# Known Limitations for v1.0.0

- SQLite supports one Conductor instance with a persistent local volume; active/active replicas and PostgreSQL are not supported.
- Local username/password authentication is the release provider. OIDC/SSO is planned for Slice 9.
- Roles are global `admin` and `user`; per-application assignments and custom roles are not implemented.
- Published visibility is application-wide (`public` or all authenticated users), not page-specific.
- Page navigation is flat. Nested routes, path parameters, per-page permissions, and cross-page component bindings are not supported.
- Runtime values are ephemeral and reset on full browser reload.
- REST proxy authentication supports Anonymous, Basic, Bearer, API-key header, and API-key query. OAuth 2.0, mTLS, and custom auth are deferred.
- Workflow orchestration, action graphs, loops, retries, and long-running jobs are out of scope.
- Binding transforms and advanced expression languages are deferred.
- The `v1.0.0` production image supports Linux/AMD64 only. ARM64 publication remains blocked on a native SQLite build/smoke runner.
- The **Projects** navigation item is a placeholder. Create, save, update, and load projects from the Visual or JSON Editor toolbar; deletion remains API-only.
- Component names are validated within a page, but project-wide unique names are recommended because template and binding paths do not include a page qualifier.
- Page-variable scope records intended ownership, but v1.0.0 does not fully reject or prevent cross-page variable references. Keep each page-scoped variable on its declared page.
- Backups are local archives by default; operators must arrange off-host copies and retention appropriate to their recovery objectives.