OXYGENHUB

Changes up to # 0468394734e9 +6 touching crates/hub/src/lib.rs · 66

See as swimlanes (independent work side by side)

0468394734e96d5db008f4e36827ed560766ae8742e0e42ed4ac7184f49242e5+1f78655a04662dea5b241598ec5ef9e1dd480a25c7fe90168712471ef3ed7bb7+380996db84e5398ec51f22c3c34ff9942f1ec928d59469ec5d048f09d1a7db93+42fa95540468b40f1710f40f1a79b1bea010c68de2bf9551876f2134644f8e09+92a797b20912c4c3ae63111a9ad18c3499f0c12ceb7fb95afe42866579556908+d23464c0ac60f60775ae362f92fa08a4b1413e8b1d89e146c1699944bc109c19+dd0788b756f2d77e53606aef21f1927b97ebdfd6948b7c39d25e71950b77448d has 7 heads. The graph shows their union; heads are marked.
Runner updates: policy, test groups and the offer
Andy McCall ·
◈ 8501fd5815b9
Board cards can be archived, by hand or by age (refs #293)
Andy McCall via agent:claude@andymccall agent ·
◈ 439ecd8708a1
Create and withdraw tags on the website (closes #295, closes #301)
Andy McCall via agent:claude@andymccall agent ·
◈ ba0a55bb5b3c
A durable work queue, first slice (refs #276)
Andy McCall via agent:claude@andymccall agent ·
◈ dd327d76062d
Drops: per-user gists, each a small hidden Oxygen repository (#279)
Andy McCall via agent:claude@andymccall agent ·
◈ 166f6e9bf4f1
Secret scanning: scan existing history, remove an allowed fingerprint
Andy McCall via agent:claude@andymccall agent ·
◈ cb7b3cd45dc0
Carry events between the hub's processes on an event bus
Andy McCall via agent:claude@andymccall agent ·
◈ 33d98147511b
Run the hub as web and worker processes, singletons under a leader lock
Andy McCall via agent:claude@andymccall agent ·
◈ e57765dee61a
Push protection: refuse a push that adds what looks like a secret v0.6.0
Andy McCall via agent:claude@andymccall agent ·
◈ 0ee5c3fb32eb
Land when checks pass
Andy McCall via agent:claude@andymccall agent ·
◈ 86a69b53aff0
Insights: OxygenFlow's standard charts, for the site, an owner and a repository
Andy McCall via agent:claude@andymccall agent ·
◈ e97500b70f9a
/metrics: HTTP requests by route class with latency histograms (refs #212)
Andy McCall via agent:claude@andymccall agent ·
◈ b9b74d997cec
Live L4: the bell, the inbox and the dashboard (closes #206); /metrics, first slice (refs #212)
Andy McCall via agent:claude@andymccall agent ·
◈ 8a48dd830178
The hub keeps Terraform and OpenTofu state (closes #252)
Andy McCall via agent:claude@andymccall agent ·
◈ 8dcaeeb848c6
Hubs witness each other's transparency logs (step A5)
Andy McCall via agent:claude@andymccall agent ·
◈ 4f40eed0588f
The hub's transparency log (step 1 of docs/transparency.md)
Andy McCall via agent:claude@andymccall agent ·
◈ 965b950f9b96
The hub countersigns updates by keys it certified (keyless step 4c)
Andy McCall ·
✔ 3eb491e9489b
Keyless step 2: the hub certifies fresh keys for ten minutes
Andy McCall via Claude Code agent ·
✔ 026a76d251ce
Flow: SLSA provenance for artifacts, in DSSE, that cosign verifies
Andy McCall via Claude Code agent ·
✔ 076c7a7c86b1
Restarts drain: SIGTERM stops taking connections and lets requests finish
Andy McCall via Claude Code agent ·
✔ c92a99490cba
A new hub gives administrator only to whoever brings its setup code
Andy McCall via Claude Code agent ·
✔ c8684d44d549
Postgres, step 3: the hub builds and passes its tests on PostgreSQL
Andy McCall via Claude Code agent ·
✔ 3b1bc27fe805
A security contact page; HSTS from [server] hsts_max_age
Andy McCall via Claude Code agent ·
✔ 2cbf6f348595
Diffusion reconciler: every 10 minutes the pin index is checked and mended
Andy McCall via Claude Code agent ·
✔ 0e04dfc20211
Security headers on every response; CSP report-only with a report endpoint
Andy McCall via Claude Code agent ·
✔ d74ce22fa80e
Sign-in, 2FA codes, device codes and reset requests slow guessing
Andy McCall via Claude Code agent ·
✔ aa0bfbd11f02
Outbound requests only to public addresses
Andy McCall via Claude Code agent ·
✔ 9a777fec4ed9
HTTPS only: nothing taken over plain http through a proxy
Andy McCall via Claude Code agent ·
✔ 9a8e3b4419e0
Notifications that reach you, and 2FA without the password twice
Andy McCall ·
✔ bff9106edcba
The hub reads what each image is for, and learns the rest from passes
Andy McCall ·
✔ 93501da2a162
feat: backups for users and organisations, to a directory, with restore (refs #169)
Andy McCall ·
✔ d7d182467382
fix(web): signed-in pages say Cache-Control: private, no-store (closes #158)
Andy McCall ·
✔ 33bd0bd45f8a
Diffusion: the reverse pin index, Used by, and how far behind
Andy McCall ·
✔ f677d6270298
Keep bookmark briefs across restarts, and log slow requests
Andy McCall ·
✔ 39442b000e6b
Jetstream: the swarm's tracker and peer tickets
Andy McCall ·
✔ a46d15e72101
Images by hash on the hub: chunks, verified manifests, and placement for runners that fetch
Andy McCall ·
✔ 92a797b20912
Reports: the Reports tab, each report's page, its frame, and checks from thresholds
Andy McCall ·
✔ c8df33a6829f
Reports: keep a job's report file by file, index its declaration, metrics and files job-waitsrun-one-jobwiki-says-so
Andy McCall ·
✔ a36bab6b9ffc
Tests tab: a bookmark's test results over its runs (part 2)
Andy McCall ·
✔ 36e5a9c15a84
Test reports from a job's junit artifact (part 1)
Andy McCall ·
✔ 0b203bbf7cc3
Coverage reports, built in
Andy McCall ·
✔ 554ccacfc123
A repository can live in its owner's bucket
Andy McCall ·
✔ 1f78655a0466
Runners decline, and the queue says why a job waits
Andy McCall ·
✔ 4d2e44d79b03
Sign in with GitHub or Google
Andy McCall ·
✔ 83940d53664f
Wikis: Markdown pages as an Oxygen repository of their own
Andy McCall ·
✔ 66fd9d6b1452
Accounts elsewhere on a profile: Bluesky, Mastodon, GitHub
Andy McCall ·
✔ 89e89836cae7
A job's identity: the hub is an OIDC issuer
Andy McCall ·
✔ d1727c573f30
Secrets for pipelines, mounted as files
Andy McCall ·
✔ 4ac01a732552
Variables for pipelines at the site, organisation and repository
Andy McCall ·
✔ 2a83f5303458
AI assistants review proposals and draft their descriptions
Andy McCall ·
✔ 7d2eb590051f
older