> ## Documentation Index
> Fetch the complete documentation index at: https://comis-fix-skill-import-vetting-gate.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Known Limitations

> Current runtime, security, interoperability, and operational limits to evaluate before deployment

Comis is an open-source, self-hosted runtime under active development. This
page summarizes limits that matter when deciding what access to grant and where
to deploy it.

<Info>
  Read the repository
  [threat model](https://github.com/comisai/comis/blob/main/THREAT_MODEL.md)
  for the complete trust boundaries, defended threats, residual risks, and
  operator checklist.
</Info>

## Execution isolation depends on the path and host

Linux with a working Bubblewrap provider is the strongest supported execution
boundary. macOS `sandbox-exec` is best-effort and does not provide the same
boundary.

The ordinary `exec` tool can run directly on the host when its sandbox is
disabled or unavailable. Some terminal and durable orchestration paths fail
closed or downshift when their jail cannot be established, but that stronger
behavior does not apply to every tool.

MCP stdio servers, in-process Node tools, and browser processes are outside the
ordinary exec sandbox. Verify the exact path used by each integration instead
of describing the whole deployment as sandboxed.

## Least-privilege defaults require operator configuration

* The default agent tool-policy profile is `full`.
* An empty per-agent `secrets.allow` list is unrestricted.
* Human approvals are disabled by default and run only on explicitly wired
  paths when enabled.
* Action classification informs policy and audit; classification alone does
  not pause an action.

Narrow tool policy and secret patterns before accepting untrusted input. If a
workflow requires human confirmation, verify that the specific action reaches
an enabled approval gate.

## Skill and code extensions

Prompt-skill manifests can declare permissions and allowed tools, but those
fields are advisory metadata unless the same limits are enforced through
runtime tool policy and deployment controls.

The core plugin registry currently exposes lifecycle hook registration to
source-integrated plugins. Comis does not yet ship a stable third-party code
plugin loader or marketplace. Adding code-level tools, routes, adapters, or
configuration normally requires a source change and composition-root wiring.

## API and protocol coverage

The OpenAI-shaped HTTP surface implements selected request and response shapes.
It is experimental and is not a complete compatibility layer.

Agent Client Protocol support is early, library-level bridge work. Comis does
not yet ship a daemon entrypoint, non-text prompt support, complete capability
negotiation, in-flight cancellation, or a complete approval response round
trip.

No external A2A protocol implementation is currently shipped. Internal
agent-to-agent routing and delegation are not the same as implementing the A2A
standard.

## Context recovery is not an unbounded active prompt

The default DAG context engine keeps canonical messages and tool results
recoverable beneath budget-bounded summaries. The active prompt can still
contain lossy summaries of older regions. `ctx_search`, `ctx_inspect`, and
`ctx_expand` recover selected detail on demand.

Configured durable graphs can resume from node-boundary checkpoints. General
exact replay of arbitrary agent, provider, network, and tool behavior remains
incomplete.

## Observability has deployment boundaries

Comis provides traces, trajectories, audit events, incident explanation,
delivery and system health, memory diagnostics, provider cost accounting, and
opt-in spend ceilings. This evidence is broad but does not guarantee that every
external side effect can be reconstructed exactly.

The standalone Prometheus endpoint has no built-in authentication. Keep it on a
trusted interface or protect it with an authenticated proxy. OpenTelemetry
model-call export exists, while standard agent, workflow, and tool semantic
spans remain incomplete.

## Self-hosting does not mean offline

The runtime and stored operational data can run on infrastructure you control.
Configured model, embedding, messaging, media, MCP, and tool providers may
still receive data deliberately routed to them. Review each provider's data
handling and the credentials granted to it.

## Enterprise readiness is not claimed

Comis does not yet provide proof of a complete enterprise identity stack,
independently audited tenant isolation, high availability, Kubernetes
operations, compliance controls, or commercial support commitments.

Before critical or regulated deployment, evaluate identity integration,
authorization defaults, host isolation, retention, backup and restore,
upgrades, rollback, availability, metrics protection, support, and external
security review.

## Provider and deployment coverage

Deterministic tests cover the core runtime extensively, but not every model,
provider, channel, media service, tool, or host combination is validated live.
APIs and configuration can change during active development. Pin versions,
test the exact deployment profile, and review release notes before upgrading.