Oxygenhub plan

Milestones from docs/spec.md §19. Each item is checked when its tests pass, clippy is clean, and the change is committed with oxy.

0.1 Browse (2026-09-27)

• Workspace: crates/hub (binary), crates/hub-api (API types), askama templates, vendored fonts, one stylesheet from the RetroPlay theme.
• Configuration (hub.toml + OXYHUB_*), SQLite with embedded migrations (repositories, pushes).
• Repository registry: bare, unbound-by-default repositories under <data>/repos/<owner>/<name>, per-repository read/write locks, trash on delete.
• Embedded wire protocol with visibility and push-token authorisation and a push log.
• Pages: home, owner, overview (tree, README, clone, bookmarks, tags, trust badge, heads and conflict strips), tree, file (highlighting, Markdown, images, raw, blame), history with the dependency graph and path filter, change with diff and dependencies, compare, bookmarks, tags, conflicts, trust, pushes.
• JSON API: repositories, bookmarks, tags; /health; /.well-known/oxyhub-key.
• CLI: init (keys, self-signed TLS), serve (HTTP and HTTPS), admin repo create|list|delete|set, check.
• Tests: unit tests per module and an end-to-end test that pushes with a real oxy-core client and fetches every page.
• Oxygen changes it needed (in the Oxygen plan, phase 4): bare repositories, embeddable server, unbound repositories, adoption of anonymous changes by seals, oxy seal.
• Developer edition running on Earth with oxygen, oxygen-vscode and oxygenhub hosted (docs/deploy.md).

0.2 Accounts and access (2026-09-27)

• Schema: accounts, organisations, members, teams, collaborators, tokens, identities, challenges, invitations, settings, audit; pushes carry the pusher.
• Passwords (Argon2id), signed session cookie bound to a per-account salt, CSRF tokens on every form, same-origin check on every non-GET request, TOTP with recovery codes, sign out everywhere.
• Registration modes (open, invite, closed; first account is the administrator), invitations, admin page (accounts, ban, promote, registration mode, audit log).
• Roles: owner and site admin → admin; organisation owners → admin, members → the organisation's default role; collaborators (accounts and teams) → their role; visibility public/internal/private decides the anonymous and signed-in floor. A repository the viewer may not read is a 404 everywhere, including the protocol.
• Personal access tokens: hashed, scoped (repo:read, repo:write, repo:admin, user:read), optionally limited to repositories, with expiry; the protocol checks role and scope; site tokens from hub.toml remain for bootstrapping.
• Linked identities: upload oxy identity export, sign the challenge with oxy identity sign-challenge, verified with verify_challenge; authors whose key is linked show as accounts on history, change and compare pages.
• Pages: sign in, register, profile, security, keys, tokens, new repository, repository settings (general, collaborators, delete), organisation settings (members, teams), admin.
• CLI: admin user create|reset-password|list.
• Tests: tests/accounts.rs drives the whole flow through the router and the wire protocol.
• Email verification and password reset by email (needs SMTP, hub 0.4 with notifications).
• Passkeys (1.0).

Later

• 0.3 proposals and review · 0.4 issues and notifications · 0.5 API, webhooks, checks · 0.6 web edits, releases, mirror · 0.7 runner · 1.0 hardening.

Notes

• State caching (spec §16.3): repos::cache::StateCache, a bounded LRU of loaded states keyed by repository id and heads, shared across threads since State became Send + Sync. Measured on the oxygen repository (90 changes): overview 154 ms cold and under 2 ms warm, history 25 ms, tree under 1 ms. Rendered-page and syntax-highlight caches are still to do. <<<<<<< oxy conflict 1 of 1, side 1 of 2: deleted by change 138969c8 "State cache keyed by heads; history and graph through oxy-core's lanes and log window"

• State holds Rc values, so a cross-thread cache needs a Send snapshot type in oxy-core first. ======= oxy conflict 1 of 1, side 2 of 2: change a8a6b660 "Push log records states, heads and change counts from the push report"

The cross-product order of work is in oxygen/docs/roadmap.md.

oxy conflict 1 of 1 end