| #948 |
tools.search.web: Google Alerts preview provider + explicit empty results (#946)
EARS:
- Where no Brave key is configured, tools.search.web shall query the Google Alerts preview end...
|
closed |
high |
2026-10-16 01:52 |
- |
|
| #947 |
highway-postgres OOM-killed inside its 4GiB cgroup (crash recovery, in-flight tasks failed)
EARS: The database container shall not be OOM-killed under the engine's maximum connection budget pl...
|
closed |
critical |
2026-10-16 01:26 |
- |
|
| #946 |
web_search duckduckgo provider returns empty results ~2/3 of queries from server IP (no SearXNG/Brave)
Found during #922. After SearXNG removal tools.search.web defaults to duckduckgo. Live smoke from hi...
|
closed |
high |
2026-10-16 01:22 |
- |
|
| #944 |
Rewrite golden demos and host-dependent templates for the sandboxed shell
EARS: Every template in api/dsl_templates and every golden demo shall run with tools.shell.run sandb...
|
closed |
high |
2026-10-16 00:24 |
- |
|
| #943 |
dsl-compiler must not reach postgres/api (own egress-only network)
EARS: The dsl-compiler service, which executes user Python at compile time, shall have no network ro...
|
closed |
high |
2026-10-16 00:23 |
- |
|
| #942 |
with_rate_limit executes a failing tool TWICE (tool exception caught by limiter fail-open branch)
EARS SPEC:
- When a rate-limited tool raises an exception after the rate-limit check passed, the dec...
|
closed |
critical |
2026-10-16 00:19 |
- |
|
| #940 |
tools.python.run imports and calls any importable module.function on the worker
EARS: If a workflow task names a function for tools.python.run, the engine shall only import and cal...
|
closed |
critical |
2026-10-16 00:05 |
- |
|
| #939 |
tools.shell.run can drive the docker CLI over the mounted docker.sock, bypassing the #914 docker policy gate
EARS: If a workflow task runs a shell command, it shall not be able to reach the Docker daemon. Work...
|
closed |
critical |
2026-10-15 23:43 |
- |
|
| #938 |
Workflow result is not the last task's result (test_docker_tools compose_simple/inspect/network_isolation fail)
EARS: When a sequential workflow completes, the workflow result exposed by GET /api/v1/workflows/{id...
|
closed |
medium |
2026-10-15 23:43 |
- |
|
| #937 |
Workflow failure surfaces only 'exhausting retries' + internal task id; root cause invisible via API
EARS SPEC:
- When a workflow run fails because a task exhausted its retries, GET /api/v1/workflows/{...
|
closed |
high |
2026-10-15 23:35 |
- |
|
| #936 |
Every LLM route is dead: agent route models retired/unpaid, DeepSeek key empty
EARS SPEC:
- Every route in [llm.routes] and default_route shall contain at least one model that ans...
|
closed |
critical |
2026-10-15 23:35 |
- |
|
| #935 |
Rebuilt image resolves spectree 3.0.0 (unpinned, no lockfile): API crash-loops at import in api/openapi/__init__.py
Found during #912. 'docker compose build api' on 2026-10-15 resolved spectree 3.0.0 (old image had 2...
|
closed |
high |
2026-10-15 23:22 |
- |
|
| #930 |
Approvals via Futex; local human_approvals kept as webhook-fed projection
EARS SPEC:
- tools.approval.request shall keep its kwargs and return shape and create a Futex decisi...
|
closed |
high |
2026-10-15 23:07 |
- |
|
| #928 |
Quotas/rate limits via TokenGate (tenant 'highway', subjects per Highway tenant); leases stay local
EARS SPEC:
- The rate_limits API shall keep its request/response contract while storing policies in ...
|
closed |
high |
2026-10-15 23:07 |
- |
|
| #927 |
Email via mail-api instead of SMTP
EARS SPEC:
- tools.email.send and all API email paths shall send through mail-api POST /api/v1/email...
|
closed |
high |
2026-10-15 23:07 |
- |
|
| #923 |
datashard hardening before upgrade: narrow _get_or_create_table, unify storage default, fatal on missing S3 creds
EARS SPEC:
- If loading an existing datashard table fails for any reason other than not-found, then ...
|
closed |
high |
2026-10-15 23:07 |
- |
|
| #920 |
uv.lock + dependency bumps: migretti 0.10, bulkman 2.0.4, resilient-circuit <0.9, scriptplan 0.10, auth 3.3
EARS SPEC:
- Each repo (highway, highway-core, jumper) shall have a uv.lock used by the Docker build...
|
closed |
high |
2026-10-15 23:07 |
- |
|
| #919 |
Native psycopg C implementation; drop psycopg2-binary and psycopg[binary]
EARS SPEC:
- The images shall install psycopg with the C implementation built against libpq and no b...
|
closed |
high |
2026-10-15 23:07 |
- |
|
| #917 |
Purge: root clutter, Jenkins, GitHub workflows, SonarQube, Dockerfile.production, helm, ansible, systemd, dead enterprise/sandbox
EARS SPEC:
- The repository shall contain no Jenkinsfile, .github/workflows, SonarQube config/script...
|
closed |
medium |
2026-10-15 23:07 |
- |
|
| #915 |
P0b: Shell sandbox on by default, fail closed, remove ${PWD} worker mount
EARS SPEC:
- The engine shall run tools.shell.run inside the sandbox by default ([sandbox] enabled=t...
|
closed |
critical |
2026-10-15 23:07 |
- |
|