| #260 |
CRITICAL: OAuth login allows any Google user to get JWT without tenant membership
## Security Vulnerability
### Problem
OAuth login generates JWT for ANY Google user with any tenant...
|
closed |
critical |
2025-12-04 18:51 |
- |
|
| #259 |
Implement Platform Tenant (_platform) for super admin access
## Overview
Implement a special '_platform' tenant that serves as the administrative domain for plat...
|
closed |
critical |
2025-12-04 18:17 |
- |
|
| #249 |
[PHASE 1] Add RBAC Permissions to Critical Endpoints
Phase 1: Add @require_permission decorators to:
1. artifacts.py - manage_artifacts permission
2. app...
|
closed |
critical |
2025-12-04 09:22 |
- |
|
| #248 |
[CRITICAL] Security Audit: Missing RBAC Permission Checks on Multiple Endpoints
COMPREHENSIVE SECURITY AUDIT FINDINGS - See Phase 1 breakdown for fix plan
|
closed |
critical |
2025-12-04 09:22 |
- |
|
| #246 |
Activity worker should use LISTEN/NOTIFY instead of polling
Activity workers poll every 1s for new activities. Should use PostgreSQL LISTEN/NOTIFY like orchestr...
|
closed |
critical |
2025-12-03 20:51 |
- |
|
| #245 |
Activity worker should use BulkheadSync for parallel execution
Activity worker processes activities sequentially (1 at a time). Should use BulkheadSync like orches...
|
closed |
critical |
2025-12-03 20:30 |
- |
|
| #244 |
Critical: Activity worker holds DB connection for entire shell execution duration
## Problem
Activity worker holds a database connection checked out from the pool for the ENTIRE dur...
|
closed |
critical |
2025-12-03 15:53 |
- |
|
| #243 |
BUG: Workflow cancel doesn't kill shell child processes
When a workflow is cancelled, shell processes spawned by tools.shell.run are NOT terminated.
Curren...
|
open |
critical |
2025-12-03 15:27 |
- |
|
| #241 |
Highway MCP Server - Enable LLMs to Generate Workflows
# Highway MCP Server - Enable LLMs to Generate Workflows
## Overview
Create an MCP SERVER that exp...
|
open |
critical |
2025-12-03 06:37 |
- |
|
| #215 |
Replay: Add runtime determinism enforcement
## Problem
Determinism relies on developer discipline with no enforcement:
- Must use ctx.now instea...
|
closed |
critical |
2025-12-02 05:22 |
- |
|
| #214 |
Replay: Implement Compensation/Saga Pattern Support
## Problem
No mechanism to define compensating tasks for rollback scenarios.
## Industry Standard
T...
|
closed |
critical |
2025-12-02 05:22 |
- |
|
| #213 |
Replay: Add exception stacktrace to step_failed events
## Problem
The event_logger.log_step_failed() only stores error_message string, not full Python trac...
|
closed |
critical |
2025-12-02 05:22 |
- |
|
| #186 |
CRITICAL: TimeoutService infinite loop on race condition
TimeoutService enters infinite tight loop when race condition detected in _fail_single_run(). The wh...
|
closed |
critical |
2025-11-30 00:20 |
- |
|
| #175 |
LLM DSL Generator Testing - Comprehensive Validation
Parent ticket for comprehensive testing of the LLM DSL generator service (https://dsl.rodmena.app/)....
|
closed |
critical |
2025-11-29 22:00 |
- |
|
| #162 |
long running Kafka producer and client Python script
Context:
This enterprise workflow engine will be used to run massive durable workflows, like long r...
|
closed |
critical |
2025-11-29 02:57 |
- |
|
| #148 |
DSL prompt flag for CLI
we need `hwe dsl-prompt` command to stdout a proper comprehensive prompt how to generate valid highw...
|
closed |
critical |
2025-11-28 08:57 |
- |
|
| #143 |
CRITICAL: Risk of Double Execution due to Manual Heartbeating
Long-running tasks (> claim_timeout) are killed by other workers via claim_task logic if they do not...
|
closed |
critical |
2025-11-28 00:46 |
- |
|
| #142 |
CRITICAL: ParallelOperator is Fork-Only (Missing Join)
The ParallelOperator currently only spawns branch tasks and returns immediately (fork-only). There i...
|
closed |
critical |
2025-11-28 00:46 |
- |
|
| #141 |
[highway-api] API tokens need scoped permissions support
Currently API tokens only identify the user - permissions come from user's roles. Need to add scopes...
|
closed |
critical |
2025-11-27 21:17 |
- |
|
| #139 |
Fix login page confusion - use /login not /#/login
Two login pages exist causing confusion. Update /login to have API token option, remove /#/login rou...
|
closed |
critical |
2025-11-27 19:46 |
- |
|