OXYGENHUB

Changes up to # 166f6e9bf4f1 +7 touching crates/hub/src/lib.rs · 63

See as swimlanes (independent work side by side)

166f6e9bf4f134de4e0de65a2d4453aa82c04cbcff14f3854bb7e8a7ee361182+8bf3010760d73eb57dfeb99535f4eb3677f8d40a284e795c7f69a24e965b9b70+93be9ce4653e32704c445475b3b3df34b72e8ca28723cb602770522bb7f71bf6+a7e6e8e6094c0a836ddde37499e7b44d64db9db4a3404d871eaa92682aea12c6+ab2d8b40f9f434845a237aa17fa9d759c9103c8a3e3e1aced1962dc6767e2f58+adbc38e7ea09d65e35433f0b506609ad0cde3ff0fa2aebfb9e4d28a2e02181c3+b5668108487f12dd7f03ba9c52f7b95f82e8aab92c8c14f75cb949e7398a68c2+d23464c0ac60f60775ae362f92fa08a4b1413e8b1d89e146c1699944bc109c19 has 8 heads. The graph shows their union; heads are marked.
A durable work queue, first slice (refs #276)
Andy McCall via agent:claude@andymccall agent ·
◈ dd327d76062d
Drops: per-user gists, each a small hidden Oxygen repository (#279)
Andy McCall via agent:claude@andymccall agent ·
◈ 166f6e9bf4f1
Secret scanning: scan existing history, remove an allowed fingerprint
Andy McCall via agent:claude@andymccall agent ·
◈ cb7b3cd45dc0
Carry events between the hub's processes on an event bus
Andy McCall via agent:claude@andymccall agent ·
◈ 33d98147511b
Run the hub as web and worker processes, singletons under a leader lock
Andy McCall via agent:claude@andymccall agent ·
◈ e57765dee61a
Push protection: refuse a push that adds what looks like a secret v0.6.0
Andy McCall via agent:claude@andymccall agent ·
◈ 0ee5c3fb32eb
Land when checks pass
Andy McCall via agent:claude@andymccall agent ·
◈ 86a69b53aff0
Insights: OxygenFlow's standard charts, for the site, an owner and a repository
Andy McCall via agent:claude@andymccall agent ·
◈ e97500b70f9a
/metrics: HTTP requests by route class with latency histograms (refs #212)
Andy McCall via agent:claude@andymccall agent ·
◈ b9b74d997cec
Live L4: the bell, the inbox and the dashboard (closes #206); /metrics, first slice (refs #212)
Andy McCall via agent:claude@andymccall agent ·
◈ 8a48dd830178
The hub keeps Terraform and OpenTofu state (closes #252)
Andy McCall via agent:claude@andymccall agent ·
◈ 8dcaeeb848c6
Hubs witness each other's transparency logs (step A5)
Andy McCall via agent:claude@andymccall agent ·
◈ 4f40eed0588f
The hub's transparency log (step 1 of docs/transparency.md)
Andy McCall via agent:claude@andymccall agent ·
◈ 965b950f9b96
The hub countersigns updates by keys it certified (keyless step 4c)
Andy McCall ·
✔ 3eb491e9489b
Keyless step 2: the hub certifies fresh keys for ten minutes
Andy McCall via Claude Code agent ·
✔ 026a76d251ce
Flow: SLSA provenance for artifacts, in DSSE, that cosign verifies
Andy McCall via Claude Code agent ·
✔ 076c7a7c86b1
Restarts drain: SIGTERM stops taking connections and lets requests finish
Andy McCall via Claude Code agent ·
✔ c92a99490cba
A new hub gives administrator only to whoever brings its setup code
Andy McCall via Claude Code agent ·
✔ c8684d44d549
Postgres, step 3: the hub builds and passes its tests on PostgreSQL
Andy McCall via Claude Code agent ·
✔ 3b1bc27fe805
A security contact page; HSTS from [server] hsts_max_age
Andy McCall via Claude Code agent ·
✔ 2cbf6f348595
Diffusion reconciler: every 10 minutes the pin index is checked and mended
Andy McCall via Claude Code agent ·
✔ 0e04dfc20211
Security headers on every response; CSP report-only with a report endpoint
Andy McCall via Claude Code agent ·
✔ d74ce22fa80e
Sign-in, 2FA codes, device codes and reset requests slow guessing
Andy McCall via Claude Code agent ·
✔ aa0bfbd11f02
Outbound requests only to public addresses
Andy McCall via Claude Code agent ·
✔ 9a777fec4ed9
HTTPS only: nothing taken over plain http through a proxy
Andy McCall via Claude Code agent ·
✔ 9a8e3b4419e0
Notifications that reach you, and 2FA without the password twice
Andy McCall ·
✔ bff9106edcba
The hub reads what each image is for, and learns the rest from passes
Andy McCall ·
✔ 93501da2a162
feat: backups for users and organisations, to a directory, with restore (refs #169)
Andy McCall ·
✔ d7d182467382
fix(web): signed-in pages say Cache-Control: private, no-store (closes #158)
Andy McCall ·
✔ 33bd0bd45f8a
Diffusion: the reverse pin index, Used by, and how far behind
Andy McCall ·
✔ f677d6270298
Keep bookmark briefs across restarts, and log slow requests
Andy McCall ·
✔ 39442b000e6b
Jetstream: the swarm's tracker and peer tickets
Andy McCall ·
✔ a46d15e72101
Images by hash on the hub: chunks, verified manifests, and placement for runners that fetch
Andy McCall ·
✔ 92a797b20912
Reports: the Reports tab, each report's page, its frame, and checks from thresholds
Andy McCall ·
✔ c8df33a6829f
Reports: keep a job's report file by file, index its declaration, metrics and files job-waitsrun-one-jobwiki-says-so
Andy McCall ·
✔ a36bab6b9ffc
Tests tab: a bookmark's test results over its runs (part 2)
Andy McCall ·
✔ 36e5a9c15a84
Test reports from a job's junit artifact (part 1)
Andy McCall ·
✔ 0b203bbf7cc3
Coverage reports, built in
Andy McCall ·
✔ 554ccacfc123
A repository can live in its owner's bucket
Andy McCall ·
✔ 1f78655a0466
Runners decline, and the queue says why a job waits
Andy McCall ·
✔ 4d2e44d79b03
Sign in with GitHub or Google
Andy McCall ·
✔ 83940d53664f
Wikis: Markdown pages as an Oxygen repository of their own
Andy McCall ·
✔ 66fd9d6b1452
Accounts elsewhere on a profile: Bluesky, Mastodon, GitHub
Andy McCall ·
✔ 89e89836cae7
A job's identity: the hub is an OIDC issuer
Andy McCall ·
✔ d1727c573f30
Secrets for pipelines, mounted as files
Andy McCall ·
✔ 4ac01a732552
Variables for pipelines at the site, organisation and repository
Andy McCall ·
✔ 2a83f5303458
AI assistants review proposals and draft their descriptions
Andy McCall ·
✔ 7d2eb590051f
AI assistants: settings per site, organisation and repository
Andy McCall ·
✔ e71846aa07b9
Mail settings on the admin page, with a test message
Andy McCall ·
✔ 3556d08e17f9
The hub garbage-collects every repository nightly
Andy McCall ·
✔ 8a3334b7a364
older