Version control, a forge and CI, designed together

Version control you can verify.

Oxygen records every change as a signed, commutative patch, keeps conflicts as part of history instead of a mess to clean up, and builds in sandboxes that leave a signed receipt. It runs on your own machines, in your own country, and proves what it did.

Explore OxygenHub Get oxy

$ oxy clone https://oxygenhub.io/andymccall/oxygen
$ oxy commit -m "Retry the upload"
$ oxy push
✔ Pushed origin/main · sealed by your key · logged

Three parts, one system

oxy Oxygen

The version control system. Changes commute, so they apply in any order and reach the same result: no rebasing, and a proposal never goes stale.

Conflicts are recorded in history and resolved once, by a change anyone can fetch.
Every change is signed, with Ed25519 and the post-quantum ML-DSA-65 together.
Imports and exports Git history, commit by commit.
Keeps repositories on disk or in your own S3 or Google Cloud Storage buckets.

oh OxygenHub

The forge, self-hosted or at oxygenhub.io: repositories, proposals and reviews, issues and boards, releases.

Approvals are sealed with the reviewer's key, so a landing proves who agreed.
Every reference update goes into a transparency log, cosigned by independent witnesses.
Agents work under grants you can revoke, signing with ten-minute keys, never stored ones.
A command line, Visual Studio Code extensions and an Android app.

flow OxygenFlow

The pipeline runner. Jobs run with no network unless they name the hosts they need, from images pinned by hash.

Three sandboxes: Firecracker microVMs, system-call filtering, and WebAssembly.
Runners on Linux (x86_64, Arm and RISC-V), Windows, and Android phones.
Each job leaves a signed receipt naming its inputs, image and outputs.
Runners update themselves, in test groups first, and roll back on their own.

Why another version control system?

Git records snapshots and leaves merging to tools and people. Every rebase rewrites history, every conflict is solved again on the next merge, and nothing proves who wrote what unless everyone signs everything by hand.

Oxygen starts from the other end. A change is a patch with a stable identity, so applying it twice or in another order changes nothing. History is never rewritten. Signing is the default, checked on every push, and recorded where anyone can audit it.

Commutative: Changes apply in any order; proposals never go stale.
Conflicts kept: Recorded, built on, resolved once for everyone.
Signed: Classical and post-quantum signatures on every change.
Logged: A witnessed transparency log of every update.
Hermetic: Builds with no network, from pinned images.

Sovereign by design

Your source, your keys, your builds, in your jurisdiction. Oxygen has no service it must call home to.

Host it where you must

Run OxygenHub and its runners on your own hardware or cloud account, in the UK or wherever your data has to stay. Storage can be your own buckets.

Prove what happened

Signed changes, sealed approvals, build receipts and a witnessed log let an auditor check the history without trusting the server that holds it.

Keep builds in

Jobs reach the network only through hosts you allow, every decision logged, so a build cannot quietly fetch or send what it should not.

Where it is today

Oxygen is young and moving fast, ahead of a 1.0 release. It is built with itself: its source lives on OxygenHub, every push is tested by OxygenFlow on our own runners, and every release is signed and logged. Try it at oxygenhub.io, or install oxy and oh from the releases page or the apt repository there.