OXYGENHUB

Changes up to # 91c306aa4706 touching crates/hub/src/oidc.rs · 5

See as swimlanes (independent work side by side)

Phone alerts: a phone registers its Cloud Messaging token and key (PUT /api/v1/user/push), and each notification its account is told goes to it sealed to that key, sent keyless as the VM's service account; pins OxygenFlow main (refs oxygenhub-android#16)
Andy McCall via agent:claude@andymccall agent ·
◈ aeed63c00ad7
Sealed approvals: a gate released only by a signature of the approver's key
Andy McCall via Claude Code agent ·
✔ 47e374020b59
Environments: the token names the environment once approved; a Deployments page
Andy McCall via Claude Code agent ·
✔ b644e1757711
feat: keyless GCS backups, and TEST (closes #169)
Andy McCall ·
✔ 35fea4237cc9
A job's identity: the hub is an OIDC issuer
Andy McCall ·
✔ d1727c573f30