Production Boundaries

Production Boundaries

This is a hackathon prototype. Some boundaries are stated by the repo. Others were observed in the code for this wiki.

Stated by the repo (README "What it does not defend")

Boundary	Effect
All authoritative state is in memory	A restart loses permits, escrows, approvals, pending sandbox operations, revocations and the ledger
No caller authentication on HTTP	Localhost demo only (binds 127.0.0.1)
Ledger is a hash chain, not a signature	It cannot detect removal of the final entries without an external checkpoint
Single-merchant sandbox prototype	The merchant binding is configured, not discovered. CAD only
Refunds are out of scope	A completed capture cannot be undone by the e-stop
Demo acceptance key is hard-coded	Predicate A uses a labelled demo HMAC key (settlement/verifier.py)
No review by a payment network or auditor	Per SECURITY.md

Observed in code at 9900817

Observation	How verified
/estop (and the dashboard e-stop) revokes one permit, not the subtree. A child's in-flight escrow could still capture	Local in-process run (repeated at 9900817)
Capture admission checks the escrow's own permit for missing/revoked/granted expiry. It does not check ancestors or a tightened expiry	Local in-process run (repeated at 9900817) + code read
POST /api/permits and /delegate coerce cap_cents with int(). Floats are truncated, and 0.5 drops the connection	Local mock-server probe (repeated at 9900817)
The sandbox client no longer recovers from ORDER_ALREADY_AUTHORIZED (the fix was removed in 980da3e)	Code read + git history. Live effect: Unknown
Exceptions other than the handled ones in server.py handlers (for example a sandbox MerchantMismatch on spend) are not caught by the route	Code read. Client-visible behaviour: Unknown

Fixed since d7d27d6

• trace.py no longer uses a fixed port (17943eb).
• The LLM runner no longer defaults to an author-local path. PERMIT_GROK_CLI is now required (PR #12).

See E-Stop and Revocation and Tighten-Only Narrowing.