Agents push with their grant token 559c39204234

[[package]]

name = "oxy-core"

dependencies = [

 "blake3",

 "ed25519-dalek",

[[package]]

name = "oxy-server"

dependencies = [

 "axum",

 "axum-server",

[[package]]

name = "oxy-strata"

dependencies = [

 "async-trait",

 "bytes",

            let Some(run) = run else { return Err(Failure(StatusCode::UNAUTHORIZED, "this job token is not valid".into())) };

            return Ok(Caller::Job { repo_id: run.repo_id, also: job.also_read_ids() });

        }

        let Some(token) = token else { return Err(Failure(StatusCode::UNAUTHORIZED, "unknown token".into())) };

        if token.expired(db::now_ms()) {

            return Err(Failure(StatusCode::UNAUTHORIZED, "this token has expired".into()));

        }

        if account.disabled {

            return Err(Failure(StatusCode::UNAUTHORIZED, "this account is disabled; contact the hub's administrator".into()));

        }

        Ok(Caller::Token(Box::new(account), Box::new(token)))

    }

}

        let n = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();

        let dir = work.path().join(format!("claude-{n}"));

        let mut r = Repo::clone(&url, &dir).unwrap().with_home(agent_home.clone());

        r.save_config().unwrap();

        r.set_user_config("author.key", &andy_key.to_hex()).unwrap();

        r.set_user_config("author.signer", "keyless").unwrap();

    write(&dir, "late.txt", "after the revocation\n");

    late.commit("Late", &[]).unwrap();

    let err = late.push("origin", false).unwrap_err().to_string();

    let (_, body) = call(&h.app, "GET", "/api/v1/agents/grants", Some(&pat), None).await;

    let list: Vec<serde_json::Value> = serde_json::from_str(&body).unwrap();

    assert!(list[0]["revoked_ms"].is_i64() && list[0].get("token").is_none(), "{body}");

`POST /api/v1/keyless/certify` gives a fresh key a certificate (Oxygen spec §14.7) for ten minutes, signed with the hub's key. The bearer is the credential: a running job's token (subject `repo:OWNER/NAME:bookmark:B`, claims `repository`, `bookmark`, `run`, `job`, `runner`, and `environment` with `approved_by` once an approved job may deploy), or one of this hub's OIDC tokens for the audience `{base_url}/keyless` (its `sub` the subject, and the same claims it carries). The body is `{"identity": base64 identity object, "proof": base64 CBOR Signature, "scope": "changes,refs"}`, the proof the fresh key's challenge signature (§14.3) over `certify_challenge(credential)` (`"oxy1 certify "` and the BLAKE3 of the credential), so it cannot be replayed with another credential. The answer is `{"certificate": base64 [certificate, signature], "subject", "expires_ms"}`; a certificate never outlives its credential, and it starts 30 s back for clocks a little behind. Each one is audited (`keyless.certified`). A runner may sign a job's receipt with such a key, certified just before it signs (scope `seal`): the receipt carries the certificate (Oxygen spec §14.6), and the hub keeps it when the certificate is this hub's, its subject is the run's repository and bookmark, its `run` and `job` claims are the run's and the job's, and it covers the moment the hub accepts it; no runner key is bound then, and the run names the signer as the runner's name with "(short-lived key)". Which issuers and subjects a repository trusts for changes and references is its policy's (docs/keyless.md, step 4). When a key it certified moves a bookmark, the hub signs an `accepted` attestation of the update with its own clock and serves it with the bookmark (Oxygen spec §14.7, step 4c), so fetches check the certificate at the hub's time. The scope given is what was asked within what the credential allows; asking for none of it is refused.

### 13.6 Coverage reports (oxygenhub#113, done 2026-10-06)