| #832 |
Hardening batch: defensive guards + observability from the jumper/core audit (low severity)
Bundle of verified-low findings from the 2026-07-19 audit: (1) jumper schedule_run's TASK-table UPDA...
|
closed |
low |
2026-07-19 05:26 |
- |
|
| #831 |
Lifecycle boundary checks do not reach foreach/while loop bodies — pause/cancel latency inside long loops
The #825/#826 boundary check (_lifecycle_signal) runs only in execute_workflow_graph's main ready-ta...
|
closed |
medium |
2026-07-19 05:26 |
- |
|
| #830 |
Sweeper fail-path can block up to DB-wide statement_timeout (2min) on a live wrapper's jumper-row lock
docker-compose.yml:159 sets statement_timeout=120000 DB-wide (SHOW confirms 2min). The wrapper holds...
|
closed |
medium |
2026-07-19 05:26 |
- |
|
| #829 |
completed_at metadata anomalies: claim-time timestamps on multi-minute runs; repair paths COALESCE stale values
Observed: run 6d2f34ac showed completed_at ~1s after creation despite ~2min execution; reconciled zo...
|
closed |
medium |
2026-07-19 05:26 |
- |
|
| #828 |
Status filter allowlists incomplete: 'orphaned' unfilterable; VALID_WORKFLOW_STATUSES dead constant missing 3 statuses
api/blueprints/v1/workflows.py:804 _status_keys = (completed,failed,running,pending,sleeping,paused,...
|
closed |
medium |
2026-07-19 05:26 |
- |
|
| #827 |
CLI hwe terminate/reset fully broken: UPDATE on phantom 'jumper_runs' table rolls back the whole command
engine/cli/workflow_cmd/lifecycle.py:96 (cmd_terminate) and :310 (cmd_reset) run UPDATE jumper_runs ...
|
closed |
high |
2026-07-19 05:26 |
- |
|
| #826 |
Lifecycle UPDATEs unguarded + wrapper holds workflow_run row lock for entire execution: pause can overwrite terminal status -> permanent 'running' zombies
Smoking-gun timeline (run b4e5e56c, 2026-07-19, prod logs worker-7 + api):
- 01:05:12 wrapper (tools...
|
closed |
critical |
2026-07-19 01:14 |
- |
|
| #825 |
Cancel endpoint cannot cancel claimed in-flight workflow runs (409); no cooperative boundary cancellation
POST /workflows/<id>/cancel only calls jumper cancel_task on the wrapper (tools.workflow.execute) ru...
|
closed |
high |
2026-07-19 01:04 |
- |
|
| #824 |
Visual editor n8n-parity push (phased): reliability, execution loop, canvas ops, expressions
Comprehensive review found major gaps vs n8n. Phased build (user approved all, in order): P1 reliabi...
|
in-progress |
high |
2026-07-15 01:31 |
- |
|
| #823 |
Expression editor + variable picker for the visual workflow editor
Add n8n-style expression support to the visual editor's inspector fields. Highway interpolates {{ va...
|
open |
high |
2026-07-14 21:44 |
- |
|
| #822 |
Introspect real tool signatures for the visual editor (self-documenting param forms)
The visual editor only had rich param forms for 14 hand-curated tools; the other ~90 fell back to a ...
|
closed |
high |
2026-07-14 21:07 |
- |
|
| #821 |
Visual workflow editor rebuild: Svelte Flow + real tools + correct compiler + round-trip
The dashboard visual editor is useless: dsl-generator.convertNodeToTask only emits task+parallel and...
|
open |
high |
2026-07-14 00:40 |
- |
|
| #820 |
SECURITY: /api/v1/activities listed all tenants' activities (no tenant filter)
GET /api/v1/activities built its SQL with WHERE 1=1 and never filtered by tenant: any tenant's API k...
|
closed |
critical |
2026-07-12 01:28 |
- |
|
| #819 |
Dashboard UX review 2026-07-11: 62 verified findings (truth-telling bugs, dead controls, older-runs regression, mobile)
Comprehensive 11-dimension UX review of highway-dashboard (code + 17 desktop + 17 mobile screenshots...
|
open |
high |
2026-07-12 00:39 |
- |
|
| #818 |
Workflows list perf: dashboard fetches + client-groups ALL runs (9845); add grouped-summary endpoint (#agentic)
The dashboard workflows page fetches every run (days-windowed, ~9845 for a busy tenant) with no work...
|
open |
high |
2026-07-10 22:08 |
- |
|
| #817 |
DB failover breaks durability: duplicate side effects (exactly-once) + run failures under postgres restart (#agentic)
Chaos harness with --db-restarts 3 (postgres restarts mid-flight) on 20 canary runs: 3 runs FAILED a...
|
closed |
high |
2026-07-09 01:40 |
- |
|
| #816 |
Production-readiness: fault-injection / chaos harness for the durable engine (#agentic)
Add tests/chaos: a fault-injection harness that SIGKILLs workers mid-flight and asserts durability i...
|
closed |
high |
2026-07-08 23:55 |
- |
|
| #815 |
Fix demo apps hello_world.wait_for_approval + notification_hub.send_alert_and_wait: broken wait_for_event calls (#agentic)
Both call ctx.wait_for_event with the wrong signature: hello_world passes (step_name, timeout=timeou...
|
closed |
medium |
2026-07-07 00:01 |
- |
|
| #814 |
Activity remote context missing 'now' -> non-waiting app with ctx.now fails when routed to activity worker (#agentic)
A non-waiting app with a timeout_policy > 30s routes to the activity worker; if the app calls ctx.no...
|
closed |
medium |
2026-07-06 01:03 |
- |
|
| #813 |
Several apps call ctx.wait_for_event(timeout=...) but SDK AppContext.wait_for_event takes timeout_seconds -> waiting actions crash (#agentic)
AppContext.wait_for_event (enterprise/apps/sdk/context.py:525) signature is (step_name, event_name, ...
|
closed |
medium |
2026-07-06 01:03 |
- |
|