Issues

• fix: harden PKCS#11 module source, embedded actor checks and widened-grant detection

  area:cliarea:integrationarea:plannerrisk:securitystatus:readytype:bug
  Sannrox/tenkai#1316 · Filter by author Sannrox opened on Nov 14, 2026

• fix(ops): dogfood-minikube deploys to the current kubectl context, plus script hygiene

  area:opsstatus:readytype:bug
  Sannrox/tenkai#1315 · Filter by author Sannrox opened on Nov 14, 2026

• test: tests that hang instead of failing, or assert too little

  area:opsstatus:readytype:bug
  Sannrox/tenkai#1314 · Filter by author Sannrox opened on Nov 14, 2026

• fix(ops): signed qualification drills attest to properties they never check

  area:opsrisk:securitystatus:readytype:bug
  Sannrox/tenkai#1313 · Filter by author Sannrox opened on Nov 14, 2026

• fix(ops): signer seed file is checked through one path and read through another

  area:opsrisk:securitystatus:readytype:bug
  Sannrox/tenkai#1312 · Filter by author Sannrox opened on Nov 14, 2026

• fix(integration): bound TLS handshakes, image blob buffering and OTLP export

  area:integrationarea:opsstatus:readytype:bug
  Sannrox/tenkai#1311 · Filter by author Sannrox opened on Nov 14, 2026

• fix: executor, CLI and storage correctness fixes from review

  area:cliarea:executorstatus:readytype:bug
  Sannrox/tenkai#1310 · Filter by author Sannrox opened on Nov 14, 2026

• fix(executor): rollback paths leave the wrong state after a failure

  area:executorarea:plannerstatus:readytype:bug
  Sannrox/tenkai#1309 · Filter by author Sannrox opened on Nov 14, 2026

• fix(executor): Helm and kubectl observe report Absent on any CLI failure

  area:executorstatus:readytype:bug
  Sannrox/tenkai#1308 · Filter by author Sannrox opened on Nov 14, 2026

• fix(executor): one bad stored record blocks certificate renewal or health for everything

  area:executorstatus:readytype:bug
  Sannrox/tenkai#1307 · Filter by author Sannrox opened on Nov 14, 2026

• fix(ops): adding a webhook wipes stored webhooks that fail to parse

  area:opsstatus:readytype:bug
  Sannrox/tenkai#1306 · Filter by author Sannrox opened on Nov 14, 2026

• fix(catalog): a panic in one database operation permanently stops the Postgres worker

  area:catalogstatus:readytype:bug
  Sannrox/tenkai#1305 · Filter by author Sannrox opened on Nov 14, 2026

• fix(catalog): governed actions and object puts are not atomic

  area:catalogstatus:readytype:bug
  Sannrox/tenkai#1304 · Filter by author Sannrox opened on Nov 14, 2026

• fix(catalog): SQLite read-then-write transactions use DEFERRED and fail under contention

  area:catalogstatus:readytype:bug
  Sannrox/tenkai#1303 · Filter by author Sannrox opened on Nov 14, 2026

• fix(integration): federated identity replay cache evicts unexpired assertion ids

  area:integrationrisk:securitystatus:readytype:bug
  Sannrox/tenkai#1302 · Filter by author Sannrox opened on Nov 14, 2026

• fix(planner): guarded plan transitions skip validation and erase emergency-override audit fields

  area:plannerrisk:securitystatus:readytype:bug
  Sannrox/tenkai#1301 · Filter by author Sannrox opened on Nov 14, 2026

• fix(planner): a missing approval-policy file silently drops quorum and preflight rules

  area:plannerrisk:securitystatus:readytype:bug
  Sannrox/tenkai#1300 · Filter by author Sannrox opened on Nov 14, 2026

• fix(integration): KMIP revoke and rotation only act on keys created by the current process

  area:integrationstatus:readytype:bug
  Sannrox/tenkai#1299 · Filter by author Sannrox opened on Nov 14, 2026

• fix(cli): idempotency key ignores parameters when a correlation id is set

  area:clistatus:readytype:bug
  Sannrox/tenkai#1298 · Filter by author Sannrox opened on Nov 14, 2026

• fix(executor): diagnostics redaction misses keys after '-' and after any ':'

  area:executorrisk:securitystatus:readytype:bug
  Sannrox/tenkai#1297 · Filter by author Sannrox opened on Nov 14, 2026

• fix(planner): plan_pins_wave skips the pin check when the plan has no input for the wave product

  area:plannerstatus:readytype:bug
  Sannrox/tenkai#1296 · Filter by author Sannrox opened on Nov 14, 2026

• fix(catalog): concurrent provider claims can overwrite each other's claim token

  area:catalogstatus:readytype:bug
  Sannrox/tenkai#1295 · Filter by author Sannrox opened on Nov 14, 2026

• fix(executor): writes after an environment lease check are not fenced against takeover

  area:executorarea:plannerstatus:readytype:bug
  Sannrox/tenkai#1294 · Filter by author Sannrox opened on Nov 14, 2026

• fix(executor): a worker that died under an older fencing generation can never be restarted

  area:executorstatus:readytype:bug
  Sannrox/tenkai#1293 · Filter by author Sannrox opened on Nov 14, 2026

• fix(executor): MLX redeploy on the same port can stop the only serving instance

  area:executorstatus:readytype:bug
  Sannrox/tenkai#1292 · Filter by author Sannrox opened on Nov 14, 2026