>_
.issue.db
/highway
Dashboard
Issues
Memory
Lessons
Audit Log
New Issue
Edit Issue #1041
Update issue details
Title *
Description
EARS SPEC: - The Highway API shall not serve the T1 routes (/api/v1/../u/<token>, shadowed version.get_version, POST /schedules/scan, POST /apps/cache/clear, POST /apps/<id>/reload, POST /circuit-breakers/reset, /static/*, /favicon.ico, /ping), the 31 T2 inspection/analytics pairs, or the 5 T6 /admin/tokens* pairs listed in SPECS/931-route-classification.md; each shall answer 404 (or 405 where a sibling method on the same path survives). - If a bearer token minted by the removed /admin/tokens flow is presented, then the API shall reject it with 401 exactly as any unknown token; hw_k1_ keys and OIDC sessions shall keep authenticating (D5). - Every route not in T1/T2/T6 shall keep its method set and permission (route permission guard test #1032 stays green; the route table diff contains only the removed pairs). - Tests that targeted removed routes shall be retargeted to a surviving route or deleted, with the reason recorded. - HEAD on /api/v1/health and every surviving liveness route shall keep the GET semantics. Owner approved T1, T2, T6 on 2026-10-22. Parent #931. Dashboard callers (lib/api/system.ts cache reset, lib/api/admin.ts tokens UI) are told over AgentBus before deploy.
Priority
Low
Medium
High
Critical
Status
Open
In Progress
Closed
Won't Do
Due Date (YYYY-MM-DD)
Tags (comma separated)
Related Issues (IDs)
Enter IDs of issues related to this one. They will be linked as 'related'.
Update Issue
Cancel