transparency.md and keyless.md: accepted, with Andy's decisions 6ba07678ae86
Transparency log: one log, hubs witnessing each other plus an oxy
witness, warn then refuse. Keyless: our own composite-signed
certificate, built now on the hub's acceptance time, agent grants that
retire agent keys, the hub's own OIDC issuer first.
Refs #238, #240, #241
Author Andy McCall @andymccall <[email protected] > via ↳ agent <[email protected] > · delegate for changes, until 2026-11-13 19:00Z · key ea5f78160088 When 19 days ago · 2026-10-17 11:14 UTCSignature ✔ signed by Claude CodeHash 6ba07678ae86cb32a19d9aa561e74718a86440f39d2963c5a4250bc2ac6e293e Depends on 52ae6422e5a1 6e006eaf1da4 Depended on by 965b950f9b96 3eb491e9489b In bookmarks api-unknown-fields cancel-landed-runs diffusion-pin-bookmark draft-ready main oh-comment-body-file proposal-list-fast In tags v0.6.0 v0.6.1 v0.7.0 v0.8.0 v0.9.0 v0.9.1 v0.9.11 v0.9.15 v0.9.16 v0.9.19 v0.9.2 v0.9.20 v0.9.21 v0.9.22 v0.9.23 v0.9.24 v0.9.3 v0.9.4 v0.9.5 v0.9.6 v0.9.7 v0.9.8 v0.9.9 Edits 8 atoms, 0 tree operations, 2 files
Browse the tree at this change
docs/keyless.md docs/transparency.md
modified
docs/keyless.md
+9 −3
1
1
# Keyless signing: short-lived keys from an OIDC identity
2
2
3
-
Design for oxygenhub#241, written 2026-10-17. **Status: proposed. ** Nothing
4
-
here is built yet; it is for Andy to read and decide. It builds on the hub's
3
+
Design for oxygenhub#241, written 2026-10-17. **Status: accepted ** (Andy,
4
+
2026-10-17, the four decisions below as recommended). Nothing here is built
5
+
yet. It builds on the hub's
5
6
OIDC issuer (hub spec §13.5) and on the transparency log
6
7
(docs/transparency.md, #238/#240).
7
8
…
148 unchanged lines
156
157
6. **Trusted time:** the acceptance attestation now; the log's integrated
157
158
time when #238 lands.
158
159
159
-
## Decisions for Andy
160
+
## Decisions (taken 2026-10-17)
160
161
162
+
Andy chose the recommendation each time: our own composite-signed
163
+
certificate, built now with the hub's acceptance time (the log's time
164
+
later), agent grants that retire the agent keys, and the hub's own OIDC
165
+
issuer first.
166
+
161
167
1. **Certificate format:**
162
168
- Our own CBOR object, composite-signed: post-quantum, and small.
163
169
- X.509, as Fulcio issues: readable by Sigstore's tools, but classical
…
16 unchanged lines
modified
docs/transparency.md
+7 −3
1
1
# A transparency log for OxygenHub
2
2
3
3
Design for oxygenhub#238 (an append-only, witnessed log) and #240 (trusted
4
-
time for signatures), written 2026-10-17. **Status: proposed. ** Nothing here
5
-
is built yet; it is for Andy to read and decide.
4
+
time for signatures), written 2026-10-17. **Status: accepted ** (Andy, 2026-10-17, the three
5
+
decisions below as recommended). Nothing here is built yet.
6
6
7
7
## Why
8
8
…
149 unchanged lines
158
158
6. **Later:** RFC 3161 for objects that never reach a hub; registering with
159
159
public witness networks.
160
160
161
-
## Decisions for Andy
161
+
## Decisions (taken 2026-10-17)
162
162
163
+
Andy chose the recommendation each time: one log, hubs witnessing each
164
+
other plus an `oxy witness` on a third machine, and warn for a release
165
+
before refusing.
166
+
163
167
1. **Public entries for private repositories?** The entries reveal only ids
164
168
and hashes. One log for everything is simplest and strongest (a single
165
169
history). A separate private log hides even that, but means two logs to
…
7 unchanged lines
Claude Code <[email protected]> · delegate for changes, until 2026-11-13 19:00Z · key ea5f78160088