# Known limitations

What Warden doesn't do yet, in plain words. We'd rather you heard it from us.

Warden is a developer preview, provided as is. This page lists what it doesn't do, so you can decide where to rely on it. If you find a way past a rule, please [report it privately](https://github.com/plutocoach/warden/security/advisories/new).

## What is checked

- **Only agents you run inside Warden are checked.** Claude Code or Codex in your own terminal isn't.
- **Claude Code, API-key and local models are checked before every action.** With Codex, Copilot, Devin and Kimi, anything the agent asks permission for is checked before it runs, but a tool it runs without asking is only checked as it starts: it may already have run, though a blocked result is thrown away before the agent sees it.
- **Rules check each command before it runs, not what a running program does.** An allowed `python script.py` can still read `.env` from inside the script.
- **Commands you type in Warden's terminal aren't checked.** Rules apply to the agent, not to you.
- **On the Open rule set, commands Warden can't read in advance** (`eval`, `$(...)`, backticks, `python -c`) run without asking. Guarded asks; Hardened blocks.
- **Command rules match flags, not every way to say the same thing.** `deny: "rm -rf"` catches `rm -fr` and `rm --recursive --force`, but a different program that deletes files (`find -delete`, a script) needs its own rule.

## Rules

- **A `touches:` rule takes one value.** For several, write one rule each.
- **In a sandboxed run, anything named in a deny or ask rule is unreachable**, including values under `unless:`. *Deny all web fetches unless github.com* also blocks github.com inside the sandbox.
- **Rule files live on your Mac**, not in the repository. Share them with **Export bundle** and **Import bundle**, or company-wide with [Warden Team](team).

## Software Factory

- **The pipeline and its items live on one Mac.** They don't sync to teammates yet, and nothing moves while Warden is closed.
- **A local merge doesn't push.** Staging and Production advance only once the change reaches the remote branch, tag or deployment you defined.
- **The Factory never deploys and never merges a pull request by itself**, and doesn't show CI logs.
- **Express's policy review passes when no assurance checks are configured.** Set up checks before you let Express merge unattended.
- **Up to two sandboxed builds run at once**, and triage, drafting and reviews run one at a time. An unattended merge of more than 300 files is held.
- **Builds start from `origin`** only, and a build's starting point can't change once its worktree exists.

## Assurance and review

- **L2 plants up to five bugs per change**: a useful signal, not a full mutation-testing run.
- **L4 needs Dafny or Lean** installed on your Mac.
- **Risk levels in the review walkthrough come from path and keyword rules**, not from understanding the code.
- **Assurance gates, automations, the review policy and model settings are stored on your Mac.** Workflows, agents, checks, plans and specs are stored in the repository.

## Other

- **Restore points skip git-ignored files**, so they won't bring back a deleted `.env`.
- **Automation schedules fire only while Warden is open.**
- **Apple Silicon Macs only** (M1 or later). No Windows, Linux or Intel builds yet.
- **It's a developer preview**, provided as is, with no warranty.