Issues

• Adopt the ciris-server release carrying CIRISVerify 18.0.0 — the v2 accord invocation label; until every agent instance is on it, the halt reaches v1-only agents only by holders dual-emitting

  CIRISAI/CIRISAgent#1227 · Filter by author emooreatx opened on Sep 28, 2026

• Billing: no credit provider reports credits_remaining=999 / plan unlimited as if real; SkillPreview.tools names the wrapper pair

  CIRISAI/CIRISAgent#1226 · Filter by author emooreatx opened on Sep 28, 2026

• POST /v1/wallet/transfer has no client idempotency key: a retry after a lost response sends twice

  CIRISAI/CIRISAgent#1225 · Filter by author emooreatx opened on Sep 28, 2026
  1

• PATCH /v1/tickets/{id} accepts any transition from any authenticated user; resolving a deferral needs AUTHORITY, a from-status check and a recorded wa_id

  CIRISAI/CIRISAgent#1224 · Filter by author emooreatx opened on Sep 28, 2026

• Responses that misreport: memory write 200 on denial, audit filters skip two sources, logs has_more always false

  CIRISAI/CIRISAgent#1223 · Filter by author emooreatx opened on Sep 28, 2026

• Connectors: test reports healthy without running, register says ok on failure, delete keeps the connection

  CIRISAI/CIRISAgent#1222 · Filter by author emooreatx opened on Sep 26, 2026

• Partnership: /decide lets the requester answer their own request; upgrade_relationship writes partnered without asking

  CIRISAI/CIRISAgent#1221 · Filter by author emooreatx opened on Sep 26, 2026

• Deletion receipts: verification checks against the CURRENT key, so every receipt signed before a key rotation reads invalid

  CIRISAI/CIRISAgent#1220 · Filter by author emooreatx opened on Sep 26, 2026

• No route tells the client whether a subject granted consent:scope:analyze, so a capacity score CC forbids is rendered as a number

  CIRISAI/CIRISAgent#1219 · Filter by author emooreatx opened on Sep 26, 2026

• The four CIRISClient CSD flows still say client: "unreleased" — #45 shipped in 0.5.224, so they assert nothing; delegation_card's entry step is also stale

  CIRISAI/CIRISAgent#1217 · Filter by author emooreatx opened on Sep 26, 2026

• The consent surface speaks streams and categories where CC 3.3.1 speaks scopes, and a revoke can say "requested" and never "done"

  CIRISAI/CIRISAgent#1212 · Filter by author emooreatx opened on Sep 25, 2026

• Handing a third party's credential to your agent produces the word "Connected!" and no delegation record

  CIRISAI/CIRISAgent#1211 · Filter by author emooreatx opened on Sep 25, 2026

• The conversation surface carries symbol events where CC 3.1.5 names a signed trace:complete:v1

  CIRISAI/CIRISAgent#1210 · Filter by author emooreatx opened on Sep 25, 2026

• "What is my agent thinking with" is answerable only by reading a screen, and its runtime state is read through a mutating POST

  CIRISAI/CIRISAgent#1209 · Filter by author emooreatx opened on Sep 25, 2026

• Three inventory reads return less than the card shows, so the client fills the gap with constants — services, tool cost, scheduler outcome

  CIRISAI/CIRISAgent#1208 · Filter by author emooreatx opened on Sep 25, 2026

• Four ticket counters cost up to 1000 third parties' records, and a completed DSAR emits no receipt

  CIRISAI/CIRISAgent#1207 · Filter by author emooreatx opened on Sep 25, 2026

• A Wise Authority who chooses "modify" has rejected the deferral, and three status numbers are not readings

  CIRISAI/CIRISAgent#1206 · Filter by author emooreatx opened on Sep 25, 2026

• /v1/audit/entries takes no cohort filter, so five circles' Record tabs show the same list

  CIRISAI/CIRISAgent#1205 · Filter by author emooreatx opened on Sep 25, 2026

• Consent: a telemetry export destination is a standing egress of the agent's traces to an arbitrary endpoint, with no consent record

  CIRISAI/CIRISAgent#1204 · Filter by author emooreatx opened on Sep 25, 2026

• Hardening: safe_to_import defaults to True — the skill-import security verdict fails open, and it has no attester

  CIRISAI/CIRISAgent#1203 · Filter by author emooreatx opened on Sep 25, 2026

• Privacy: GET /v1/users pages every account with its email, and UserSummary has no listed field to opt out with

  CIRISAI/CIRISAgent#1202 · Filter by author emooreatx opened on Sep 25, 2026

• crypto-DRY: ~10 Python Ed25519/P-256 verify sites bypass the embedded verify wheel (which now has the counterparts, v17.0.0)

  CIRISAI/CIRISAgent#1201 · Filter by author emooreatx opened on Sep 25, 2026

• CIRIS_FORCE_FIRST_RUN is re-read on every status check, so setup stays 'required' after it completes

  CIRISAI/CIRISAgent#1195 · Filter by author emooreatx opened on Sep 24, 2026

• /v1/setup/status should declare claim_pin_file — a client that didn't launch the node guesses the path and skips the claim

  CIRISAI/CIRISAgent#1196 · Filter by author emooreatx opened on Sep 24, 2026

• setup/complete ran on a node whose server had closed setup/root (AlreadyBootstrapped) — two stores disagree on 'already owned'

  CIRISAI/CIRISAgent#1194 · Filter by author emooreatx opened on Sep 24, 2026