Summary

A paid agent deployment could stall when its assigned worker stopped responding. The workflow gave the owner no reliable way to recover the request and get the work completed.

Root cause

The workflow had a path for assigning work and recording completion, but lacked a reliable recovery route when that work never finished. Request ownership could outlive the worker's willingness or ability to deliver.

Attack scenario

A malicious or unresponsive participant could leave a deployment dependent on work that never arrived. The reported problem was the owner's inability to recover from that failure and continue with another available worker.

Impact

Affected users could lose access to the deployment service they had paid for, while legitimate workers could not complete the abandoned job. The issue disrupted both agent creation and the surrounding service workflow.

Fix recommendation

Provide controlled cancellation, expiry, and reassignment for unfinished work. Sherlock links the remediation to Crestal pull request 19, a merged change adding deployment-status recovery.