---
title: "Known issues"
description: "User-facing problems, affected configurations and available workarounds."
canonical_url: "https://docs.oz0.ai/reference/known-issues"
---
# Known issues

> User-facing problems, affected configurations and available workarounds.

For: cluster operators and application developers.

These issues affect the implementation described by the current documentation. They remain open; a workaround does not mean the underlying issue is fixed. Each entry names the configuration or operation affected so you can decide whether it matters to your deployment.

For platform and integration availability, use [Compatibility](https://docs.oz0.ai/reference/compatibility). Deployment boundaries and security reporting are covered in [Security assurance](https://docs.oz0.ai/concepts/security/assurance).

## Jobs and accounting

### Budget counters on separate edges

With management and edge running separately, repeated usage reports can temporarily inflate a budget counter and refuse calls early. Usage rows and quota charges are not duplicated by this issue.

Check recorded usage. The counter corrects after that budget has no open calls. See [repeated reports on separate edges](https://docs.oz0.ai/spend/budgets-and-quotas/charging#repeated-reports-on-separate-edges).

### Quota charges after a crash

A crash can lose an owner or team quota charge when no recovery record survives. This affects an unreserved call interrupted between its usage and quota writes, or a failed charge kept only in memory.

Review usage and quota totals after an unclean stop. Durable reservations and saved retries repair other missing charges. See [quota accounting after a crash](https://docs.oz0.ai/concepts/security/assurance#quota-accounting-after-a-crash).

### Delayed Temporal tasks

On a slow database under load, a Temporal task can be recorded as started without reaching a node. The job waits for the task timeout before retrying.

Check database latency and allow the retry to complete. See [capacity guidance](https://docs.oz0.ai/concepts/limits-and-scaling/measurements#what-limits-what).

### Grant revocation during a segment

When a grant is revoked during a running segment, a node's stale grant view can make the edge fail a job, rather than refuse the call on the node. An OpenAI Agents SDK segment still lists the revoked delegation.

Adjust the agent's work or access before restarting. The revoked call remains refused. See [revocation during a running segment](https://docs.oz0.ai/build/plugins/install/grants#revocation-during-a-running-segment).

### Sandbox exemptions across nodes

If a plugin is exempted from sandboxing on only some eligible nodes, routing can select a node that refuses its tool at startup.

Apply the reviewed exemption consistently, or restrict routing with a label. See [builds and mixed fleets](https://docs.oz0.ai/concepts/security/plugins#builds-and-mixed-fleets).

## Clients and deployment

### Remote nodes with Compose

When you add a remote node to the Compose deployment, the console's command can name an unreachable container address.

Replace both occurrences with the host's published edge address. Follow the [remote-node procedure](https://docs.oz0.ai/fleet/docker#more-nodes).

### Resuming AG-UI approvals

When you resume several AG-UI approvals, a job update can fail after earlier decisions were applied.

Retry with the same run ID or `Idempotency-Key`; already-applied decisions are retained. See [resume rules](https://docs.oz0.ai/build/apps/ag-ui#all-or-nothing).

### Reconnecting to a completed job

If a long job ended without an active poller, reconstructing its final stream can fail and request a resync.

Fetch current job state and its trace. See [feed limits](https://docs.oz0.ai/build/apps/live-feeds#incomplete-or-delayed-feed-data).

## Isolation and stored data

### macOS processes after a session

When a macOS sandbox session ends, a process that left the original process group can remain running under the old profile.

Use Linux when all child processes must end with the sandbox. Check for survivors before reusing its working directory. See [processes after a session](https://docs.oz0.ai/fleet/sandbox-on-macos#processes-after-a-session).

### Older invalid job IDs

For jobs created with older invalid IDs, some name-only lookups return no result. Erasure and export can report `jobs_partly_found`.

Inspect those reports before relying on completeness. Destroyed keys stay destroyed. See [older job IDs](https://docs.oz0.ai/govern/personal-data/erase#older-job-ids).

### Abandoned temporary folders

A runtime killed before temporary-folder tracking was available can leave untracked folders containing job data.

Remove abandoned folders only while no session runs on the node. See [locations and cleanup](https://docs.oz0.ai/reference/files#temporary-session-files).

<legacy-sections>
<span id="known-not-to-work">



</span>



[Known issues](https://docs.oz0.ai/reference/known-issues).

<span id="bubblewrap-versions-affected-by-cve-2026-87766">



</span>

<span id="debugging-requires-yama">



</span>



[Sandbox tiers and routing](https://docs.oz0.ai/concepts/security/sandbox-tiers#how-tier-1-works).

<span id="protected-paths-require-bubblewrap-0120">



</span>



[Protected files and sandbox limits](https://docs.oz0.ai/concepts/security/protected-files#configure-extra-protected-paths).

<span id="git-file-cleanup-happens-at-sandbox-exit">



</span>

<span id="cleanup-after-a-killed-runner">



</span>



[Protected files and sandbox limits](https://docs.oz0.ai/concepts/security/protected-files#cleanup-after-an-interrupted-sandbox).

<span id="programs-whose-paths-depend-on-the-shell">



</span>

<span id="remaining-file-hold-limits">



</span>



[Protected files and sandbox limits](https://docs.oz0.ai/concepts/security/protected-files#limits-of-configured-command-discovery).

<span id="shell-forms-the-file-hold-follows">



</span>



[Protected files and sandbox limits](https://docs.oz0.ai/concepts/security/protected-files#reading-configured-commands).

<span id="alpine-cannot-install-the-python-runtime">



</span>

<span id="not-built-yet">



</span>



[Compatibility](https://docs.oz0.ai/reference/compatibility).

<span id="slow-databases-can-delay-task-delivery">



</span>



[Capacity measurements](https://docs.oz0.ai/concepts/limits-and-scaling/measurements#what-limits-what).

<span id="release-mirroring-requires-an-unpacked-distribution">



</span>



[Offline install](https://docs.oz0.ai/fleet/offline-install#the-folder).

<span id="event-waits-are-unavailable-in-some-runtimes">



</span>



[Waiting for events](https://docs.oz0.ai/agents/waiting-for-events).

<span id="intel-macs-need-a-local-rust-compiler">



</span>



[Node and plugin outbound connections](https://docs.oz0.ai/concepts/outbound-connections/nodes-and-plugins#the-node).

<span id="gemini-cli-reads-repository-settings">



</span>



[Use an ACP agent](https://docs.oz0.ai/build/parts/harnesses/acp#what-a-repositorys-own-settings-can-do-to-a-session).

<span id="older-runtimes-can-leave-untracked-folders">



</span>

<span id="remote-session-folders-have-delayed-cleanup">



</span>



[Files and directories](https://docs.oz0.ai/reference/files#temporary-session-files).

<span id="gemini-cli-usage-reporting-needs-its-own-settings">



</span>



[Node and plugin outbound connections](https://docs.oz0.ai/concepts/outbound-connections/nodes-and-plugins#the-official-plugins).

<span id="some-plugin-dependencies-still-need-internet-access">



</span>



[Offline install](https://docs.oz0.ai/fleet/offline-install#what-it-does-not-cover).

<span id="repeated-refused-calls-can-exhaust-agent-retries">



</span>



[How the runtime enforces tool policy](https://docs.oz0.ai/govern/tool-policy/runtime#where-it-applies).

<span id="repeated-reports-can-temporarily-overcharge-budget-counters">



</span>



[Understand quota charging and refusals](https://docs.oz0.ai/spend/budgets-and-quotas/charging#repeated-reports-on-separate-edges).

<span id="a-slow-management-link-delays-jobs">



</span>



[Management over a WAN](https://docs.oz0.ai/fleet/management-over-a-wan#what-gets-slower-and-why).

<span id="workflow-eviction-relies-on-a-local-sdk-fix">



</span>



[Understand runtime shutdown](https://docs.oz0.ai/fleet/upgrades/runtime-shutdown#the-runtimes-shutdown-order).

<span id="large-agent-catalogs-increase-startup-cost">



</span>



[Tenant and queue limits](https://docs.oz0.ai/concepts/limits-and-scaling/limits#_10000-agents-in-one-tenant).

<span id="concurrency-slots-can-take-30-seconds-to-clear">



</span>



[Tenant and queue limits](https://docs.oz0.ai/concepts/limits-and-scaling/limits#what-a-pool-means-for-capacity).

<span id="a-single-node-quality-gate-blocks-shared-pool-peers">



</span>



[Gate a plugin update](https://docs.oz0.ai/improve/evals/quality-gates#one-node-tests-it).

<span id="kubernetes-tier-1-needs-explicit-pod-configuration">



</span>



[Deploy with Kubernetes](https://docs.oz0.ai/fleet/kubernetes#sandbox-tier-1-in-node-pods).

<span id="a-legal-hold-can-delay-accepted-erasure-cleanup">



</span>



[Erase personal data](https://docs.oz0.ai/govern/personal-data/erase#holds-added-after-acceptance).

<span id="older-invalid-job-ids-cannot-always-be-found">



</span>



[Erase personal data](https://docs.oz0.ai/govern/personal-data/erase#older-job-ids).

<span id="command-rule-parsing-and-review-limits">



</span>



[Command rule evaluation and limits](https://docs.oz0.ai/govern/command-rules/evaluation-and-limits#review-and-interface-limits).

<span id="shell-options-and-startup-files">



</span>

<span id="environment-and-nested-commands">



</span>



[What the command reader understands](https://docs.oz0.ai/govern/command-rules/command-reader#environment-assumptions).

<span id="sandbox-boundary-and-approval-review">



</span>



[Command rule evaluation and limits](https://docs.oz0.ai/govern/command-rules/evaluation-and-limits#what-it-sees-and-what-it-does-not).

<span id="chat-identity-and-delivery-gaps">



</span>



[Connect a chat channel](https://docs.oz0.ai/build/apps/chat-channels).

<span id="skill-loading-and-review-gaps">



</span>



[Write and load skills](https://docs.oz0.ai/build/parts/skills).

<span id="clients-must-label-returned-agent-text">



</span>



[AI labels](https://docs.oz0.ai/govern/ai-labels).

<span id="grant-revocation-can-reach-edges-before-nodes">



</span>



[Grant access between plugins](https://docs.oz0.ai/build/plugins/install/grants#revocation-during-a-running-segment).

<span id="file-retention-and-older-runtime-erasure-gaps">



</span>



[Return results and files](https://docs.oz0.ai/build/parts/tools/results-and-files#files-between-tools).

<span id="github-call-tokens-remain-valid-after-a-call">



</span>



[Understand connection security](https://docs.oz0.ai/admin/connections/security#scope-and-deliver-call-tokens).

<span id="pending-node-joins-can-fill-a-region">



</span>



[Node identity and tenant secrets](https://docs.oz0.ai/concepts/security/identity-and-secrets#pending-joins-on-an-exposed-edge).

<span id="strict-nodes-refuse-builds-that-execute-code">



</span>

<span id="routing-does-not-account-for-sandbox-exemptions">



</span>



[Plugin processes and operator exemptions](https://docs.oz0.ai/concepts/security/plugins#builds-and-mixed-fleets).

<span id="egress-changes-do-not-close-existing-tunnels">



</span>

<span id="egress-errors-and-backend-enforcement-limits">



</span>



[Sandbox egress rules](https://docs.oz0.ai/concepts/security/egress#changes-and-backend-limits).

<span id="private-candidate-feature-limits">



</span>



[Check a plugin candidate](https://docs.oz0.ai/build/plugins/develop-and-test/candidate-checks#its-jobs).

<span id="plugin-isolation-depends-on-node-settings">



</span>



[Plugin processes and operator exemptions](https://docs.oz0.ai/concepts/security/plugins).

<span id="tls-tunnel-checks-do-not-inspect-encrypted-requests">



</span>



[Sandbox egress rules](https://docs.oz0.ai/concepts/security/egress#shared-hosts-and-encrypted-request-limits).

<span id="tcp-tunnel-checks-cover-the-opening-only">



</span>

<span id="openings-the-proxy-refuses">



</span>

<span id="recognised-protocols-and-host-forms">



</span>

<span id="unrecognised-forms-and-connection-closure">



</span>



[Sandbox egress rules](https://docs.oz0.ai/concepts/security/egress#raw-tcp-entries).

<span id="secret-scans-miss-transformed-and-short-values">



</span>



[Node identity and tenant secrets](https://docs.oz0.ai/concepts/security/identity-and-secrets#secrets-in-calls-and-requests).

<span id="shared-tool-servers-may-ignore-cancellation">



</span>



[Handle tool call lifecycle](https://docs.oz0.ai/build/parts/tools/call-lifecycle#cancels-time-limits-and-the-idempotency-key).

<span id="windows-tier-1-is-not-available-for-routed-work">



</span>



[Sandbox on Windows](https://docs.oz0.ai/fleet/sandbox-on-windows).

<span id="shell-and-write-sessions-require-tier-1-or-an-opt-out">



</span>



[Sandbox tiers and routing](https://docs.oz0.ai/concepts/security/sandbox-tiers#shell-and-write-sessions).

<span id="older-webhook-secrets-must-be-rebound-as-signing-keys">



</span>



[Bind secrets to destination hosts](https://docs.oz0.ai/admin/secrets/host-bindings#rebind-older-inbound-webhook-keys).

<span id="tier-1-relies-on-the-operating-system-sandbox">



</span>



[Sandbox tiers and routing](https://docs.oz0.ai/concepts/security/sandbox-tiers#sandboxes).

<span id="outside-work-requires-tier-1">



</span>



[Sandbox tiers and routing](https://docs.oz0.ai/concepts/security/sandbox-tiers#jobs-started-by-outside-events).

<span id="macos-resource-and-plugin-isolation-gaps">



</span>



[Sandbox on macOS](https://docs.oz0.ai/fleet/sandbox-on-macos#validation-limits).

<span id="macos-processes-can-survive-their-session">



</span>



[Sandbox on macOS](https://docs.oz0.ai/fleet/sandbox-on-macos#processes-after-a-session).

<span id="oci-tool-management-gaps">



</span>



[MCP servers from container images](https://docs.oz0.ai/build/plugins/container-images#limits-today).

<span id="compose-advertises-an-unreachable-container-address">



</span>



[Docker](https://docs.oz0.ai/fleet/docker#more-nodes).

<span id="gvisor-runtime-and-engine-limits">



</span>



[Set up gVisor](https://docs.oz0.ai/fleet/sandbox-tier-2/gvisor).

<span id="microvm-isolation-remains-experimental">



</span>



[Set up microVM isolation](https://docs.oz0.ai/fleet/sandbox-tier-2/microvms#microvms).

<span id="credential-injection-platform-and-protocol-limits">



</span>

<span id="runtime-and-host-boundaries">



</span>



[Credential injection](https://docs.oz0.ai/admin/credential-injection#where-it-applies).

<span id="response-filtering">



</span>



[Credential injection](https://docs.oz0.ai/admin/credential-injection#what-a-bound-host-must-not-do).

<span id="client-protocol-support">



</span>



[Credential injection](https://docs.oz0.ai/admin/credential-injection#not-yet).

<span id="live-feed-scope-resync-and-latency-limits">



</span>



[Follow live jobs](https://docs.oz0.ai/build/apps/live-feeds#incomplete-or-delayed-feed-data).

<span id="approval-scope-and-interface-limits">



</span>



[Decide an approval](https://docs.oz0.ai/agents/approvals).

<span id="decision-scope-and-policy-changes">



</span>



[Edit an approval or allow repeated calls](https://docs.oz0.ai/agents/approvals/edits-and-repeat-calls#allow-the-same-call-again).

<span id="fields-and-people-shown-in-the-interface">



</span>



[Edit an approval or allow repeated calls](https://docs.oz0.ai/agents/approvals/edits-and-repeat-calls#edit-forms-in-chat-threads).

<span id="a-partially-applied-ag-ui-resume">



</span>



[AG-UI for your apps](https://docs.oz0.ai/build/apps/ag-ui#all-or-nothing).

<span id="sse-configuration-and-resume-limits">



</span>



[Feed access and browser streams](https://docs.oz0.ai/build/apps/live-feeds/browser-and-access#server-sent-events).

<span id="chat-drawer-rendering-and-refresh-limits">



</span>



[Use the chat drawer](https://docs.oz0.ai/getting-started/web-ui/chats#earlier-turns-and-result-cards).

<span id="taint-propagation-and-quarantine-limits">



</span>



[Read outside text in a quarantine child](https://docs.oz0.ai/govern/taint-and-labels/quarantine#runtime-and-evaluation-limits).

<span id="lost-harness-sessions-restart-from-input">



</span>



[Recover a harness session](https://docs.oz0.ai/build/parts/harnesses/recovery#when-a-node-is-lost).

<span id="label-policy-enforcement-boundaries">



</span>



[Set clearance, egress and content walls](https://docs.oz0.ai/govern/taint-and-labels/label-policies).

<span id="clearance-and-compartment-walls">



</span>



[Set clearance, egress and content walls](https://docs.oz0.ai/govern/taint-and-labels/label-policies#clearance-per-agent).

<span id="session-egress-and-model-calls">



</span>



[Set clearance, egress and content walls](https://docs.oz0.ai/govern/taint-and-labels/label-policies#egress-by-level).

<span id="content-shown-to-people">



</span>



[Set clearance, egress and content walls](https://docs.oz0.ai/govern/taint-and-labels/label-policies#content-shown-to-people).

<span id="verification-and-saved-examples">



</span>



[Set clearance, egress and content walls](https://docs.oz0.ai/govern/taint-and-labels/label-policies#verification-and-saved-examples).

<span id="teams-cloud-and-private-chat-restrictions">



</span>



[Microsoft Teams](https://docs.oz0.ai/build/plugins/verified/teams).

<span id="governance-replay-coverage-limits">



</span>



[Governance replay](https://docs.oz0.ai/govern/governance-replay#what-a-replay-does-not-tell-you).

<span id="guardrail-detection-is-not-measured">



</span>



[Guardrail coverage and limits](https://docs.oz0.ai/build/plugins/verified/guardrails/intent-and-limits#what-the-checks-miss).

<span id="cross-tenant-list-and-reporting-limits">



</span>



[Choose a tenant](https://docs.oz0.ai/getting-started/web-ui/tenants#cross-tenant-reporting-limits).

<span id="revocation-receipts-can-miss-older-invisible-jobs">



</span>



[Kill switches](https://docs.oz0.ai/govern/kill-switches#exactly-the-jobs-that-lost-their-authority).

<span id="email-receiving-is-unavailable">



</span>



[ai.oz0/email](https://docs.oz0.ai/build/plugins/verified/email).

<span id="model-vetting-scope-and-timing">



</span>



[Control what model calls can reach](https://docs.oz0.ai/spend/models-and-keys/data-rules#vetting-scope-and-timing).

<span id="duty-checks-depend-on-available-agent-and-tool-records">



</span>



[Assign duties to tool calls](https://docs.oz0.ai/govern/tool-policy/duties#records-available-at-each-check).

<span id="plugin-improver-eligibility-and-review-limits">



</span>



[Improver limits and records](https://docs.oz0.ai/build/plugins/verified/plugin-improver/limits-and-records#limits).

<span id="tier-0-cannot-contain-a-malicious-model">



</span>



[Sandbox tiers and routing](https://docs.oz0.ai/concepts/security/sandbox-tiers#a-backdoored-model).

<span id="working-directory-secrets-remain-readable">



</span>



[Node identity and tenant secrets](https://docs.oz0.ai/concepts/security/identity-and-secrets#secrets-in-the-working-directory).

<span id="tested-only-against-stand-ins">



</span>

<span id="flaky-tests-in-quarantine">



</span>



[Compatibility](https://docs.oz0.ai/reference/compatibility#integrations-awaiting-live-validation).

<span id="security">



</span>



[Security assurance](https://docs.oz0.ai/concepts/security/assurance).

<span id="in-this-guide">



</span>

<span id="previous-section-links">



</span>



[Known issues](https://docs.oz0.ai/reference/known-issues#jobs-and-accounting).

</legacy-sections>


## Sitemap

See the full [sitemap](https://docs.oz0.ai/sitemap.md) for all pages.