Issues

• Task: the chart upgrade test uses the newest release that has an image

  bugeffort:smallinfrastructurepriority:mediumtask
  evoila/meho#6079 · Filter by author damir-topic opened on Nov 9, 2026

• Task: a tool's description follows its switch

  effort:smallenhancementmcppriority:mediumtask
  evoila/meho#6077 · Filter by author damir-topic opened on Nov 9, 2026

• linux-ssh: a root operation on a key-only target fails after approval, and MEHO hides its own reason as 'vendor text withheld'

  evoila/meho#6073 · Filter by author harhod opened on Nov 9, 2026

• Knowledge: the two user-facing messages of the wiki search still say "team wiki"

  task
  evoila/meho#6069 · Filter by author damir-topic opened on Nov 9, 2026
  1

• k8s logs: a wrong container name gets the error "pod has multiple containers"

  bugeffort:smallpriority:lowtask
  evoila/meho#6059 · Filter by author damir-topic opened on Nov 9, 2026

• The policy evaluator decides; the old code branches are removed one release later; docs

  enhancementholdpolicypriority:mediumpythontask
  evoila/meho#6053 · Filter by author damir-topic opened on Nov 8, 2026

• The 'read-only agents' file, the custom-role 'separated duties' file, Keycloak tests with several groups, and the secret-store check for logins in several groups

  enhancementholdpolicypriority:mediumpythontask
  evoila/meho#6052 · Filter by author damir-topic opened on Nov 8, 2026

• Bindings to custom roles, a second admin approves every role or binding change, and console pages for roles, bindings and the policy

  enhancementgoholdpolicypriority:mediumpythontask
  evoila/meho#6051 · Filter by author damir-topic opened on Nov 8, 2026

• Customer-defined roles: the roles section, five rule kinds and one base level per role

  enhancementholdpolicypriority:mediumpythontask
  evoila/meho#6050 · Filter by author damir-topic opened on Nov 8, 2026

• Initiative: Configurable policy, part 2: customer-defined roles and the evaluator decides

  enhancementholdinitiativepriority:mediumseat:heavy
  evoila/meho#6049 · Filter by author damir-topic opened on Nov 8, 2026

• Role bindings in the policy file match the login group's attribute or full path, never its short name

  enhancementpolicypriority:highpythontask
  evoila/meho#6048 · Filter by author damir-topic opened on Nov 8, 2026

• MEHO remembers which roles each login held at its last login, so notifications reach only the people who may approve

  enhancementpolicypriority:highpythontask
  evoila/meho#6047 · Filter by author damir-topic opened on Nov 8, 2026

• Approver routing by category: the approver set is computed when a request is created, stored on it, and checked again at click time

  enhancementpolicypriority:highpythontask
  evoila/meho#6046 · Filter by author damir-topic opened on Nov 8, 2026

• meho policy explain: why a call runs, waits or is denied, and who may approve, without running anything

  effort:mediumenhancementgopolicypriority:highpythontask
  evoila/meho#6045 · Filter by author damir-topic opened on Nov 8, 2026

• The matched rule is written on the audit row and the approval request

  effort:mediumenhancementpolicypriority:highpythontask
  evoila/meho#6044 · Filter by author damir-topic opened on Nov 8, 2026

• Parity test: the evaluator and today's code agree on every who-asks × risk-level × path cell, every approval case and every route's role check

  effort:largeenhancementpolicypriority:highpythontask
  evoila/meho#6043 · Filter by author damir-topic opened on Nov 8, 2026

• One policy evaluator with a fixed schema, run in shadow mode next to today's checks, logging every difference

  effort:largeenhancementpolicypriority:highpythontask
  evoila/meho#6042 · Filter by author damir-topic opened on Nov 8, 2026

• Search results, the call contract and the approval request show the operation's category

  effort:smallenhancementpolicypriority:highpythontask
  evoila/meho#6041 · Filter by author damir-topic opened on Nov 8, 2026

• Shipped default 'small team' policy file and the test that proves importing it changes nothing

  effort:mediumenhancementpolicypriority:highpythontask
  evoila/meho#6040 · Filter by author damir-topic opened on Nov 8, 2026

• The policy file 'policy: v1' with taxonomy and classifications, with its own meho policy command: import, export, diff and dry run; the import replaces the whole file and waits for a second tenant admin

  effort:largeenhancementgopolicypriority:highpythontask
  evoila/meho#6039 · Filter by author damir-topic opened on Nov 8, 2026

• Edit classification one at a time or by pattern: REST, CLI, console and the admin MCP tool

  effort:largeenhancementgopolicypriority:highpythontask
  evoila/meho#6038 · Filter by author damir-topic opened on Nov 8, 2026

• Category, labels and 'always wait' on connectors, operation groups and operations, with inheritance

  effort:largeenhancementpolicypriority:highpythontask
  evoila/meho#6037 · Filter by author damir-topic opened on Nov 8, 2026

• One rights-change mark for approvals: no login approves its own rights change, and category edits and the policy import reuse the same mark

  effort:mediumenhancementpolicypriority:highpythontask
  evoila/meho#6036 · Filter by author damir-topic opened on Nov 8, 2026

• The credential-read minimum risk level applies at every operation lookup, not only at spec import

  effort:smallenhancementpolicypriority:highpythontask
  evoila/meho#6034 · Filter by author damir-topic opened on Nov 8, 2026
  1

• Initiative: Configurable policy, part 1: categories on operations, approver routing by category, and the policy file

  enhancementinitiativepriority:highseat:heavy
  evoila/meho#6033 · Filter by author damir-topic opened on Nov 8, 2026