| #1069 |
submit_workflow ignores queue= when the process already has a JumperClient: platform workflows meant for highway_internal run on highway_default; tenant onboarding fails at create_rate_limits
EARS SPEC:
- When submit_workflow is called with queue=Q, the engine shall create the workflow_run w...
|
closed |
critical |
2026-10-25 06:09 |
- |
|
| #1068 |
Retire Highway copilot (copilot.highway.rodmena.app code completion)
EARS SPEC:
- When a client requests copilot.highway.rodmena.app after retirement, the edge shall ans...
|
closed |
medium |
2026-10-25 06:03 |
- |
|
| #1067 |
Remove dead S3/MinIO and SMTP-era host pins: compose extra_hosts s3.rodmena.co.uk and mail.rodmena.co.uk, docker/.env S3_*, stale host /etc/highway/config.ini
EARS SPEC:
- The Highway containers shall not pin s3.rodmena.co.uk or mail.rodmena.co.uk in extra_ho...
|
closed |
medium |
2026-10-25 02:31 |
- |
|
| #1066 |
highway_dsl on ci.rodmena.co.uk: uv.lock, .rodmena/ci.yml; GitHub publish workflow removed
EARS SPEC:
- When a commit is pushed to rodmena-limited/highway_dsl main or a pull request is opened...
|
open |
medium |
2026-10-25 01:05 |
- |
|
| #1065 |
LLM usage records $0 for prism/deepseek-v4-flash: no PRICING entry for provider prism
EARS SPEC:
- When an LLM call is served by provider prism, the engine shall record a non-zero estima...
|
open |
medium |
2026-10-25 01:01 |
- |
|
| #1064 |
Retire the highway-dsl generator (dsl-generator.service, dsl.rodmena.app, dsl.mcp.highway.rodmena.app) and its clients
EARS SPEC:
- The dsl-generator service on vm-1 shall not run and shall not start at boot.
- When a c...
|
closed |
high |
2026-10-25 00:59 |
- |
|
| #1063 |
highway-dsl generator (vm-1 dsl-generator.service): clear provenance findings brotli, certifi, werkzeug, setuptools
EARS SPEC:
- The dsl-generator venv (highway_dsl/app/.venv-uv313) shall contain no package version w...
|
closed |
high |
2026-10-24 22:59 |
- |
|
| #1062 |
llm_routes health probe is single-turn: a provider that fails multi-turn tool calls stays green
EARS SPEC:
- The llm_routes health probe shall, for each candidate, send a two-turn tool-call exchan...
|
open |
high |
2026-10-24 00:16 |
- |
|
| #1061 |
Live checkers out of date after #1041/#1013/#977: retarget or delete stale probes
EARS SPEC:
- Every live checker named in SPECS/deploy-first-ci-build.md step 5 shall probe only rout...
|
open |
medium |
2026-10-23 23:14 |
- |
|
| #1060 |
openai_compat drops reasoning_content: DeepSeek thinking mode rejects every multi-turn tool call; agent runs on prism fail after the first tool call
EARS SPEC:
- When a provider response carries reasoning_content (or reasoning) on an assistant messa...
|
closed |
critical |
2026-10-23 23:10 |
- |
|
| #1059 |
Embedded auth tables have no row level security: auth 3.5.1 apply_tenant_rls() not present in highway_db_v2
EARS SPEC:
- While Highway embeds the auth library, the auth_rbac tables shall have RLS enabled and ...
|
open |
high |
2026-10-23 23:05 |
- |
|
| #1058 |
Public workflow error reports max_attempts from the run budget, not the failing step's retry budget
EARS SPEC:
- When a step fails, the public workflow error shall report attempts and max_attempts of ...
|
open |
medium |
2026-10-23 23:05 |
- |
|
| #1057 |
Sandbox shell: stderr log read 409 (container dead or marked for removal) fails the user step
EARS SPEC:
- If the sandbox container's logs cannot be read because the container is being removed a...
|
open |
high |
2026-10-23 23:05 |
- |
|
| #1056 |
Manual deploy of a5d4f45 to vm-1 (director-approved stopgap until CI G15)
EARS SPEC:
- When the director approves a manual deploy (2026-10-23), the operator shall build highw...
|
in-progress |
critical |
2026-10-23 22:41 |
- |
|
| #1055 |
SensitiveDataFilter card pattern masks UUIDs in logs (run/app ids lost from audit logs)
EARS SPEC:
- If a log message or argument contains a UUID (8-4-4-4-12 hex), then the SensitiveDataFi...
|
closed |
high |
2026-10-23 21:05 |
- |
|
| #1054 |
First CI runs with submodules: mypy ratchet regressions (132 vs 118) and engine secret-owner test under root without CAP_DAC_OVERRIDE
EARS SPEC:
- When the mypy ratchet finds a file over its baseline, the ratchet shall print every myp...
|
open |
high |
2026-10-23 20:37 |
- |
|
| #1053 |
CI red on 16720f9: size allowlist stale after #1041, gitleaks tracked-tree findings unnamed
EARS SPEC:
- The size gate shall pass on main: allowlist entries equal current line counts (api/test...
|
in-progress |
high |
2026-10-23 15:20 |
- |
|
| #1052 |
Adopt auth 3.5.0 check_schema in place of Highway's own column check
EARS SPEC:
- The highway lock shall install auth==3.5.0 (wheel sha256 3e0a7ba8e7ebdce1d8095691fe88de...
|
in-progress |
medium |
2026-10-23 02:40 |
- |
|
| #1051 |
Permission checks that run on the api event loop can block it for up to POOL_TIMEOUT with a 1-connection auth pool
EARS SPEC:
- The api shall run every synchronous auth library call (Authorization reads and writes) ...
|
open |
high |
2026-10-22 23:12 |
- |
|
| #1050 |
Adopt auth row level security in auth_rbac (creator_fp + tenant_isolation policies) or record why not
EARS (draft):
- Highway shall decide whether to apply auth's creator_fp and RLS migrations (auth rep...
|
open |
medium |
2026-10-22 23:11 |
- |
|