Oxygenhub plan

Milestones from docs/spec.md §19. Each item is checked when its tests pass, clippy is clean, and the change is committed with oxy.

0.1 Browse (2026-09-27)

• Workspace: crates/hub (binary), crates/hub-api (API types), askama templates, vendored fonts, one stylesheet from the RetroPlay theme.
• Configuration (hub.toml + OXYHUB_*), SQLite with embedded migrations (repositories, pushes).
• Repository registry: bare, unbound-by-default repositories under <data>/repos/<owner>/<name>, per-repository read/write locks, trash on delete.
• Embedded wire protocol with visibility and push-token authorisation and a push log.
• Pages: home, owner, overview (tree, README, clone, bookmarks, tags, trust badge, heads and conflict strips), tree, file (highlighting, Markdown, images, raw, blame), history with the dependency graph and path filter, change with diff and dependencies, compare, bookmarks, tags, conflicts, trust, pushes.
• JSON API: repositories, bookmarks, tags; /health; /.well-known/oxyhub-key.
• CLI: init (keys, self-signed TLS), serve (HTTP and HTTPS), admin repo create|list|delete|set, check.
• Tests: unit tests per module and an end-to-end test that pushes with a real oxy-core client and fetches every page.
• Oxygen changes it needed (in the Oxygen plan, phase 4): bare repositories, embeddable server, unbound repositories, adoption of anonymous changes by seals, oxy seal.
• Developer edition running on Earth with oxygen, oxygen-vscode and oxygenhub hosted (docs/deploy.md).

0.2 Accounts and access (2026-09-27)

• Schema: accounts, organisations, members, teams, collaborators, tokens, identities, challenges, invitations, settings, audit; pushes carry the pusher.
• Passwords (Argon2id), signed session cookie bound to a per-account salt, CSRF tokens on every form, same-origin check on every non-GET request, TOTP with recovery codes, sign out everywhere.
• Registration modes (open, invite, closed; first account is the administrator), invitations, admin page (accounts, ban, promote, registration mode, audit log).
• Roles: owner and site admin → admin; organisation owners → admin, members → the organisation's default role; collaborators (accounts and teams) → their role; visibility public/internal/private decides the anonymous and signed-in floor. A repository the viewer may not read is a 404 everywhere, including the protocol.
• Personal access tokens: hashed, scoped (repo:read, repo:write, repo:admin, user:read), optionally limited to repositories, with expiry; the protocol checks role and scope; site tokens from hub.toml remain for bootstrapping.
• Linked identities: upload oxy identity export, sign the challenge with oxy identity sign-challenge, verified with verify_challenge; authors whose key is linked show as accounts on history, change and compare pages.
• Pages: sign in, register, profile, security, keys, tokens, new repository, repository settings (general, collaborators, delete), organisation settings (members, teams), admin.
• CLI: admin user create|reset-password|list.
• Tests: tests/accounts.rs drives the whole flow through the router and the wire protocol.
• Email verification and password reset by email (needs SMTP, hub 0.4 with notifications).
• Passkeys (1.0).

0.3 Proposals and review (2026-09-27)

• Schema: proposals with a per-repository number space shared with issues, comments (atom anchored), reviews, events; landing requirements on repositories.
• Projection (repos/proposals.rs): union of the target's heads and the source (bookmark, fork with objects copied from the fork's store, or explicit changes), the changes added, the diff and the conflicts the landing would carry, recomputed on every view and remembered for lists, the API and stacking.
• Comments anchored to atoms: a line comment records (change, index); it is placed at the atom's current line, or listed as outdated when the line is gone.
• Reviews: comment, request changes, approve; an approval counts when the reviewer's linked key has sealed every change (oxy seal --proposal URL, pushed on its own with push_seals); no self-approval.
• Requirements: sealed approvals, code owners from .oxyowners, conflicts refused unless allowed, outstanding change requests, drafts, stacking on earlier open proposals.
• Landing: from the hub when the repository has no policy; otherwise the page gives oxy proposal land URL, which fetches the projection, sets the bookmark and pushes with the user's key. A proposal whose changes all reach the target by any route is marked landed.
• Pages: list with counts, new with preview, detail with conversation, changes and files tabs; JSON API for proposals used by oxy proposal show|land and oxy seal --proposal.
• Tests: tests/proposals.rs covers bookmark and fork sources, anchoring, approval before and after sealing, requirements, landing.
• Notifications for review requests, mentions and landings (0.4).
• Hub-side landing under a policy through the delegate key (needs the attestation delegate rule in oxy, see spec §18).

Later

• 0.4 issues and notifications · 0.5 API, webhooks, checks · 0.6 web edits, releases, mirror · 0.7 runner · 1.0 hardening.

Notes

• State caching (spec §16.3): repos::cache::StateCache, a bounded LRU of loaded states keyed by repository id and heads, shared across threads since State became Send + Sync. Measured on the oxygen repository (90 changes): overview 154 ms cold and under 2 ms warm, history 25 ms, tree under 1 ms. Rendered-page and syntax-highlight caches are still to do. <<<<<<< oxy conflict 1 of 1, side 1 of 2: deleted by change 138969c8 "State cache keyed by heads; history and graph through oxy-core's lanes and log window"

• State holds Rc values, so a cross-thread cache needs a Send snapshot type in oxy-core first. ======= oxy conflict 1 of 1, side 2 of 2: change a8a6b660 "Push log records states, heads and change counts from the push report"

The cross-product order of work is in oxygen/docs/roadmap.md.

oxy conflict 1 of 1 end