| #972 |
Template interpolation into tools.shell.run is raw text: upstream output executes as shell (bypasses #374 quoting)
EARS: When a {{var}} placeholder is resolved into a tools.shell.run command, the Highway engine shal...
|
in-progress |
high |
2026-10-20 00:43 |
- |
|
| #971 |
Fresh install fails: jumper and product migrations are out of order after engine 01M514J6GN9S42SQK3YW8GKEVP
EARS: When migrations-entrypoint.sh runs against an empty database, the migrations service shall app...
|
in-progress |
high |
2026-10-20 00:41 |
- |
|
| #969 |
Secret history triage: gitleaks finds 45 (highway) + 8 (engine) historical findings; default rules missed the [secrets] mail password
EARS SPEC:
- The Highway CI secret scan shall fail on any credential added to tracked files or histo...
|
in-progress |
high |
2026-10-20 00:09 |
- |
|
| #966 |
Branch on_failure handlers never run; handler referenced inside a parallel branch lambda is auto-chained in the parent and runs unconditionally
EARS: When a task inside a parallel branch fails and declares on_failure, the engine shall run that ...
|
in-progress |
high |
2026-10-17 17:34 |
- |
|
| #965 |
Reduce idle PostgreSQL connections: pool_min_size 1, pool_max_idle 90s
EARS: While a Highway service is idle, each engine pool shall hold at most 1 connection, and an idle...
|
closed |
high |
2026-10-17 02:49 |
- |
|
| #963 |
POST /admin/api-keys ignores documented expires_in_days; key never expires
EARS: When POST /api/v1/admin/api-keys receives expires_in_days, the API shall set expires_at = now ...
|
closed |
high |
2026-10-17 00:53 |
- |
|
| #956 |
on_failure handler makes a failed step's run report completed
EARS: When a step fails and its on_failure handler succeeds, the run status shall show the step fail...
|
closed |
high |
2026-10-17 00:50 |
- |
|
| #950 |
Email: expose mail-api send features and durable reply-wait via plus-tags
EARS SPEC:
- tools.email.send and ctx.send_email shall accept cc, bcc, reply_to, from_name, schedule...
|
closed |
high |
2026-10-16 23:02 |
- |
|
| #948 |
tools.search.web: Google Alerts preview provider + explicit empty results (#946)
EARS:
- Where no Brave key is configured, tools.search.web shall query the Google Alerts preview end...
|
closed |
high |
2026-10-16 01:52 |
- |
|
| #946 |
web_search duckduckgo provider returns empty results ~2/3 of queries from server IP (no SearXNG/Brave)
Found during #922. After SearXNG removal tools.search.web defaults to duckduckgo. Live smoke from hi...
|
closed |
high |
2026-10-16 01:22 |
- |
|
| #944 |
Rewrite golden demos and host-dependent templates for the sandboxed shell
EARS: Every template in api/dsl_templates and every golden demo shall run with tools.shell.run sandb...
|
closed |
high |
2026-10-16 00:24 |
- |
|
| #943 |
dsl-compiler must not reach postgres/api (own egress-only network)
EARS: The dsl-compiler service, which executes user Python at compile time, shall have no network ro...
|
closed |
high |
2026-10-16 00:23 |
- |
|
| #941 |
Sandbox throughput: shell/code sandbox holds a worker slot for the full command and adds ~175ms per call
EARS: While a sandboxed tools.shell.run is running, the engine shall not hold a workflow worker slot...
|
open |
high |
2026-10-16 00:05 |
- |
|
| #937 |
Workflow failure surfaces only 'exhausting retries' + internal task id; root cause invisible via API
EARS SPEC:
- When a workflow run fails because a task exhausted its retries, GET /api/v1/workflows/{...
|
closed |
high |
2026-10-15 23:35 |
- |
|
| #935 |
Rebuilt image resolves spectree 3.0.0 (unpinned, no lockfile): API crash-loops at import in api/openapi/__init__.py
Found during #912. 'docker compose build api' on 2026-10-15 resolved spectree 3.0.0 (old image had 2...
|
closed |
high |
2026-10-15 23:22 |
- |
|
| #930 |
Approvals via Futex; local human_approvals kept as webhook-fed projection
EARS SPEC:
- tools.approval.request shall keep its kwargs and return shape and create a Futex decisi...
|
closed |
high |
2026-10-15 23:07 |
- |
|
| #929 |
Authorization via hosted auth service; hw_k1_ keys kept; Google login removed
EARS SPEC:
- require_permission shall decide via hosted auth (one namespace per Highway tenant) with...
|
open |
high |
2026-10-15 23:07 |
- |
|
| #928 |
Quotas/rate limits via TokenGate (tenant 'highway', subjects per Highway tenant); leases stay local
EARS SPEC:
- The rate_limits API shall keep its request/response contract while storing policies in ...
|
closed |
high |
2026-10-15 23:07 |
- |
|
| #927 |
Email via mail-api instead of SMTP
EARS SPEC:
- tools.email.send and all API email paths shall send through mail-api POST /api/v1/email...
|
closed |
high |
2026-10-15 23:07 |
- |
|
| #926 |
datashard 0.11 on S3 with offline table migration
EARS SPEC:
- The logger shall store tables on S3 using datashard>=0.11.
- Every existing production ...
|
open |
high |
2026-10-15 23:07 |
- |
|