Current Limitations

Current Limitations

This page records verified implementation gaps and explicit non-claims. It is kept consistent with current source and the QEMU release-candidate contract. Progress status and ownership live only in Project Tracker.

Platform and hardware

• AArch64 QEMU provides the broadest complete OS-service path. QEMU validates behavior, not physical ARM performance, firmware behavior, or scaling.
• VMware Fusion 25.0.1 on Apple Silicon reaches /init through a generated ARM64 compatibility stage. VMware networking, persistent storage, multi-vCPU discovery, and later service gates are not integrated.
• The x86_64 QEMU image executes the complete common process/thread, filesystem, networking, SSH/SFTP, control, security, AI Cell and telemetry service set. Modern PCI VirtIO block/network and emulated NVMe pass focused correctness gates. The platform matrix reaches 256 vCPUs with x2APIC.
• Physical x86 firmware, interrupt routing, NIC, NVMe durability, NUMA locality, AVX2/AVX-512/VNNI/AMX state, security exposure and performance remain unvalidated. QEMU parity is not a physical support claim.
• Physical Apple, Intel desktop, Xeon, SMMU/IOMMU, NVMe, NIC, NUMA, many-core, thermal, power, and performance evidence is not present.
• The macOS TCG/EDK2 harness permits at most two nonfatal startup retries and saves each failed serial log. Guest panic/assertion markers are never retried. This is emulator robustness handling, not physical boot evidence.

Networking and SSH

• FreeBSD 15.1, native macOS, and Debian 13 OpenSSH clients pass bounded QEMU interoperability suites. This is not a production Internet deployment or an independent security audit.
• The normal QEMU boot requires an external IPv4 A-record response before SSH binds. This checks the configured gateway/DNS path only; it is not a general Internet-health check. Failure reports a numeric startup error. A local shell is available only after PBKDF2 authentication in explicitly password-enabled development images; default, key-only and release consoles stay locked.
• The SSH service deliberately supports four transports and two active channels per transport. Fleet-scale identity, audit, replay, and connection policy remains unresolved.
• SSH key exchange is classical curve25519-sha256 only. Hybrid post-quantum key exchange, OpenSSH interoperability and downgrade-policy review remain production security gates; the quiet local QEMU launcher only suppresses the OpenSSH 10 client notice for that development connection.
• The outbound guest SSH/SCP client uses the same classical crypto suite, verifies Ed25519 host keys through persistent TOFU, and currently authenticates with passwords over IPv4 or DNS A records. Public-key client authentication, IPv6 active opens, forwarding, agents and jump hosts are not implemented.
• DNS performs asynchronous external A-record resolution with timeout, retry, cache, and a QEMU-verified cache hit. DNSSEC, TCP fallback, complete AAAA application results, and deployment resolver policy remain absent.
• The SNTP client validates request binding, server mode/version, stratum, and bounded retry/timeout behavior. QEMU's PL031 RTC may report epoch zero, and public UDP/123 may be filtered; both conditions remain explicit instead of being reported as synchronized. Production NTP authentication, source policy, drift discipline, and physical RTC qualification remain open.
• TCP implements retained segments, cumulative and partial ACK handling, RTT/RTO backoff, SACK, fast retransmit, zero-window handling, bounded reordering, keepalive, and FIN bookkeeping. Repeated-loss physical-network soak and congestion-control tuning remain unverified.
• Bounded IPv4/IPv6 reassembly and source fragmentation pass maximum-size UDP echo under dual-client load and focused AArch64/x86_64 QEMU gates. A deterministic sanitizer corpus covers 50,000 malformed fragment inputs; coverage-guided hostile fuzzing and physical lossy-link behavior remain.

Storage and persistence

• VirtIO block/network use interrupt-assisted completions, indirect descriptors, and bounded queued work. The x86 block gate records whether the post-reset completion arrived through MSI-X and otherwise verifies the bounded polling fallback. Repeated block MSI-X delivery after a device reset is not claimed from QEMU. Emulated NVMe covers focused identify/write/flush/read and backing-byte checks.
• AArch64 and x86_64 QEMU negotiate four NVMe I/O queues and pass four-page PRP 16 KiB write/read/flush operations with host backing-byte verification. Asynchronous block integration, SGL, queue affinity, cancellation, direct final-buffer reads, physical durability, discard behavior, and throughput remain open.
• ModelFS supports signed registration, resumable staging, verification, immutable activation, scrub/quarantine, cleanup/reuse, and free-only trim under hosted and QEMU tests.
• Trusted-replica repair, production signing and key custody, physical multi-terabyte transfer, and model-v2 execution admission are not complete.
• ModelFS activation and MutableFS audit persistence are separate durability domains. A post-publication audit failure cannot roll back an already published active generation.
• MutableFS v4 is intentionally bounded to 128 nodes, 64 open handles, 128 KiB files and 2 MiB of data space. Interactive nano is further bounded to a 32 KiB editing buffer. This is suitable for OS state and small user files, not general bulk storage or model weights.
• Tar/ZIP exchange is bounded by that 128 KiB file limit. Tar extraction accepts ustar, PAX paths, GNU long names and one gzip member; ZIP accepts stored and Deflate entries. Symlinks, device nodes, encrypted ZIP, ZIP64, multi-member gzip and gzip creation are explicitly unsupported.

Administration and security

• xaios.control.v1 operations are bounded to 16 active keys, 16 revoked fingerprints, 64 audit/replay records, and 16 shell contexts. These are implementation limits, not fleet-scale targets.
• Role, capability, replay, rollback, host-key rotation, sensitive-path denial, and secret-redaction behavior pass QEMU/OpenSSH gates but have not received an independent production security review.
• Update signing uses a development trust root to validate transaction, fallback, and rollback behavior. The checked-in private fixture seed is public; production key custody, rotation, revocation, and release authorization are unresolved.
• xapt uses HTTP/1.1 with a required Content-Length; it does not yet support TLS, transfer encoding, compression, proxies, mirrors, deltas, dependencies, or unattended updates. Signed catalogs and payload hashes provide integrity and authenticity for the QEMU scope, not transport confidentiality.
• External applications are bounded to 128 KiB by the current MutableFS/app loader, and only one previous version is retained. Shipped applications, including xapt, nano, htop, and pong, are standalone ELFs; publishing them as independently upgradable repository packages still requires signed package manifests and architecture-specific payloads.
• QEMU verifies persistent clean/unclean lifecycle records, rescue selection, reset/poweroff dispatch, and block flush completion. It cannot establish physical power-loss durability or platform reset correctness. Thermal and PMU support reports remain explicitly unavailable until physical backends exist.

Inference engine and model support

• The kernel model-v1 path is a deterministic fixture. It does not execute a transformer and must not be described as real inference.
• Model-v2 parsing, streaming writing, architecture/backend registries, immutable readers, sessions, and scalar packed kernels are foundations only. Model-v2 packages are not yet executed end to end.
• No official tokenizer importer, real Qwen tensor importer, transformer plan, logits parity, or deterministic 32-token decode parity exists.
• Qwen 3.6 27B is the next active correctness workstream now that the declared QEMU platform gate passes. Kimi K3, DeepSeek V4 Flash 0731, and GLM 5.2 remain later roadmap targets.
• Kimi K3 KDA, Gated MLA, AttnRes, exact top-16 routing, shared experts, native MXFP4, text parity, and multimodal execution are not implemented.
• Scalar INT4/INT6 and experimental NEON/AVX2 packed kernels pass bounded correctness tests. Physical AVX2 validation, AVX-512/VNNI, AMX, SVE, tiled prefill/verification, persistent worker gangs, and bandwidth autotuning remain incomplete.
• No complete model-executing native macOS process, Metal backend, physical model-parity run, cluster data plane, or immutable performance artifact exists.

Evidence policy

Sparse files above 4 GiB or 100 GiB prove address width and bounded-memory behavior, not physical transfer throughput. High-vCPU QEMU gates prove dynamic metadata capacity, not server scalability. Performance claims require physical artifacts satisfying docs/BENCHMARK-CONTRACT.md.

See Project Tracker.