# Status & Known Issues

> ⚠️ **OX is a work in progress.** It is an early, opinionated tool developed in the open — not a polished product. It began as one developer's personal workflow, and adopting it currently means adopting that workflow. **Don't use OX unless you're comfortable running and updating it yourself.** Expect rough edges.

## The big caveat: indexing is manual

Keeping the search index current is **a manual step**. `ox search` and the MCP tools only reflect the vault/code state as of the last `ox index` run. If you add or edit notes and don't re-index, you silently get **stale or degraded results** — no error, just missing or outdated hits.

```bash
ox index      # re-run this after changing notes/code, or results drift
```

If results look wrong or incomplete, re-index first.

## Known issues

These are tracked on GitHub. See the live list:
**[github.com/icewaterlabs/ox · label:known-issue](https://github.com/icewaterlabs/ox/issues?q=is%3Aissue+is%3Aopen+label%3Aknown-issue)**

| # | Issue | Status |
|---|-------|--------|
| [#70](https://github.com/icewaterlabs/ox/issues/70) | `ox index` is manual — a stale index silently degrades search/MCP results | Open |
| [#71](https://github.com/icewaterlabs/ox/issues/71) | `ox index` can appear to hang near the tail on large vaults | Open |
| [#72](https://github.com/icewaterlabs/ox/issues/72) | `ox tui` (Go CLI): removed. ox-rs ships a ratatui TUI (Phase 6). | Closed — resolved in ox-rs |
| [#73](https://github.com/icewaterlabs/ox/issues/73) | Workspace structure is rigid / not pluggable (`~/ox` + `o/o/who-what-when-where` + Obsidian) | Open |
| [#74](https://github.com/icewaterlabs/ox/issues/74) | Embeddings require a running Ollama; silent fallback to text-only (use `ox serve --no-embed` to opt out explicitly) | Open |
| [#75](https://github.com/icewaterlabs/ox/issues/75) | bbolt CVE (CVE-2026-33817, indirect via Bleve) | Closed — resolved in v0.3.0 (bbolt v1.4.0) |

## ox-rs dependency advisories

Two upstream RUSTSEC advisories affect ox-rs v0.2.0's graph engine dependency chain (cozo → swapvec):

- **lz4_flex** (HIGH): memory-safety issue in older lz4 flex bindings
- **lru** (LOW): algorithmic complexity issue in LRU cache

Both are upstream-blocked — fixes depend on swapvec and tantivy releasing updated versions. Both are documented in CI with ignore justifications. Monitor when swapvec and tantivy release updates.

Found something not listed? Open an issue: <https://github.com/icewaterlabs/ox/issues/new>.

## What's solid

For balance — the parts that are genuinely good today:

- **Hybrid search engine** — BM25 + vector similarity over a SQLite graph is fast and the ranking is useful (once the index is current).
- **MCP server** — all six tools (`search_vault`, `get_note`, `find_related`, `get_backlinks`, `vault_stats`, `find_path`) work well against real agent sessions.
- **Co-located knowledge + code** — the core idea (one graph over notes *and* repos) holds up.

See [Methodology](https://iamox.ai/docs/methodology.md) for the philosophy and [CLI Reference](https://iamox.ai/docs/cli.md) for commands.