| #1049 |
#1041 follow-ups: live checkers probe removed routes; orphaned permissions; per-key breaker reset /tmp flag; drop api_tokens table
EARS SPEC:
- scripts/verify_* live checkers (#911, #1014, #1020, #1025, #1028, #1032, api_input) sha...
|
open |
low |
2026-10-22 22:50 |
- |
|
| #1038 |
Drop unused tenant_client_keys.suspended_at
Since #908 the tenant state is status/deactivated_at/deactivated_by with the reason in suspended_rea...
|
open |
low |
2026-10-20 07:10 |
- |
|
| #1029 |
Pre-installed welcome_email app and api/app_templates welcome emails interpolate caller values into HTML unescaped
Found during #1018 sweep, not fixed there: enterprise/apps/pre_installed/welcome_email.py send (reci...
|
in-progress |
low |
2026-10-20 06:03 |
- |
|
| #1028 |
Permission check for an unknown tenant answers 500 'Permission check failed' instead of 403/404
Found during #1020 (live): GET /api/v1/analytics/queues?tenant_id=nosuchtenant1020 as admin@test: re...
|
in-progress |
low |
2026-10-20 06:03 |
- |
|
| #1004 |
mg verify fails on highway_db_v2: jumper_initial row has NULL checksum, parallel_join_counter applied with a pre-commit checksum
EARS: When mg verify runs on the merged migration set against highway_db_v2, it shall report no mism...
|
open |
low |
2026-10-20 02:04 |
- |
|
| #1002 |
Stale smtp_password refs (shared/mail) in 10 welcome_email/invitation_email installations; tenant app secret DELETE cannot remove a ref without a value
EARS: Installations shall not reference retired platform secrets; DELETE /api/v1/tenant/apps/<instal...
|
open |
low |
2026-10-20 01:42 |
- |
|
| #1000 |
Gmail and Telegram connect are not atomic (token write, installation upsert, integration row in separate transactions)
EARS: When a tenant connects Gmail or Telegram, the token write, the app installation upsert and the...
|
in-progress |
low |
2026-10-20 01:42 |
- |
|
| #996 |
get_system_health_summary calls __wrapped__ on undecorated health tools: every sub-check reports unhealthy
EARS: internal.health.get_summary shall report each sub-check's real result. FOUND in #924: enterpri...
|
in-progress |
low |
2026-10-20 01:19 |
- |
|
| #983 |
ruff 0.16.4: engine 28 and jumper 31 findings fail their CI lint; superproject 45 held by a ratchet; format drift in all three
EARS: ruff check and ruff format --check at the version in uv.lock shall report zero findings in hig...
|
in-progress |
low |
2026-10-20 00:47 |
- |
|
| #980 |
Workflow gate tenant is hardcoded to demo (scripts/testing/gate_helper.py)
EARS SPEC:
- Where the workflow gate is run, the operator shall be able to choose the tenant (defaul...
|
open |
low |
2026-10-20 00:46 |
- |
|
| #970 |
Split 8 code files over the 550-line cap that #855-#904 do not cover
EARS: Each tracked code file shall be at most 550 lines. Found by the #918 size gate (git ls-files -...
|
open |
low |
2026-10-20 00:29 |
- |
|
| #964 |
TokenGate client: per-process concurrency cap below TG's 24 per tenant
EARS: The sum of in-flight TokenGate calls across ALL Highway processes (api, worker x2, activity-wo...
|
closed |
low |
2026-10-17 01:01 |
- |
|
| #962 |
Split tests/unit/test_tool_rate_limiter.py (838 lines) below 500
EARS: test files shall stay under 500 lines.
|
closed |
low |
2026-10-17 00:50 |
- |
|
| #960 |
Branch runs log step_succeeded twice; step event results truncated to 200 chars as Python repr
EARS: Each step shall log exactly one step_succeeded event, and event payload results shall be JSON....
|
in-progress |
low |
2026-10-17 00:50 |
- |
|
| #953 |
rate_limits: limit_scope=workflow unsupported on TokenGate path (needs per-run subject + assignment)
EARS: If a rate limit uses limit_scope=workflow, then the API shall reject it (400 INVALID_SCOPE) an...
|
in-progress |
low |
2026-10-17 00:13 |
- |
|
| #934 |
Later: RunFlow replaces tools.docker.* after feature request delivered
EARS SPEC:
- When RunFlow ships the requested safe feature subset, tools.docker.run shall be version...
|
open |
low |
2026-10-15 23:07 |
- |
|
| #932 |
FastAPI migration (strangler, golden contract tests)
EARS SPEC:
- Each router migrated shall pass golden contract tests recorded from the served Quart AP...
|
open |
low |
2026-10-15 23:07 |
- |
|
| #832 |
Hardening batch: defensive guards + observability from the jumper/core audit (low severity)
Bundle of verified-low findings from the 2026-07-19 audit: (1) jumper schedule_run's TASK-table UPDA...
|
closed |
low |
2026-07-19 05:26 |
- |
|
| #778 |
Demo/research tenant Gmail token stale -> send fails ('Gmail token refresh failed'); offer SMTP fallback for agent email
run_goal research+email path works end-to-end (HITL approval + dispatch) but apps.platform.gmail.sen...
|
open |
low |
2026-06-29 01:53 |
- |
|
| #775 |
Converge the two ActivityWorker implementations (enterprise vs engine package)
Live worker is enterprise/services/activity_worker.py (hwe activity-worker). A parallel refactored i...
|
open |
low |
2026-06-29 00:40 |
- |
|