Known Limitations — Consolidated NOT_VERIFIED / BLOCKED Register
Reading guide
This is the consolidated register of unverified, blocked, designed-only, and accepted limitations. Use it before describing readiness or promising protection.
For each item check the exact scope, evidence, and reason it remains open; NOT_VERIFIED is not interchangeable with FAILED.
Scope: every known limitation, residual finding, and unverified claim across the platform at validated base
9798ed8da870753c821b6a819fac3486a04825e6(p4 battery cited from its unmerged worktree doc, executed 2026-11-04). Labels:NOT_IMPLEMENTED·NOT_VERIFIED(exists, no executed evidence in the stated scope) ·BLOCKED(external dependency missing) ·ACCEPTED(documented residual risk, no fix planned at this level) ·DESIGNED(contract only).Nothing in this file may be paraphrased into a capability claim in marketing, docs, or a ToS.
1. Verification gaps (exist but unproven in the stated scope)
| # | Item | Label | Detail / evidence boundary |
|---|---|---|---|
| 1.1 | Multi-instance D1 at scale | NOT_VERIFIED | RT-REL-04 ran exactly 2 wrangler dev instances sharing one local D1 — dedup held exactly-1 but the losing instance surfaced 500 (sqlite contention), not clean 409 (F-04). Behavior at N>2 instances, remote D1, or real concurrency distribution is unexamined. |
| 1.2 | OUTBOX_SINK_URL delivery end-to-end | NOT_VERIFIED | deliver_event code path exists (checkout_impl.rs:269) and posts {id,topic,payload,attempts,created_at} JSON, but every executed test ran with the sink unset → consumer:none dead-letters. No test has observed a real 2xx delivery, retry-on-5xx, or sink outage. |
| 1.3 | Deployed staging/prod behavior of the security plane | NOT_VERIFIED | LICENSE_SECURITY_ENABLED is absent from wrangler.toml — PoP endpoints 404 wherever deployed. All PoP evidence is loopback. No claim about the deployed worker. |
| 1.4 | Remote D1 / production data | NOT_VERIFIED | Migrations 001–017 verified on local miniflare sqlite only. Remote-D1 apply, latency, and multi-region behavior unexecuted (charter-gated anyway). |
| 1.5 | Cron in deployment | NOT_VERIFIED | */5 outbox dispatch + prune_expired verified via live miniflare cron invocation (RT-REL-03) — never on a deployed schedule. |
| 1.6 | JWT path against real accounts | NOT_VERIFIED | Executed tests use dev-auth identities (x-dev-user). The verify_token_db path (DB re-check, token_version, act-as guard) has no executed end-to-end evidence against real issued tokens in this wave — red-team auth legs exercised the PoP/entitlement auth paths, not user JWT login. |
| 1.7 | Worker CPU/latency measurements | NOT_MEASURED | Only Axum be/ perf baseline exists (docs/perf-baseline.md) — different stack, does not transfer. See unit-economics-cost-model.md §2. |
| 1.8 | Seller-ops e2e in CI | NOT_VERIFIED (in CI) | seller-ops.spec.ts requires durable read APIs; the CI e2e job runs Axum be/ which lacks them → spec self-skips by design (probe gate, no false PASS). Executed only against wrangler dev locally. |
| 1.9 | Cross-session entitlement replay (track-b) | NOT_VERIFIED | Recorded residual in evidence/cross-track-report.md / trust-model §3. |
| 1.10 | Email delivery | NOT_IMPLEMENTED by charter | Mock email adapter only (charter §0 rule 5). No provider exists. |
2. Blocked on external dependencies
| # | Item | Label | Unblock condition |
|---|---|---|---|
| 2.1 | Real PG sandbox roundtrip | BLOCKED_EXTERNAL_CREDENTIALS | Toss live-mode or sandbox credentials + explicit approval. Today: TEST-keys-only adapter, all refetches hit 127.0.0.1:8799 stub; PAYMENT_LIVE_ENABLED=false; Portone 503 PAYMENT_PROVIDER_UNAVAILABLE. |
| 2.2 | Legal/privacy review | BLOCKED | Counsel review of data-protection-compliance.md open items C-1/C-2 (ToS, cross-border). |
| 2.3 | Production deploy of anything | BLOCKED | Charter §0: explicit user authorization; staging-first. |
| 2.4 | External customer pilot | BLOCKED | A non-author seller willing to run the pipeline. |
3. Designed-only (no executable product path)
| # | Item | Label | Notes |
|---|---|---|---|
| 3.1 | Hosted execution service | DESIGNED | hosted-execution-requirements.md — provider/isolation/secrets/limits/cost contract only. PoC experiment-h-hosted-exec is loopback research (thread-level isolation, no container boundary, no concurrency cap — its own §8/§9 lists the gaps). planner/capabilities.json maturity=designed. |
| 3.2 | Wire-version negotiation | NOT_IMPLEMENTED | No version field in entitlement claims (license-crypto/src/lib.rs claims: iss/lic_id/product_id/features/jkt_bound/cnf.jkt/iat/exp), no contract-version header, no negotiation logic in sdk/license/*. SDK is 0.1.0 with documented interop deltas vs the Worker (iss, activatePath). |
| 3.3 | Buyer self-service | NOT_IMPLEMENTED | No buyer dashboard; buyers cannot view own licenses/orders via API (email is not a credential). |
| 3.4 | Seller plan/billing collection | NOT_IMPLEMENTED | platform_fee_krw accrual exists at settlement; no collection path (pricing-model §1). |
| 3.5 | Usage read for billing | PARTIAL | usage_counters + read APIs exist; no per-request counter for activate/capability/status/verify; BYOS executions structurally unobservable. |
| 3.6 | Retention enforcement | NOT_IMPLEMENTED | retention_class/legal_hold columns only; no purge/anonymize/deletion endpoints (compliance §4). |
| 3.7 | D1 backup/restore | NOT_IMPLEMENTED | admin/backup exists only in Axum be/ (SQLite VACUUM INTO + verify); no D1-side backup endpoint or restore drill. |
| 3.8 | Worker entitlement aud/tenant_id claims | NOT_IMPLEMENTED (DEFERRED) | be-cloudflare/license-crypto emits only iss/lic_id/product_id/features/jkt_bound/cnf.jkt/iat/exp — no aud, no tenant_id (lib.rs:84-101). SDK emits tenant_id (nullable) and optional aud. Adding either to Worker tokens is a wire-format change deferred to a wire-v2 decision; recorded per d1 interface-contract-matrix.md §5. |
4. Accepted residuals (documented, not bugs)
| # | Item | Source | Bound |
|---|---|---|---|
| 4.1 | node:vm / worker threads not a security boundary | trust-model §2.6, runtime README | Escape → same-uid process; never co-locate caller-forbidden secrets. |
| 4.2 | BYOS enforcement removable by seller | trust-model §2.1 | Structural — enforcement covers the buyer-facing contract, not seller tamper-proofing. |
| 4.3 | Seller-internal executions unmetered | trust-model §2.2 | BYOS usage is seller-local (in-memory PoC metering); DevPay sees only hosted calls. |
| 4.4 | Cooperative-relay / analog hole | trust-model §2.3/2.4 | Capability+ metering bounds the oracle; delivered results reshareable. |
| 4.5 | DevPay-specific PoP contract (not RFC 9449) | p5-sdk-contract-audit | jkt double-hash, htu semantics, payload jwk, custom h — versioned-contract decision pending (§3.2). |
| 4.6 | Key rotation hard cutover | p4 F-06 | No kid overlap; in-flight entitlements die at 401 (120-s TTL bounds impact); mid-flight clients re-activate. |
| 4.7 | JWS typ header not enforced | p4 F-03 | Signature+claims still gate; PoC parity, non-security-bearing. |
| 4.8 | location_hint.file inert label | p4 F-01 (Low) | Planner artifact can carry attacker-chosen file label; transform.mjs never reads it — downstream consumers must not trust it. |
| 4.9 | Dev-identity parity gap | p4 F-02 | dev kind gets 401 on kind=="user"-gated lists while scope-read APIs accept it — fail-closed, no exposure. |
| 4.10 | Rate limiting only on /auth/login | p4 F-05, auth_impl.rs:334 | 5-fail→5-min lock, per-email. Everything else (incl. public licenses/verify) is unthrottled at the app layer. |
| 4.11 | 32-bit seller-issued license keys | product-contract KNOWN_LIMITATION | NG-{4hex}-{4hex} from POST /licenses — enumerable through public verify (purchase keys are 128-bit). |
| 4.12 | NODE_OPTIONS propagates to traced drivers | analyzer/dynamic.mjs:33 | Child-env allowlist passes NODE_[A-Z_]+ — ambient NODE_OPTIONS (e.g. --require) reaches the traced driver. Drivers are author-supplied so impact is bounded; partition workers deliberately drop it (different allowlist). |
| 4.13 | CI actions tag-pinned not SHA-pinned | yetdapay.yml header note | @v4/@stable accepted LOW; SHA-pinning + Dependabot is future hardening. |
| 4.14 | Reconciliation auto-fix scope | durable-authority §recon | Only stale-claim/state normalization is auto-fixed; money/entitlement findings stay needs_review — manual resolution with no SLA/owner. |
| 4.15 | No needs_review sweeper | refund_impl / recon | needs_review refund attempts and recon findings have no scheduled resolution job — manual ops only. |
5. Deliberate exclusions (product-scope §4)
No universal auto-protection (safe-subset only) · no hosted execution GA · no escrow/marketplace fund-holding · no absolute clone prevention · no native mobile/desktop SDKs · no real PG capture · no real email.
6. Register maintenance
This file is the single consolidated register. When a finding is fixed, move it to the implementing wave's report and annotate here — do not delete history. When a NOT_VERIFIED item gains executed evidence, upgrade it in implementation-status.md and cite the run.