Skip to content

known-limitations.md

Latest commit

 

History

History
169 lines (132 loc) · 8.91 KB

known-limitations.md

File metadata and controls

169 lines (132 loc) · 8.91 KB
Raw

Known limitations

Honest constraints for v0.7.0 evaluators. For capability tiers see feature-status.md. For live-backend setup see troubleshooting.md.

Runtime notices: spanda run, spanda sim, and live transport/AI calls print one-time [spanda] warnings when mock or in-memory backends are active. Set SPANDA_QUIET=1 to hide them.

Runtime and execution

  • The tree-walking interpreter is the primary execution path. LLVM native codegen is experimental (spanda compile-native, spanda llvm-ir).
  • Real-time contracts (deadline, jitter, priority, budgets) on the interpreter are intent + monitoring (compile checks + miss telemetry), not OS hard real-time — see realtime.md.
  • Simulation is physics-lite 2D — suitable for logic and safety testing, not high-fidelity Gazebo-class physics.
  • Multi-robot fleet examples default to in-process simulation with per-robot setup/execute. Distributed orchestration uses HTTP fleet agents and optional mesh coordinator — not a production fleet OS.
  • Mission continuity checkpoints persist to .spanda/mission-checkpoints.json (override with SPANDA_CONTINUITY_CHECKPOINTS). Runtime takeover on fleet agents requires deployed programs and mesh/agent wiring — validate in staging before field trials.

AI and providers

  • AI models use mock backends by default. Live OpenAI, Anthropic, and ONNX require API keys or model paths (SPANDA_LIVE_AI=0 forces mock).
  • provider: string literals must be one of mock, openai, anthropic, onnx (checked at compile time); unknown names no longer silently fall through as mock at check time.
  • Provider packages wire through an in-process registry; there is no managed cloud inference service.
  • Setup: troubleshooting.md — Live AI and extern bridges · live-ai-provider.md

Language surface

  • Traits support export trait across modules via import; private traits stay local.
  • User generics are Stable for module fn + struct type params; T: Bound, where, and trait/enum generics remain unsupported — spanda-type-system.md.
  • Closed typed enums: AiProvider.*, SerializeFormat.*, CodegenTarget.* (bare idents/strings still accepted).
  • Cognitive policies use @policy(kind: "homeostasis"|"attention") only — legacy homeostasis_policy / attention_policy keywords are removed (breaking).
  • Official package spanda-policies exports std.policies.homeostasis / std.policies.attention scaffolds; evaluation remains in spanda-autonomy.
  • spanda codegen --target accepts only native, wasm, esp32.

Safety model (precise guarantee)

See the authoritative paragraph in spanda-type-system.md — Safety motion guarantee. In short: AI motion must use safety.validate → execute(SafeAction); drive/follow cannot take ActionProposal components; max_speed and optional max_angular are clamped on the interpreter drive/execute/validate paths, and follow(path:) cruise is re-validated each tick via validate_action_proposal (stops on reject; zone/max_speed caps still apply).

Connectivity and IoT

Packages and registry

  • Monorepo installs prefer registry/index.json plus on-disk packages/registry/; compile-time LOCAL_REGISTRY stub is incomplete but no longer blocks install.
  • spanda publish mirrors bundles to registry/packages/ in-repo. Remote upload needs SPANDA_REGISTRY_URL.
  • The hosted index lists curated packages; community expansion is ongoing.

Verification and certification

Spanda does not perform formal verification. See verification-vocabulary.md for the three distinct mechanisms:

  • spanda verify / spanda compatibility — hardware fit checking

  • verify { } / assert { } — runtime assertions

  • certify … { } — declared metadata only (not a certification body sign-off)

  • requires / ensures — runtime contracts (ensures is checked after the body runs)

  • certify ISO13849 { … } is verify-time metadata — not a formal certification body sign-off.

  • Capability traceability and minimum-hardware checks are static analysis plus runtime health hooks — not IEC 61508 tooling.

Tooling

  • LSP and DAP work with a built native CLI; VS Code extension builds in CI. Marketplace listing is partial: GitHub secret VSCE_PAT and publisher spanda-lang are configured; public upload is blocked by the automated “suspicious content” scanner until Microsoft manual review. Install from release VSIX or vscode-marketplace-publish.md.
  • WASM playground covers check/run/verify — smaller surface than native CLI.

Security

  • Encryption and signed messages are implemented for wire frames and audit records. No production HSM or PKI integration is bundled.
  • remote_signed kill switch requires configured signature material — verify reports errors when missing.

Replay and twins

  • Mission traces are local files (--record → spanda replay). No managed trace cloud.
  • OSS Twin Cloud (/v1/twins/*, spanda twin cloud) is Stable with file-backed storage. Hosted managed product (billing, SLA, multi-region) is separate — hosted-twin-cloud-product.md.

Platform

  • ROS2 adapter requires ROS Humble and manual setup on Linux (SPANDA_ROS2_LIVE=1 for live topics).
  • Windows support is via MSI/prebuilt CLI; some golden paths are Linux/macOS only in CI.

Cognitive & Resilience Architecture

  • Stable implementation tier — see feature-status.md, cognitive-resilience-maturity.md, and cognitive-resilience-architecture.md. Field soak for production claims remains organizational (organizational-gates.md).
  • Sensory fusion is entity-derived and rule-based (Stable); fusion conflicts lower entity readiness to partial scoring. Optional live multi-sensor pipeline via SPANDA_LIVE_FUSION_SENSORS=1 (Stable-with-env-gate) merges GPS/IMU/camera or automotive proxy reads when a supplier is registered at CLI startup.
  • Control Center Cognitive & Resilience tab uses live REST panels with browse-by-category memory and a maintenance schedule; gRPC parity ships for /v1/autonomy/*.
  • Homeostasis merges entity health with interpreter scheduler telemetry when a recent run/sim completed.
  • Reflex traces persist to .spanda/autonomy-reflex-traces.json (override with SPANDA_AUTONOMY_TRACE_FILE). Episodic memory persists to .spanda/autonomy-episodic-memory.json and indexes .trace replay files.
  • Adaptive recovery learning is statistics-based (no ML); preferred strategy feeds spanda mission verify abort/replan. Accuracy thresholds: min 3 attempts, escalate below 30%, Stable field target ≥70% over 30-day soak.
  • Maintenance windows: spanda maintenance window list|set and GET/POST /v1/autonomy/maintenance/windows (POST requires Operate).
  • Habituation/sensitization applies to CLI-reported alert analysis, not all telemetry backends.

Organizational gates (not code blockers)

Enterprise operations and solution blueprints ship as Stable in code and CI, but full production claims still require:

  • 30-day field soak — ./scripts/enterprise_ops_field_soak_init.sh then ./scripts/enterprise_ops_stable_promotion_gate.sh
  • Third-party security audit — ./scripts/security_audit_prep.sh then external reviewer sign-off

Tracked as RB-007 / #51. Full v1.0 checklist: organizational-gates.md · runbooks: enterprise-ops-stable-promotion.md · release-blockers.md.

Not planned (by design)

Spanda intentionally does not target: blockchain production adapters, cryptocurrency integrations, advanced swarm intelligence research, self-hosting compiler as default, or custom database backends as core product scope.

Reporting issues

If behavior differs from this document, file an issue with spanda --version, OS, and the smallest .sd reproducer. For setup and integration failures, start with troubleshooting.md.