OXYGENHUB

Release 0.4.0, pinning oxygen 0.4.0 a6c241e8eba0

Who did the work (via, agent badges, self-linking rotated identities),
a Flow badge, history by revset, the nightly gc, milestones over the
API and oh milestone, oh issue edit, and the fixes listed in
CHANGELOG.md. Pins oxygenflow main at oxygen 0.4.0.
Author
Andy McCall @andymccall <[email protected]>
When
· 2026-10-04 14:29 UTC
Signature
✔ signed by Andy McCall
Hash
a6c241e8eba04811556f4670714abde1f4a56f86f6d691e66660ce433d862c4c
Depends on
0a56c5313bc0 348f8c4baccf 380996db84e5 5c6e92fd8d71 749d9a5fcd9f 8933faff2043 b5668108487f d23464c0ac60
Depended on by
8aafd2023dec 4bae285c6ed8 2a83f5303458 3556d08e17f9
In bookmarks
api-unknown-fields cancel-landed-runs clear-waiting close-proposal-140 diffusion-pin-bookmark draft-ready image-check job-waits main oh-comment-body-file proposal-list-fast run-one-job wiki-says-so
In tags
v0.4.0 v0.4.1 v0.4.2 v0.5.0 v0.5.1 v0.5.2 v0.6.0 v0.6.1 v0.7.0 v0.8.0 v0.9.0 v0.9.1 v0.9.11 v0.9.15 v0.9.16 v0.9.19 v0.9.2 v0.9.20 v0.9.21 v0.9.22 v0.9.23 v0.9.24 v0.9.3 v0.9.4 v0.9.5 v0.9.6 v0.9.7 v0.9.8 v0.9.9
Edits
10 atoms, 0 tree operations, 4 files

Browse the tree at this change

modified CHANGELOG.md +26 −0
…
3 unchanged lines
4 4
5 5
## Unreleased
6 6
7 +
## 0.4.0 (2026-10-04)
8 +
9 +
- **Who did the work.** A change an AI agent signed for its author says so wherever the author is shown: `via NAME` with an `agent` badge in history rows, a `via` row under the author on the change page (the agent's identity, the delegation it acted under and its expiry, its key), a count under the author in Contributors, and `via` in the API's change summaries. The author stays the human; a revoked delegation turns the badge red.
10 +
11 +
- **Rotated identities link themselves.** A push that brings changes authored by a successor of a linked identity, where every step kept the key pair (a renewal, a delegation added or removed), links the successor to the same account: delegating to an agent no longer leaves your changes unattributed until you re-upload a key.
12 +
13 +
- **A Flow badge.** `/{owner}/{name}/flow/badge.svg` is the latest run on the default bookmark as a small SVG for a README (`passing`, `failing`, `running`, `no runs`).
14 +
15 +
- **History by revset.** `GET /repos/{o}/{n}/history/{ref}?r=REVSET` answers the changes a revset selects (Oxygen's `docs/revset_query_language.md`), under a two-second budget.
16 +
17 +
- **The hub garbage-collects every repository nightly (#94).** `oxy gc` runs for each repository in turn at `retention.gc_hour` UTC (default 3; 24 or more turns it off), under its write lock, logging what was pruned and packed; `oxygenhub gc` runs the same pass by hand. The oxygen repository had 1.45 GB of loose objects when this was found.
18 +
19 +
- **Milestones over the API, and `oh milestone` (#91).** `POST /milestones` creates one (title, description, due date) or changes the one with that title, `PATCH /milestones/{title}` changes title, description, due date or state; `oh milestone list|create|edit|close|reopen`.
20 +
21 +
- **`oh issue edit` (#95).** Title, body (`-F` for a file), labels and assignees as whole sets (`--no-labels`, `--no-assignees`), milestone (`""` clears); `oh issue label` keeps adding and removing.
22 +
23 +
- **`oh` dies quietly on a closed pipe (#92),** as `oxy` does: `oh issue list | head -1` no longer panics.
24 +
25 +
- **The trust report prints the tagged state once (#93):** "The tagged state has N heads" with the short heads, and each asset's line names the run that built it.
26 +
27 +
- **A runner busy with its only job stays online (#78).** Its log batches and finish call mark it seen, where only claims did.
28 +
29 +
- **The hub signs for you only with `changes,refs`.** Delegating to the hub key now takes `--scope changes,refs`; the recipes and the trust page say so.
30 +
31 +
- **Web workspaces, designed (#69).** Spec §13.3 has the design to review before anything is built: data, the runner's `workspace` job kind with flow-casfs, the owner-only proxy, delegate-signed pushes to `ws/{account}/{id}`, security, costs, open questions.
32 +
7 33
- **What starts a job: `on` (oxygenflow#24).** A pipeline's or a job's `on { push "main" "feature/*"; tag "v*"; manual }` decides which events run it: pushing a tag now runs the jobs that name it, on the tagged state; a run has only the jobs its event starts (and what they need), and an event that starts none starts no run. A rerun repeats its run's event. A bookmark sent again unchanged starts no run. `schedule "0 3 * * *"` lines run their jobs on the default bookmark when due (UTC), checked each minute.
8 34
9 35
## 0.3.1 (2026-10-02)
…
57 unchanged lines
modified Cargo.lock +5 −5
…
1427 unchanged lines
1428 1428
1429 1429
[[package]]
1430 1430
name = "hub-api"
1431 -
version = "0.3.1"
1431 +
version = "0.4.0"
1432 1432
dependencies = [
1433 1433
 "schemars",
1434 1434
 "serde",
…
700 unchanged lines
2135 2135
2136 2136
[[package]]
2137 2137
name = "oh"
2138 -
version = "0.3.1"
2138 +
version = "0.4.0"
2139 2139
dependencies = [
2140 2140
 "anyhow",
2141 2141
 "axum",
…
33 unchanged lines
2175 2175
2176 2176
[[package]]
2177 2177
name = "oxy-core"
2178 -
version = "0.3.1"
2178 +
version = "0.4.0"
2179 2179
dependencies = [
2180 2180
 "blake3",
2181 2181
 "ed25519-dalek",
…
16 unchanged lines
2198 2198
2199 2199
[[package]]
2200 2200
name = "oxy-server"
2201 -
version = "0.3.1"
2201 +
version = "0.4.0"
2202 2202
dependencies = [
2203 2203
 "axum",
2204 2204
 "axum-server",
…
4 unchanged lines
2209 2209
2210 2210
[[package]]
2211 2211
name = "oxygenhub"
2212 -
version = "0.3.1"
2212 +
version = "0.4.0"
2213 2213
dependencies = [
2214 2214
 "ammonia",
2215 2215
 "anyhow",
…
2435 unchanged lines
modified Cargo.toml +1 −1
…
6 unchanged lines
7 7
resolver = "2"
8 8
9 9
[workspace.package]
10 -
version = "0.3.1"
10 +
version = "0.4.0"
11 11
edition = "2021"
12 12
license = "MIT OR Apache-2.0"
13 13
authors = ["Andy McCall <[email protected]>"]
…
52 unchanged lines
replaced deps/oxygenflow +0 −0

No line changes.