| #851 |
Vault token VAULT_TOKEN_ADMIN is invalid - OIDC/SSO sign-in and circuit-breaker API are down in production
EARS SPEC:
- When the Highway API cannot authenticate to Vault, the /api/v1/health circuit_breaker_d...
|
open |
critical |
2026-08-22 01:50 |
- |
|
| #844 |
circuit-breakers 503: Vault password for resilient_circuit_db never applied to the postgres role
EARS SPEC:
- When GET /api/v1/circuit-breakers is called by an authorized caller, the Highway API sh...
|
closed |
critical |
2026-08-03 16:44 |
- |
|
| #843 |
health/metrics 500s: get_health_metrics builds jumper.r_%I, breaks on queue named "default"
EARS SPEC:
- When get_health_metrics builds a per-queue SQL statement, the Highway health metrics fu...
|
closed |
critical |
2026-08-03 16:44 |
- |
|
| #833 |
CATASTROPHIC: /simulate re-executed REAL tool side effects + crashed on incomplete mock client
User report: opening the Simulate/Replay tab on a real workflow produced a 500 with 'ReplayJumperCli...
|
closed |
critical |
2026-07-19 17:26 |
- |
|
| #826 |
Lifecycle UPDATEs unguarded + wrapper holds workflow_run row lock for entire execution: pause can overwrite terminal status -> permanent 'running' zombies
Smoking-gun timeline (run b4e5e56c, 2026-07-19, prod logs worker-7 + api):
- 01:05:12 wrapper (tools...
|
closed |
critical |
2026-07-19 01:14 |
- |
|
| #820 |
SECURITY: /api/v1/activities listed all tenants' activities (no tenant filter)
GET /api/v1/activities built its SQL with WHERE 1=1 and never filtered by tenant: any tenant's API k...
|
closed |
critical |
2026-07-12 01:28 |
- |
|
| #791 |
Pause is advisory: engine keeps executing tasks of a paused workflow run
POST /workflows/<id>/pause (api/blueprints/v1/workflows.py:~3613) only sets workflow_run.status='pau...
|
closed |
critical |
2026-07-01 22:21 |
- |
|
| #771 |
Agentic durable leaves crash on activity worker: ActivityContext has no jumper_client
durable_leaves=true routes tools.agent.execute_leaf_agent to the activity worker (agent_leaf DSL, 60...
|
closed |
critical |
2026-06-29 00:04 |
- |
|
| #755 |
CRITICAL: HITL approval bypassed for 2nd+ approval in one task (request_approval wait checkpoint keyed by task id)
enterprise/tools/approval_tool.py request_approval used step_name=_current_task_id (the DSL task id)...
|
closed |
critical |
2026-06-21 00:30 |
- |
|
| #721 |
Workers become zombies after asyncio crash - container healthy but all threads dead
OBSERVED: Workers can crash with asyncio.exceptions.CancelledError during HTTP operations, causing a...
|
closed |
critical |
2025-12-27 03:27 |
- |
|
| #719 |
Parallel branch retry creates orphaned waits due to absurd_run_id in join_event_name
FIXED: When a workflow with parallel branches is retried (e.g., due to worker crash), the join_event...
|
closed |
critical |
2025-12-27 02:52 |
- |
|
| #715 |
BUG: python_task.py swallows AbsurdSleepError in sandbox fallback path
In engine/tools/python_task.py lines 373-376, the except Exception block catches AbsurdSleepError wh...
|
closed |
critical |
2025-12-26 00:06 |
- |
|
| #697 |
WFL-01: Workflow pause/resume not implemented
Location: API missing. Issue: RBAC permissions exist for pause_workflows and resume_workflows but no...
|
closed |
critical |
2025-12-25 02:56 |
- |
|
| #696 |
OBS-01: No system-level alerting for worker failures
Location: Not implemented. Issue: If workers crash at 2 AM, no notification to on-call engineers. No...
|
closed |
critical |
2025-12-25 02:56 |
- |
|
| #695 |
APP-02: Playwright import allows uncontained browser automation
Location: code_loader.py:332. Issue: Playwright can spawn browser processes that bypass multiprocess...
|
closed |
critical |
2025-12-25 02:56 |
- |
|
| #694 |
APP-01: No resource limits on app child processes
Location: executor.py:462. Issue: multiprocessing.Process spawned without CPU/memory/file descriptor...
|
closed |
critical |
2025-12-25 02:56 |
- |
|
| #693 |
CLI-02: Missing workflow cancel/reset/signal/describe/list commands
Location: engine/cli/. Issue: Missing essential CLI operations for incident response: cancel, reset,...
|
closed |
critical |
2025-12-25 02:55 |
- |
|
| #692 |
CLI-01: Missing workflow terminate command
Location: engine/cli/. Issue: Cannot forcibly terminate a stuck/runaway workflow. In airport-critica...
|
closed |
critical |
2025-12-25 02:55 |
- |
|
| #691 |
VAL-04: DLQ not integrated with retry exhaustion
Location: timeout_service.py, dead_letter_service.py. Issue: TimeoutService marks tasks as failed bu...
|
closed |
critical |
2025-12-25 02:55 |
- |
|
| #690 |
VAL-03: Highway DSL RetryPolicy not implemented
Location: engine/interpreters/. Issue: Per-task retry_policy defined in DSL is ignored. Only Absurd-...
|
closed |
critical |
2025-12-25 02:55 |
- |
|