Financial current limitations

Paper only

• Orders are filled by a local simulation (simulateOrderFill, or automatically for market orders). The Alpaca adapter's submitOrder is not called by any workflow. No order reaches an exchange or broker.
• Only market and limit orders are offered in the portal. The API accepts stop and trailing fields, but they are only filled by the same simulation.
• Transfers change recorded cash balances when an operator settles them. No bank, ACH, or card network is contacted.
• Bank verification uses micro-deposit amounts that the app generates and stores. It does not prove ownership of a real account.
• Every provider and adapter is restricted to sandbox status with execution support off. There is no live mode to switch on.

No firm or tenant model

There is no organization, firm, branch, or advisor-to-client assignment. Records belong to a user, and platform pages read through the operator's own session. An operator therefore sees their own connections, accounts, orders, and transfers, not every customer's. Only KYC checks, risk profiles, and compliance cases are visible across users. A multi-client back office needs a new ownership and access model.

Data that is only seeded

These records are created by onboarding and have no ongoing write path in the source:

• Dividend, TaxLot, AccountStatement, and PortfolioSnapshot. Tax lots are not opened or closed by fills, and statements are not generated per period. The monthly CSV export is the only report produced at run time.
• KycCheck, RiskProfile, ComplianceCase, and PortfolioAlert. Compliance records can be transitioned, but there is no identity-verification provider and nothing creates new checks, profiles, cases, or alerts. Nothing evaluates alert thresholds at run time; seeded alerts keep their seeded state.
• TradeRecommendation. No analyst or model generates recommendations.
• FollowedTrader and FollowedTrade. Nothing fetches trades from another instance or copies them.
• DepositWithdrawal is a legacy list with no write path.

Market data

Asset quotes are whatever was seeded or entered by an operator. No code refreshes Asset prices or writes PriceHistory from a provider. recordBrokerSyncRun records run status only. The portal says quotes may be delayed; in practice they are static until someone edits them.

Provider and webhook gaps

• Only Alpaca paper has an adapter. The three import providers accept data only through the import and observation mutations.
• Webhooks are verified and stored by hash, but nothing turns a webhook into account changes.
• There is no outbox worker and no outbound delivery target.
• Credential references resolve only from environment variables.

Tests

package.json defines unit and test:financial-* integration scripts, but tests/unit and tests/integration are empty in the current source. Only two .cjs tests exist at the top of tests/, and the test script does not run them. Treat the lifecycle code as untested until you add tests.

Other gaps

• No license file or package license is declared in the repository.
• No tax reporting forms (for example 1099), cost-basis methods, wash-sale handling, or corporate actions.
• No margin calculations, options trading, or crypto custody, even though fields for margin and options approval exist.
• No customer notifications beyond password-reset email.
• The generic MCP tools expose CRUD on whatever the session can reach; they do not wrap the named workflows.

No certification

The source does not certify compliance with any securities, banking, privacy, or security regime, and it is not documented as meeting PCI DSS, SOC 2, GDPR, or any other standard. Tests, builds, and screenshots show only the paths they exercise.