Pin oxygen main: scoped delegates; the hub needs changes and refs b43a9ab0498f

    let mut delegated = Vec::new();

    if let Some(p) = repo.current_policy()?.map(|(_, sp)| sp.policy) {

        for i in &p.identities {

                delegated.push(KeyView { key: i.hash().to_hex(), short: i.hash().short(12), name: i.name.clone(), email: i.email.clone() });

            }

        }

use askama::Template;

use axum::extract::{Form, Path, Query, State};

use axum::response::{IntoResponse, Redirect, Response};

use oxy_core::repo::FileEdit;

use serde::Deserialize;

/// The user's linked identity that names the hub key as a delegate.

pub async fn delegated_identity(app: &Shared, account_id: i64) -> Option<Identity> {

    let linked = accounts::identities_of(&app.db, account_id).await.ok()?;

}

/// Everything needed to sign for the user, or why not.

pub async fn signer_for(app: &Shared, account_id: i64) -> Result<Signer, String> {

    let author = delegated_identity(app, account_id).await.ok_or_else(|| {

    })?;

    let (hub_key, hub_secret) = crate::keys::load_secret(&app.config.keys_dir()).map_err(|e| format!("the hub key is unavailable: {e}"))?;

    Ok(Signer { author, hub_key, hub_secret, hub_identity: app.hub_key.identity.clone() })

    }

    pub fn delegate_cmd(&self) -> String {

    }

    pub fn clone_cmd(&self) -> String {

    assert!(r.body.contains("not delegated"), "refused: {}", r.body);

    // Delegate to the hub key (the policy follows the rotation), push it, link the new identity.

    assert!(client.push("origin", false).unwrap().iter().all(|r| r.ok), "policy update pushed");

    let key2 = client.config.author_key.unwrap();

    let id2 = client.identity(&key2).unwrap();

    db::accounts::link_identity(&app.db, andy_id, &key2.to_hex(), &id2.name, &id2.email, &id2.encode()).await.unwrap();

    // An edit lands on main, authored by Andy, signed by the hub as his delegate.

A repository with no policy accepts any reference update from any account with `write`. The settings page says so plainly and offers to create a policy. Policy editing in the browser produces a **policy proposal**: a signed policy object that roots sign with `oxy policy sign` from their own clients; the hub collects signatures until the threshold is met, then applies the update as an ordinary push. The hub never holds a root key.

### 5.6 Personal access tokens

</section>

<section class="panel">

  <h2>Hub delegate key</h2>

  <p><code class="full">{{ t.hub_key }}</code></p>

  {% if t.hub_delegated_by.is_empty() %}<p class="mute small">Nobody in this repository's policy has delegated to it.</p>{% else %}<p class="small">Delegated by: {% for k in t.hub_delegated_by %}{{ k.name }}{% if !loop.last %}, {% endif %}{% endfor %}</p>{% endif %}

</section>