Known limitations
What does not work, what is not built, and what you should not rely on yet.
Kept deliberately blunt. A limitation recorded here is one you will not discover the hard way.
Distribution
| Limitation | Detail |
|---|---|
| Preview artifacts may be unsigned | Read each artifact's signature state on the download page. Windows SmartScreen or macOS Gatekeeper may warn. |
| Availability varies by channel | Only verified artifacts present in the live release manifest appear on the download page. |
| No Windows ARM64 build | Platform identifier exists; no native build has been tested. |
| Preview channel only | There is no stable channel release yet. |
Signing is a prerequisite for stable publication, not an afterthought — an unsigned build can reach the preview channel only, with an explicit publisher flag.
Platform parity
Do not assume behaviour is identical across operating systems. Voice dictation
requires Python 3.10+ on PATH; system-wide dictation depends on OS window
management; and keyboard conventions differ (mod is ⌘ on macOS and
Ctrl elsewhere, while the Ctrl B prefix is
literal everywhere).
Orchestration
| Limitation | Detail |
|---|---|
| Modes vary in maturity | Some orchestration modes are designed ahead of being proven end to end. |
| Cost visibility is a gate | A run should block when billing route or cost cannot be determined. If it does not, report it. |
| Verification is yours | Agent-reported success is not evidence. Read the diff and run the tests. |
Messaging and channels
| Limitation | Detail |
|---|---|
| Cross-workspace mention delivery | Known open defect; delivery across workspaces required a daemon event-scope redesign. |
| Queued is not delivered | Do not read a queued message as an acted-upon message. |
Agents and sessions
| Limitation | Detail |
|---|---|
| A live process is not progress | An agent can hold a session open without advancing a task. |
| Fleet counts can overstate | A known defect can show more agents live than exist. |
| Detection is not authentication | Harmony can see a provider binary; it cannot see your login or plan. |
Security boundaries
| Limitation | Detail |
|---|---|
| Extensions and skills are not sandboxed by default | Do not treat third-party extension code as contained. |
| Model, repository, and browser content is untrusted input | Any of it can attempt to influence tools. |
| Remote (LAN Link) messages | Rendered as text only; never pasted into a PTY or routed to an execute path. |
See security overview for what Harmony does and does not protect.
Documentation
Parts of this documentation set are still being written. Pages that exist are source-backed; sections not yet published are listed in the internal documentation status matrix rather than stubbed out here.