Limitations

Quick summary

Client-side code remains inspectable and cloneable in principle. Current tests and SDK claims apply only to the stated environment and verification scope.

Distinguish accepted design limits from unimplemented functions and blocked external verification before adopting DevPay.

Digested from docs/product/known-limitations.md — the single consolidated register and the authoritative source. Labels: NOT_IMPLEMENTED · NOT_VERIFIED · BLOCKED · ACCEPTED · DESIGNED · PARTIAL.

Structural (accepted residuals — documented, not bugs)

• A public client is cloneable in principle. Non-extractable keys block naive extraction, not profile clone or abuse-in-place (threat model).
• node:vm / worker threads are not a security boundary — an escape lands in the same-uid process; never co-locate caller-forbidden secrets (§4.1).
• BYOS enforcement is removable by the seller — enforcement covers the buyer-facing contract, not seller tamper-proofing (§4.2).
• Seller-internal executions are unmetered — DevPay sees only hosted /licenses/execute calls; BYOS usage is seller-local (§4.3).
• Cooperative-relay / analog hole — capability + metering bound the oracle; delivered results are reshareable (§4.4).
• DevPay-specific PoP contract, not RFC 9449 — jkt double-hash, htu semantics, payload jwk, custom h (§4.5).
• Key rotation is a hard cutover — no kid overlap; in-flight entitlements die at 401 within the 120-s TTL (§4.6).
• Rate limiting only on /auth/login — 5-fail → 5-min lock, per-email; everything else is unthrottled at app layer (§4.10).
• 32-bit seller-issued license keys — NG-{4hex}-{4hex} from POST /licenses are enumerable through public verify; purchase keys are 128-bit (§4.11).
• NODE_OPTIONS reaches traced analyzer drivers — bounded: drivers are author-supplied; partition workers drop it (§4.12).

Verification gaps (exist, unproven in stated scope)

• Multi-instance D1 at scale — dedup held exactly-1 over 2 local instances; the loser saw 500 (sqlite contention), not clean 409; N>2 and remote D1 unexamined (§1.1).
• OUTBOX_SINK_URL end-to-end delivery — code path exists; every test ran with the sink unset (§1.2).
• Deployed PoP behavior — LICENSE_SECURITY_ENABLED is absent from wrangler.toml; all PoP evidence is loopback (§1.3).
• Remote D1 migrations, deployment cron, real-account JWT path — unexecuted (§1.4–1.6).
• Worker perf — only the Axum baseline exists; does not transfer (§1.7).
• Email delivery — NOT_IMPLEMENTED by charter; mock adapter only (§1.10).

Blocked on externals

• Real PG sandbox roundtrip — BLOCKED_EXTERNAL_CREDENTIALS; TEST keys only, PAYMENT_LIVE_ENABLED=false, Portone → 503 (§2.1).
• Legal/privacy review; production deploys; external pilot (§2.2–2.4).

Designed-only / not implemented

• Hosted execution service — DESIGNED (requirements doc + loopback research PoC; not a container boundary) (§3.1).
• Wire-version negotiation — NOT_IMPLEMENTED; contract v1 is implicit, no version field anywhere (§3.2).
• Buyer self-service — no buyer dashboard or own-record API (§3.3).
• Seller plan/billing collection; retention enforcement; D1 backup/restore (§3.4, §3.6–3.7).
• Usage read for billing — PARTIAL; BYOS executions structurally unobservable (§3.5).
• Worker entitlement aud/tenant_id — DEFERRED to a wire-v2 decision (§3.8).
• Device unbind — resetDevice() burns a max_devices slot; no unbind path exists.

Deliberate exclusions (product scope)

No universal auto-protection (safe-subset only) · no hosted execution GA · no escrow/marketplace fund-holding · no absolute clone prevention · no native mobile/desktop SDKs · no real PG capture · no real email.

Nothing here may be paraphrased into a capability claim

Per the register's own rule: these rows bound what marketing, docs, and ToS may say.