Issues [issues] - .issue.db

ID	Title	Status	Priority	Created	Due Date	Actions
#62	FTX-62: MCP Streamable HTTP transport + per-request auth StreamableHTTPSessionManager(stateless=True) mounted at /mcp with auth ASGI wrapper (Bearer -> authe...	closed	critical	2026-07-23 15:08	-	Edit
#55	FTX-55: Mail drainer with mint-at-send Tokens minted at send time in drainer - outbox rows carry NO token material (UB-TOK-4); skip obsolet...	closed	critical	2026-07-23 15:08	-	Edit
#54	FTX-54: Durable webhook outbox + drainer + subscriptions CRUD enqueue_webhook writes webhook_deliveries in caller transaction (replaces fire-and-forget asyncio.cr...	closed	critical	2026-07-23 15:08	-	Edit
#52	FTX-52: Worker runtime process + futex-worker.service python -m app.workers.main: N independent asyncio loops (expiry/sla/mail/webhook/token_cleanup/runfl...	closed	critical	2026-07-23 15:08	-	Edit
#47	FTX-47: Multi-stage progression decisions.current_stage_index + instantiate_stage() in same transaction as stage completion; termina...	closed	critical	2026-07-23 15:08	-	Edit
#46	FTX-46: apply_action rewrite with row locking Single transaction: lock decision FOR UPDATE then task FOR UPDATE (global lock order); guard non-ter...	closed	critical	2026-07-23 15:08	-	Edit
#45	FTX-45: Quorum engine fixes n_of_m reads n_required (schema field, currently reads nonexistent step.n so n=1 always); only persi...	closed	critical	2026-07-23 15:08	-	Edit
#44	FTX-44: Decision/task state machine + transition guards domain/statemachine.py DECISION_TRANSITIONS/TASK_TRANSITIONS/TERMINAL/ACTIVE (UB-SM-1/2); guard_tran...	closed	critical	2026-07-23 15:08	-	Edit
#40	FTX-40: Capability token hardening HITL_TOKEN_SECRET mandatory in prod (delete futex-dev-secret fallback + master-key reuse); verify te...	closed	critical	2026-07-23 15:08	-	Edit
#39	FTX-39: Fail-closed tenant scoping sweep Frozen Principal dataclass; eliminate every principal.get('tenant_id','default') fallback (CI grep g...	closed	critical	2026-07-23 15:08	-	Edit
#38	FTX-38: Delete unauthenticated one_click_approve/reject routes Remove GET /v1/tasks/{id}/one_click_approve\|reject (main.py:643-664) - no auth, no token, no tenant ...	closed	critical	2026-07-23 15:08	-	Edit
#36	FTX-36: api_keys authn core + auth oracle client api_keys table (hashed futex_sk_* secrets, UNIQUE key_hash, tenant+principal binding, policy_allowli...	closed	critical	2026-07-23 15:08	-	Edit
#33	FTX-33: Test DB isolation (prod-wipe guard) conftest.py hardwired to futex_test; assert dbname endswith _test before ANY truncate (current conft...	closed	critical	2026-07-23 15:08	-	Edit