| #929 |
Authorization via hosted auth service; hw_k1_ keys kept; Google login removed
EARS SPEC:
- require_permission shall decide via hosted auth (one namespace per Highway tenant) with...
|
open |
high |
2026-10-15 23:07 |
- |
|
| #928 |
Quotas/rate limits via TokenGate (tenant 'highway', subjects per Highway tenant); leases stay local
EARS SPEC:
- The rate_limits API shall keep its request/response contract while storing policies in ...
|
closed |
high |
2026-10-15 23:07 |
- |
|
| #927 |
Email via mail-api instead of SMTP
EARS SPEC:
- tools.email.send and all API email paths shall send through mail-api POST /api/v1/email...
|
closed |
high |
2026-10-15 23:07 |
- |
|
| #926 |
datashard 0.11 on S3 with offline table migration
EARS SPEC:
- The logger shall store tables on S3 using datashard>=0.11.
- Every existing production ...
|
open |
high |
2026-10-15 23:07 |
- |
|
| #925 |
Production Postgres on pg-nano with TLS client certs (verify-full); data migration from pg.rodmena.app
EARS SPEC:
- Every DB client (engine pool, migretti, psql in entrypoint, resilient-circuit, db tool)...
|
in-progress |
high |
2026-10-15 23:07 |
- |
|
| #924 |
Remove Vault: platform secrets from /etc/highway/secrets, tenant secrets AES-GCM in Postgres
EARS SPEC:
- The engine shall resolve platform secrets from /etc/highway/secrets (0600) and tenant s...
|
in-progress |
high |
2026-10-15 23:07 |
- |
|
| #923 |
datashard hardening before upgrade: narrow _get_or_create_table, unify storage default, fatal on missing S3 creds
EARS SPEC:
- If loading an existing datashard table fails for any reason other than not-found, then ...
|
closed |
high |
2026-10-15 23:07 |
- |
|
| #922 |
Remove Ollama-only features: generate-workflow, dsl/ask, dsl/search, RAG tools, ragit, SearXNG, ollama service
EARS SPEC:
- The API shall not expose /generate-workflow, /dsl/ask or /dsl/search.
- The engine shal...
|
in-progress |
medium |
2026-10-15 23:07 |
- |
|
| #921 |
Embeddings off Ollama: router embed(), memory/semantic/apps SDK repointed, agent_memory re-embedded
EARS SPEC:
- The LLM router shall expose an embed operation backed by a hosted provider producing 76...
|
open |
high |
2026-10-15 23:07 |
- |
|
| #920 |
uv.lock + dependency bumps: migretti 0.10, bulkman 2.0.4, resilient-circuit <0.9, scriptplan 0.10, auth 3.3
EARS SPEC:
- Each repo (highway, highway-core, jumper) shall have a uv.lock used by the Docker build...
|
closed |
high |
2026-10-15 23:07 |
- |
|
| #919 |
Native psycopg C implementation; drop psycopg2-binary and psycopg[binary]
EARS SPEC:
- The images shall install psycopg with the C implementation built against libpq and no b...
|
closed |
high |
2026-10-15 23:07 |
- |
|
| #918 |
CI on ci.rodmena.co.uk: ruff, mypy, tests
EARS SPEC:
- When a commit is pushed to main, ci.rodmena.co.uk shall run ruff, mypy and the test sui...
|
in-progress |
medium |
2026-10-15 23:07 |
- |
|
| #917 |
Purge: root clutter, Jenkins, GitHub workflows, SonarQube, Dockerfile.production, helm, ansible, systemd, dead enterprise/sandbox
EARS SPEC:
- The repository shall contain no Jenkinsfile, .github/workflows, SonarQube config/script...
|
closed |
medium |
2026-10-15 23:07 |
- |
|
| #916 |
P0c: Move cancel-time container cleanup to worker; drop docker.sock from api
EARS SPEC:
- When a workflow is cancelled, a worker task shall remove its containers.
- The api cont...
|
in-progress |
high |
2026-10-15 23:07 |
- |
|
| #915 |
P0b: Shell sandbox on by default, fail closed, remove ${PWD} worker mount
EARS SPEC:
- The engine shall run tools.shell.run inside the sandbox by default ([sandbox] enabled=t...
|
closed |
critical |
2026-10-15 23:07 |
- |
|
| #914 |
P0a: DockerPolicy gate for all docker tools (privileged/devices/cap_add/bind/host ns/foreign networks; tenant label ownership)
EARS SPEC:
- If a docker tool call requests privileged, devices, cap_add, a host bind mount, pid/ipc...
|
closed |
critical |
2026-10-15 23:07 |
- |
|
| #913 |
EPIC: Highway realignment - durable-execution core on house platforms
EARS SPEC:
- The Highway engine shall keep its durable-execution core, tools, and the MCP/agent surf...
|
open |
high |
2026-10-15 23:07 |
- |
|
| #912 |
Tool registry swallows ImportError: a broken tool module silently drops tools (126 -> 124) with only a log warning
EARS SPEC:
- When a tool module fails to import, the tool registry shall fail loudly (or expose the ...
|
closed |
high |
2026-08-22 13:39 |
- |
|
| #911 |
Token endpoint leaks caught exception text into client 500 responses (str(e) in details, f-string in raise)
EARS SPEC:
- When a token endpoint fails, the API shall return a generic error code and message to t...
|
in-progress |
high |
2026-08-22 13:33 |
- |
|
| #910 |
App SDK ctx.checkpoint() promises exactly-once replay caching and delivers none in production
EARS SPEC:
- When an app action calls ctx.checkpoint(step_name, func) and the workflow later resumes...
|
open |
high |
2026-08-22 12:04 |
- |
|