Keyless agents' release tags: log and serve a tag's acceptance and log place b5c199bd6b1a

- **Keyless agents can push release tags (andymccall/oxygen#129):** A tag signed by a key the hub certified (an agent's or a Flow job's ten-minute key) was refused "unknown key", and then refused by the policy. With oxy's fix the hub accepts it under the policy's subject grant and countersigns when it accepted it, as it does a bookmark move. It logs the tag's acceptance in the transparency log beside the tag, and serves both with the tag in every refs answer, so a client fetching the tag months later checks the certificate at the hub's time. Runners read repositories with their own oxy, so they need rebuilding to check such tags; older ones ignore the new fields.

                // A short-lived key's tag, and when the hub accepted it

                // (oxygen#129).

                if let Ok(Some(acc)) = repo.acceptance_of(&r) {

                    add(&mut out, "accepted", acc.attest.hash(), sig_keys(&acc.sigs));

                }

/// checkpoint, and for each bookmark's and tag's attestation its entry and

/// inclusion proof against it. An attestation the hub serves but never

/// logged (one pushed before the log began) is logged now, and proved on a

/// later fetch.

        if let Some((logged, integration)) = place(app, size, row, "ref", a, &mut backfill) {

            r.logged = Some(logged);

            r.integration = integration;

        }

    }

    // Tags too (oxygen#129): a short-lived key's tag is checked at its

    // integrated time on every later fetch.

    for t in refs.tags.iter_mut() {

        let Some(a) = &t.attestation else { continue };

        if let Some((logged, integration)) = place(app, size, row, "tag", a, &mut backfill) {

            t.logged = Some(logged);

            t.integration = integration;

        }

    }

    backfill

}

/// Attestation `a`'s entry (of `kind`) in a log of `size` entries, its

/// inclusion proof, and the first cosigned checkpoints that hold it; none

/// when it is not in that checkpoint yet, and queued in `backfill` when it

/// was never logged.

fn place(

    app: &Shared,

    size: u64,

    row: Option<i64>,

    kind: &'static str,

    a: &oxy_core::protocol::SignedAttest,

    backfill: &mut Vec<Pending>,

) -> Option<(oxy_core::protocol::Logged, Vec<oxy_core::protocol::Integration>)> {

    let object = a.attest.hash();

    let idx =

        tokio::task::block_in_place(|| tokio::runtime::Handle::current().block_on(db::tlog::entry_of(&app.db, &object.to_hex(), kind)));

    match idx {

        Ok(Some(i)) if (i as u64) < size => {

            let (Ok(entry), Ok(proof)) = (app.tlog.entry(i as u64), app.tlog.prove_inclusion(size, i as u64)) else { return None };

            // When witnesses first saw it (#240): the first cosigned

            // checkpoints that hold it, each with the entry's proof.

            let notes =

                tokio::task::block_in_place(|| tokio::runtime::Handle::current().block_on(db::tlog::cosigned_notes_after(&app.db, i, 2)))

                    .unwrap_or_default();

            let mut integration = Vec::new();

            for (at, text) in notes {

                if let Ok(proof) = app.tlog.prove_inclusion(at as u64, i as u64) {

                    integration.push(oxy_core::protocol::Integration { note: text, proof });

            Some((oxy_core::protocol::Logged { index: i as u64, entry, proof }, integration))

        }

        Ok(Some(_)) => None,

        Ok(None) => {

            backfill.push(Pending { kind, repo: a.attest.repo, repo_row: row, object, signers: sig_keys(&a.sigs) });

            None

        Err(e) => {

            eprintln!("tlog: looking up {}: {e}", &object.to_hex()[..12]);

            None

        }

/// A keyless agent's release tag (oxygen#129): a key the hub certified

/// creates a tag and pushes it under the policy's subject grant; the hub

/// accepts it, countersigns when, logs both and serves them with the tag,

/// and a fresh clone fetches it at the hub's time rather than the tag's.

#[tokio::test(flavor = "multi_thread")]

async fn a_tag_by_a_key_the_hub_certified_is_accepted_and_fetched() {

    use oxy_core::attest::AttestBody;

    use oxy_core::cert::{Certificate, SignedCertificate};

    use oxy_core::identity::Scope;

    use oxy_core::repo::IdentityScope;

    use oxy_core::tlog::Entry;

    let h = hub().await;

    create(&h.app, "andy", "demo").await;

    let url = format!("{}/andy/demo", h.base);

    let work = tempfile::tempdir().unwrap();

    let mut a = client(&url, &work.path().join("a")).with_home(work.path().join("home-a"));

    a.create_identity("Andy", "[email protected]", IdentityScope::User).unwrap();

    write(&work.path().join("a"), "a.txt", "a\n");

    a.commit("a", &[]).unwrap();

    a.policy_init().unwrap();

    assert!(a.push("origin", false).unwrap().iter().all(|r| r.ok));

    let hub_id = h.app.hub_key.identity.clone();

    a.policy_grant_subject("agent:claude@andy", hub_id.clone(), Scope::CHANGES | Scope::REFS, None).unwrap();

    assert!(a.push("origin", false).unwrap().iter().any(|r| r.name == "policy" && r.ok));

    // An agent whose fresh key the hub certified tags what it fetched.

    let mut b = Repo::clone(&url, &work.path().join("b")).unwrap().with_home(work.path().join("home-b"));

    b.config.set("remote.origin.token", "site").unwrap();

    b.save_config().unwrap();

    let (_, key) = b.create_identity("claude", "[email protected]", IdentityScope::User).unwrap();

    let (_, secret) = oxygenhub::keys::load_secret(&h.app.config.keys_dir()).unwrap();

    let now = db::now_ms() as u64;

    let cert = SignedCertificate::sign(

        Certificate {

            key,

            issuer: hub_id.hash(),

            subject: "agent:claude@andy".into(),

            claims: vec![],

            scope: Scope::CHANGES | Scope::REFS,

            not_before: now - 60_000,

            expires: now + 600_000,

            grant: None,

        },

        &hub_id,

        &secret,

    );

    b.store().put_identity(&hub_id).unwrap();

    b.store().put_certificate(&cert).unwrap();

    let heads = b.bookmark_heads().unwrap();

    b.tag_create("v0.2.0", &heads, "OxygenFlow 0.2.0").unwrap();

    let r = b.push("origin", false).unwrap();

    assert!(r.iter().any(|x| x.name == "tags/v0.2.0" && x.ok), "{r:?}");

    // The hub serves its acceptance of the tag, signed by its key, and

    // logs both.

    h.app.tlog.refresh_checkpoint(&hub_id, &secret).unwrap();

    let refs = open_remote(&url, &RemoteOptions::default()).unwrap().refs().unwrap();

    let tag = refs.tags.iter().find(|t| t.name == "v0.2.0").expect("the tag");

    let (attest, acc) = (tag.attestation.clone().unwrap(), tag.accepted.clone().expect("an acceptance"));

    assert!(matches!(acc.attest.body, AttestBody::Accepted { attest: r } if r == attest.attest.hash()));

    assert_eq!(acc.sigs[0].key, hub_id.hash());

    assert!(acc.attest.hlc.wall_ms >= now);

    let logged = tag.logged.as_ref().expect("the tag's place in the log");

    let entry = Entry::decode(&logged.entry).unwrap();

    assert_eq!((entry.kind.as_str(), entry.object), ("tag", attest.attest.hash()));

    let logged_acceptance = db::tlog::entry_of(&h.app.db, &acc.attest.hash().to_hex(), "accepted").await.unwrap();

    assert!(logged_acceptance.is_some(), "the acceptance is logged too");

    // A fresh clone takes the tag at the hub's time.

    let c = Repo::clone(&url, &work.path().join("c")).unwrap().with_home(work.path().join("home-c"));

    assert_eq!(c.tag_heads("v0.2.0").unwrap(), Some(heads));

    let report = c.fetch("origin").unwrap();

    assert!(report.skipped.is_empty(), "{:?}", report.skipped);

    // Andy's checkout too, the tag signed by the agent's key.

    a.pull("origin").unwrap();

    let t = a.tags().unwrap().into_iter().find(|t| t.name == "v0.2.0").expect("pulled");

    assert_eq!(t.signer.as_deref(), Some("claude"));

}

bookmark and tag attestations get a time so far (tags since

andymccall/oxygen#129, so a keyless agent's release tag is checked at it;

seals and receipts next).