Edit Issue - .issue.db

Title *

Description

EARS SPEC:
- The API shall not serve DELETE /api/v1/storage/<ref> or GET /api/v1/storage/<ref>/url; /storage/files/* keeps serving with its current permissions.
- When tools.storage creates an upload request, the link it returns shall be built from the public base URL ([api] public_base_url, https://highway.rodmena.app in prod), never from the internal http://api:7822.
- When a person opens the upload link and uploads a file within its expiry, the waiting workflow shall resume with the stored file reference; an expired, used or cancelled token shall be refused with a clear error and the workflow shall not resume.
- POST /api/v1/uploads/<token>/cancel shall require proof of possession of the token's cancel secret (or the link holder's token), never be callable by anyone who only guesses a path.
- The nginx route for /u/ is host config owned by infra-manager: the exact location block shall be handed to them over AgentBus; Highway does not edit host nginx.
Owner decision 2026-10-22: fix uploads, do not drop the feature. Parent #931.

Due Date (YYYY-MM-DD)

Tags (comma separated)

Related Issues (IDs)

Enter IDs of issues related to this one. They will be linked as 'related'.

Edit Issue #1042