Issues

• webhook: helm upgrade can reset the webhook caBundle to empty, and admission then fails with x509 until the controller restarts

  nirmata/ottoflow#215 · Filter by author AIWithShrey opened on Oct 31, 2026

• chart: helm upgrade of a release installed with Helm 4 fails on server-side apply conflicts (runner ClusterRole .rules, webhook caBundle)

  nirmata/ottoflow#214 · Filter by author AIWithShrey opened on Oct 31, 2026

• Caller gates: drop legacy configmaps rule, close E2E gaps

  nirmata/ottoflow#209 · Filter by author AIWithShrey opened on Oct 29, 2026
  

• webhook trigger server only logs a listen/bind failure; controller keeps running without a trigger listener

  nirmata/ottoflow#208 · Filter by author AIWithShrey opened on Oct 28, 2026
  

• chart: port-clash guard from #206 does not scan controller.command

  nirmata/ottoflow#207 · Filter by author AIWithShrey opened on Oct 28, 2026
  

• Binding deletes in the WorkflowRun and Exposure controllers lack a UID precondition

  bug
  nirmata/ottoflow#191 · Filter by author AIWithShrey opened on Oct 25, 2026
  

• No default e2e covers the MCP and A2A caller gates

  nirmata/ottoflow#190 · Filter by author AIWithShrey opened on Oct 24, 2026
  

• Heads-up: ExecuteWorkflow and instantiateStepTemplate are at cyclomatic 47/48 of the 50 lint limit

  nirmata/ottoflow#186 · Filter by author AIWithShrey opened on Oct 24, 2026
  

• Question: should the controllers set MaxConcurrentReconciles?

  nirmata/ottoflow#185 · Filter by author AIWithShrey opened on Oct 24, 2026
  

• ensureRunnerSecrets fails runs on transient errors; runner binding delete-and-recreate paths handle edge cases inconsistently

  nirmata/ottoflow#181 · Filter by author AIWithShrey opened on Oct 24, 2026
  

• SubjectAccessReview caller gates check core configmaps, which runner ServiceAccounts bound to the runner ClusterRole can read cluster-wide (follow-up to #23)

  nirmata/ottoflow#173 · Filter by author AIWithShrey opened on Oct 24, 2026
  

• Runner: refuse to overwrite a WorkflowRun that is terminal or owned by a newer attempt

  bug
  nirmata/ottoflow#121 · Filter by author AIWithShrey opened on Oct 18, 2026
  

• Runner interrupt: a Continue-policy step cancelled by SIGTERM is recorded as an ordinary failure

  bug
  nirmata/ottoflow#114 · Filter by author AIWithShrey opened on Oct 16, 2026
  

• Auto-reload LLM credential Secret on change so agents pick up rotated tokens without a restart

  enhancement
  nirmata/ottoflow#93 · Filter by author nsagark opened on Sep 15, 2026
  

• Promote e2e-gate to a required check only after post-merge e2e is proven green

  tests
  nirmata/ottoflow#38 · Filter by author AIWithShrey opened on Aug 24, 2026
  

• security: per-run serviceAccountName override bypasses runner least-privilege (follow-up to earlier RBAC work)

  bugsecurity
  nirmata/ottoflow#26 · Filter by author AIWithShrey opened on Aug 20, 2026
  

• Controller has cluster-wide delete on clusterrolebindings — document residual blast radius

  documentationsecurity
  nirmata/ottoflow#25 · Filter by author AIWithShrey opened on Aug 20, 2026
  

• Runner ClusterRole still grants cluster-wide ConfigMap write — scope checkpoint writes to the run namespace (follow-up to earlier RBAC work)

  enhancement
  nirmata/ottoflow#23 · Filter by author AIWithShrey opened on Aug 20, 2026
  

• cost-analyzer: metricsSourceResolved guardrail is blind to phase-filter pod drops (only catches pod-name-join drops)

  enhancement
  nirmata/ottoflow#17 · Filter by author AIWithShrey opened on Aug 20, 2026
  

• [P3] Packaging and reproducibility: floating ko, missing GOWORK=off, dead workflows, near-empty values.schema.json

  enhancement
  nirmata/ottoflow#15 · Filter by author AIWithShrey opened on Aug 20, 2026
  

• [P3] Documentation contradicts the code (DESIGN.md stale 'not implemented' claims, Go 1.21 vs 1.26, steps.* namespacing, DependsOn inference)

  documentation
  nirmata/ottoflow#14 · Filter by author AIWithShrey opened on Aug 20, 2026
  1

  

• [P2] Checks that cannot fail: six green signals that are indistinguishable from failure

  bug
  nirmata/ottoflow#13 · Filter by author AIWithShrey opened on Aug 20, 2026
  

• [P2] 29 of 70 shipped samples fail 'ottoflow validate' on a default install

  bug
  nirmata/ottoflow#11 · Filter by author AIWithShrey opened on Aug 20, 2026
  1

  

• [P2] Runner Jobs have no default activeDeadlineSeconds, and context-init failures never reach WorkflowRun.status

  bug
  nirmata/ottoflow#10 · Filter by author AIWithShrey opened on Aug 20, 2026
  

• waitForCallback outputs never reach CEL; dead OPENAI_BASE_URL allowlist key; gemini ignores skipVerifySSL

  bug
  nirmata/ottoflow#8 · Filter by author AIWithShrey opened on Aug 20, 2026