# OCP 0.4 remaining blockers

## Publication blockers

- Complete public deployment and live readback for the `https://opencontinuity.org` namespace; adopt neutral stewardship, immutable archival mirroring, redirects, deprecation, and registry administration.
- Adopt specification/code licenses, contribution/IPR policy, neutral governance, and vulnerability response.
- Complete public review and resolve material issues; reproduce the release on the pinned toolchain.
- Publish immutable release members/digests and the public hostile corpus.

## Implementation blockers

- Build and identify two independent provider adapters, two independent OCP providers, and one independent client.
- Run actual provider exports through quarantine/mapping without personal data in the public suite.
- Demonstrate cross-provider package transfer/re-export and semantic comparison.
- Demonstrate independently retrievable managed bytes, re-verification, source loss, changed provider IDs/URLs, and recovery.
- Generate accessible human loss UX from recipient-filtered machine results at large scale.

## Security blockers

- Run hostile archives/content against deployed isolated parsers and application control boundaries.
- Complete independent threat/security review for Conversation, Artifact, and Adapter profiles.
- Register and test remote/offline authenticity, confidentiality, recipient, and client-instance binding profiles.
- Exercise credentials, network denial, limits, supply-chain, recovery, and action-boundary behavior in real deployments.

## Interoperability blockers

- Achieve identical graph, custody, mapping, loss, and comparator results across independent languages/codebases.
- Test real provider schema drift, duplicate/renamed/reordered fields, and unsupported semantics.
- Pin comparator normalization and raw-input/JCS vectors across languages.
- Demonstrate PROV/C2PA mapping behavior and publish all exceptions.

## Future-profile work (not 0.4 blockers)

Organization authority, minors/guardianship, inheritance, full multi-party context, autonomous delegation, live delta sync, offline CRDT merge, universal credential/project/personal-context semantics, universal tool history, and jurisdictional profiles remain deferred unless implementation evidence exposes a required narrow hook.
