Issues

Redis fixed-window limiter per key/tenant/IP; 429 + error shape + headers (UB-API-8). Unauthenticate...

Signed HttpOnly session cookie on review GET + double-submit CSRF on all Action Web POSTs (UB-AW-6, ...

POST/GET/DELETE /v1/tenants/{id}/api-keys (raw key shown once); member add writes role/permissions/m...

CREATE TABLE IF NOT EXISTS delegation_rules matching models.py + indexes. Fixes unreproducible fresh...

app/config.py (all env in one place, one REDIS_URL, prod startup validation), app/db.py, app/errors....

Add pyproject.toml with pinned deps + [tool.pytest.ini_options] (markers=[e2e], addopts='-m "not e2e...

Resolve active delegation rules at task assignment time. Cap chain depth to 1. Skip non_delegable ta...

Implement /v1/delegations CRUD. Require hitl:delegation:manage_self or manage_others. Rules must hav...

Implement conditional further approval (clearance). Generate clearance tasks on approve, block RunFl...

Implement SoD rules: submitter-cannot-act, mutually exclusive principals/roles. Reject task assignme...

Implement policy evaluation for step completion modes (all_of, any_of, n_of_m). Support parallel ste...

Implement hitl_list_inbox, hitl_get_task, hitl_act_on_task. Require inbox/act permissions. (UB-MCP-4...

Implement hitl_list_policies, hitl_get_policy, hitl_request_decision, hitl_get_decision, hitl_cancel...

Implement /mcp endpoint. Support SSE or stdio (HTTP stream). Enforce Bearer API key authentication i...

When a decision is created, instantiate initial tasks from policy and trigger webhooks.