free disk it needs, learned from past runs of the same job.

    pub need_disk_mib: Option<i64>,

    /// Why it ran on its runner (oxygenflow#42).

}

impl Job {

    /// The run whose pass this job reused (#265), if it did.

    pub fn reused_from(&self) -> Option<i64> {

        self.error.strip_prefix("reused from run #")?.parse().ok()

        .bind(job_id)

        .execute(pool)

        .await?;

    Ok(())

}

            "UPDATE flow_jobs SET status = 'queued', runner = '', token_hash = '', started_ms = NULL, finished_ms = NULL,

             exit_code = NULL, error = '', receipt = '', receipt_hash = '', log_count = 0, also_read = '', receipt_attest = '',

             receipt_signer = '', receipt_note = '', runner_id = NULL, waiting = '', placed = '', peak_disk_mib = NULL,

             approved_ms = NULL, approval_seal = '', approved_via = '', queued_ms = $2, ready_ms = NULL, handed_back_ms = NULL,

             handbacks = 0 WHERE id = $1",

        )

    };

    let error = f.error.clone().unwrap_or_default();

    fdb::set_peaks(&app.db, job.id, f.peak_disk_mib, f.peak_memory_mib).await?;

    let changed = fdb::finish(

        &app.db,

        job.id,

//! Security headers on every response (oxygenhub#222), and the endpoint

//! the browser reports Content-Security-Policy violations to.

//!

//! Responses that set their own policy (report frames, #127; a job's

//! HTML artifact) keep theirs, and may be framed as they say.

//! Strict-Transport-Security is sent only when `[server] hsts_max_age` is

pub const REPORT_PATH: &str = "/csp-report";

/// Enforce the policy rather than only report it.

/// What the pages may load: their own scripts (and WebAssembly, for the

/// backdrop), styles (inline too: style attributes are everywhere), images

/// from anywhere over https (READMEs show badges), and forms posted only to

base-uri 'self'; form-action 'self'; frame-ancestors 'none'; report-uri /csp-report; report-to csp";

const PERMISSIONS: &str = "camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), bluetooth=(), \

        &queue,

    );

    histogram(out, "oxyhub_flow_job_run_seconds", "How long finished jobs of the last day ran, by runner.", &run);

    family(

        out,

        "oxyhub_flow_jobs_finished_last_day",

/// A histogram family from samples (seconds) per runner.

fn histogram(out: &mut String, name: &str, help: &str, by_runner: &std::collections::BTreeMap<String, Vec<f64>>) {

    let _ = writeln!(out, "# HELP {name} {help}");

    let _ = writeln!(out, "# TYPE {name} histogram");

        for b in JOB_SECONDS {

            let n = samples.iter().filter(|s| **s <= b).count();

            let _ = writeln!(out, "{name}_bucket{{{l},le=\"{b}\"}} {n}");

    assert_eq!(hd[header::REFERRER_POLICY], "strict-origin-when-cross-origin");

    assert_eq!(hd[header::X_FRAME_OPTIONS], "DENY");

    assert!(hd["permissions-policy"].to_str().unwrap().contains("camera=()"));

    for part in [

        "default-src 'self'",

        "object-src 'none'",

        "form-action 'self'",

        "'wasm-unsafe-eval'",

        "report-uri /csp-report",

    ] {

        assert!(csp.contains(part), "{part} in {csp}");

    }

    // Static files and errors carry them too.

    let res = oxygenhub::router(h.app.clone()).oneshot(Request::get("/no/such/page").body(Body::empty()).unwrap()).await.unwrap();

    assert_eq!(res.headers()[header::X_CONTENT_TYPE_OPTIONS], "nosniff");

        "a failing receipt names no outputs"

    );

    r["outputs"] = serde_json::json!([]);

    let (_, page) = call(&h.app, "GET", &format!("/andy/demo/flow/{}", run.number), None, None).await;

    assert!(page.contains(&format!("/andy/demo/flow/{}/artifacts/test/junit", run.number)), "listed");

    assert!(page.contains("not in its receipt"), "marked");

    assert!(page.contains("2 tests: 1 failed"), "counts beside the job");

    assert!(!bump().await.unwrap().body.contains("api v4"), "not before its run passes");

    pass_all().await;

    let mut updated = None;

        let p2 = bump().await.unwrap();

        if p2.body.contains("api v4") {

            updated = Some(p2);

  <pre class="flow-log" data-log data-seq="{{ l.last_seq }}">{% for line in l.lines %}<span class="ln s-{{ line.stream }}"><span class="t">{{ line.t / 1000 }}.{{ "{:01}"|format(line.t % 1000 / 100) }}s</span>{{ line.text }}</span>

{% endfor %}</pre>

  {% if !l.j.placed.is_empty() %}<p class="small mute pad">Ran on {{ l.j.runner }}: {{ l.j.placed }}.</p>{% endif %}

  {% if l.j.status == "passed" %}{% if let Some(n) = l.j.reused_from() %}<p class="small mute pad" data-reused>Not run again: this job, with the same spec and sandbox, passed on this very state in <a href="{{ repo.url }}/flow/{{ n }}">run #{{ n }}</a>, whose log it would repeat; that pass's receipt stands for it here.</p>{% endif %}{% endif %}

  {% if l.j.status == "queued" && !l.j.waiting.is_empty() %}<p class="small warn pad" data-waiting data-queued-note>Waiting: {{ l.j.waiting }}.</p>{% else if l.lines.is_empty() && l.j.status == "queued" %}<p class="small mute pad" data-queued-note>Waiting for a runner{% if !l.j.depends_on().is_empty() %} and for {{ l.j.depends_on().join(", ") }}{% endif %}.</p>{% endif %}

  {% if l.lines.is_empty() && l.j.status == "skipped" %}<p class="small mute pad">Skipped: a job it depends on did not pass.</p>{% endif %}