conductor/docs/KNOWN_LIMITATIONS.md

Known Limitations for v1.0.0

• SQLite supports one Conductor instance with a persistent local volume; active/active replicas and PostgreSQL are not supported.
• Local username/password authentication is the release provider. OIDC/SSO is planned for Slice 9.
• Roles are global admin and user; per-application assignments and custom roles are not implemented.
• Published visibility is application-wide (public or all authenticated users), not page-specific.
• Page navigation is flat. Nested routes, path parameters, per-page permissions, and cross-page component bindings are not supported.
• Runtime values are ephemeral and reset on full browser reload.
• REST proxy authentication supports Anonymous, Basic, Bearer, API-key header, and API-key query. OAuth 2.0, mTLS, and custom auth are deferred.
• Workflow orchestration, action graphs, loops, retries, and long-running jobs are out of scope.
• Binding transforms and advanced expression languages are deferred.
• The v1.0.0 production image supports Linux/AMD64 only. ARM64 publication remains blocked on a native SQLite build/smoke runner.
• The Projects navigation item is a placeholder. Create, save, update, and load projects from the Visual or JSON Editor toolbar; deletion remains API-only.
• Component names are validated within a page, but project-wide unique names are recommended because template and binding paths do not include a page qualifier.
• Page-variable scope records intended ownership, but v1.0.0 does not fully reject or prevent cross-page variable references. Keep each page-scoped variable on its declared page.
• Backups are local archives by default; operators must arrange off-host copies and retention appropriate to their recovery objectives.