Issues [highway] - .issue.db

ID	Title	Status	Priority	Created	Due Date	Actions
#689	VAL-02: Missing dependency reference validation in DSL Location: highway_dsl/workflow_dsl.py build() method. Issue: Task dependencies referencing non-exist...	closed	critical	2025-12-25 02:55	-	Edit
#688	VAL-01: No circular dependency detection in workflow DSL Location: highway_dsl/workflow_dsl.py build() method. Issue: No cycle detection in task dependencies...	closed	critical	2025-12-25 02:55	-	Edit
#687	TXN-04: Checkpoint not persisted on retry failure paths Location: operators.py:304-309. Issue: Failed attempt checkpoints saved to ctx._checkpoints_cache (i...	closed	critical	2025-12-25 02:55	-	Edit
#686	TXN-03: Missing FOR UPDATE lock on run state transition Location: orchestrator.py:521-528. Issue: Run state transition from claimed to running uses simple U...	closed	critical	2025-12-25 02:55	-	Edit
#685	TXN-02: Race condition in rate limiter token consumption Location: tenant_rate_limiter.py:72-96. Issue: UPDATE with computation in WHERE clause without FOR U...	closed	critical	2025-12-25 02:55	-	Edit
#684	TXN-01: Rate limit lease uses separate connection causing token exhaustion Location: orchestrator.py:446-459. Issue: Rate limiter consume_with_lease uses its own committed tra...	closed	critical	2025-12-25 02:55	-	Edit
#683	SEC-03: Artifact download endpoint lacks authentication Location: api/blueprints/v1/artifacts.py:260. Issue: Artifacts can be downloaded by anyone who knows...	closed	critical	2025-12-25 02:55	-	Edit
#682	SEC-02: Pickle deserialization RCE vulnerability Location: engine/rag/assistant.py:116. Issue: pickle.loads() on data from database is an RCE vector....	closed	critical	2025-12-25 02:55	-	Edit
#678	Security: Isolate Python DSL compilation in sandboxed container CRITICAL SECURITY ISSUE: Python DSL code currently executes on API server with full access to databa...	closed	critical	2025-12-24 22:51	-	Edit
#670	CRITICAL: Branch tasks must not update parent workflow_run status Branch tasks were updating the parent workflow_run status to 'sleeping' even after the parent task h...	closed	critical	2025-12-24 03:30	-	Edit
#665	cancel_task() does not update workflow_run status AbsurdClient.cancel_task() updated absurd task to 'cancelled' but workflow_run.status was updated in...	closed	critical	2025-12-23 20:45	-	Edit
#664	workflow_run status not updated when task enters sleeping state When durable_cron workflow sleeps, absurd task state is 'sleeping' but workflow_run.status stayed 'r...	closed	critical	2025-12-23 20:45	-	Edit
#663	workflows which sent by (execute=False) doesn't show up in get workflows bug curl 'https://highway.rodmena.app/api/v1/workflows' \ -X POST \ -H 'User-Agent: Mozilla/5.0 (X...	closed	critical	2025-12-23 20:40	-	Edit
#662	Security Vulnerability: IPC Proxy Exposes Internal Engine API The IPCServer blindly proxies all method calls to DurableContext. This allows sandboxed apps to call...	closed	critical	2025-12-22 18:18	-	Edit
#650	Internal Worker Bootstrap Hook Auto-bootstrap on internal-worker startup. Flow: 1. Internal-worker starts 2. Check highway.platfor...	closed	critical	2025-12-21 05:45	-	Edit
#644	Tenant Onboarding Workflow _system.tenant.onboard workflow for new customer tenants. Workflow runs on _platform tenant, intern...	closed	critical	2025-12-21 05:45	-	Edit
#643	Platform Bootstrap Workflow _system.platform.bootstrap workflow for fresh deployment. Workflow runs on _platform tenant, intern...	closed	critical	2025-12-21 05:45	-	Edit
#642	Internal Platform Tools Implement internal.platform.* tools for platform-level operations. Tools: - internal.platform.check...	closed	critical	2025-12-21 05:45	-	Edit
#641	Internal Tenant Tools Implement internal.tenant.* tools for tenant lifecycle operations. Tools: - internal.tenant.create ...	closed	critical	2025-12-21 05:44	-	Edit
#640	Platform Bootstrap Infrastructure Create engine/platform/ directory structure and database migration. Directory structure: - engine/p...	closed	critical	2025-12-21 05:44	-	Edit

Previous Page 2 of 8 Next