EQTY LabDocs

Known Issues

Known issues and release-specific advisories for the Guardian Platform.

View as Markdown

This page records customer-facing known issues from the product documentation source. Release notes remain the source of truth for release-specific advisories.

Current Status

Advisories specific to a release are carried in that release’s notes. These advisories apply to current releases:

  • Gateway Stack not covered by v1.2.1 validation. The v1.2.1 staging validation ran without the Gateway Stack enabled, so its changes in that release are not covered by the validation evidence in the release manifest. Validate the stack in your own environment before enabling it.
  • openbao-custody chart is a development integration. The supplied OpenBao chart is for evaluation and not an approved production rollout; seal, backup, restore, and recovery decisions still need validation before a pilot. OpenBao Transit itself is supported for fresh installations against a customer-managed OpenBao that meets the Auth Service contract.
  • Cloudsmith publication is being commissioned. Cloudsmith publication is initially disabled. Install from Cloudsmith only for a stable version with a verified cloudsmith-delivery.json, and use GHCR until then. See Connected Install.
  • Rolling back from v1.3.0 needs a database restore. A v1.2.x Integrity Service doesn’t start against the schema v1.3.0 migrates, and a v1.2.x Control Plane and LLM Gateway fail project traffic, because v1.3.0 drops the project references they read. Back up before upgrading, and to return to v1.2.x, restore that backup. See Rolling Back from 1.3 to 1.2.x.
  • Audit header values redacted by v1.3.0 can’t be recovered by a downgrade. When it upgrades, the LLM Gateway replaces every header value outside an allowlist of standard protocol and provider headers with [REDACTED] in each stored audit record, including signatures, API keys, content digests, and X-Guardian-Correlation-Id, and redacts new records the same way. Only the pre-upgrade backup still holds the original values, so protect it as you would the credentials themselves.
  • v1.2.1 with OpenBao can’t verify project membership credentials. The v1.2.1 Control Plane and LLM Gateway don’t verify P-256 proofs, which an OpenBao Transit key produces, so they reject project membership credentials with unsupported proof type: EcdsaSecp256r1Signature2019. v1.3.0 fixes this. Installations whose keys are in Azure Key Vault, AWS KMS, or Google Cloud KMS are not affected.

Before publication, release owners should reconcile this page with the final release validation record and release notes. If new issues are found, record the user impact, affected versions, workaround, and support guidance.

Review Checklist

  • Install and upgrade guidance matches the release manifest.
  • Helm reference matches the released charts.
  • Air-gapped guidance matches the release package.
  • Rollback notes reflect release-specific migration behavior.
  • Examples and logs do not expose internal or customer data.