Core count seems a less-than-useful restriction on its own. Clock rate, cache sizes, and instructions per cycle need to be limited for this to be effective. Then bandwidth has to be constrained to avoid people building Beowulf clusters of RISC-V systems (which we won't be able to buy in the US thanks to "munitions" import restrictions from overseas producers).

RAM and disk capacities will also have to be limited for similar reasons. As will their speeds.