# Oxygenhub plan

Milestones from `docs/spec.md` §19. Each item is checked when its tests

pass, clippy is clean, and the change is committed with `oxy`.

## 0.1 Browse (2026-09-27)

- [x] Workspace: `crates/hub` (binary), `crates/hub-api` (API types), askama templates, vendored fonts, one stylesheet from the RetroPlay theme.

- [x] Configuration (`hub.toml` + `OXYHUB_*`), SQLite with embedded migrations (`repositories`, `pushes`).

- [x] Repository registry: bare, unbound-by-default repositories under `<data>/repos/<owner>/<name>`, per-repository read/write locks, trash on delete.

- [x] Embedded wire protocol with visibility and push-token authorisation and a push log.

- [x] Pages: home, owner, overview (tree, README, clone, bookmarks, tags, trust badge, heads and conflict strips), tree, file (highlighting, Markdown, images, raw, blame), history with the dependency graph and path filter, change with diff and dependencies, compare, bookmarks, tags, conflicts, trust, pushes.

- [x] JSON API: repositories, bookmarks, tags; `/health`; `/.well-known/oxyhub-key`.

- [x] CLI: `init` (keys, self-signed TLS), `serve` (HTTP and HTTPS), `admin repo create|list|delete|set`, `check`.

- [x] Tests: unit tests per module and an end-to-end test that pushes with a real `oxy-core` client and fetches every page.

- [x] Oxygen changes it needed (in the Oxygen plan, phase 4): bare repositories, embeddable server, unbound repositories, adoption of anonymous changes by seals, `oxy seal`.

- [ ] Developer edition running on Earth with `oxygen`, `oxygen-vscode` and `oxygenhub` hosted (docs/deploy.md).

## 0.2 Accounts and access (2026-09-27)

- [x] Schema: accounts, organisations, members, teams, collaborators, tokens, identities, challenges, invitations, settings, audit; pushes carry the pusher.

- [x] Passwords (Argon2id), signed session cookie bound to a per-account salt, CSRF tokens on every form, same-origin check on every non-GET request, TOTP with recovery codes, sign out everywhere.

- [x] Registration modes (open, invite, closed; first account is the administrator), invitations, admin page (accounts, ban, promote, registration mode, audit log).

- [x] Roles: owner and site admin → admin; organisation owners → admin, members → the organisation's default role; collaborators (accounts and teams) → their role; visibility public/internal/private decides the anonymous and signed-in floor. A repository the viewer may not read is a 404 everywhere, including the protocol.

- [x] Personal access tokens: hashed, scoped (`repo:read`, `repo:write`, `repo:admin`, `user:read`), optionally limited to repositories, with expiry; the protocol checks role and scope; site tokens from `hub.toml` remain for bootstrapping.

- [x] Linked identities: upload `oxy identity export`, sign the challenge with `oxy identity sign-challenge`, verified with `verify_challenge`; authors whose key is linked show as accounts on history, change and compare pages.

- [x] Pages: sign in, register, profile, security, keys, tokens, new repository, repository settings (general, collaborators, delete), organisation settings (members, teams), admin.

- [x] CLI: `admin user create|reset-password|list`.

- [x] Tests: `tests/accounts.rs` drives the whole flow through the router and the wire protocol.

- [ ] Email verification and password reset by email (needs SMTP, hub 0.4 with notifications).

- [ ] Passkeys (1.0).

## Later

- 0.3 proposals and review · 0.4 issues and notifications · 0.5 API, webhooks, checks · 0.6 web edits, releases, mirror · 0.7 runner · 1.0 hardening.

## Notes

- State caching (spec §16.3): `repos::cache::StateCache`, a bounded LRU of loaded states keyed by repository id and heads, shared across threads since `State` became `Send + Sync`. Measured on the `oxygen` repository (90 changes): overview 154 ms cold and under 2 ms warm, history 25 ms, tree under 1 ms. Rendered-page and syntax-highlight caches are still to do.

<<<<<<< oxy conflict 1 of 1, side 1 of 2: deleted by change 138969c8 "State cache keyed by heads; history and graph through oxy-core's lanes and log window"

-------

- `State` holds `Rc` values, so a cross-thread cache needs a `Send` snapshot type in `oxy-core` first.

======= oxy conflict 1 of 1, side 2 of 2: change a8a6b660 "Push log records states, heads and change counts from the push report"

The cross-product order of work is in `oxygen/docs/roadmap.md`.

>>>>>>> oxy conflict 1 of 1 end