Agents show on the website: seals count, the via line knows certified keys, Contributors names agents; help sets an agent's author (closes #352) 42c77f6515c2

- **Fixed: agents show on the website (#352).** A change a keyless agent sealed (Kimi, Antigravity, Claude: `author.signer = keyless` seals at push) showed as unsigned on change pages, history, proposals and the API, because the hub read only a change's own signature. It now reads seals too: the change says sealed, with "via agent:NAME@you" and "keyless, under your grant", and the Contributors panel names the agent under you. **Help › AI identities** now sets the agent's author (your name, email and the key you make its grant with, filled in when you are signed in) and copies your public identity into its home; without them an agent's changes were unattributed.

/// How a change is authenticated: by its own signature, or by a seal over

/// it (a keyless agent seals at push, as `oxy seal` does; oxygenhub#352).

    match repo.authenticate_change(hash) {

    /// A short-lived key a hub certified under the author's grant (a

    /// keyless agent, spec §14.7), rather than a delegate in the author's

    /// identity.

    pub certified: bool,

        if self.certified {

            return format!("keyless, under your grant for {}", self.scope);

        }

        if self.certified {

            format!(

                "sealed by {} with a short-lived key the hub certified under the author's grant ({}), key {}",

                self.name, self.scope, self.short

            )

        } else if self.revoked {

    let email = repo.store().get_identity(&signer).map(|i| i.email).unwrap_or_default();

    // A keyless agent's key is in no identity: its certificate says for

    // whom and what; authenticating the change checked its grant.

    if let Some(cert) = certificate(repo, &signer) {

        return Some(ViaView {

            name: name.clone(),

            email,

            key: key.clone(),

            short: signer.short(12),

            scope: cert.scope.to_string(),

            expires_ms: Some(cert.expires),

            revoked: *revoked,

            certified: true,

        });

    }

        certified: false,

/// The certificate a hub gave short-lived key `key`, if the store keeps one.

fn certificate(repo: &Repo, key: &KeyId) -> Option<oxy_core::cert::Certificate> {

    let r = repo.store().certificate_of(key).ok()??;

    repo.store().get_certificate(&r).ok().map(|c| c.cert)

}

/// The key that sealed `hash` for its author, when another key did: the

/// first seal's signer (read, not verified: the change rows do that).

fn sealer(repo: &Repo, hash: &ChangeHash, author: &KeyId) -> Option<KeyId> {

    let seals = repo.store().seals_for(hash).ok()?;

    seals.iter().find_map(|a| repo.store().signatures(a).ok()?.into_iter().map(|s| s.key).find(|k| k != author))

}

            // A delegate signs the change; a keyless agent seals it (#352).

            let signer = repo

                .store()

                .signatures(hash)

                .ok()

                .and_then(|s| s.first().map(|s| s.key))

                .filter(|k| *k != meta.author)

                .or_else(|| sealer(repo, hash, &meta.author));

                let who = names

                    .entry(k)

                    .or_insert_with(|| match certificate(repo, &k) {

                        Some(c) => c.subject,

                        None => repo.store().get_identity(&k).map(|i| i.name).unwrap_or_else(|_| k.short(12)),

                    })

                    .clone();

    /// What an agent's changes are authored as: the signed-in user's

    /// name, email and newest linked key, or placeholders (#352).

    author: (String, String, String),

    let mut author = ("YOUR NAME".to_string(), "[email protected]".to_string(), "YOUR_KEY".to_string());

    if let Some(name) = &shell.user {

        if let Ok(Some(a)) = crate::db::accounts::account_by_name(&app.db, name).await {

            let newest = crate::db::accounts::identities_of(&app.db, a.id).await.ok().and_then(|ids| ids.into_iter().next());

            if let Some(id) = newest {

                author = (id.name, id.email, id.key);

            } else {

                author.0 = if a.display_name.is_empty() { a.username } else { a.display_name };

            }

        }

    }

    Page(HelpPage { shell, q: Quickstart::new(&app, true), base, who, author })

    /// An agent's own home, keyless, with its grant kept (#287), authored

    /// as you with the key you make its grant with (#352): without an

    /// author its changes are unattributed, and a grant made by a newer key

    /// than its author key does not count for it.

        let (name, email, key) = &self.author;

            "mkdir -p ~/.oxy-agents/claude/keys\n\

             oxy identity export ~/.oxy-agents/claude/keys/{key}.identity   # in a checkout of yours, as you\n\

             export OXY_HOME=~/.oxy-agents/claude\n\

             oxy config --user author.name \"{name}\"\n\

             oxy config --user author.email \"{email}\"\n\

             oxy config --user author.key {key}\n\

             oxy config --user author.signer keyless\n\

             oxy config --user keyless.hub {base}\n\

             oxy config --user core.sign seal\n\

             oxy auth grant {base}   # paste the token, then Ctrl-D",

    // An agent's home is authored as its owner, or its changes are unattributed (#352).

    for line in [

        "oxy config --user author.name",

        "oxy config --user author.email",

        "oxy config --user author.key YOUR_KEY",

        "keys/YOUR_KEY.identity",

    ] {

        assert!(help.contains(line), "the agent setup sets {line}");

    }

/// oxygenhub#352: a keyless agent's change, authored by its owner and sealed

/// with a short-lived key the hub certified under the owner's grant, shows

/// as sealed via the agent: on the change over the API (not "unsigned"), on

/// the change page, and among the repository's contributors.

#[tokio::test(flavor = "multi_thread")]

async fn a_change_a_keyless_agent_sealed_shows_the_agent() {

    use oxy_core::cert::{Certificate, Grant, SignedCertificate, SignedGrant};

    use oxy_core::identity::Scope;

    use oxy_core::repo::IdentityScope;

    let h = hub().await;

    create(&h.app, "andy", "demo").await;

    let url = format!("{}/andy/demo", h.base);

    let work = tempfile::tempdir().unwrap();

    let mut a = client(&url, &work.path().join("a")).with_home(work.path().join("home-a"));

    let (_, andy) = a.create_identity("Andy", "[email protected]", IdentityScope::User).unwrap();

    write(&work.path().join("a"), "a.txt", "a\n");

    a.commit("base", &[]).unwrap();

    assert!(a.push("origin", false).unwrap().iter().all(|r| r.ok));

    // The owner's grant to agent:kimi@andy, and the hub's certificate for

    // the agent's fresh key carrying it, as `oxy auth grant` and keyless

    // signing make them.

    let hub_id = h.app.hub_key.identity.clone();

    let (_, hub_secret) = oxygenhub::keys::load_secret(&h.app.config.keys_dir()).unwrap();

    let (_, andy_secret) = a.secret_key().unwrap().unwrap();

    let now = db::now_ms() as u64;

    let scope = Scope::CHANGES | Scope::REFS | Scope::SEAL;

    let grant = SignedGrant::sign(

        Grant {

            grantor: andy.hash(),

            subject: "agent:kimi@andy".into(),

            issuer: hub_id.hash(),

            scope,

            not_before: now - 60_000,

            expires: now + 86_400_000,

        },

        &andy,

        &andy_secret,

    );

    let mut b = Repo::clone(&url, &work.path().join("b")).unwrap().with_home(work.path().join("home-b"));

    b.config.set("remote.origin.token", "site").unwrap();

    b.save_config().unwrap();

    let (_, agent) = b.create_identity("kimi", "[email protected]", IdentityScope::User).unwrap();

    let cert = SignedCertificate::sign(

        Certificate {

            key: agent.clone(),

            issuer: hub_id.hash(),

            subject: "agent:kimi@andy".into(),

            claims: vec![],

            scope,

            not_before: now - 60_000,

            expires: now + 600_000,

            grant: Some(grant),

        },

        &hub_id,

        &hub_secret,

    );

    b.store().put_identity(&hub_id).unwrap();

    b.store().put_certificate(&cert).unwrap();

    // Authored as the owner, sealed (not signed) by the agent's key.

    b.config.set("author.key", &andy.hash().to_hex()).unwrap();

    b.config.set("author.signer", &agent.hash().to_hex()).unwrap();

    b.save_config().unwrap();

    write(&work.path().join("b"), "b.txt", "agent work\n");

    let change = b.commit("agent work", &[]).unwrap();

    assert!(b.store().signatures(&change).unwrap().is_empty(), "the change itself is unsigned");

    b.seal(&[change]).unwrap();

    let r = b.push("origin", false).unwrap();

    assert!(r.iter().all(|x| x.ok), "{r:?}");

    let (st, body) = call(&h.app, "GET", &format!("/api/v1/repos/andy/demo/changes/{}", change.to_hex()), None, None).await;

    assert!(st.is_success(), "{st} {body}");

    let v: serde_json::Value = serde_json::from_str(&body).unwrap();

    let sig = &v["change"]["signature"];

    assert_eq!(sig["status"], "valid", "a sealed change is not unsigned: {sig}");

    assert_eq!(sig["sealed"], true, "{sig}");

    assert_eq!(sig["key"], agent.hash().to_hex());

    let (_, page) = call(&h.app, "GET", &format!("/andy/demo/change/{}", change.to_hex()), None, None).await;

    assert!(page.contains("agent:kimi@andy"), "the change page names the agent");

    assert!(page.contains("keyless, under your grant"), "a certified key is not flagged as a lost delegation");

    let (_, overview) = call(&h.app, "GET", "/andy/demo", None, None).await;

    let contributors = &overview[overview.find("Contributors").expect("a Contributors panel")..];

    assert!(contributors.contains("agent:kimi@andy"), "Contributors names the agent under its owner");

}

  <p>The <code>author.*</code> lines make its changes yours{% if shell.user.is_some() %} (filled in with your newest linked key){% endif %}: without them they show as unattributed. Use the key you make the grant with: after you rotate your identity, make a new grant and set the new key here too.</p>