Cannabis current limitations
Disabled commands, missing flows, provider gaps, and regulatory work that remain outside the current source.
This page describes the source boundary. It is not legal advice or a complete readiness checklist for any cannabis market.
No license or certification
The repository does not license a dispensary, verify staff or premises authority with a regulator, connect to a state traceability system, or certify compliance with any jurisdiction's rules, tax law, payment network, or privacy law. License, credential, and rule-pack records hold what an operator enters. Tests, builds, and migrations are engineering checks only.
Commands that exist but are disabled
These mutations are registered but refuse to run because their runtime capability is not enabled in features/keystone/domain/runtimeCapabilities.ts:
| Command | Capability | Effect |
|---|---|---|
submitCannabisCustomerIntake | privacy.approved-intake | No online customer intake |
createCustomerPickupCart | commerce.customer-cart | No online pickup orders |
postCannabisInventoryEvent | inventory.event-specific-custody | No transfers, waste, destruction, counts, or adjustments outside the dedicated receive, release, hold, recall, and sale commands |
activateIntegrationInstallation | provider.installation-verification | Integrations stay unconfigured |
recordStateInboxEvent | provider.authenticated-inbox | No inbound regulator events |
recordReconciliationRun, approveReconciliationRun | provider.computed-reconciliation | No reconciliation runs |
recordEligibilityDecision (deciding a pending online intake) is reachable only for customers created through intake, which is disabled. In-store eligibility uses checkInCannabisCustomer.
Missing flows
- No online ordering. The storefront is a menu and visit page; there is no cart, checkout, customer account, or order history.
- No outbox delivery. State-reporting events are queued but nothing sends them.
- No payment processing. Non-cash tenders record a terminal reference; funds are not captured or settled by the software.
- No MCP tools. The MCP transport returns 503, so the dashboard AI chat has no data access.
- Single public scope. The public storefront serves one organization with one active premises. It shows an unavailable state otherwise.
- No suspend or close mutation for
OrganizationorPremises; the status values exist but nothing transitions to them. - No generic CRUD. Every list denies GraphQL create, update, and delete. New data needs a named command.
Operational work outside the source
Before real use, a deployment needs its own review of market-specific purchase limits, tax rules, labeling, retention, and reporting deadlines; a working traceability integration; payment terminals and reconciliation; staff training for the second-approver flows; backups and restore testing; and incident response. Replace every record created from the sample store, which uses fictional license, credential, lab, and manifest details.