Say when a change is signed by a key no account has linked 760a7dd30d6f

    /// Set when the change is signed by a key no account has linked, and

    /// says how its owner links it.

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub note: Option<String>,

}

impl Author {

    /// What `note` says for a key that no account has linked.

    pub const UNLINKED: &'static str =

        "signed by a key not linked to any account; its owner links it under Settings → Keys (/settings/keys)";

    /// The note for an author with this key and account.

    pub fn note_for(key: &str, account: &Option<String>) -> Option<String> {

        (!key.is_empty() && account.is_none()).then(|| Self::UNLINKED.to_string())

    }

            note: Author::note_for(&c.author.key, &c.author.account),

                    note: hub_api::Author::note_for(&c.author.key, &c.author.account),

/// A change signed by a key no account has linked says so, on its page

/// and in the API (feedback 14).

#[tokio::test(flavor = "multi_thread")]

async fn changes_signed_by_unlinked_keys_say_so() {

    let h = hub().await;

    let app = &h.app;

    let andy = call(app, "POST", "/register", None, None, None, Some("username=andy&email=a%40example.com&password=correct-horse-battery"))

        .await

        .cookie

        .unwrap();

    let page = call(app, "GET", "/new", None, Some(&andy), None, None).await;

    call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=demo", csrf_of(&page.body)))).await;

    let url = format!("{}/andy/demo", h.base);

    let work = tempfile::tempdir().unwrap();

    let (w, u, home) = (work.path().to_path_buf(), url.clone(), work.path().join(".home"));

    let hash = tokio::task::spawn_blocking(move || {

        let mut c = Repo::init(&w.join("r")).unwrap().with_home(home);

        c.config.set("remote.origin.url", &u).unwrap();

        c.config.set("remote.origin.token", "site").unwrap();

        c.save_config().unwrap();

        c.create_identity("Ada", "[email protected]", oxy_core::repo::IdentityScope::Repo).unwrap();

        write(&w.join("r"), "a.txt", b"a\n");

        let h = c.commit("signed by Ada", &[]).unwrap();

        assert!(c.push("origin", false).unwrap()[0].ok);

        h.to_hex()

    })

    .await

    .unwrap();

    let (st, v) = api(app, "GET", &format!("/api/v1/repos/andy/demo/changes/{hash}"), None, None).await;

    assert_eq!(st, StatusCode::OK, "{v}");

    assert!(v["change"]["author"]["account"].is_null(), "{v}");

    assert!(v["change"]["author"]["note"].as_str().unwrap().contains("not linked"), "{v}");

    let page = call(app, "GET", &format!("/andy/demo/change/{hash}"), None, Some(&andy), None, None).await;

    assert!(page.body.contains("key not linked") && page.body.contains("/settings/keys"), "a signed-in viewer is pointed at Settings");

    let anon = call(app, "GET", &format!("/andy/demo/change/{hash}"), None, None, None, None).await;

    assert!(anon.body.contains("key not linked") && !anon.body.contains("link your key"));

}

An Oxygen identity is a signed object holding an Ed25519 + ML-DSA-65 key pair's public halves (spec §14.2). An account links an identity by uploading the identity object (`oxy identity export`) and proving possession: the hub issues a 32-byte challenge and the client signs it with `oxy identity sign-challenge` (§18); the hub verifies both signatures. A linked key is what makes a pushed change *this account's* change: author attribution in every page comes from the change's signing key, not from who held the token that pushed it. A change signed by an unlinked key shows its identity's name (or KeyId when the identity is unknown) with a "key not linked" tag rather than a user name.

JSON under `/api/v1`, bearer tokens, `application/json`, RFC 7807 problem responses (an unknown route too), cursor pagination (`?after=`), ETags on cacheable resources, and rate limits per token. Resources mirror the pages: `/repos/{owner}/{name}`, `/bookmarks`, `/changes/{hash}`, `/tree/{ref}/{path}`, `/file/{ref}/{path}`, `/blame`, `/history`, `/compare`, `/conflicts`, `/proposals`, `/proposals/{n}/comments|reviews|checks|files|land`, `/proposals/{n}/content/{base|head}/{path}` (a changed file's bytes in the target's state or the projected state, for editor diff views), `/issues` (creating an issue can set its labels, assignees and milestone; `PATCH /issues/{n}` edits the title and body for the author or triage, and replaces labels, assignees or the milestone for triage, recording each on the timeline; unknown names are refused before anything changes), `/labels` (`POST` creates or changes one, `DELETE /labels/{name}` removes it; triage), `/milestones`, `/releases`, `/tags`, `/trust`, `/pushes`, `/hooks`, `/checks`, `/user`, `/notifications` (the caller's inbox and unread count; `/notifications/{id}/read` and `/notifications/read` mark read; scope `user:read`), `/users/{name}`, `/orgs/{name}`, `/checks/{state}` (the checks on a state, named by its hash, by its heads joined with `+`, by the one head of a single-head state, or by a bookmark), `/checks/required` (`GET`, and `PUT` of the whole list by a repository admin: the checks a proposal needs, passed, to land), `/projects/{owner}` (list, create) and `/projects/{owner}/{n}` (the board as the caller may see it, `PATCH` for title, description, privacy and closing, `/cards` to add a reference or note to a column named by id or name, `/cards/{id}` to move or remove one; `repo:write` and the page's rights to change), `/flow/runs` (`GET`: runs newest first, `?before=N&limit=`; `POST {"bookmark"}`, repo:write: run a bookmark's current state, the default bookmark when none is named), `/flow/runs/{n}` (a run with its jobs), `/flow/runs/{n}/jobs/{job}/log` (`?after=seq&limit=`) and `/flow/runs/{n}/rerun` (repo:write: a finished run again), both answering `201 {"number", "url"}` or `409` with why nothing started, `/search`. A change's author carries the account its key is linked to, or `null` and a `note` saying the key is not linked and where its owner links it (the change page shows a "key not linked" tag, with a link to Settings → Keys for signed-in viewers). Shapes reuse `oxy --json` shapes wherever one exists (change, status, blame, diff) so tools written against the CLI work against the hub. `crates/hub-api` holds the types with `serde` derives and is what the runner and the VS Code extension will link.

    <dt>Author</dt><dd>{% if let Some(a) = c.view.author.account %}<a href="/{{ a }}">{{ c.view.author.name }}</a> <span class="tag">@{{ a }}</span>{% else %}{{ c.view.author.name }}{% endif %}{% if !c.view.author.email.is_empty() %} <span class="mute">&lt;{{ c.view.author.email }}&gt;</span>{% endif %}{% if !c.view.author.key.is_empty() && c.view.author.account.is_none() %} <span class="tag" title="The key that signed this change is not linked to any account.">key not linked</span>{% if shell.user.is_some() %} <a class="small" href="/settings/keys">link your key</a>{% endif %}{% endif %}</dd>