| #1069 |
submit_workflow ignores queue= when the process already has a JumperClient: platform workflows meant for highway_internal run on highway_default; tenant onboarding fails at create_rate_limits
EARS SPEC:
- When submit_workflow is called with queue=Q, the engine shall create the workflow_run w...
|
closed |
critical |
2026-10-25 06:09 |
- |
|
| #1060 |
openai_compat drops reasoning_content: DeepSeek thinking mode rejects every multi-turn tool call; agent runs on prism fail after the first tool call
EARS SPEC:
- When a provider response carries reasoning_content (or reasoning) on an assistant messa...
|
closed |
critical |
2026-10-23 23:10 |
- |
|
| #1056 |
Manual deploy of a5d4f45 to vm-1 (director-approved stopgap until CI G15)
EARS SPEC:
- When the director approves a manual deploy (2026-10-23), the operator shall build highw...
|
in-progress |
critical |
2026-10-23 22:41 |
- |
|
| #1032 |
T0 (#931): agent/session/trigger/automation/agent-run and Gmail/Telegram routes have no permission check; idempotency reset routes delete across tenants
EARS SPEC:
- When a caller who is not a member of tenant T with the required permission calls any /a...
|
in-progress |
critical |
2026-10-20 06:58 |
- |
|
| #1014 |
tools.workflow.spawn takes tenant_id from a workflow variable; definition lookups by name/id are not tenant-scoped
EARS: tools.workflow.spawn shall submit the child under ctx.tenant_id only. get_latest_definition an...
|
in-progress |
critical |
2026-10-20 02:52 |
- |
|
| #1008 |
POST /api/v1/dsl_to_json executed caller Python on the API container (AST blocklist only)
EARS SPEC:
- When POST /api/v1/dsl_to_json converts Python DSL, the API shall run the code only in t...
|
open |
critical |
2026-10-20 02:38 |
- |
|
| #1005 |
Tenant workflows can run internal.* tools: the submit-time internal tool block is never called
EARS SPEC:
- If a workflow submitted through POST /api/v1/workflows (or any tenant-facing submit pat...
|
in-progress |
critical |
2026-10-20 02:26 |
- |
|
| #991 |
CRITICAL: {{ENV.<name>}} in workflow templates returns any worker environment variable (DB_PASSWORD, JWT secret, encryption keys, Vault admin token)
EARS SPEC:
- The variable resolver shall not resolve any reference to the worker process environment...
|
open |
critical |
2026-10-20 01:11 |
- |
|
| #955 |
ALL_OF JoinOperator lets the workflow continue when join_satisfied=false
EARS: If an ALL_OF join has a failed or missing branch, then the engine shall not run the join's dep...
|
closed |
critical |
2026-10-17 00:50 |
- |
|
| #949 |
Postgres password is the literal 'postgres'; rotate and stop sharing the superuser across services
EARS: No service shall connect to PostgreSQL with a default or repo-visible password; the superuser ...
|
closed |
critical |
2026-10-16 01:55 |
- |
|
| #947 |
highway-postgres OOM-killed inside its 4GiB cgroup (crash recovery, in-flight tasks failed)
EARS: The database container shall not be OOM-killed under the engine's maximum connection budget pl...
|
closed |
critical |
2026-10-16 01:26 |
- |
|
| #945 |
Tenant-published app source escapes restricted builtins: root + docker.sock in worker
EARS: When a workflow task runs a tenant-published app action, the engine shall execute the app sour...
|
open |
critical |
2026-10-16 01:22 |
- |
|
| #942 |
with_rate_limit executes a failing tool TWICE (tool exception caught by limiter fail-open branch)
EARS SPEC:
- When a rate-limited tool raises an exception after the rate-limit check passed, the dec...
|
closed |
critical |
2026-10-16 00:19 |
- |
|
| #940 |
tools.python.run imports and calls any importable module.function on the worker
EARS: If a workflow task names a function for tools.python.run, the engine shall only import and cal...
|
closed |
critical |
2026-10-16 00:05 |
- |
|
| #939 |
tools.shell.run can drive the docker CLI over the mounted docker.sock, bypassing the #914 docker policy gate
EARS: If a workflow task runs a shell command, it shall not be able to reach the Docker daemon. Work...
|
closed |
critical |
2026-10-15 23:43 |
- |
|
| #936 |
Every LLM route is dead: agent route models retired/unpaid, DeepSeek key empty
EARS SPEC:
- Every route in [llm.routes] and default_route shall contain at least one model that ans...
|
closed |
critical |
2026-10-15 23:35 |
- |
|
| #915 |
P0b: Shell sandbox on by default, fail closed, remove ${PWD} worker mount
EARS SPEC:
- The engine shall run tools.shell.run inside the sandbox by default ([sandbox] enabled=t...
|
closed |
critical |
2026-10-15 23:07 |
- |
|
| #914 |
P0a: DockerPolicy gate for all docker tools (privileged/devices/cap_add/bind/host ns/foreign networks; tenant label ownership)
EARS SPEC:
- If a docker tool call requests privileged, devices, cap_add, a host bind mount, pid/ipc...
|
closed |
critical |
2026-10-15 23:07 |
- |
|
| #851 |
Vault token VAULT_TOKEN_ADMIN is invalid - OIDC/SSO sign-in and circuit-breaker API are down in production
EARS SPEC:
- When the Highway API cannot authenticate to Vault, the /api/v1/health circuit_breaker_d...
|
open |
critical |
2026-08-22 01:50 |
- |
|
| #844 |
circuit-breakers 503: Vault password for resilient_circuit_db never applied to the postgres role
EARS SPEC:
- When GET /api/v1/circuit-breakers is called by an authorized caller, the Highway API sh...
|
closed |
critical |
2026-08-03 16:44 |
- |
|