Compare close-proposal-140 … main

# The CI profile (#307): every test runs, and a JUnit report is

# written to target/nextest/ci/junit.xml for the hub's test report

# (the job's `junit` artifact).

[profile.ci]

fail-fast = false

# A test still running after ten minutes is stopped and fails (#365):

# a hang in run #537 held its runner for an hour.

slow-timeout = { period = "60s", terminate-after = 10 }

[profile.ci.junit]

path = "junit.xml"

// Cheap checks on the WASM tier (oxygenflow#96): OxygenFlow's checks module,

// copied from oxygenflow/.flow/checks.wasm (built there from

// crates/flow-checks; copy it again when it changes). No image and no KVM,

// so any runner with the WASM tier takes it: a phone, plex, windows-1.

sandbox "wasm" {

    runtime "wasm"

    memory-limit "64MiB"

}

// The changelog's shape, and a section for the version Cargo.toml says, so a

// release never finds its notes missing.

job "changelog" {

    sandbox "wasm"

    scope "CHANGELOG.md" "Cargo.toml" ".flow/checks.wasm"

    exec ".flow/checks.wasm" "changelog" "CHANGELOG.md" "Cargo.toml"

}

    rootfs "cas://blob/836461b613019f62399a960c61a25c482eb74e30054ff2cd44d5594c3305872b"

        // One build identity for every CI state, so a cached target stays

        // fresh from one push to the next (oxygenflow#52); dist sets the

        // release's own.

        OXY_BUILD "ci"

    rootfs "cas://blob/836461b613019f62399a960c61a25c482eb74e30054ff2cd44d5594c3305872b"

// The riscv64 build image on narvi-1 (oxygenflow#69): Ubuntu 24.04 riscv64

// with Rust 1.97.1 and the same vendored crates, in the syscall tier (the

// board has no hardware virtualisation, so no microVM). `runs-on` keeps it

// on a RISC-V runner.

sandbox "rust-riscv64" {

    runtime "syscall"

    rootfs "cas://blob/b4edba9173ddf63aa1df46222e6a59b265071b19f2815c89d0153b593835c616"

    runs-on "riscv64"

    memory-limit "4GiB"

    cpu-limit 6

    network "loopback"

    env {

        CARGO_INCREMENTAL "0"

        CARGO_PROFILE_RELEASE_DEBUG "0"

        CARGO_BUILD_JOBS "4"

    }

}

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

        // 40 GiB (2026-10-20), as test-postgres: its kept target filled 24 GiB.

        size "40GiB"

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

    }

    // Under cargo-nextest (#307): a JUnit report for the hub's Tests tab,

    // kept whether or not the tests pass.

    exec "sh" ".flow/warm-target.sh" "cargo" "nextest" "run" "--workspace" "--locked" "--profile" "ci"

    output {

        artifact "junit" {

            path "/src/target/nextest/ci/junit.xml"

            when "always"

        }

    }

}

// Line coverage (#307) for the Coverage tab: the tests again, instrumented,

// in a job of its own beside `test`, so neither waits for the other and the

// instrumented build keeps its own cached target. Not a required check.

job "coverage" {

    sandbox "rust"

    depends-on "fmt"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "48GiB"

        cache "coverage-target"

        key "Cargo.lock"

    }

    exec "cargo" "llvm-cov" "nextest" "--workspace" "--locked" "--profile" "ci" "--lcov" "--output-path" "/src/target/lcov.info"

    output {

        artifact "coverage" {

            path "/src/target/lcov.info"

        }

    }

}

// The hub's tests again on PostgreSQL (#211, docs/postgres.md), against a

// server the job starts in its own guest.

job "test-postgres" {

    sandbox "rust"

    depends-on "fmt"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        // 40 GiB (2026-10-20): its kept target holds the postgres-feature test

        // binaries beside older ones, and filled 24 GiB (the linker then dies

        // with SIGBUS writing its mmapped output).

        size "40GiB"

        cache "target"

        key "Cargo.lock"

    exec "sh" ".flow/test-postgres.sh"

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

        // Kept from this job's last passing run (oxygenflow#28): cargo

        // builds only what changed since.

        cache "target"

        key "Cargo.lock"

        artifact "oxygenhub-server-linux-x86_64.tar.gz" {

            path "/src/target/dist-flat/oxygenhub-server-linux-x86_64.tar.gz"

        }

        artifact "oh-src.tar.gz" {

            path "/src/target/dist-flat/oh-src.tar.gz"

        }

// The native RISC-V check (oxygenflow#69): oh built and run on narvi-1, a

// real riscv64 board, so each release is known to run there and not only

// to cross-compile (dist). Like dist, a push runs it only when it touches

// these paths; "Run pipeline" and reruns always do. Its target directory

// is cached between passing runs (oxygenflow#70).

job "riscv64" {

    sandbox "rust-riscv64"

    depends-on "fmt"

    scope "Cargo.toml" "scripts/dist.sh" "packaging/**" ".flow/riscv64-check.sh"

    timeout "3h"

    mount {

        source "ephemeral://disk"

        target "/src/target"

        size "16GiB"

        cache "target"

        key "Cargo.lock"

    }

    exec "sh" ".flow/riscv64-check.sh"

    output {

        artifact "oh-linux-riscv64-native" {

            path "/src/target/release/oh"

        }

    }

}

#!/bin/sh

# The native RISC-V check (oxygenflow#69): on narvi-1, a riscv64 board,

# build oh natively and run it, so a release is known to work on real

# RISC-V hardware, not only to cross-compile for it (dist does that).

set -eu

uname -m

cargo build --release --locked -p oh

oh=/src/target/release/oh

"$oh" --version

"$oh" --help >/dev/null

"$oh" issue --help >/dev/null

"$oh" run --help >/dev/null

echo "oh works natively on $(uname -m)"

#!/bin/sh

# The hub's tests on PostgreSQL (oxygenhub#211, docs/postgres.md): a server

# of the job's own on loopback, thrown away with the guest. The build image

# has Debian's server and nss_wrapper, which gives the job's user (the

# runner's builder, unknown to the image) the name initdb looks up.

set -eu

pg=/tmp/pg

if ! getent passwd "$(id -u)" >/dev/null; then

    printf 'flow:x:%s:%s:flow:/tmp:/bin/sh\n' "$(id -u)" "$(id -g)" >/tmp/passwd

    printf 'flow:x:%s:\n' "$(id -g)" >/tmp/group

    wrapper=$(find /usr/lib -name libnss_wrapper.so | head -1)

    export LD_PRELOAD="$wrapper" NSS_WRAPPER_PASSWD=/tmp/passwd NSS_WRAPPER_GROUP=/tmp/group

fi

initdb -D "$pg" -U hub --auth=trust >/tmp/initdb.log || { cat /tmp/initdb.log >&2; exit 1; }

# Thrown away with the guest: no need to survive a crash.

pg_ctl -D "$pg" -l /tmp/postgres.log -w start \

    -o "-c listen_addresses=127.0.0.1 -p 55432 -k /tmp -c fsync=off -c synchronous_commit=off -c full_page_writes=off" \

    >/dev/null || { cat /tmp/postgres.log >&2; exit 1; }

unset LD_PRELOAD NSS_WRAPPER_PASSWD NSS_WRAPPER_GROUP

echo "flow: $(postgres --version) on 127.0.0.1:55432"

export OXYHUB_DATABASE_URL=postgres://[email protected]:55432/postgres OXYHUB_DATABASE_SCHEMA='*'

# Under nextest, as the test job: a test that hangs is stopped at the CI

# profile's limit and reported, not left holding the runner (#365).

exec sh .flow/warm-target.sh cargo nextest run -p oxygenhub --features postgres --locked --profile ci

# oxygen#145: two changes that each add a changelog entry in the same

# place keep both, without a conflict.

CHANGELOG.md merge=union

/crates/backdrop/target

- **The New repository page in sections (#371):** Repository, Visibility, Starting files, Wiki, Project board, OxygenFlow and Storage, each with a heading and a line on what it does, and the choices as cards side by side that stack on a phone.

- **OxygenFlow with a new repository (#371):** on the site's runners (site administrators) or the owner's own (when the owner has one), set as it is made; left alone, the site's default applies.

- **Start the wiki (#371):** a Home page with the repository's name and description, written as you with the hub signing as your delegate.

- **Default bookmark (#371):** chosen on the New repository page, else the owner's default, else the site's, else `main`. A user sets theirs under Settings › New repositories, an organisation under its settings, and a site administrator under Administration › New repositories.

- The API's create takes `flow` (`on`, `own`), `wiki` and `default_bookmark`; `oh repo create … --flow on|own --wiki --bookmark NAME`.

## 0.9.24 (2026-11-04)

- **A fresh New repository page (#360):** owner and name side by side with a live check that the name is free and valid and the address it will have; visibility as three described choices; **Start with** a README, a licence (MIT, BSD 2-Clause or ISC, with what each allows) and an `.oxyignore` for a language, committed as you with the hub signing as your delegate (it says what to do first when you have not delegated, before anything is made); and a **project board** with it: a new one (Backlog, Doing, Done, on by default for an organisation) or one of the owner's, which takes the repository's issues and proposals as they open. Storage moves under its own heading. The API's create takes the same (`project: {"new": TITLE} | {"number": N}`, `readme`, `licence`, `ignore`), and `oh repo create OWNER/NAME [--project new:TITLE|N] [--readme] [--licence MIT] [--ignore Rust]`.

- **oxygenhub.io links open the Android app (#370):** `/.well-known/assetlinks.json` vouches for the app (its package and release key's fingerprint, `[push] android_apps` to change), so Android opens the hub's links in it once the app claims them (oxygenhub-android#36).

- **The changelog is checked on the WASM tier:** a `changelog` job in the pipeline runs OxygenFlow's checks module (no image, no KVM; a phone or plex takes it) and fails when the changelog's sections are out of shape or Cargo.toml's version has none.

- **Board views (#361):** a board shows what matters now and other views of the same cards.

  - **Saved views** as tabs across the top: a layout with its filter, lanes and order, saved under a name and shared by its address (`?view=NAME`).

  - **One filter bar** for every view: words, `repo:`, `assignee:`, `label:`, `milestone:` (quote a title with spaces), `state:`, `is:open|closed`, `age:>14d` and `age:<7d`.

  - **Board**: swimlanes by repository, assignee, label or milestone; a **work-in-progress limit** per column, whose header turns to the warning colour past it; **Done shows this iteration's work** while one is open, saying how many cards finished before it; and **compact cards** (labels as dots).

  - **Table**: every card as a row (title, reference, state, column, assignees, labels, milestone, opened), sortable, grouped, a column changed in place, 50 rows a page.

  - **Keys**: `j`/`k` between cards, `Enter` opens one, `m` moves it, `/` filters.

  - **History**: every card's moves (added, moved, archived, restored, removed) are kept from now on, for the charts and forecasts of #357.

  - The API answers `GET /projects/{owner}/{n}?q=` or `?view=NAME` with the filter applied, and lists the board's views and each column's limit; `oh project view N --filter TEXT` or `--view NAME`.

- **A hung test no longer holds a runner (#365):** the PostgreSQL tests run under nextest like the rest, and CI stops any test still running after ten minutes; the history scan's tests have four worker threads and a two-minute bound of their own. Two of them once sat for an hour on plex-1.

- **Charts and forecasts from the board's own history (#357):** a **Charts** tab on every board, with no estimates to keep.

  - **Forecasts**: a Monte Carlo of the board's weekly throughput (the last 12 weeks, or its life if shorter) says when the open cards will be done, at 50% and 85%: for the open iteration or the whole board, for each milestone, and for any filter. It says how many weeks it rests on, and says plainly when there is nothing to go on. Seeded by the board and the day, so it does not change between page loads.

  - **Cycle time** (leaving the first column to reaching Done: median and 85th percentile), **throughput** (cards done each week), the open iteration's **burn-down** with its scope, and **cumulative flow** (cards per column per day over 60 days, a widening band showing where work waits).

  - **Timeline** (#361): iterations as spans and milestones with their due dates and forecast bands on one time axis, today marked.

  - Drawn server-side as SVG in the hub's chart style, readable in both themes, each with its numbers in a table. `GET /projects/{owner}/{n}/charts` (`?q=`) gives the series and forecasts; `oh project charts N [-q FILTER]`.

## 0.9.23 (2026-11-03)

- **A push no longer stops main's running run (#369):** a push cancels its bookmark's older push runs, and those already running too unless Settings › OxygenFlow keeps them; on the default bookmark, where releases are cut from the run of their commit, a running push run now always finishes, and only queued ones are cancelled. A release commit's run lost to the next push is what prompted it.

- **A board's columns from the API and `oh` (#366):** `POST /projects/{owner}/{n}/columns` adds one at the right, `PATCH …/columns/{column}` (by id or name) renames it or moves it to a `position`, and `DELETE` removes it, its cards going to the first remaining column; each answers the board. `oh project column add|rename|move|remove BOARD …` (`move --to N`, counting from 1 at the left, `--left`, `--right`), so a sprint column is renamed without the web page.

- **`oh run watch` and `oh run view` take the newest run (#367):** with no number they follow or show the newest run, or the newest of `--bookmark NAME`, so the run a push just started needs no lookup.

- **`oh issue close` and `reopen` say why (#368):** `-b`, `-F` and `--attach` post a comment first, in the same command.

## 0.9.22 (2026-11-02)

- **Pictures in issues and comments fit their box (#364):** an attached screenshot was shown at its own size, running out of the card on a phone and dwarfing the text on a desktop; pictures in all rendered Markdown now scale down to the width they have.

## 0.9.21 (2026-11-01)

- **Added: your phone as the second factor, and the sudo step (#356).** With two-factor sign-in on, the OxygenHub app can add the phone as a second factor (its Keystore key, opened by your fingerprint, face or PIN; adding it needs a current app code). Signing in then shows a two-digit number and waits: the phone offers three, you pick the one shown and confirm, and the browser carries on, with "Use a code instead" always there. A wrong number is a no. Before sensitive changes (password, two-factor settings, keys, tokens, secrets, webhooks, collaborators, deleting or transferring a repository, anything under Administration) a session that has not proved a second factor in 15 minutes is asked again at `/sudo`: the phone, a code, or the password for an account without two-factor. Settings › Security lists the phones; turning app codes off removes them. API: `/api/v1/user/authenticators`, `/api/v1/user/approvals`; migration 0104.

## 0.9.20 (2026-11-01)

- **Added: `GET /api/v1/user/issues` (#359).** The open issues assigned to you, in repositories you can see, newest-updated first, as the dashboard's "Assigned to you" lists them, each with its repository and address; for apps, first the Android widget's issue count (oxygenhub-android#31).

## 0.9.19 (2026-11-01)

- **Added: attachments on issues and comments (#350).** Screenshots and any other file: `POST /api/v1/repos/OWNER/NAME/attachments?name=FILE` with the file's bytes answers with its address and the Markdown to use, and `oh issue create` and `oh issue comment` take `--attach FILE` (repeatable), so a screenshot pasted into Claude Code can go onto the issue it files. An image (by its bytes: PNG, JPEG, GIF, WebP) shows in place; anything else, SVG included, is a download. Attachments are served under the repository's read rules and can run nothing (no sniffing, a policy that allows nothing, never in a shared cache). Pasting and dragging into the web editors come later.

## 0.9.18 (2026-10-31)

- **Added: `oh mcp`, OxygenHub for AI agents (#353).** An MCP server on stdio for the repository `oh` resolves: tools to read issues, proposals with their files and checks, OxygenFlow runs, job logs, reports, test results, releases, drops and the inbox; with `--allow-write`, to open, comment on and close issues, comment on proposals and re-run Flow runs. What people wrote on the hub comes back under `untrusted`, so an agent reads it as data, never as instructions. Built on oxy-core's MCP module (oxygen#159). See docs/oh.md.

- **Fixed: agents show on the website (#352).** A change a keyless agent sealed (Kimi, Antigravity, Claude: `author.signer = keyless` seals at push) showed as unsigned on change pages, history, proposals and the API, because the hub read only a change's own signature. It now reads seals too: the change says sealed, with "via agent:NAME@you" and "keyless, under your grant", and the Contributors panel names the agent under you. **Help › AI identities** now sets the agent's author (your name, email and the key you make its grant with, filled in when you are signed in) and copies your public identity into its home; without them an agent's changes were unattributed.

- **Kimi has its own avatar (#351).** Changes signed via an agent named Kimi (`agent:kimi@…`, or Moonshot) now show a Kimi mark, a white K with a blue dot on a dark disc, instead of an identicon, as Claude, Gemini and the others have theirs.

## 0.9.17 (2026-10-29)

- **Drops over the API: fork, star and comment (#349).** What a drop's page does, for the VS Code extension and other clients: `POST /api/v1/drops/{id}/fork`, `PUT`/`DELETE /api/v1/drops/{id}/star`, `GET`/`POST /api/v1/drops/{id}/comments` and `DELETE /api/v1/drops/{id}/comments/{n}`, by the web's rules (the owner told of a comment; its author, the owner or an administrator deletes it). A drop over the API now says its stars, whether you starred it, what it was forked from and its embed address. `oh drop fork|star|unstar|comments|comment`. The API's TypeScript types now include the dashboard's proposals, the starter and test reports.

## 0.9.16 (2026-10-29)

- **A release's asset at a fixed address (oxygen#157).** `/OWNER/NAME/releases/download/TAG/FILE` redirects to the asset, an address known before the release exists (as GitHub's), so a packager's recipe can name it.

- **Releases carry their source (oxygen#157).** Each release now has `oh-VERSION-src.tar.gz`: the oxygenhub tree with its subrepos inside, so oh builds from it alone, reproducible and listed in SHA256SUMS, for packagers (haikuports' oh recipe).

- **A phone's runner follows the app's releases (oxygenflow#84).** A runner on Android is part of the OxygenHub app, so the hub never offers it a runner build: with updates on, it is told it follows the app's releases (update the app to update it), and Admin › Runners › Updates says so.

## 0.9.15 (2026-10-28)

- **Run a pipeline's WASM jobs in your browser (oxygenflow#80, first part).** Flow › *run in this tab* (`/OWNER/NAME/flow/tab`) lists the jobs of a bookmark's pipeline whose sandbox is `runtime "wasm"` and runs them in this tab, as a runner's WASM tier does: a worker fetches the bookmark's files as a zip once, unpacks them in memory and runs each job's modules with a WASI preview 1 shim, the files at `/src` and as the current directory, the job's arguments and environment, its output shown as it comes, its exit code and time; Run all, Run and Stop per job. Nothing is claimed or reported: it shows the tier in a browser before a tab can take jobs as a runner.

- **Runner builds through the swarm (oxygenflow#84).** The first time the hub offers a runner build, it cuts the release asset into its image chunks, as an image named by the build's BLAKE3, so a runner in a swarm (OxygenFlow 0.5.2) fetches it from its site's peers and the hub together and the hub serves it about once per site; Admin › Runners › Images lists it as "runner build flow VERSION".

## 0.9.14 (2026-10-28)

- **Read a Flow job's report over the API and with `oh` (#348).** A report a job published could only be read on its web page. Now `GET /api/v1/repos/OWNER/NAME/flow/runs/N/jobs/JOB/report` gives it with its metrics, context and files, `…/report/PATH` one file as published (`data/frames.csv`), `…/jobs/JOB/reports` every report the job published, `GET …/reports` the newest run of each report (`?bookmark=`), and `GET …/reports/NAME` one run by `?id=` (the id the web page carries) or the newest on a bookmark, with `…/files/PATH`. Files come sandboxed, so a page in one runs nothing on the hub; errors name the jobs, reports and files there are. `oh run report RUN JOB` prints its `report.toml`, `--list` what it holds, `--file PATH [-o FILE]` one file; `oh report list` and `oh report show NAME` do the same by name.

- **A job's timings over the API (#348).** A run's jobs now say when each was queued and claimed, the phases its runner reported (image, prepare, run, finish, in milliseconds) and its peak disk and memory; `oh run view N --timings` prints them under each job ("waited 12.0 s · image 850 ms · run 2 min 5 s · peak disk 2.1 GiB, memory 900 MiB").

## 0.9.13 (2026-10-28)

- **An assistant drafts a new repository's starting files (#347).** Creating a repository can come with a description of what it is for: `POST /api/v1/repos/OWNER/NAME/starter {"description"}` asks the owner's assistant (the site's, or the organisation's) for a small working starting point (a README, the build files, a source layout and a first test), checks what comes back (relative paths, text, at most 40 files and 256 KiB), and commits it to the empty repository's default bookmark as the person who asked, signed by the hub as their delegate, the change naming the assistant and what was asked. It runs in the background, since a model may take longer than a proxied request may last; `GET …/starter` says how it went, and `GET /api/v1/user/starter?owner=X` which assistants may be asked. Never over files that are there. The Android app's New repository uses it.

- **Your Flow runs over the API (oxygenhub-android#26).** `GET /api/v1/user/flow/runs` gives the newest runs of the repositories you belong to, each with its repository and jobs (`?before=MS` pages back), for the Android app's Flow monitor.

## 0.9.12 (2026-10-28)

- **A repository's sky over the API (oxygenhub-android#23).** `GET /api/v1/repos/OWNER/NAME/sky` gives the backdrop a repository's pages draw (#196), its events of the last 30 days, in the shape of `/user/sky`, for the Android app's repository screen; read access, as the repository's pages.

- **Runner updates in waves (oxygenflow#84).** A test group can be given a wave (1 to 9) on Admin › Runners › Updates or an organisation's settings: a new version reaches wave 2's runners only once every runner of wave 1 that took it has finished a number of jobs on it (5 by default) with none ending in error, or a number of hours (24) has passed since its first job there; runners in no wave come last. A job that ends in `error` on a wave's runner (the runner's or the machine's fault; failed tests do not count) stops the version: the next runner to ask holds it for every runner, and the page names the job, until an administrator lifts the hold. Each job now keeps the runner build it was claimed by (migration 0102). A runner waiting says so: "flow 0.5.1 waits for wave 1 to prove it: 1 of 2 runners on it, 3 jobs". First slice: errors are not yet weighed against the version before, and a stopped wave's runners are not rolled back by the hub.

## 0.9.11 (2026-10-28)

- **Your sky over the API (oxygenhub-android#23).** `GET /api/v1/user/sky` gives what the dashboard's backdrop draws: the caller's repositories and their pushes, proposal and issue events, releases and Flow runs of the last 30 days, so the Android app draws the same sky from the same data.

- **Another repository's pass is taken only on its signed receipt (#296).** A pass from upstream or from any other repository on the hub now stands only if its runner's signed receipt was kept (the hub checks it against the runner's bound key when the job finishes) and, read again from that repository's store, still verifies and its key is not revoked; otherwise the job runs here. Only a pass that ran in the repository offering it is taken, so the receipt is where it is checked.

- **A pass on the same state is reused from any repository on the hub (#296).** After the repository's own runs and the line it was forked from, a push's job with no pass of its own on that state reuses one from any other repository holding the same state, public or with the same owner, newest first: a state is its changes, so whoever proved it, the proof holds. The run page and the check say whose pass it was.

## 0.9.10 (2026-10-27)

- **Approval gates and expedite for clients (oxygenhub-android#5).** A run's jobs over the API say `approval` (`waiting` while one waits for a person, `approved` or `rejected` after), and `POST /api/v1/repos/OWNER/NAME/flow/runs/N/expedite {"reason": …}` makes a run urgent as the run page's Expedite does (a maintainer, with a reason, within the owner's cap of urgent runs); the page and the API share it.

- **A proposal's diffs over the API (oxygenhub-android#4).** `GET /api/v1/repos/OWNER/NAME/proposals/N/diff` gives each file the proposal changes with its diff (three lines of context, in the shape a change's files have), as the proposal page shows them, for the Android app's proposal view.

- **Images that point at a file's page show (#346).** Markdown left an image's full or root-relative address alone, so `![…](https://oxygenhub.io/OWNER/NAME/file/main/x.png)` (the address a file's page shows, as the doomsdayone/tetriblox wiki's screenshots use) pointed an `<img>` at an HTML page and showed broken. An image of one of this hub's file pages now renders as that file's raw bytes (`…/raw/REF/PATH`), as GitHub does for `blob/` images; links keep the page, and other sites' addresses are untouched.

- **Phone alerts (oxygenhub-android#16, oxygenhub-gcp decision 0008).** A phone registers its Cloud Messaging token and an X25519 public key with `PUT /api/v1/user/push`, using the token it signed in with (`DELETE` unregisters; revoking the token ends it too, migration 0101). Each notification an account is told then also goes to its phones, its title and link sealed to each phone's key (`flow_core::alert`), as a data-only, high-priority message, so Google carries only ciphertext. The hub sends as the service account its VM runs as, with the metadata server's token: no key. Off until `[push] fcm_project` (`OXYHUB_PUSH_FCM_PROJECT`) is set; a registration Cloud Messaging no longer knows is forgotten. Pins OxygenFlow main (sealed alerts).

- **A fork starts green where upstream proved the same state (#296, first slice).** Pass reuse (#265) looked in the repository's own runs only. A push's job with no pass of its own on that state now reuses one from the repositories it was forked from, nearest first (up to five up): the same state is the same changes, so upstream's receipt stands for it. Only from an upstream that is public or has the fork's owner. The run page says whose pass it was and links to it, and its check reads "passed in OWNER/NAME run #N on this state, reused".

- **A proposal's conflicts are resolved on the web (#337).** A proposal whose landing would conflict has RESOLVE ON THE WEB for those who may push to its source: the hub brings the target into the source bookmark, as `oxy merge TARGET` would there (signed as the user's delegate, or unsigned where no trust policy asks for more), and opens the resolver on the first conflicted file. The resolution is committed to the source, so the proposal follows it and lands. A proposal from a fork is resolved in the fork.

- **A default bookmark must exist, and bookmarks are made on the web (#345).** Settings refused nothing, so a default named before it existed (doomsdayone/tetriblox's `develop`) left the repository's pages saying `"develop" is not a change`. Settings now refuse a new default that is not a bookmark (an empty repository may name any, for its first push) and list those that are; a missing default leaves the overview showing main, or the first bookmark, with a note; an unknown name is "not a bookmark, tag or change of this repository". Bookmarks › New bookmark makes one from a bookmark, tag or change, as the user's delegate or, without a trust policy, unsigned as a push would be, so a proposal can then target it.

- **Iterations on project boards (#343).** A board can run an iteration: a name and its first and last days. The board shows it above the columns, day N of M and the cards done so far, with a burn-up of cards done per day. Closing it archives the cards in the Done column (the one that takes finished work, or else the last) under it; its page, linked from "past iterations", lists them, restorable, with its burn-up. One iteration is open at a time. Migration 0100.

- **`oh` on Haiku (#344).** `oh` builds and runs on Haiku R1/beta6 (x86_64); `oh-VERSION-haiku-x86_64.tar.gz` is on the releases page from 0.9.9, with its own `SHA256SUMS-haiku`, and the README says how to install it.

## 0.9.9 (2026-10-27)

- **`oh` works in PowerShell (#319).** PowerShell has a built-in alias `oh` (for `Out-Host`), so `oh --version` ran that and failed. The Windows zip now carries `ohub.exe`, the same program under a name nothing hides, and `install.ps1`, which installs both for the current user and puts them on `PATH`. Where PowerShell runs scripts it also removes the alias in the profile; under Windows' default policy, where a profile cannot run and would only print an error, it says to use `ohub` and never changes the policy. Tried on the Windows VM under both policies.

- **Admin › Runners › Images tells a peer-held image from the hub's own (#342).** An image only runners hold shows as "manifest" (sent by which runner) rather than "hub", and one no runner holds now is marked nowhere, as an image the hub lacks is.

- **A queued job's reason names CPUs too.** A runner with a free slot but not the room for a job was said to lack "the memory or disk"; earth-1's limit is often its CPUs (5, with a 4-vCPU job running), so it says "the memory, CPUs or disk".

- **The Content Security Policy is enforced (#227).** The pages carry no inline scripts or handlers, and a week of reports showed it would block only Cloudflare's Web Analytics beacon, which the policy now allows (`static.cloudflareinsights.com`, reports to `cloudflareinsights.com`). Violations are still reported and logged.

- **Where a job's time went (oxygenflow#35).** A runner's finish report carries its phases (image, prepare, run, finish); the run page shows them under each job, and `/metrics` has `oxyhub_flow_job_phase_seconds` by phase. Migration 0099 (`flow_jobs.phases`).

## 0.9.8 (2026-10-27)

- **Images only runners hold (#342, oxygenflow#94).** A runner that serves its peers sends the manifest of each image it holds that the hub lacks (`POST /flow/images/held`, `PUT /flow/images/{hash}/held`, runner tokens only); the hub keeps it as held by runners and offers the image's jobs to runners of the same swarm site, which fetch it from their peers (the announce says the hub is no seed for it). A pushed image replaces such a record. On 2026-10-25 a re-pinned image that was never pushed kept every Rust job on one runner for a day. Migration 0098 (`jet_images.source`, `holder`).

## 0.9.7 (2026-10-27)

- **A push to a landed proposal's bookmark says so (#329).** The changes reach no target until a new proposal takes them, and the push was silent: now it is answered `its proposal #N has landed in TARGET, and these changes are not on TARGET: open a new proposal with oh proposal create --from BOOKMARK` (oxygen's `Backend::push_notes`). The landed proposal's page lists them as changes since it landed, with a link to a new proposal; it no longer shows them as its own, and no longer offers to delete a bookmark that holds them.

- **Creating a repository no longer stalls the hub on a busy disk (#335).** A bare init makes about sixteen fsyncs, and on Earth's shared disk each waited behind every other write: one create took 26 s and held an async worker the whole time. Creates from the API, the web and drops now run on a blocking thread, as forks and bucket creates already did.

- **A Diffusion bump pins the upstream's default bookmark (#332).** A bump kept the bookmark name of the pin it replaced, so a subrepo first pinned at an upstream proposal's bookmark still named it after the proposal landed and Diffusion moved the pin to the default bookmark's state; a checkout then counted the subrepo as on another bookmark. A bump now names the upstream's default bookmark, unless it keeps pinned changes that bookmark lacks.

- **Listing landed proposals is quick, and pages (#331).** `oh proposal list --state landed` on a repository with a few hundred proposals timed out: the API worked out every proposal's projected state again, landed and closed ones too. Those now come from what was recorded, and the list takes `limit` (`oh proposal list --limit N`, 30 by default), newest first.

- **A big image's push no longer fails at the last step (#341).** The hub reads a whole image before it accepts the manifest, which on a busy disk outlasted `flow rootfs push`'s wait. The image could then be kept but never offered, and a retry read it all again. The hub now finishes and records the image even if the sender gives up, and a manifest it already keeps is recorded without reading the image again.

- **The API refuses a field an edit does not take (#330).** `PATCH` on an issue, proposal, project, milestone, release or drop answered 200 to a field it does not know and changed nothing (`{"ready": true}` on a draft proposal, say), which looked like success. It now answers 422 naming the field and the ones it takes.

- **Mail reads `[OxygenHub]`, in a wider message (#334).** A notification's subject was tagged with the site's name (`[Oxygenhub on Earth]`); mail now goes by the From address's display name (`OxygenHub <noreply@…>`) in the subject and the footer, falling back to the site's name, so the site keeps its own name (which its apt repository is labelled with). The message card is 720px wide rather than 560.

- **An agent follows its owner's newest identity (oxygen#82).** A keyless certificate's answer now carries `author_chain`: the grant owner's newest linked identity and its predecessors back to the grant's key, so an agent home with `author.for` authors as the owner's current identity, not one several rotations old.

- **The profile page's actions are one tidy group (#328).** Edit profile, Projects and Drops sat on two rows, touching each other and the panel below; they are now one evenly spaced block, Edit profile across the top and the two pages side by side.

- **Copy buttons are a glyph joined to their field (#338).** Every copy button is now a clipboard glyph on the end of the box it copies, with the tooltip "Copy to clipboard"; pressed, it turns to a tick saying "Copied!" for two seconds. A drop's Embed and Clone boxes line up with each other.

- **Changelog entries no longer block a landing (oxygen#145).** Two proposals that each add a line at the same place in a file marked `merge=union` in `.oxyattributes` (`CHANGELOG.md merge=union`) used to leave the second unlandable where conflicts are refused. When a proposal's only conflicts are such adjacent insertions, landing it now adds the resolution, both sides kept, the earlier change's first, authored by whoever lands it and signed by the hub as their delegate. Any other conflict blocks as before.

## 0.9.6 (2026-10-26)

- **A highlighting test no longer fails a busy machine's gate (#327):** it timed a debug build against a release build's 500 ms; debug builds now have 3 s, still far below what highlighting the line would take.

- **`oh runner-updates` and its API (#322):** site administrators read every level's update settings, the test groups, each runner's policy and offer, and the held builds (`GET /api/v1/admin/runner-updates`); `oh runner-updates set group:canary --updates on --window 02-05` changes one level, keeping what is not given (`PUT …/settings`, 422 saying what is wrong); `oh runner-updates lift 0.4.0` offers a held build again (`POST …/holds/{version}/lift`).

- **A build that rolls back on one runner is held for the rest (#326):** when a runner reports it rolled back from flow X (it did not reach the hub after updating, or would not start), the hub offers X to no other runner, saying why, until an administrator lifts the hold on Admin › Runners › Updates, which lists each held build with the runner and the reason. One failed canary halts the rollout. Migration 0097.

- **Finished work moves to Done (#325):** a card whose issue closes (on its page, through the API, or by a change's `closes #N`), or whose proposal lands or closes, moves to its board's column for finished work. A new board's Done is that column, and so is each existing board's column named Done; a column's menu turns it on or off (one column of a board). Archived cards stay archived.

- **A WASM job's placement names no image (#323):** a job on the WASM tier was placed saying its runner "fetches the image from the hub"; it has none, so the line now starts with what the runner is doing (andymccall/windows-runner-demo run #1).

- **Runner updates: policy, test groups and the offer (#322):** Admin › Runners › Updates sets where runner builds come from (a repository whose releases carry `flow-linux-ARCH` files, and `flow-windows-x86_64.exe` for Windows runners) and who takes them. Updates are off unless chosen; the site, an owner, a test group and a runner may each set updates on or off, a channel (`stable`, `canary` or a version), a window of hours (UTC) and dry run, and the nearest setting wins, each setting on its own. A test group is chosen runners or a percentage of the site's (or an owner's) runners, by a stable hash of each runner's id, so a share is the same machines every rollout and 10% sits inside 50%. `GET /api/v1/flow/runner/update` tells a runner its policy, where each setting came from, and the build to install (its BLAKE3, to check the download against); `POST` takes what the runner did, shown on the page and in the audit log. An organisation's owners set the same for their own runners in the organisation's Settings › Runner updates: the organisation's setting, test groups of its runners (chosen, or a percentage), and each runner's own; nothing of the site's or another owner's. Pins OxygenFlow's main.

## 0.9.5 (2026-10-26)

- **No failed run every minute for a pipeline that does not parse (#321):** the scheduler asked each repository's pipeline every minute and, for one it could not read (a mistake, or no jobs yet), recorded a failed `schedule` run each time: oxygenhub-android had about 1,500. A scheduled tick now starts nothing for such a pipeline; its push's run still says what is wrong.

- **A change's diff through the API (#320):** `GET /api/v1/repos/{owner}/{name}/changes/{hash}` gives each file's diff lines too (`lines`: `kind` context, add, del or gap, `old` and `new` line numbers, `text`), with three lines of context, up to 2000 lines a file (`truncated` says when it stops short), so the Android app can show a diff itself.

- **JaCoCo coverage is read (#308):** Gradle's `jacocoTestReport` and Kover write JaCoCo XML, which a `coverage` artifact (or `POST /coverage`) may now be, beside LCOV and Cobertura: lines hit when an instruction ran, branches, methods. Its paths are relative to a source root (`io/oxygenhub/…/X.kt`), so a report's path not in the state is matched by its ending to the one file it can be.

## 0.9.4 (2026-10-25)

- **Checkpoints, so a handed-back job resumes (oxygenflow#77):** `POST /api/v1/flow/jobs/{id}/checkpoint` keeps the directories a job declares with `checkpoint "/src/…"` as its runner hands it back; the next attempt's claim names the blob (`checkpoint`) and its runner fetches it (`GET`) and restores it before running. A checkpoint is kept beside the job's artifacts but is none of them (no receipt names it). Pins OxygenFlow's main.

- **Boards keep the last fortnight of finished work (#293):** by default every column archives its finished cards (closed issues, closed or landed proposals) 14 days after they reached it, hourly, so a Done column stops growing however long a project runs; open work and notes stay. A column can instead archive every card after N days, or never ("Archive automatically" in its menu). Archived cards stay on the board's archive view, searchable and restorable. On the next hourly pass, boards with years of Done cards (Super Mario Land 2's 327) shrink to their last two weeks.

- **An issue's references: no line through the chips, each change once (#318):** an opened "referenced by N changes" box drew the proposal timeline's vertical rule through its first column (the events shared its class); and a change was recorded again for every bookmark it was pushed on, and for every mention in its message, so one change filled several chips. Now one reference per change per issue or proposal, and the page shows each change once, including those recorded before.

- **Claims say how long a job is expected to take (oxygenflow#76):** `expected_ms`, the median of the job's last five passing runs in the repository (reused passes left out), so a runner leaving with notice finishes a job that fits it and hands back the rest. Pins OxygenFlow's main.

- **The hub's CI writes a test report and coverage (#307):** `test` runs under cargo-nextest and keeps a JUnit report (whether or not the tests pass); a new `coverage` job runs the tests instrumented beside it, with its own cached target, and keeps LCOV coverage. `coverage` is not a required check.

- **The new proposal form lines up (#315):** as wide as the changes above it; Draft with Claude a secondary button under the editor (it fills the fields, it does not open the proposal); the draft checkbox and Open proposal on one row.

- **Draft with Claude proposes a title too (#316):** for a proposal not yet opened, the assistant begins its draft with a title in the style of the changes' own titles; it fills the title field unless you wrote one (the page's own suggestion does not count), and stays out of the description.

- **A waiting WASM job no longer says runners lack its image (#317):** a job with no image (the WASM tier) waited saying every runner "does not hold image" with an empty name; the explanation now skips the image check, as the claim always did.

- **A draft proposal can be made ready from `oh` and the API (#313):** `oh proposal ready N` (and `--undo` to turn it back into a draft); `PATCH …/proposals/{n}` takes `state: "open"` for a draft and `state: "draft"` for an open one, as the page's buttons do, and `draft: false|true` in the words a proposal is created with. `{"draft": false}` used to answer 200 and change nothing.

## 0.9.3 (2026-10-25)

- **Runners hand jobs back, and the queue takes them first (#312, oxygenflow#76):** `POST /api/v1/flow/jobs/{id}/release` {reason} lets a draining runner hand back a job it holds as it leaves (a phone off Wi-Fi, a restart, a spot reclaim). The job is queued again **ahead of new work**, whatever its priority; its log says who handed it back and why, and its next attempt's log follows on; it is not a decline. A job whose runner the hub has not heard from for 3 minutes (claims, 30-second heartbeats, logs) is handed back the same way, rather than running on until its time limit and ending as lost. A job handed back more than 5 times ends as an error saying so. Migration 0094 adds `flow_jobs.handed_back_ms` and `handbacks`.

## 0.9.2 (2026-10-25)

- **`GET /api/v1/user/proposals?landable=true` (#311):** also lists the open proposals the caller could land now (in repositories they can write to, with no blockers, as each proposal's `landable` says), for the Android app to say when there is something to land. Only when asked for, since it works out each one's projected state.

- **One logo, with its arms (#306):** the Oxygen mark's two arms were never drawn: their gradient was in bounding-box units, and a horizontal line's box has no height, so SVG paints nothing. The gradient is now in user space everywhere (header, footer, favicon, `mark.svg`; the VS Code extensions and the Android app too), and while a page loads the arms slide back and forth in turn beside the turning rings (still with reduced motion).

- **Admin › Runners: the Serves column lines up (#309):** the scope sits above its input, so the inputs line up whatever the scope's length.

- **A job's RE-RUN THIS JOB button no longer touches its log (#310).**

## 0.9.1 (2026-10-25)

- **Pipelines may use the WASM tier:** OxygenFlow's main pinned (oxygenflow#75), so `runtime "wasm"` sandboxes are accepted and their jobs placed on runners that offer the tier (every runner from flow 0.3.1-3; an Android phone from the app).

- **`POST /api/v1/user/runner-token` (repo:write):** a one-time registration token for a runner that serves the caller's own repositories and no one else's, as the Android app offers the phone as a runner (oxygenhub-android#8); it lasts a day, like the settings pages' tokens, and is audited.

## 0.9.0 (2026-10-25)

- **`GET /api/v1/user/proposals` (repo:read):** the proposals the web dashboard lists, for apps: `review` (open ones by others in repositories the caller belongs to, not yet reviewed by them) and `authored` (their own open and drafts, in repositories they can still see), each with its repository, state, conflicts and web address. The Android app's dashboard shows them (oxygenhub-android#18).

- **Board cards can be archived (#293, archive):** off the board but kept, on the board's archive view (`?archived=1`, with the same filter) and restored to the end of their column. A column archives its cards that reached it more than N days ago at once ("Archive cards here more than 14 days"), or on its own once set to (checked hourly, `projects.archiver`), so a Done column stops growing. An issue's or proposal's page says its card is archived. The API has `POST …/cards/archive` (#289's selection plus `older_days`, with `dry_run`), `GET …/cards?archived=true` and `POST …/cards/{id}/restore`; `oh project card archive N --from Done --older 14d`, `oh project card restore N CARD` and `oh project view N --archived`. Migration 0093 adds `project_cards.archived_ms` and `moved_ms` (when a card joined its column) and `project_columns.archive_after_days`.

- **Board cards show their labels and assignees, and the board filters by them (#293, filters):** an issue's or proposal's card shows its labels (each a link to the board filtered by it) and an issue's assignees; the filter takes `label:NAME`, `assignee:NAME` and `state:STATE` with words, as the issue list does, every term holding. The board reads what its cards show once per repository rather than once per card (a board of 300 cards made 300 queries). The API's cards and `oh project view` carry the labels and assignees too.

## 0.8.0 (2026-10-25)

- **Built on oxy 0.6.0 and OxygenFlow 0.3.1:** tag withdrawals, keyless grants that survive a key rotation, working depth-0 clones of big repositories (oxygen#134, #135, #137; oxygenhub#301).

- **The API for apps (#302-#305), found building the Android app:** `GET /api/v1/user/repos` lists the caller's own repositories, their organisations' and those they collaborate on (`?affiliation=owner,organization,collaborator`, paged with `?after=owner/name&limit=`), and `GET /api/v1/user/orgs` their organisations and role (#302); a call with no token now answers 401 (sign in) rather than 403 (#303); `DELETE /api/v1/device/code` withdraws a device sign-in the app gave up on, at once (#304); each notification says its `repository`, `reason` (participating, watching), `thread` and the kind's `label` (#305).

- **Boards that keep growing stay readable (#293, first part):** a column of more than 30 cards shows its newest 30 (cards join a column at its end), says how many older ones it leaves out and links to "show all"; a filter above the board finds cards by title or reference, and by state (open, closed, landed, draft), in every column, counting "3 of 312".

- **An issue's references come in a box per day (#292):** an issue many changes refer to listed a line per change and ran on down the page. Two or more on one day are now one box, "referenced by 12 changes on 21 Oct 2026", their changes as wrapping chips, collapsible, the newest day's open.

- **Move a board's column at once (#289):** `oh project card move N --from Doing -c Done` moves every card of a column, `--except 317,#320` leaves some, `--state closed,landed` takes only cards whose issue or proposal is done, and `--dry-run` lists what would move. One call (`POST …/projects/{owner}/{n}/cards/move`), all or none, one audit entry: tidying a board of 115 cards took 115 commands.

- **Expediting a run moves the queue at once (#291):** a run's jobs kept the place they had ("9 of 9 jobs come before") until the next placement pass and some other change on the page. Expediting now places every queued job again straight away, every run whose jobs' notes changed updates live, and a job an expedited run moved down says so ("2 ready jobs come first (after expedited run andy/demo #12)").

- **Create and withdraw tags on the website (#295, #301):** a writer creates a tag on the Tags page (or `oh tag create`, `POST …/tags`), signed by the hub as their delegate, under the policy, and its tag jobs run; a maintainer withdraws one there (or `oh tag delete`, `DELETE …/tags/{tag}`, or `oxy push --delete tags/NAME`) with a signed withdrawal, never while a release uses it. The withdrawal is logged, audited and listed on the page with why, and clones drop the tag on their next fetch. Tags never move, and a withdrawn name is not used again. Pins oxygen with tag withdrawal and with keyless grants that survive their owner's key rotation (oxygen#135).

- **An agent's changes verify in a new repository (oxygen#134):** a keyless agent's change in a repository its owner had never pushed to read INVALID ("grant is by an unknown author"). The hub now sends the grant's signer with each certificate, and with oxy's fix the agent keeps it and pushes it beside the certificate, so the repository can check the grant.

- **A mistyped address shows the not-found page (#294):** an address the hub could not read, such as a project or issue number that is not a number, answered with a raw parse error ("Invalid URL: Cannot parse value …"); it now shows the site's not-found page, signed-in header and all.

- **Embed a drop (#280):** a drop's page offers an `<iframe>` snippet; `/{owner}/drops/{id}/embed` shows its files with a link back, framed by any site, with no scripts and no forms.

- **Comments on drops (#280):** a drop's page has comments: signed-in readers write them in Markdown, the drop's owner is told, and the author, the owner or a site administrator deletes one.

- **Star a drop (#280):** a signed-in visitor stars a drop, or takes the star back, from its page, which shows how many it has.

## 0.7.0 (2026-10-21)

- **Fork a drop (#280):** a signed-in visitor's FORK makes a drop of their own from someone else's, with its files, history, title and secrecy; the fork's page says which drop it came from.

- **Flow's job times in /metrics (oxygenflow#35, #212):** `oxyhub_flow_job_queue_seconds` (ready to started) and `oxyhub_flow_job_run_seconds` histograms by runner, finished jobs by runner and result, reused passes, and the work queue's waiting and dead items, all over the last day, for the Grafana dashboard.

- **A durable work queue (#276):** work that fails where it starts is queued and retried instead of lost: a notification's email the mail server refused, and a Git mirror export after a push. Any worker process takes due items (on PostgreSQL several at once, each skipping what another holds), retries back off from 30 seconds to an hour, and an item still failing after eight attempts is kept as dead.

- **One auto-land and one Diffusion bump at a time across hub processes (#275):** auto-land's check of a proposal, and Diffusion's bump and landing of a consumer's pin, were serialised only within a process, so two web processes could land one proposal twice. Each now holds a lock named for the proposal or the pin across every process sharing the database (a PostgreSQL advisory lock; on SQLite, one process, as before).

- **Several web processes can share a data directory (#274):** the transparency log took appends from one process only, so only one process per data directory could have the web role. Each append now holds a lock in the log's directory and starts from the log as the files hold it, readers see every process's entries, and every process serves the newest checkpoint, whichever signed it.

- **A push reuses a job's pass on the same state (#265):** when main reaches a state a proposal's run already tested (landing it), a job that passed there with the same spec and sandbox is not run again: it shows passed, reused from that run, with its receipt, and its check says so. Jobs with an approval gate, an environment, secrets or identity tokens, or whose artifacts another job takes, always run. Maintainers can turn reuse off under Settings › Runs.

- **Drops are backed up (#280):** an owner's backups now include its drops, each copied like a repository and restored as a drop (secret or public, with its title and description); Admin › Backups counts them with the repositories they cover.

- **A skip marker quoted in code does not skip:** a change message that mentions `[skip ci]` between backticks or in a fenced block (documenting the marker, say) now starts its run as usual; only a marker in the text itself skips it.

- **Administration has a sidebar, one page per section (#288):** the admin area was one long page plus separate pages for runners, images, Diffusion, backups and storage. Every page now has the same sidebar, grouped as Overview, People (accounts, registration and invitations, organisations), Sign-in (providers, security contact), Mail, Flow (runners, images, runner settings, insights, variables, secrets), Integrations (AI assistants, Diffusion), Data (storage and maintenance, backups) and Audit, each at its own address (`/admin/mail`, `/admin/audit`, …). `/admin` is an overview of the site's numbers. Forms keep their addresses and answer with their own page, and a kept `/admin#mail` link opens the Mail page.

- **Help: AI identities (#287):** a section on letting an AI agent work for you: keyless agents (a grant with `oh agent grant`, an agent home with `oxy auth grant`, ten-minute certified keys, nothing secret on disk), how its work shows (`via agent:NAME@YOU`), admitting it to a repository's trust policy (`oxy policy grant-subject`), agents with keys of their own (delegation), agent-marked tokens, approval gates, and revoking. "Letting the hub act for you" now says to export your identity again after delegating and upload that.

- **Settings › Keys says when each key was last used (#286):** like tokens, each linked key shows when it was linked, when the hub last accepted a push it signed (a change or a seal; "never" until then) and when the identity expires.

- **Settings › Security is balanced (#285):** every box runs the page's width: two-factor shows whether it is on in its head, with its field and button on one row; connected accounts are rows with Connect or Disconnect; signed-in browsers are rows with Sign out, and Sign out everywhere else sits in that box's head with the session limits under it.

- **Push without starting a run (#284):** `[skip flow]`, `[skip ci]` or `[ci skip]` in the newest pushed change's message starts no jobs; the run list shows a skipped run naming the change and who pushed it, and the next run still tests what it brought. Tags always run. Maintainers choose where it is allowed under Settings › Runs: any bookmark (the default), any but the default bookmark, or never.

- **A drop's page is centred and its header clearer (#283):** the page ran the full width with everything against the left edge; it is now centred like other pages, with the title, description and details on the left, EDIT and DELETE together on the right (DELETE only for whoever may delete it), the clone line with a copy button under them, and a Markdown file filling its box.

- **A started job no longer says it is waiting (#282):** a run page opened while a job was queued kept "Waiting for a runner and for build." under it after it started, as the live update changed its status and streamed its log; the note now goes once the job leaves the queue.

- **Linking the identity that delegates to the hub (#281):** the notice on pages that commit for you (New drop, web edits) read as if the hub's key file was what to link under Settings › Keys, which then asked for a signature nobody but the hub can make. It now says to export your own identity again after `oxy identity delegate add` and upload that; uploading the hub's own key is refused saying so, uploading an already linked key says to export again after delegating, and a challenge signed by another key than the one uploaded names both keys. The New drop form runs the page's width, and CREATE DROP and CANCEL are the same height in one row.

## 0.6.1 (2026-10-20)

- **Tidier forms and headers:** the New drop page is laid out like every other page (it ran the full width when its notice did), a form's Cancel lines up with its buttons (drops and web edits), and the Drops page's + NEW DROP sits beside its title instead of against the text above.

- **Released oxy can clone repositories with an agent's release tag again (oxygen#131):** since keyless agents could tag releases with ten-minute certified keys, oxy 0.5.0 and older refused such a tag when cloning or fetching a repository with a trust policy (`key … may not create tags/v0.5.0 under this repository's policy`), and with it the whole clone, so andymccall/oxygen could not be cloned by any released client. The hub now leaves those tags out of its answer to a client that does not declare `certified-tags` in the new `Oxy-Features` request header (oxygen#131), which sees the repository as if the tag did not exist; current clients get it as before. Needs the oxygen pin with oxygen#131.

- **Drops: snippets of files, each its own small repository (#279):** a drop is one or more files, as a gist is, kept as an Oxygen repository of its own at `/{owner}/drops/{id}` (a 24-hex-digit id), so every edit is a signed change with history and diffs, and `oxy clone` and `oxy push` take its address. Make one at `/drops/new` (title, description, files, public or secret), with `POST /api/v1/drops`, or with `oh drop create FILE… [--secret] [-d TEXT] [-t TITLE]`; the hub commits it as your delegate, as web edits are, so you delegate to the hub's key first. Your Drops page (`/drops`, under your profile and in the site band) lists and manages them; someone else's shows their public drops only. A secret drop is listed nowhere but readable by anyone with its address. Drops never appear among repositories (profiles, the dashboard, Explore, search, `GET /api/v1/repos`); Admin › Storage labels them. Only the owner edits a drop; the owner or a site administrator deletes it. Push protection covers drop pushes and what the web and the API commit. API: `GET`/`POST /drops`, `GET /users/{name}/drops`, `GET`/`PATCH`/`DELETE /drops/{id}`; `oh drop list|view|delete`. `drops` is now a reserved name, for owners and for repositories. Not yet: forks, stars, comments, embedding, and drops in backups.

- **Repository settings are one page per setting (#278):** a repository's Settings was one long page; it is now a sidebar of grouped pages (General, Code, Flow, Integrations, Data, Danger zone) with the page shown beside it, the current one marked, each at its own address (`/{owner}/{name}/settings/push-protection`, `/settings/runs`, …; `/settings` is General). Pages a role cannot use are not listed and are not found. Every form keeps its address and now returns to its own page with what happened, so reloading does not send it again. Links elsewhere point at the new pages (the push protection refusal names `/settings/push-protection`), and a kept `/settings#section` link opens the page that has it. On a narrow screen the sidebar becomes a compact list above the page. An archived repository's settings open for its admins again, so they can bring it back.

- **Proposal lists and the proposals API are much faster on large files:** listing a repository's proposals rendered every open proposal's full diff and looked up each new line's history separately, recomputing a whole file's lines for every line; lists, the API, auto-land and the checks after a push now skip the rendering, and the proposal page computes each file's lines once.

- **Keyless agents can push release tags (andymccall/oxygen#129):** A tag signed by a key the hub certified (an agent's or a Flow job's ten-minute key) was refused "unknown key", and then refused by the policy. With oxy's fix the hub accepts it under the policy's subject grant and countersigns when it accepted it, as it does a bookmark move. It logs the tag's acceptance in the transparency log beside the tag, and serves both with the tag in every refs answer, so a client fetching the tag months later checks the certificate at the hub's time. Runners read repositories with their own oxy, so they need rebuilding to check such tags; older ones ignore the new fields.

- **Secret scanning finds what is already in history (#277):** push protection's rules now also run over each repository's existing history in the background (every change reachable from its bookmarks: the lines it inserts and the text files it replaces), so a credential committed before push protection existed, or while it was off, is found too. Every repository's whole history is scanned once after this deploy, then only what each push adds, a budget at a time (`[limits] history_scan_limit`, 64 MiB, and `history_scan_time_ms`, 5 s, per repository per pass; `0` turns it off), at low priority, resuming where it stopped. Maintainers see the findings, with the change, bookmark, file and line, under Settings › Push protection › Found in history, and either allow one (not a secret) or mark it resolved with how it was revoked (audited as `secret.resolved`); "Scan history now" scans the whole history again. An allowed fingerprint can now be removed (audited as `secret.bypass_removed`), so pushes adding that value are refused again. Repositories with push protection off are not scanned.

## 0.6.0 (2026-10-20)

- **An event bus between the hub's processes (#273):** on PostgreSQL, what one process publishes (a push, a check, a run's jobs, a comment, a waiting webhook delivery, a choice in the conflict resolver) reaches every other process over `LISTEN/NOTIFY`, so live pages on any web process see a push made through another, and a separate worker delivers a push's webhooks at once instead of on its once-a-minute pass. Nothing to configure; on SQLite the bus stays in process. Events say "look now" and are delivered at most once; a process that loses its listening connection listens again on a new one and logs that events may have been missed. A live page that reconnects with an event id its process never gave (another web process's, or one from before a restart) is now told to reload instead of waiting for newer ids. In the conflict resolver, choices and landings cross processes; who is present stays per process. See docs/roles.md.

- **Run the hub as web and worker processes (#272):** `oxygenhub serve --role web,worker` (or `[server] roles`, `OXYHUB_SERVER_ROLES`; both by default, so one process works as before). A web process serves pages, the API, the wire protocol and the runner API; a worker runs the background tasks and serves only `/health` and `/metrics`. On PostgreSQL each singleton task (Flow's scheduler, reaper and placement pass, webhooks, nightly upkeep, backups, Diffusion's index, the log's checkpointer) runs in one process at a time under an advisory lock, and another takes it over within seconds when that process stops or loses its connection. `/health` reports the process's `roles` and the locks it is `leading`. Until the transparency log has a cluster-wide writer (#274), run one web process per data directory. See docs/roles.md.

- **Repositories kept in a bucket need far fewer requests (oxygen#116):** the hub reads a repository's signatures and index entries from a journal and entry lists instead of a LIST per lookup, and stops asking for the old one-list keys once its nightly gc has folded them. Another writer's new entry is seen within 30 seconds. Every writer of a bucket repository should run oxy 0.5.0 or later: until it does, entries it writes after the first fold are seen only after the next nightly gc.

- **Push protection (#268):** the hub refuses a push that adds what looks like a credential (cloud keys, GitHub, GitLab and OxygenHub tokens, Slack and Stripe keys, private keys; rules v1), naming each by file, line and a fingerprint, never the secret itself, and saying how to take it out (`oxy amend`) and to revoke it if real. Nothing of a refused push is stored. A maintainer can allow one fingerprint with a reason (Settings › Push protection, audited); the setting is on for every repository and can be turned off there. Only what a push adds is scanned, within `[limits] scan_limit` (16 MiB), `scan_file_limit` (1 MiB) and `scan_time_ms` (2 s); a push past them is accepted and its push log says how much went unscanned. Existing history is not scanned yet.

- **Land when checks pass, or land now over them (#261):** anyone who may land a proposal can set it to land by itself, on the proposal, through `POST`/`DELETE …/proposals/{n}/auto-land` or with `oh proposal land N --when-ready` (`--off` to clear it). Once every required check has passed and nothing else blocks it, it lands as the person who set it, if they may still land. A required check that fails or is cancelled turns it off with a note on the timeline; a push to the source makes it wait again. When required checks are the only thing in the way (pending, or failed with the runners down), a maintainer may land now with a reason: on the proposal, with `{"over_checks": "reason"}` on the API's land, or `oh proposal land N --over-checks REASON`. Only the checks are passed over; approvals, code owners, requested changes, drafts, dependencies and the trust policy still apply. Both are audited, and the proposal, its timeline and the pushes page say how it landed.

- **The repository bar has an Artifacts menu and a More menu (#254):** the bar is now Code, Changes, Proposals, Issues, Flow, Releases, Wiki, Artifacts, More and Settings, and no longer wraps. Artifacts holds Releases, Build artifacts (every run's outputs in one list, new), Images (the runner images the repository's jobs used, new), Terraform state and Reports; More holds Bookmarks, Tags, Diffusion, Trust, Pushes and Conflicts. Projects leaves the bar (it is on the site band and every profile). The menus work without JavaScript.

- **The hub keeps Terraform and OpenTofu state (#252, #255):** an HTTP backend per repository at `/api/v1/repos/OWNER/NAME/terraform/state/STATE`, with locking. A job uses it with an identity token for `{base}/terraform` or its job token, for its own repository only; people use a token of theirs and their role. State is sealed at rest and its last 20 versions are kept; backups carry it. The Terraform state page (under Artifacts) lists each state's versions; writers download the current state or any version as a `.tfstate` file, and maintainers restore one. A restore writes the version again with a serial above the current one, since OpenTofu and Terraform only take a state forward, and keeps the state it replaces as a version, so nothing is lost. Refused while the state is locked, never by a job, and audited.

- **Insights (#257):** OxygenFlow's charts for the site (`/admin/insights`, filtered by repository, owner or runner), an owner (`/insights/{owner}`) and a repository (`/{owner}/{name}/insights`): pickup time (median and p95), jobs finished and pass rate, duration, queued and running, runners online and slots busy, a runners table and the busiest repositories, over 1 hour, 24 hours or 7 days. The page refreshes itself every 30 seconds, and `?wall=1` is a view without menus for a second monitor. `[server] grafana_url` (`OXYHUB_SERVER_GRAFANA_URL`) adds an Open in Grafana link. `log`, `metrics` and `insights` are now reserved names.

- **Prometheus metrics (#212):** `/metrics` serves Prometheus text to a bearer of `[server] metrics_token` (`OXYHUB_SERVER_METRICS_TOKEN`); without one it is 404. It reports the build, uptime, memory, the state cache, bucket requests by kind, HTTP requests by route class with latency histograms, protocol bytes by endpoint, the database pool, pushes accepted and refused, Flow jobs and runs, runners' last heartbeats, backups, mail sent and failed, and the transparency log's size.

- **A transparency log (#238):** the hub logs every signed object it accepts (reference and tag attestations, seals, the policy, its acceptances, short-lived keys' certificates, kept receipts and sealed approvals) in one append-only Merkle tree, and signs a checkpoint every 5 seconds while entries arrive. The log is served as C2SP tlog-tiles under `/log/`, with a `/log` page. Every refs answer carries the latest checkpoint and each bookmark's entry with its inclusion proof, so oxy checks them on fetch. Hubs can witness each other's logs: `[tlog] witnesses` and `witness_for` in `hub.toml` (none by default, so nothing changes until set).

- **Trusted time (#240):** the hub keeps each cosigned checkpoint, lists its witnesses at `GET /log/witnesses` and in every refs answer, and serves for each logged bookmark the first cosigned checkpoints that hold its entry, from which oxy takes the integrated time: when a witness first saw it, by the witness's clock.

- **Agents act for their owner with no key (#241, #253):** an owner makes a grant with `oh agent grant NAME [--scope] [--for 30d]`, signed with their own oxy key; the hub keeps it and answers with the agent's token, shown once. The agent exchanges it at `POST /api/v1/keyless/certify` for ten-minute certificates, so its fresh keys' commits count in the owner's name, and the same token works for fetch, push and the API as an agent's token of the owner (writing when the grant allows). What the agent does is marked as its own and its owner is told. `oh agent list` and `oh agent revoke` manage grants, and a revoked grant gets no more certificates. When a push moves a bookmark with a short-lived key, the hub countersigns it with its own clock. Runners' receipts signed with keys this hub certified are kept, and a release's trust report counts them as known signers.

- **Approval gates (oxygenflow#57, #235):** a job whose pipeline asks for approval waits until someone with the role it names approves it on the run page, through the API, or with `oh run approve N --job NAME` (`oh run reject` to refuse). Everyone who may decide is notified once the job is ready. A rejected or expired job ends cancelled and the jobs after it are skipped. A gate that asks for a sealed approval (the default for a job with an environment) is released only by a signature of the approver's own key (`oxy seal --flow`), kept in the repository and named in the job's identity tokens.

- **Environments and deployments (oxygenflow#59):** a job's identity tokens name its environment only once the job is approved. `/{owner}/{name}/deployments` and `GET /api/v1/repos/{o}/{n}/deployments` show what each environment runs, who approved it, and the history.

- **Artifacts between jobs, and allow-listed egress (oxygenflow#58, oxygenflow#55):** a job's inputs come from the artifacts of a job it depends on in the same run, served to the runner holding it. A sandbox with `network "egress"` goes only to runners offering egress.

- **Flow priorities (#244):** runners take queued jobs by level first (urgent, high, normal, low), then by turn, so repositories take turns instead of one repository's burst holding everyone. The level comes from the run when expedited, else the repository (Settings › OxygenFlow), else the organisation, else the site. A maintainer can expedite a queued or running run to urgent with a reason; at most 2 expedited runs per owner go at once unless Admin › Runners › Settings says otherwise. A pipeline may lower its own jobs with `priority "low"`, never raise them.

- **Runners show Connectivity and Status apart (#243):** Admin › Runners shows whether a runner is online (when the hub last heard from it) apart from what it is doing (disabled, draining, idle, or running N of M). A busy runner sends a heartbeat, so a quiet job no longer shows it offline. The queue filters by repository, status and runner, and shows when each job started.