| #1031 |
resilient-circuit PostgresStorage connects per operation; request pooled storage (pg-nano rc_app limit 30, TLS+SCRAM per connect)
EARS: The breaker store shall reuse pooled connections (about 2 per process) instead of one connecti...
|
open |
medium |
2026-10-20 06:49 |
- |
|
| #1030 |
GET /analytics/queues reads tenant_id from the query string after require_permission checked the header tenant
Found during #1028 (live, public URL, 2026-10-20, read-only GETs). api/middleware/tenant.py takes g....
|
open |
high |
2026-10-20 06:20 |
- |
|
| #1023 |
get_jumper_client(queue_name=X) ignores X after the first call: spawns land on the process singleton's queue
Found while doing #916. engine/jumper_client.py get_jumper_client() is a process singleton; queue_na...
|
open |
high |
2026-10-20 06:01 |
- |
|
| #1022 |
ShellOutputStreamer leaks the stdout/stderr pipe of every streamed shell command
EARS: When ShellOutputStreamer.run finishes (normally, on timeout or on a non-zero exit), it shall c...
|
open |
medium |
2026-10-20 03:04 |
- |
|
| #1021 |
hwec dsl-prompt fails in the deployed image: engine/cli/DSL_PROMPT.txt is not in the highway-core package data
EARS: When highway-core is installed from its wheel (the Docker image does uv pip install ./docker/h...
|
open |
medium |
2026-10-20 03:04 |
- |
|
| #1008 |
POST /api/v1/dsl_to_json executed caller Python on the API container (AST blocklist only)
EARS SPEC:
- When POST /api/v1/dsl_to_json converts Python DSL, the API shall run the code only in t...
|
open |
critical |
2026-10-20 02:38 |
- |
|
| #1007 |
INCIDENT 2026-10-20 ~02:29Z: engine tests/unit/db ran against live highway_db_v2 and called jumper.cleanup_events('highway_default', 60, 1000)
WHAT: a security-batch agent ran the full engine tests/unit inside highway-api; tests/unit/db/test_c...
|
open |
high |
2026-10-20 02:34 |
- |
|
| #1006 |
App child processes inherit the worker environment; pathlib/io are allowlisted, so app code can likely read /proc/self/environ and /run/highway/secrets
EARS SPEC:
- When an app action runs in its child process, the child shall hold no worker secret in ...
|
open |
high |
2026-10-20 02:26 |
- |
|
| #1004 |
mg verify fails on highway_db_v2: jumper_initial row has NULL checksum, parallel_join_counter applied with a pre-commit checksum
EARS: When mg verify runs on the merged migration set against highway_db_v2, it shall report no mism...
|
open |
low |
2026-10-20 02:04 |
- |
|
| #1002 |
Stale smtp_password refs (shared/mail) in 10 welcome_email/invitation_email installations; tenant app secret DELETE cannot remove a ref without a value
EARS: Installations shall not reference retired platform secrets; DELETE /api/v1/tenant/apps/<instal...
|
open |
low |
2026-10-20 01:42 |
- |
|
| #999 |
Tenant secret key rotation tooling: reload ring once on unknown key id; hwe secrets reseal
EARS: When the store reads an envelope whose key id is not in the cached key ring, it shall reload t...
|
open |
medium |
2026-10-20 01:42 |
- |
|
| #998 |
Encryption keys: env wins over platform file with no drift guard (HIGHWAY_ENCRYPTION_KEY, RBAC_MASTER_ENCRYPTION_KEY)
EARS: When the JSONB encryption key or the RBAC master key is configured in both the environment and...
|
open |
medium |
2026-10-20 01:42 |
- |
|
| #997 |
TenantRateLimiter run-lease methods have no tests
EARS: The run-lease path of engine/policies/tenant_rate_limiter.py shall have unit tests that go red...
|
open |
medium |
2026-10-20 01:40 |
- |
|
| #991 |
CRITICAL: {{ENV.<name>}} in workflow templates returns any worker environment variable (DB_PASSWORD, JWT secret, encryption keys, Vault admin token)
EARS SPEC:
- The variable resolver shall not resolve any reference to the worker process environment...
|
open |
critical |
2026-10-20 01:11 |
- |
|
| #988 |
highway_dsl WorkflowBuilder.build() should reject branch handlers defined outside the branch lambda
EARS: When WorkflowBuilder.build() runs, it shall raise ValueError if any task inside a ParallelOper...
|
open |
medium |
2026-10-20 00:47 |
- |
|
| #987 |
Branch failures accepted by wait_for_parallel_branches(all_of) never reach the #956 unrecovered-failure rule
EARS: If a branch task fails with a handler and nothing downstream accepts the failure, then the run...
|
open |
medium |
2026-10-20 00:47 |
- |
|
| #986 |
Pause is not honoured inside parallel branches
EARS: While a run is paused, the engine shall not start the next task of any of its branch runs. Fou...
|
open |
medium |
2026-10-20 00:47 |
- |
|
| #985 |
Workflow deadline expiry does not run the branch/child/activity teardown
EARS: When a run's deadline expires, the engine shall tear down pending and sleeping branch runs, ch...
|
open |
high |
2026-10-20 00:47 |
- |
|
| #984 |
Explicit cancel via API does not cancel sleeping branch runs
EARS: When a run is cancelled through the API, the engine shall cancel its pending and sleeping bran...
|
open |
high |
2026-10-20 00:47 |
- |
|
| #982 |
Unit tests that depend on production database state fail on an empty database
EARS: The superproject and engine unit suites shall pass against an empty database built from the mi...
|
open |
medium |
2026-10-20 00:46 |
- |
|