OXYGENHUB

Changes up to # 0ee5c3fb32eb touching crates/hub/src/lib.rs · 51

See as swimlanes (independent work side by side)

Push protection: refuse a push that adds what looks like a secret v0.6.0 head
Andy McCall via agent:claude@andymccall agent ·
◈ 0ee5c3fb32eb
The hub's transparency log (step 1 of docs/transparency.md)
Andy McCall via agent:claude@andymccall agent ·
◈ 965b950f9b96
The hub countersigns updates by keys it certified (keyless step 4c)
Andy McCall ·
✔ 3eb491e9489b
Keyless step 2: the hub certifies fresh keys for ten minutes
Andy McCall via Claude Code agent ·
✔ 026a76d251ce
Flow: SLSA provenance for artifacts, in DSSE, that cosign verifies
Andy McCall via Claude Code agent ·
✔ 076c7a7c86b1
Restarts drain: SIGTERM stops taking connections and lets requests finish
Andy McCall via Claude Code agent ·
✔ c92a99490cba
A new hub gives administrator only to whoever brings its setup code
Andy McCall via Claude Code agent ·
✔ c8684d44d549
Postgres, step 3: the hub builds and passes its tests on PostgreSQL
Andy McCall via Claude Code agent ·
✔ 3b1bc27fe805
Diffusion reconciler: every 10 minutes the pin index is checked and mended
Andy McCall via Claude Code agent ·
✔ 0e04dfc20211
Security headers on every response; CSP report-only with a report endpoint
Andy McCall via Claude Code agent ·
✔ d74ce22fa80e
Sign-in, 2FA codes, device codes and reset requests slow guessing
Andy McCall via Claude Code agent ·
✔ aa0bfbd11f02
Outbound requests only to public addresses
Andy McCall via Claude Code agent ·
✔ 9a777fec4ed9
HTTPS only: nothing taken over plain http through a proxy
Andy McCall via Claude Code agent ·
✔ 9a8e3b4419e0
Notifications that reach you, and 2FA without the password twice
Andy McCall ·
✔ bff9106edcba
The hub reads what each image is for, and learns the rest from passes
Andy McCall ·
✔ 93501da2a162
feat: backups for users and organisations, to a directory, with restore (refs #169)
Andy McCall ·
✔ d7d182467382
fix(web): signed-in pages say Cache-Control: private, no-store (closes #158)
Andy McCall ·
✔ 33bd0bd45f8a
Diffusion: the reverse pin index, Used by, and how far behind
Andy McCall ·
✔ f677d6270298
Keep bookmark briefs across restarts, and log slow requests
Andy McCall ·
✔ 39442b000e6b
Jetstream: the swarm's tracker and peer tickets
Andy McCall ·
✔ a46d15e72101
Images by hash on the hub: chunks, verified manifests, and placement for runners that fetch
Andy McCall ·
✔ 92a797b20912
Reports: the Reports tab, each report's page, its frame, and checks from thresholds
Andy McCall ·
✔ c8df33a6829f
Reports: keep a job's report file by file, index its declaration, metrics and files job-waitsrun-one-jobwiki-says-so
Andy McCall ·
✔ a36bab6b9ffc
Tests tab: a bookmark's test results over its runs (part 2)
Andy McCall ·
✔ 36e5a9c15a84
Test reports from a job's junit artifact (part 1)
Andy McCall ·
✔ 0b203bbf7cc3
Coverage reports, built in
Andy McCall ·
✔ 554ccacfc123
A repository can live in its owner's bucket
Andy McCall ·
✔ 1f78655a0466
Runners decline, and the queue says why a job waits
Andy McCall ·
✔ 4d2e44d79b03
Sign in with GitHub or Google
Andy McCall ·
✔ 83940d53664f
Wikis: Markdown pages as an Oxygen repository of their own
Andy McCall ·
✔ 66fd9d6b1452
Accounts elsewhere on a profile: Bluesky, Mastodon, GitHub
Andy McCall ·
✔ 89e89836cae7
A job's identity: the hub is an OIDC issuer
Andy McCall ·
✔ d1727c573f30
Secrets for pipelines, mounted as files
Andy McCall ·
✔ 4ac01a732552
Variables for pipelines at the site, organisation and repository
Andy McCall ·
✔ 2a83f5303458
AI assistants review proposals and draft their descriptions
Andy McCall ·
✔ 7d2eb590051f
AI assistants: settings per site, organisation and repository
Andy McCall ·
✔ e71846aa07b9
Mail settings on the admin page, with a test message
Andy McCall ·
✔ 3556d08e17f9
The hub garbage-collects every repository nightly
Andy McCall ·
✔ 8a3334b7a364
Scheduled runs: on { schedule } jobs start on the default bookmark when due v0.3.1
Andy McCall ·
✔ 348f8c4baccf
Serve the releases' .debs as a signed apt repository at /apt
Andy McCall ·
✔ ea85398a51bc
The hub ends jobs no runner reports, past the time limit (refs #71)
Andy McCall ·
✔ 070a7b64b368
Device tokens expire and renew on use; the approval page shows the requester (closes #70)
Andy McCall ·
✔ 60f11b71a740
Resolve conflicts together, live
Andy McCall ·
✔ 5e6d6484c28e
Password reset and email verification: single-use hashed links, reset by verified email or an administrator's link, verification on every address change, notification mail only to verified addresses, and a file:// mail transport for development
Andy McCall ·
✔ 34beb1a7e376
OxygenFlow runs: pushes start pipeline runs, a runner API with job tokens, jobs as checks, and a Flow tab with the job graph and live logs
Andy McCall ·
✔ 42fa95540468
Write the forge's name as OxygenHub in everything people read
Andy McCall ·
✔ 8d2caf122517
Milestone 0.6: releases, Git mirror, code search, anchored API comments
Andy McCall ·
✔ 3f4b0ea6eabf
Milestone 0.5: API, webhooks, checks
Andy McCall ·
✔ b64e2537d702
Milestone 0.4: issues and notifications
Andy McCall ·
✔ 18e381ea88c2
Milestone 0.2: accounts and access
Andy McCall ·
✔ 19bb31ff1f5c
older