# IHVRK limitations

Each limitation has an ID that other documents cite. Status labels follow the IHVRK evidence vocabulary.

| ID | Limitation | Status | Consequence |
|---|---|---|---|
| L-INTEG | IHVRK is a library + reference gate. It is **not wired into** the live CAIN gateway, MCPGate proxy or any of the three public sites. | NOT_IMPLEMENTED (integration) | Nothing in production is protected by IHVRK today. |
| L-STORE | Nonce, request and permit state live in one SQLite file. Uniqueness and atomicity hold for all processes that share that file on one host with a POSIX filesystem that honours locks and fsync. | IMPLEMENTED_AND_TESTED (single node) | A multi-node deployment needs a linearizable store behind the `EpochRegistry` interface. Until then: one node. |
| L-HSM | No HSM or KMS is attached. All service keys are `SOFTWARE_TEST` keys in process memory. `HardwareKeyStore` raises and has no fallback. | NOT_IMPLEMENTED | Compromise of the service host = compromise of the permit, challenge and checkpoint keys. |
| L-PQC | ML-DSA (FIPS 204) is not used. The pinned `cryptography` build exposes no ML-DSA API here. | NOT_IMPLEMENTED | Classical Ed25519 only. |
| L-ATTEST | Hardware attestation (SEV-SNP, TDX, Nitro, TPM quotes) is not appraised. Only a software-measured statement signed by a pinned key can satisfy the environment check. | NOT_IMPLEMENTED / EXTERNALLY_DEPENDENT | A HARDWARE_BACKED requirement always blocks. |
| L-HUMAN | A valid approval signature proves only that a key enrolled to a verifier id signed this exact action. It does not prove a person was present, saw a faithful rendering, or understood the consequences. Identity proofing is the enrollment authority's procedure (`identity_proofing` is only a reference string). | ARCHITECTURALLY_SPECIFIED | Rendering the digest into a human-readable form on the verifier device is outside IHVRK. |
| L-BIO | No biometric processing exists. `authn` carries a method name and an AAL claim, capped by the enrolled AAL. No raw biometric data is accepted or stored. | NOT_IMPLEMENTED (by design) | Liveness and presentation-attack detection are the authenticator's job. |
| L-DID | Verifier ids may be DID strings, but no DID document is resolved. The key comes only from the signed enrollment record. | ARCHITECTURALLY_SPECIFIED | No dependency on DID resolution. No W3C VC verification either. |
| L-TIME | The service clock is trusted (`A-TIME`). Its declared uncertainty is honoured: a deadline inside `[now−u, now+u]` blocks. There is no external time source (Roughtime/NTS). | IMPLEMENTED_AND_TESTED under assumption | A host with a wrong clock and a small declared uncertainty can mis-judge expiry. |
| L-LEDGER | The ledger is tamper-evident, not immutable. Without an off-host checkpoint, a consistent rewrite or a truncation of the newest records is undetectable (tests G8, G9 assert this). Anchoring to a public transparency log is not done. | IMPLEMENTED_AND_TESTED; anchoring EXTERNALLY_DEPENDENT | Checkpoints must be exported (to the auditor, a witness, WORM storage). |
| L-RT-LSM | The eBPF LSM hooks compile and pass the kernel verifier but cannot be attached on the build host: `bpf` is not in the active LSM list (`lockdown,capability,landlock,yama,apparmor,ima,evm`). Enabling it means changing the kernel boot parameters, which is the owner's infrastructure decision. | BLOCKED | No kernel-level denial was demonstrated. The user-space daemon that would fill `ihvrk_blocked` is not written. |
| L-RT-TP | `ihvrk_telemetry.bpf.c` uses tracepoints, which cannot deny anything. | IMPLEMENTED (telemetry only), not attached | Observability only. |
| L-RT-FREEZE | `cgroup.freeze` contains only tasks in the configured cgroup. Helpers outside it keep running (F12), kernel I/O already in flight completes, open sockets stay open, and anything the agent can reach through another principal is untouched. It is containment, not an interrupt. | IMPLEMENTED_AND_TESTED (disposable scopes on this host) | Must be paired with the gate being the only route to the resource. |
| L-NMI | No hardware or non-maskable interrupt mechanism is used or claimed. | NOT_IMPLEMENTED | – |
| L-DOS | Anyone who can submit approvals can deny a pending request by sending `MAX_ATTEMPTS` (5) invalid ones. This is a deliberate fail-closed trade-off. | ACCEPTED_RESIDUAL_RISK | Put the approval endpoint behind authenticated transport. |
| L-EXACTLY-ONCE | At most one start per permit. A crash after consumption gives INDETERMINATE, never an automatic retry. | IMPLEMENTED_AND_TESTED | A human resolves INDETERMINATE requests. |
| L-INDEP | The models, tests, verifier and code were all written in one session by one author (an AI model). The stand-alone evidence verifier shares no code with `ihvrk/`, but it shares the spec and the author. No third-party review has happened. | – | Independence is limited to code separation. |
| L-PERF | Benchmarks come from one run on a shared 6-vCPU host under load (≈10). They are a baseline, not capacity figures. | – | Re-measure on the target host. |
| L-FLAKE | The runtime (cgroup) suite was intermittently failing (about 1 in 24 runs, then once in a full-suite run). Cause found: tests F4 and F12 asserted after a fixed sleep instead of waiting for `frozen 1`. Fixed; 15/15 consecutive runtime runs passed afterwards. Timing-based tests can still be sensitive on a heavily loaded host. | CLOSED (monitor) | Re-run the runtime suite a few times when auditing. |