| #31 |
TEST-1: Contract & Isolation Tests
Write tests mocking Auth, Mail, RunFlow with circuit-open behavior. Prove cross-tenant isolation and...
|
closed |
medium |
2026-07-22 21:59 |
- |
|
| #29 |
SEC-1: Redis Rate Limiting & API Security
Enforce per-tenant and per-key rate limits via Redis. Enforce 1MB max JSON body. Protect Webhooks ag...
|
closed |
medium |
2026-07-22 21:59 |
- |
|
| #28 |
API-7: Audit REST API & Event Logging
Implement /v1/audit read endpoint. Trigger audit events for decision lifecycle, actions, delegations...
|
closed |
medium |
2026-07-22 21:59 |
- |
|
| #27 |
CORE-5: Delegation Resolution Engine
Resolve active delegation rules at task assignment time. Cap chain depth to 1. Skip non_delegable ta...
|
closed |
high |
2026-07-22 21:59 |
- |
|
| #26 |
API-6: Delegation REST API
Implement /v1/delegations CRUD. Require hitl:delegation:manage_self or manage_others. Rules must hav...
|
closed |
high |
2026-07-22 21:59 |
- |
|
| #25 |
CORE-4: Policy Engine - Clearance Profiles
Implement conditional further approval (clearance). Generate clearance tasks on approve, block RunFl...
|
closed |
high |
2026-07-22 21:59 |
- |
|
| #24 |
CORE-3: Policy Engine - Separation of Duties (SoD)
Implement SoD rules: submitter-cannot-act, mutually exclusive principals/roles. Reject task assignme...
|
closed |
high |
2026-07-22 21:59 |
- |
|
| #23 |
CORE-2: Complex Policy Engine - Quorums & Modes
Implement policy evaluation for step completion modes (all_of, any_of, n_of_m). Support parallel ste...
|
closed |
high |
2026-07-22 21:59 |
- |
|
| #22 |
MCP-3: MCP Reviewer Tools
Implement hitl_list_inbox, hitl_get_task, hitl_act_on_task. Require inbox/act permissions. (UB-MCP-4...
|
closed |
high |
2026-07-22 21:59 |
- |
|
| #21 |
MCP-2: MCP Submitter Tools
Implement hitl_list_policies, hitl_get_policy, hitl_request_decision, hitl_get_decision, hitl_cancel...
|
closed |
high |
2026-07-22 21:59 |
- |
|
| #20 |
MCP-1: MCP Server Core & Authentication
Implement /mcp endpoint. Support SSE or stdio (HTTP stream). Enforce Bearer API key authentication i...
|
closed |
high |
2026-07-22 21:59 |
- |
|
| #19 |
CORE-1: Decision Workflow Wiring
When a decision is created, instantiate initial tasks from policy and trigger webhooks.
|
closed |
high |
2026-07-22 21:41 |
- |
|
| #18 |
AUDIT-1: Audit Logs & Quality Check
Ensure all state mutations correctly log to audit_events. Expose /v1/audit API. Final quality checks...
|
closed |
medium |
2026-07-22 21:09 |
- |
|
| #17 |
MCP-2: Reviewer MCP Server
Expose SSE MCP server with tools hitl_list_inbox, hitl_act_on_task.
Development Workflow:
1. Read t...
|
closed |
medium |
2026-07-22 21:09 |
- |
|
| #16 |
MCP-1: Submitter MCP Server
Expose SSE MCP server with tools hitl_request_decision, hitl_list_policies.
Development Workflow:
1...
|
closed |
medium |
2026-07-22 21:09 |
- |
|
| #13 |
WORKER-1: SLA & Expiry Background Workers
Implement background jobs (Celery/RQ) to handle SLA escalation and hard expiries.
Development Workf...
|
closed |
medium |
2026-07-22 21:09 |
- |
|
| #12 |
WEB-2: Step-Up OTP via Mailserver
Implement OTP challenge via Action Web interacting with MAIL-1 client before task action execution.
...
|
closed |
medium |
2026-07-22 21:09 |
- |
|
| #11 |
WEB-1: Minimal Action Web Routes
Implement server-rendered Jinja2 UI for Review & Submit actions using one-click capability tokens.
...
|
closed |
medium |
2026-07-22 21:09 |
- |
|
| #10 |
API-5: Actions API
Implement /v1/tasks/{id}/actions for approve, reject, request_changes.
Development Workflow:
1. Rea...
|
closed |
medium |
2026-07-22 21:09 |
- |
|
| #9 |
API-4: Tasks & Inbox API
Implement /v1/inbox/tasks. Handle step evaluation, SoD (Separation of Duties), and assignment routin...
|
closed |
medium |
2026-07-22 21:09 |
- |
|