- Authentication uses one instance-wide Bearer token and does not identify individual users.
- Possession of API access grants access to every configured workspace and valid pending approval.
- Pending approvals live in memory and disappear on restart.
- Multi-file Apply uses best-effort rollback and is not crash-atomic.
- Audit records are durable but not cryptographically chained or signed.
- A host administrator can modify workspaces and audit files.
- MCP executables retain the OS permissions of the Akritas account.
- External validators are not sandboxed by the temporary workspace or sanitized environment.
- Buffered streaming does not reduce generation latency.
- Alert investigation uses one in-process worker; multi-node claiming and an external queue are not implemented.
- Notification delivery is best effort and has no persistent outbox or automatic retry.
- Bot conversation history and bot-event deduplication live in bounded memory and disappear on restart.
- Commit, push, and merge-request creation remain manual.