# Known Limitations — Nexus Laptop POC

## Platform lockdown

| Limitation | Detail |
|------------|--------|
| Shell-only policy | Alt+Tab, Win key, Task Manager, Explorer outside Shell still work |
| Overlay mode | Windows desktop visible behind Nexus — intentional for safe POC |
| No Winlogon replacement | Nexus is an app, not the Windows shell |

## Package

| Limitation | Detail |
|------------|--------|
| Framework-dependent | Requires .NET 8 + .NET 10 Desktop Runtime (~4 MB vs ~110 MB self-contained) |
| Identity local only | Identity API runs on localhost:5050 — not for multi-user production |
| POC seed credentials | `user@nexus.local` / `admin@nexus.local` — rotate before any wider use |

## Developer Console

| Limitation | Detail |
|------------|--------|
| Escape disabled | All Windows tools show "Disabled in POC for safety" |
| No TOTP MFA | Planned phase 2 |
| In-memory + file audit | No central SIEM yet |

## Hosting

| Limitation | Detail |
|------------|--------|
| latest.json UTF-8 BOM | Some strict JSON parsers need BOM strip |
| Ephemeral catbox staging | Publish uses temporary HTTPS upload → wget; consider persistent volume in POC 2 |
| No auto-update in Shell yet | Manifest format ready; client update flow is POC 2+ |

## Security

| Limitation | Detail |
|------------|--------|
| Config tampering | Local JSON can be edited by admin user |
| Public download URL | Acceptable for POC; sign artifacts in production |

## Future (POC 2/3)

- Self-contained or MSI installer
- Persistent Coolify volume for downloads
- MSIX with proper uninstall
- Platform lockdown (GPO, AppLocker, Winlogon) — **only with recovery plan**
