Trusted time on the hub: serve when witnesses first saw an entry 13b27cb2200c

-- Trusted time (oxygenhub#240): each checkpoint the witnesses cosigned,

-- by its size, with the cosignatures it gathered, so a fetch can show when

-- a witness first saw an entry (Oxygen spec §14.8, integrated time).

CREATE TABLE tlog_cosigned_notes (

    size       BIGINT PRIMARY KEY,

    note       TEXT NOT NULL,

    updated_ms BIGINT NOT NULL

);

-- Trusted time (oxygenhub#240): each checkpoint the witnesses cosigned,

-- by its size, with the cosignatures it gathered, so a fetch can show when

-- a witness first saw an entry (Oxygen spec §14.8, integrated time).

CREATE TABLE tlog_cosigned_notes (

    size       INTEGER PRIMARY KEY,

    note       TEXT NOT NULL,

    updated_ms INTEGER NOT NULL

);

/// Keep the cosigned checkpoint of `size` entries, with every cosignature

/// it has gathered so far (#240).

pub async fn keep_cosigned_note(pool: &Pool, size: i64, note: &str) -> sqlx::Result<()> {

    sqlx::query(

        "INSERT INTO tlog_cosigned_notes (size, note, updated_ms) VALUES ($1, $2, $3) \

         ON CONFLICT (size) DO UPDATE SET note = $2, updated_ms = $3",

    )

    .bind(size)

    .bind(note)

    .bind(super::now_ms())

    .execute(pool)

    .await?;

    Ok(())

}

/// The first `n` cosigned checkpoints that hold entry `index`: (size, note).

pub async fn cosigned_notes_after(pool: &Pool, index: i64, n: i64) -> sqlx::Result<Vec<(i64, String)>> {

    sqlx::query_as("SELECT size, note FROM tlog_cosigned_notes WHERE size > $1 ORDER BY size LIMIT $2")

        .bind(index)

        .bind(n)

        .fetch_all(pool)

        .await

}

    // The witnesses a client may pin, for integrated times (#240).

    refs.witnesses = app.tlog.witnesses().iter().map(|p| (p.name.clone(), p.identity.encode())).collect();

                // When witnesses first saw it (#240): the first cosigned

                // checkpoints that hold it, each with the entry's proof.

                let notes = tokio::task::block_in_place(|| {

                    tokio::runtime::Handle::current().block_on(db::tlog::cosigned_notes_after(&app.db, i, 2))

                })

                .unwrap_or_default();

                for (at, text) in notes {

                    if let Ok(proof) = app.tlog.prove_inclusion(at as u64, i as u64) {

                        r.integration.push(oxy_core::protocol::Integration { note: text, proof });

                    }

                }

        // Kept by size too, for integrated times (#240).

        db::tlog::keep_cosigned_note(&app.db, cp.size as i64, &note.encode()).await.ok();

}

/// `GET /log/witnesses` (#240): this log's witnesses, one `NAME BASE64`

/// line each (the identity object), which `oxy tlog verify` pins.

pub async fn witnesses(State(app): State<Shared>) -> Response {

    let body: String =

        app.tlog.witnesses().iter().map(|p| format!("{} {}\n", p.name, oxy_core::dsse::base64(&p.identity.encode()))).collect();

    ([(header::CONTENT_TYPE, "text/plain; charset=utf-8"), (header::CACHE_CONTROL, "no-cache")], body).into_response()

        .route("/log/witnesses", get(crate::tlog::witnesses))

    // Leaving one of oxy's own markers in is refused (marker-like text that

    // isn't one is ordinary text, oxygen#126); removing them resolves.

    let raw = send(app, "GET", "/andy/demo/raw/main/a.txt", Some(&andy), None).await.body;

    let marker = raw.lines().find(|l| l.starts_with("<<<<<<< oxy conflict")).expect("a marker").to_string();

        Some(&format!("_csrf={csrf}&path=a.txt&original=a.txt&content={}&message=half&mode=commit", enc(&format!("{marker}\nLeft\n")))),

    // The check says it too. The hub's own placement pass runs beside this

    // test's: if it lands a reading from before the runner's offer, the

    // next pass puts it right.

    let mut summary = String::new();

    for _ in 0..40 {

        let checks = db::hooks::checks_for_state(&h.app.db, run.repo_id, &run.state).await.unwrap();

        summary = checks.iter().find(|c| c.name == "flow/build").unwrap().summary.clone();

        if summary.contains("does not hold image") {

            break;

        }

        let build = db::flow::jobs(&h.app.db, run.id).await.unwrap().into_iter().find(|j| j.name == "build").unwrap();

        db::flow::set_waiting(&h.app.db, build.id, "").await.unwrap();

        oxygenhub::flow::explain_waits(&h.app).await.unwrap();

        tokio::time::sleep(std::time::Duration::from_millis(50)).await;

    }

    assert!(summary.contains("does not hold image"), "{summary}");

    // Trusted time (#240): the log lists its witnesses, and a fetch's refs

    // carry, for a logged bookmark, the cosigned checkpoints that first held

    // its entry, from which the client takes the integrated time.

    let (_, listed) = call(&log.app, "GET", "/log/witnesses", None, None).await;

    assert!(listed.starts_with(&format!("{name} ")), "{listed}");

    let url = format!("{}/andy/demo", log.base);

    let refs = tokio::task::spawn_blocking(move || {

        let opts = RemoteOptions { token: Some("site".into()), ..Default::default() };

        open_remote(&url, &opts).unwrap().refs().unwrap()

    })

    .await

    .unwrap();

    assert_eq!(refs.witnesses.len(), 1);

    assert_eq!(refs.witnesses[0].0, name);

    let main = refs.refs.iter().find(|r| r.name == "main").expect("main");

    let logged = main.logged.as_ref().expect("logged");

    assert!(!main.integration.is_empty(), "a witnessed checkpoint holds it");

    let cosigned: Vec<(&str, &[[u8; 32]])> = main.integration.iter().map(|i| (i.note.as_str(), i.proof.as_slice())).collect();

    let at = oxy_core::tlog::integrated_time(&logged.entry, logged.index, &cosigned, &origin, &log_id, &[(name.clone(), wid.clone())])

        .expect("an integrated time");

    assert_eq!(at.witness, name);

    assert!(at.size > logged.index);

**Built (2026-10-18, oxygen fd97f4c8 and the hub after it):** the hub keeps

each cosigned checkpoint by its size (migration 0083,

`tlog_cosigned_notes`), lists its witnesses at `GET /log/witnesses` and in

every refs answer (key 7), and for each logged bookmark serves the first

cosigned checkpoints that hold its entry, with inclusion proofs (ref key 7).

oxy pins the witnesses on first use beside the log key, takes the earliest

trusted cosignature as the integrated time, and checks a delegate's refs

delegation and a short-lived key's certificate at it (Oxygen spec §14.8).

Not yet: revocations carry no time today, so they stay absolute rather

than "revoked at T" (a decision for Andy, with revocation times); a

failure at the integrated time is flagged, not refused; one trusted

witness is enough (a k-of-n policy would take the k-th earliest time);

only bookmark attestations get a time so far (tags, seals and receipts

next).