The hub countersigns updates by keys it certified (keyless step 4c) 3eb491e9489b

    )

    .with_acceptor(hub_key.identity.clone(), keys::load_secret(&config.keys_dir())?.1);

    /// The hub's key, which countersigns when it accepted an update a key

    /// it certified signed (oxygenhub#241 step 4c, Oxygen spec §14.7).

    acceptor: Option<Arc<(oxy_core::identity::Identity, oxy_core::identity::SecretKey)>>,

        HubBackend { repos, wikis, pool, site_tokens, runtime, app_hint: Arc::new(std::sync::Mutex::new(None)), acceptor: None }

    /// Countersign accepted updates by keys this hub certified with `identity`.

    pub fn with_acceptor(mut self, identity: oxy_core::identity::Identity, secret: oxy_core::identity::SecretKey) -> Self {

        self.acceptor = Some(Arc::new((identity, secret)));

        self

    }

        let repo = store.open(&name).map_err(|e| match e {

        })?;

        Ok(match &self.acceptor {

            Some(a) => repo.with_acceptor(a.0.clone(), a.1.clone()),

            None => repo,

/// Keyless step 4c (oxygenhub#241): when a key the hub certified moves a

/// bookmark, the hub signs when it accepted the update and serves that

/// with the bookmark, so a fetch checks the certificate at the hub's time

/// rather than the time the key claimed.

#[tokio::test(flavor = "multi_thread")]

async fn the_hub_countersigns_an_update_by_a_key_it_certified() {

    use oxy_core::attest::AttestBody;

    use oxy_core::cert::{Certificate, SignedCertificate};

    use oxy_core::identity::Scope;

    use oxy_core::repo::IdentityScope;

    let h = hub().await;

    create(&h.app, "andy", "demo").await;

    let url = format!("{}/andy/demo", h.base);

    let work = tempfile::tempdir().unwrap();

    let mut a = client(&url, &work.path().join("a")).with_home(work.path().join("home-a"));

    a.create_identity("Andy", "[email protected]", IdentityScope::User).unwrap();

    write(&work.path().join("a"), "a.txt", "a\n");

    a.commit("a", &[]).unwrap();

    a.policy_init().unwrap();

    assert!(a.push("origin", false).unwrap().iter().all(|r| r.ok));

    let hub_id = h.app.hub_key.identity.clone();

    a.policy_grant_subject("agent:claude@andy", hub_id.clone(), Scope::CHANGES | Scope::REFS, None).unwrap();

    assert!(a.push("origin", false).unwrap().iter().any(|r| r.name == "policy" && r.ok));

    // An agent whose fresh key the hub certified pushes.

    let mut b = Repo::clone(&url, &work.path().join("b")).unwrap().with_home(work.path().join("home-b"));

    b.config.set("remote.origin.token", "site").unwrap();

    b.save_config().unwrap();

    let (_, key) = b.create_identity("claude", "[email protected]", IdentityScope::User).unwrap();

    let (_, secret) = oxygenhub::keys::load_secret(&h.app.config.keys_dir()).unwrap();

    let now = db::now_ms() as u64;

    let cert = SignedCertificate::sign(

        Certificate {

            key,

            issuer: hub_id.hash(),

            subject: "agent:claude@andy".into(),

            claims: vec![],

            scope: Scope::CHANGES | Scope::REFS,

            not_before: now - 60_000,

            expires: now + 600_000,

        },

        &hub_id,

        &secret,

    );

    b.store().put_identity(&hub_id).unwrap();

    b.store().put_certificate(&cert).unwrap();

    write(&work.path().join("b"), "b.txt", "agent work\n");

    b.commit("work", &[]).unwrap();

    let r = b.push("origin", false).unwrap();

    assert!(r.iter().all(|x| x.ok), "{r:?}");

    // The hub serves its acceptance of that update, signed by its key.

    let refs = open_remote(&url, &RemoteOptions::default()).unwrap().refs().unwrap();

    let main = refs.refs.iter().find(|r| r.name == "main").unwrap();

    let (attest, acc) = (main.attestation.clone().unwrap(), main.accepted.clone().expect("an acceptance"));

    assert!(matches!(acc.attest.body, AttestBody::Accepted { attest: r } if r == attest.attest.hash()));

    assert_eq!(acc.sigs[0].key, hub_id.hash());

    assert!(acc.attest.hlc.wall_ms >= now);

    // An update signed by a long-lived key gets none.

    a.pull("origin").unwrap();

    write(&work.path().join("a"), "a.txt", "again\n");

    a.commit("again", &[]).unwrap();

    assert!(a.push("origin", false).unwrap().iter().all(|r| r.ok));

    let refs = open_remote(&url, &RemoteOptions::default()).unwrap().refs().unwrap();

    assert!(refs.refs.iter().find(|r| r.name == "main").unwrap().accepted.is_none());

}

2026-10-17, the four decisions below as recommended). Built on 2026-10-17:

steps 1 to 4 of the order of work and the hub's acceptance attestation

(step 6's first half, Oxygen spec §14.7); agent grants (step 5) and the

log's time are next. It builds on the hub's

   clock alone, which the log later removes. Built: the hub signs one with

   its key for each reference attestation by a key it certified, keeps

   it beside the attestation and serves it with the bookmark; a fetch

   uses its time only when the certificate's issuer signed it for exactly

   that attestation.