Harness limits
This is the hand-maintained catalog of runtime harness budgets, admission caps, protocol frames, bounded output and lifecycle timing in core, bundled plugins, shared packages and registry consumers. It describes source contracts, not a deployment's installed plugin versions. Registry rows identify the plugin and source path in the registry repository.
Operator file
harness.json lives in the explicit instance directory, resolved by instancePaths(instanceRoot).root.
The service user owns it; the operator edits it by hand. Missing file or omitted keys use the defaults
below. A present malformed JSON document, unknown key, wrong type, non-integer, out-of-range value or
a Bash maximum below its default prevents daemon startup. There is no environment/DB precedence.
The daemon loads one frozen snapshot before startup. Its existing runner boot message carries that
snapshot to every later runner. Terminal reads only its two deadlines through
ctx.host.terminalTimeouts(); no plugin sees the file or a generic settings registry. A daemon restart
applies changes. There is no hot reload or settings API/UI. Host administrators with shell/Editor
access can read and edit the file. Ordinary users are confined to authorized Project roots, which
must exclude the instance directory; managed Projects receive their own filesystem mounts.
The configurable values use the defaults below. Shared downloads default to 5 GiB; other settings preserve their existing defaults. Their ranges are operational policy, not measured optimal values: ordinary host RPC is bounded to 1 second through 5 minutes, Bash keeps its 1 ms minimum while respecting the existing root 15-minute execution ceiling, and PostgreSQL pool sizes are positive integer connection counts validated by the daemon's harness schema. Tests may inject shorter RPC budgets without widening the operator schema.
buildBrainCore selects databasePoolDaemon or databasePoolRunner by process role and passes it
as createCoreDatabase's explicit poolSize. Each pool accepts 1..32 client connections; the daemon
default is 4 and each runner defaults to 2. Embedded cores without a harness snapshot use these same
schema defaults. Runner boot uses the daemon's frozen snapshot and never rereads the operator file.
The shared core also passes databasePoolRunner in workerDatabase to the brain's export jobs.
Daemon maintenance uses that same boot snapshot for attachment jobs. Both carry databaseUrl,
instanceRoot and poolSize over worker IPC; a worker never rereads the operator file.
These limits do not cap PostgreSQL server connections. For example, the pools of 45 runners plus one
daemon can open up to 94 client connections with the defaults; database workers add their own pools.
Staying within a 35-server-connection budget
requires PgBouncer transaction pooling with its server pool budget configured independently.
Reading the catalog
Each row describes one limit at its owning declaration or enforcement site. Repeated protocol values on two sides are listed separately because both owners must stay aligned. Named derived expressions keep their dependency visible. Backoff sequences describe one retry policy. All non-operator rows remain fixed. "Product envelope; tuning not established" means the purpose follows from the caller, but the exact number has no benchmark-derived tuning justification. It must not be presented as a measured safe optimum. Protocol and root-enforced values require coordinated contract changes.
Root worker admission, systemd envelopes and guest protocol caps never trust this service-user file. Guest request/reply frames remain fixed at 1 MiB/16 MiB: the current typed agent start admits exactly two argv and an empty environment. Configuring the frames needs a coordinated typed startup change; the catalog alone does not change admission, Python framing or the root helper handshake.
This catalog contains 719 limit rows. The light contract checks schema defaults and owner-file existence, not semantic discovery of every future inline number. Add or update the owning row whenever a limit changes. Constants that only identify versions, IDs, units, geometry styling or enum values are not harness budgets. Administrator-editable values are referenced below instead of copied here.
Operator settings
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| sharedFileMaxBytes | 5368709120 bytes | src/shared/harnessConfig.ts |
One agent-to-user download via ShareFile | Streamed copies use disk rather than whole-file buffers; default 5 GiB is an operational envelope, not a quota. | sharedFileMaxBytes; 1..9007199254740991 bytes |
| Platform shared file bytes | Declared per adapter | src/plugins/api.ts |
Agent-to-user platform shares | ShareFile uses the smaller of this positive safe-integer declaration and the harness limit before copying; Teams declares 20 MiB and Discord, Telegram, WhatsApp and Chatbot 25 MiB. | Adapter declaration; omitted uses harness limit |
| Inline shared image bytes | 10485760 bytes | src/brain/chatImages.ts |
ShareImage inline rendering and downstream model/platform image buffers | Keeps images bounded at 10 MiB; large image originals may be delivered as ShareFile downloads. | Fixed model/display envelope |
| databasePoolDaemon | 4 client connections | src/shared/harnessConfig.ts |
One daemon's PostgreSQL client pool | Allows concurrent daemon work; transaction-pooling server admission remains a separate budget. | databasePoolDaemon; 1..32 client connections |
| databasePoolRunner | 2 client connections | src/shared/harnessConfig.ts |
Each runner's PostgreSQL client pool | Bounds per-runner connections; 45 runners plus one daemon allow up to 94 clients at defaults. | databasePoolRunner; 1..32 client connections |
| hostRpcTimeoutMs | 15000 ms | src/shared/harnessConfig.ts |
Runner calls waiting for daemon replies | Allows ordinary local RPC under load; 1000..300000 ms bounds abandoned calls. | hostRpcTimeoutMs; 1000..300000 ms |
| bashDefaultTimeoutMs | 120000 ms | src/shared/harnessConfig.ts |
Bash foreground wait when no timeout is supplied | Preserves the two-minute default; adjustable to operator workload. | bashDefaultTimeoutMs; 1..900000 ms |
| bashMaxTimeoutMs | 600000 ms | src/shared/harnessConfig.ts |
Largest accepted Bash foreground timeout | Preserves ten-minute tool cap; never exceeds the root 900000 ms execution ceiling. | bashMaxTimeoutMs; 1..900000 ms and >= bashDefaultTimeoutMs |
Shared downloads
For example, {"sharedFileMaxBytes": 5368709120} allows a single 5 GiB ShareFile download.
The boot snapshot reaches the daemon and every runner through BrainDeps and the session spawner.
The cap is checked against the source stat before reading any chunks; exact byte count is checked
again before atomic publication. Four shares per turn remain the existing tool budget.
ShareImage keeps its fixed 10 MiB limit. Its bytes may be rendered inline, decoded and base64-encoded for models or platform APIs, so the download setting cannot safely govern that path. No separate image setting is exposed. Share an oversized image original with ShareFile when a download is intended.
The existing reference sweep retains files while conversation journal references survive, and deletes unreferenced files after a one-hour grace period. Completed copies have SHA-256 addresses that include the original filename; active staging is never swept, and a dead writer's staging is reclaimed after the same grace period. A transfer checks free disk space before copying and removes staging on errors or cancellation. This is not a total storage quota: parallel copies and retained conversations still consume disk and a concurrent writer can exhaust free space after the initial check. See execution and sharing.
Platform adapters declare sharedFileMaxBytes through their existing registration.
ShareFile applies the smaller of that cap and the harness limit before copying. Teams declares
20 MiB; Discord, Telegram, WhatsApp and Chatbot declare 25 MiB. An undeclared cap uses the harness
limit. Buffered provider adapters also pass their declared cap to
resolveSharedFiles(dir, refs, cap, maxBytes), which rechecks disk size before loading bytes.
Chatbot shares its declaration with the existing public attachment filter and widget limit.
PostgreSQL
The caller must pass DatabaseOptions.poolSize explicitly. The daemon passes
harness.databasePoolDaemon; attached runners and background workers pass
harness.databasePoolRunner from their boot snapshot. The package does not read
harness.json, query a setting or choose a size by process role. It rejects a missing,
non-positive or non-integral size before constructing pg.Pool, preventing the driver's
implicit pool default. Test fixtures supply explicit fixture-owned sizes.
The rows below describe package-owned operational bounds. Domain product settings and codec
validation retain their existing administrator/contract owners. A single-row existence or
identity query is SQL semantics rather than a configurable work budget. There is no package
statement_timeout, lock_timeout or generic parameter-count limit: execution deadlines
belong to the PostgreSQL server, while the statement input caps below bound actual callers.
Serializable retries rerun the whole callback and snapshot, never an already committed write.
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| PostgreSQL acquisition | 5000 ms | packages/db/src/database.ts |
Waiting for a pool client or connection | Bounds abandoned acquisitions while leaving SQL execution independent. | Fixed: product envelope; tuning not established |
| SERIALIZABLE attempt ceiling | 1..5 total attempts | packages/db/src/retry.ts |
Whole-transaction retry admission for 40001 and 40P01 only | Bounds repeated fresh snapshots; other SQLSTATE errors propagate. | Fixed: product envelope; tuning not established |
| SERIALIZABLE retry backoff | 0 ms | packages/db/src/retry.ts |
Delay between eligible transaction attempts | Current policy retries immediately; no sleep, jitter or exponential backoff is implemented. | Fixed: product envelope; tuning not established |
| SERIALIZABLE config/configStore.ts | 3 total attempts | packages/db/src/config/configStore.ts |
Explicit retrying domain writes | Retries the complete lock/recheck/write unit after a serialization failure or deadlock. | Fixed: product envelope; tuning not established |
| SERIALIZABLE config/userSettings.ts | 3 total attempts | packages/db/src/config/userSettings.ts |
Explicit retrying domain writes | Retries the complete lock/recheck/write unit after a serialization failure or deadlock. | Fixed: product envelope; tuning not established |
| SERIALIZABLE config/userPluginConfig.ts | 3 total attempts | packages/db/src/config/userPluginConfig.ts |
Explicit retrying domain writes | Retries the complete lock/recheck/write unit after a serialization failure or deadlock. | Fixed: product envelope; tuning not established |
| SERIALIZABLE delegation/inbox.ts | 3 total attempts | packages/db/src/delegation/inbox.ts |
Explicit retrying domain writes | Retries the complete lock/recheck/write unit after a serialization failure or deadlock. | Fixed: product envelope; tuning not established |
| SERIALIZABLE delegation/recovery.ts | 3 total attempts | packages/db/src/delegation/recovery.ts |
Explicit retrying domain writes | Retries the complete lock/recheck/write unit after a serialization failure or deadlock. | Fixed: product envelope; tuning not established |
| SERIALIZABLE journal/forkRetention.ts | 3 total attempts | packages/db/src/journal/forkRetention.ts |
Explicit retrying domain writes | Retries the complete lock/recheck/write unit after a serialization failure or deadlock. | Fixed: product envelope; tuning not established |
| SERIALIZABLE journal/sessions.ts | 3 total attempts | packages/db/src/journal/sessions.ts |
Explicit retrying domain writes | Retries the complete lock/recheck/write unit after a serialization failure or deadlock. | Fixed: product envelope; tuning not established |
| SERIALIZABLE memory/rows.ts | 3 total attempts | packages/db/src/memory/rows.ts |
Explicit retrying domain writes | Retries the complete lock/recheck/write unit after a serialization failure or deadlock. | Fixed: product envelope; tuning not established |
| SERIALIZABLE projects/index.ts | 3 total attempts | packages/db/src/projects/index.ts |
Explicit retrying domain writes | Retries the complete lock/recheck/write unit after a serialization failure or deadlock. | Fixed: product envelope; tuning not established |
| SERIALIZABLE projects/membership.ts | 3 total attempts | packages/db/src/projects/membership.ts |
Explicit retrying domain writes | Retries the complete lock/recheck/write unit after a serialization failure or deadlock. | Fixed: product envelope; tuning not established |
| SERIALIZABLE providerConnections/index.ts | 3 total attempts | packages/db/src/providerConnections/index.ts |
Explicit retrying domain writes | Retries the complete lock/recheck/write unit after a serialization failure or deadlock. | Fixed: product envelope; tuning not established |
| SERIALIZABLE search/vectors.ts | 3 total attempts | packages/db/src/search/vectors.ts |
Explicit retrying domain writes | Retries the complete lock/recheck/write unit after a serialization failure or deadlock. | Fixed: product envelope; tuning not established |
| SERIALIZABLE usage/quota.ts | 3 total attempts | packages/db/src/usage/quota.ts |
Explicit retrying domain writes | Retries the complete lock/recheck/write unit after a serialization failure or deadlock. | Fixed: product envelope; tuning not established |
| SERIALIZABLE users/common.ts | 3 total attempts | packages/db/src/users/common.ts |
Explicit retrying domain writes | Retries the complete lock/recheck/write unit after a serialization failure or deadlock. | Fixed: product envelope; tuning not established |
| Slow SQL threshold | >250 ms | packages/db/src/diagnostics.ts |
Slow-query logging and local SQL mapping | Separates slow statements from ordinary query timing; parameters are never mapped. | Fixed: product envelope; tuning not established |
| Query timing history | 100 queries | packages/db/src/diagnostics.ts |
Recent in-memory timing records | Bounds health memory independently of lifetime counters. | Fixed: product envelope; tuning not established |
| Slow query health output | 10 queries | packages/db/src/diagnostics.ts |
Slowest records from the recent timing window | Bounds each health response. | Fixed: product envelope; tuning not established |
| Plugin schema identifier | 63 UTF-8 bytes | packages/db/src/pluginDb/index.ts |
Complete plugin_ schema identifier | Matches PostgreSQL identifier storage and prevents silent ownership aliasing. | Fixed: PostgreSQL identifier contract |
| Journal rebuild input page | 128 rows and 256 KiB | packages/db/src/journal/projection.ts |
Fenced boot/import structural rebuild | Typed inputs stage in an indexed transaction-local table before one canonical set-based projection. One indivisible oversized entry progresses alone. | Fixed: product envelope; tuning not established |
| Event retention candidates | 128 rows | packages/db/src/events/index.ts |
Locked event deletion candidates | Bounds work and row-lock duration per retention call. | Fixed: product envelope; tuning not established |
| Alert retention candidates | 128 rows | packages/db/src/events/alerts.ts |
Locked alert deletion candidates | Bounds work and row-lock duration per retention call. | Fixed: product envelope; tuning not established |
| Event and alert retention bytes | 256 KiB | packages/db/src/events/alerts.ts |
Selected deletion payload bytes | Allows one indivisible oversized row alone so retention can progress. | Fixed: product envelope; tuning not established |
| Host-resource retention pass | 1000 rows | packages/db/src/events/hostResources.ts |
Combined detail and rollup deletions | Shares one bounded budget across both tables. | Fixed: product envelope; tuning not established |
| Event heatmap range | 1..90 days | packages/db/src/events/index.ts |
Heatmap SQL history window | Bounds aggregation work. | Fixed: product envelope; tuning not established |
| Recent event actors range | 1..720 hours | packages/db/src/events/index.ts |
Recent-actor SQL history window | Bounds account activity aggregation. | Fixed: product envelope; tuning not established |
| Journal purge rows | 128 rows | packages/db/src/journal/deletion.ts |
One source or mutation batch | Bounds per-statement materialization and lock work. | Fixed: product envelope; tuning not established |
| Journal purge bytes | 256 KiB | packages/db/src/journal/deletion.ts |
One source or mutation batch | Allows one indivisible oversized entry alone so the cursor advances. | Fixed: product envelope; tuning not established |
| Inherited fork reclamation rows | 128 rows | packages/db/src/journal/forkRetention.ts |
One source or mutation batch | Bounds per-statement materialization and lock work. | Fixed: product envelope; tuning not established |
| Inherited fork reclamation bytes | 256 KiB | packages/db/src/journal/forkRetention.ts |
One source or mutation batch | Allows one indivisible oversized entry alone so the cursor advances. | Fixed: product envelope; tuning not established |
| Fork entry copy rows | 128 rows | packages/db/src/journal/forks.ts |
One source or mutation batch | Bounds per-statement materialization and lock work. | Fixed: product envelope; tuning not established |
| Fork entry copy bytes | 256 KiB | packages/db/src/journal/forks.ts |
One source or mutation batch | Allows one indivisible oversized entry alone so the cursor advances. | Fixed: product envelope; tuning not established |
| Parked-session resume attempts | 3 attempts | packages/db/src/journal/metadata.ts |
Durable resume claims before refusal | Bounds repeated automatic recovery of the same parked session. | Fixed: product envelope; tuning not established |
| Maintenance scheduling pass | 128 batches | packages/db/src/maintenance/index.ts |
One bounded domain/token/deleted-session drain | Yields after each batch and returns control instead of monopolizing a pool connection. | Fixed: product envelope; tuning not established |
| Memory eviction page | 1000 memories | packages/db/src/maintenance/index.ts |
Per-account eviction candidate reads | Bounds the in-memory page while existing per-memory transactions own admission. | Fixed: product envelope; tuning not established |
| Archive retention page | 128 entries | packages/db/src/maintenance/retention.ts |
Original-entry reads, validation and retirement batches | Bounds SQL payloads while the outer archive transaction remains atomic. | Fixed: product envelope; tuning not established |
| Prepared archive restore page | 128 entries | packages/db/src/maintenance/restore.ts |
Prepared-original validation and restoration batches | Bounds each SQL phase without committing batches independently. | Fixed: product envelope; tuning not established |
| Memory recall history purge | 128 rows | packages/db/src/memory/index.ts |
Expired memory-usage deletion candidates | Bounds retention statements. | Fixed: product envelope; tuning not established |
| Memory recall-count range | 365 days maximum | packages/db/src/memory/index.ts |
Recall-history aggregation | Bounds the requested historical scan. | Fixed: product envelope; tuning not established |
| Memory maintenance visible jobs | 20 jobs | packages/db/src/memory/maintenance.ts |
One account's unacknowledged maintenance results | Bounds durable-job UI reads. | Fixed: product envelope; tuning not established |
| Memory maintenance result lifetime | 24 hours | packages/db/src/memory/maintenance.ts |
Completed job visibility and pruning | Retains the latest result per operation while bounding old history. | Fixed: product envelope; tuning not established |
| Dreaming dock jobs | 25 jobs | packages/db/src/memory/dreaming.ts |
One account's unacknowledged dreaming jobs | Bounds dock reads. | Fixed: product envelope; tuning not established |
| Dreaming dock history | 24 hours | packages/db/src/memory/dreaming.ts |
Completed dreaming-job visibility | Keeps recent results without an unbounded dock history. | Fixed: product envelope; tuning not established |
| Dreaming pending evidence rows | 200 rows by default | packages/db/src/memory/dreaming.ts |
One caller-sized pending evidence batch | Bounds default SQL source materialization. | Fixed: product envelope; tuning not established |
| Dreaming pending evidence bytes | 120000 bytes by default | packages/db/src/memory/dreaming.ts |
Pending memory bodies returned together | Bounds default evidence memory; one oversized first memory can progress. | Fixed: product envelope; tuning not established |
| Token last-used refresh | 60000 ms | packages/db/src/users/apiTokens.ts |
Token activity writes | Writes the first use immediately, then refreshes after at least one minute. | Fixed: product envelope; tuning not established |
| Dreaming same-boot reacquisition | 3600000 ms | packages/db/src/memory/dreaming.ts |
Reacquiring a held dreaming lock with the same boot id | Rejects the same holder within one hour; a different boot id can acquire immediately. | Fixed: product envelope; tuning not established |
| Descendant usage cache | 64 session entries | packages/db/src/usage/rollup.ts |
Process-local descendant usage results | Clears the cache before adding a new identity at capacity; publishes only after commit and validates revision and epoch on reads. | Fixed: product envelope; tuning not established |
| Message search candidates | 500 rows per page and 500 accepted candidates | packages/db/src/search/index.ts |
Literal-authoritative search candidates | Bounds each SQL page and the candidate set before branch filtering. | Fixed: product envelope; tuning not established |
| Message search result default | 50 hits | packages/db/src/search/index.ts |
Default caller-visible search result count | Bounds ordinary search output; caller can request a different count. | Fixed: product envelope; tuning not established |
| Vector hash lookup statement | 512 hashes | packages/db/src/search/vectors.ts |
One array-bound lookup statement | Bounds lookup input independently of total caller hashes. | Fixed: product envelope; tuning not established |
| Vector prune scan statement | 512 rows | packages/db/src/search/vectors.ts |
One locked live-hash pruning page | Bounds scan and lock work per transaction. | Fixed: product envelope; tuning not established |
| Vector insert batch | 64 vectors | packages/db/src/search/vectors.ts |
One write transaction | Bounds per-transaction insert work. | Fixed: product envelope; tuning not established |
| Vector space and oldest eviction batch | 64 vectors | packages/db/src/search/vectors.ts |
One locked deletion transaction | Bounds each space-prune or oldest-cache eviction pass. | Fixed: product envelope; tuning not established |
| Vector mutation bytes | 256 KiB | packages/db/src/search/vectors.ts |
Vector insert/delete batch payload | Allows one oversized vector alone so a batch can advance. | Fixed: product envelope; tuning not established |
| Provider diagnostic session page | 50 default, 100 maximum, plus one sentinel row | packages/db/src/providerRequests/debug.ts |
Session debug SQL result page | Bounds metadata reads while detecting continuation. | Fixed: product envelope; tuning not established |
| Provider diagnostic request page | 50 default, 100 maximum, plus one sentinel row | packages/db/src/providerRequests/debug.ts |
Request debug SQL result page | Bounds request header reads while detecting continuation. | Fixed: product envelope; tuning not established |
| Provider payload page | 20 default, 100 maximum entries | packages/db/src/providerRequests/debug.ts |
Debug payload entries | Bounds caller-selected payload cardinality. | Fixed: product envelope; tuning not established |
| Provider diagnostic bytes | 256 KiB default, 4 MiB maximum | packages/db/src/providerRequests/debug.ts |
Prepared debug payload bytes | Rejects a first oversized entry before materializing its body. | Fixed: product envelope; tuning not established |
| Provider segment metadata statement | 100 references, 301 bind parameters | packages/db/src/providerRequests/debug.ts |
One OR-expanded metadata lookup | One session bind plus three fields per reference bounds SQL statement size. | Fixed: product envelope; tuning not established |
| Provider response segment statement | 100 references | packages/db/src/providerRequests/debug.ts |
One response assembly lookup | Bounds segment lookup clauses and bind arrays. | Fixed: product envelope; tuning not established |
| Provider retention batch rows | 128 rows | packages/db/src/providerRequests/retention.ts |
Requests, chains or segments removed in one step | Bounds one independently committed retention step. | Fixed: product envelope; tuning not established |
| Provider retention batch bytes | 256 KiB | packages/db/src/providerRequests/retention.ts |
Estimated request/chain/segment bytes removed in one step | Allows one oversized indivisible row alone. | Fixed: product envelope; tuning not established |
| Transcript tail scan page | 128 entries | packages/db/src/transcript/reads.ts |
Reverse branch message scans | Bounds each SQL result while finding the qualifying tail. | Fixed: product envelope; tuning not established |
| Activity-tool history window | 1..48 hours | packages/db/src/transcript/reads.ts |
Tool-activity SQL snapshot range | Bounds source history. | Fixed: product envelope; tuning not established |
| Activity-tool snapshot size | 1..20000 calls | packages/db/src/transcript/reads.ts |
Collected activity tool calls | Bounds one snapshot's output. | Fixed: product envelope; tuning not established |
| Activity-tool source page | 128 entries | packages/db/src/transcript/reads.ts |
Paged assistant-entry scan | Bounds source materialization independently of collected calls. | Fixed: product envelope; tuning not established |
| Legacy transcript diagnostic page | 50 default, 100 maximum, plus one sentinel row | packages/db/src/transcript/reads.ts |
Debug transcript headers | Bounds reads while detecting continuation. | Fixed: product envelope; tuning not established |
| Legacy transcript diagnostic bytes | 256 KiB default, 4 MiB maximum | packages/db/src/transcript/reads.ts |
Accepted legacy debug bodies | Rejects an oversized first body before reading it. | Fixed: product envelope; tuning not established |
| Artifact deletion queue page | 200 rows by default | packages/db/src/transcript/reads.ts |
Pending artifact cleanup listing | Bounds ordinary cleanup discovery; caller may select a different page size. | Fixed: product envelope; tuning not established |
| Digest assistant source | 5 messages per session | packages/db/src/transcript/reads.ts |
Recent assistant source for digest material | Bounds one session's assistant contribution. | Fixed: product envelope; tuning not established |
| Delegated SQL identity chunk | 200 session ids | packages/db/src/delegation/branches.ts |
Batched delegated branch SQL inputs | Bounds array-bound statement input. | Fixed: product envelope; tuning not established |
| Delegated branch roots | 100 conversations | packages/db/src/delegation/branches.ts |
Root identities in one traversal | Bounds traversal fan-out. | Fixed: product envelope; tuning not established |
| Delegated branch depth | 8 levels | packages/db/src/delegation/branches.ts |
Recursive branch exploration | Bounds traversal depth. | Fixed: product envelope; tuning not established |
| Delegated branch children | 50 children per parent | packages/db/src/delegation/branches.ts |
Per-parent SQL child/result window | Bounds fan-out; truncation is explicit. | Fixed: product envelope; tuning not established |
| Delegated branch nodes | 2000 nodes | packages/db/src/delegation/branches.ts |
One complete branch response | Bounds total materialized branch nodes. | Fixed: product envelope; tuning not established |
| Delegated child reads | 50 children maximum | packages/db/src/delegation/reads.ts |
Accepted child ids and their detail/result listing | Caps the page after principal filtering; the initial ownership-candidate query is not SQL-limited. | Fixed: product envelope; tuning not established |
| Origin retention page | 128 rows | packages/db/src/usage/origins.ts |
One source or deletion statement | Bounds transaction work while preserving progress between calls. | Fixed: product envelope; tuning not established |
| Provider-usage retention page | 128 rows | packages/db/src/usage/providers.ts |
One source or deletion statement | Bounds transaction work while preserving progress between calls. | Fixed: product envelope; tuning not established |
| Quota history retention page | 128 rows | packages/db/src/usage/quota.ts |
One source or deletion statement | Bounds transaction work while preserving progress between calls. | Fixed: product envelope; tuning not established |
| Usage rollup rebuild page | 128 rows | packages/db/src/usage/rollup.ts |
One source or deletion statement | Bounds transaction work while preserving progress between calls. | Fixed: product envelope; tuning not established |
| User proof/token expiry page | 128 rows | packages/db/src/users/auth.ts |
One source or deletion statement | Bounds transaction work while preserving progress between calls. | Fixed: product envelope; tuning not established |
| Origin usage aggregate page | 50 default, 500 maximum rows | packages/db/src/usage/origins.ts |
Origin usage ranking | Bounds grouped usage output. | Fixed: product envelope; tuning not established |
| Provider usage aggregate page | 50 default, 100 maximum rows | packages/db/src/usage/providers.ts |
Provider usage ranking | Bounds grouped usage output. | Fixed: product envelope; tuning not established |
| Origin attribution pin lifetime | 6 hours | packages/db/src/usage/origins.ts |
Process-owned usage attribution pins | Reclaims abandoned pins without changing durable counters. | Fixed: product envelope; tuning not established |
| Quota sampling heartbeat | 1 hour | packages/db/src/usage/quota.ts |
Unchanged quota sample persistence | Avoids redundant historical rows while retaining regular observations. | Fixed: product envelope; tuning not established |
| Quota reset jitter | 60 seconds | packages/db/src/usage/quotaHistory.ts |
Comparing provider reset instants | Treats countdown rounding as the same window rather than double-counting consumption. | Fixed: product envelope; tuning not established |
| Quota history gap | 3 hours | packages/db/src/usage/quotaHistory.ts |
Missing quota observation detection | Distinguishes missed readings from an unchanged window. | Fixed: product envelope; tuning not established |
| Memory recall retention | 90 days | packages/db/src/memory/index.ts |
Memory usage history expiry | Bounds durable recall history. | Fixed: product envelope; tuning not established |
| Cleared alert retention | 30 days | packages/db/src/maintenance/index.ts |
Cleared alert history | Preserves the existing durable-history envelope. | Fixed: product envelope; tuning not established |
| Read informational alert retention | 14 days | packages/db/src/maintenance/index.ts |
Read informational alert history | Keeps low-priority history shorter than other alerts. | Fixed: product envelope; tuning not established |
| Read alert retention | 30 days | packages/db/src/maintenance/index.ts |
Other read alert history | Bounds durable alert history. | Fixed: product envelope; tuning not established |
| Quota sample retention | 120 days | packages/db/src/maintenance/index.ts |
Durable provider quota sample history | Bounds historical quota storage. | Fixed: product envelope; tuning not established |
| Digest retention | 7 days | packages/db/src/events/digests.ts |
Old digest rows | Bounds generated digest history. | Fixed: product envelope; tuning not established |
| User token TTL default | 30 days | packages/db/src/users/common.ts |
Expiry when a caller supplies no valid token TTL | Preserves the account token contract; configured positive TTLs remain authoritative. | Fixed: product envelope; tuning not established |
| Plugin secret payload | 1 MiB | packages/db/src/config/pluginSecretVault.ts |
One encrypted plugin secret value | Bounds encryption and durable secret input. | Fixed: product envelope; tuning not established |
| Provider SERIALIZABLE writes | 3 total attempts | packages/db/src/providerRequests/index.ts |
Explicit retrying diagnostic retention writes | Retries each independently bounded lock/recheck/delete transaction. | Fixed: product envelope; tuning not established |
| Provider capture segment rows | 128 segments | packages/db/src/providerRequests/index.ts |
One independently committed capture batch | Bounds staging transaction cardinality. | Fixed: product envelope; tuning not established |
| Provider capture segment bytes | 256 KiB | packages/db/src/providerRequests/index.ts |
One capture batch's segment bodies | Allows one indivisible oversized segment alone so capture advances. | Fixed: product envelope; tuning not established |
| Provider capture chain rows | 128 nodes | packages/db/src/providerRequests/index.ts |
One independently committed chain batch | Bounds chain staging statement and lock work. | Fixed: product envelope; tuning not established |
| Provider diagnostic prune passes | 128 batches | packages/db/src/providerRequests/index.ts |
One diagnostic maintenance invocation | Bounds independently committed retention work before returning. | Fixed: product envelope; tuning not established |
| Provider diagnostic completed sessions | 8 sessions | packages/db/src/providerRequests/index.ts |
Completed sessions removed in one diagnostic maintenance invocation | Bounds cross-session retention work per tick. | Fixed: product envelope; tuning not established |
| Event listing page | 200 events by default | packages/db/src/events/index.ts |
Ordinary event list SQL output | Bounds default listing; explicit caller limits remain supported. | Fixed: product envelope; tuning not established |
| Open-alert listing page | 200 alerts by default | packages/db/src/events/alerts.ts |
Ordinary open-alert SQL output | Bounds default listing; explicit caller limits remain supported. | Fixed: product envelope; tuning not established |
| Memory event listing page | 100 events by default | packages/db/src/memory/index.ts |
Ordinary memory audit SQL output | Bounds default listing; explicit caller limits remain supported. | Fixed: product envelope; tuning not established |
| Provider diagnostic preview | 240 characters | packages/db/src/providerRequests/payload.ts |
Stored display preview per provider segment | Bounds row metadata independently of the full segment body. | Fixed: product envelope; tuning not established |
Runner sizing and IPC
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Runner RSS estimate | 512 MiB | src/subagent/sizing.ts |
Initial runner memory sizing | Conservative estimate before measured RSS arrives. | Fixed: product envelope; tuning not established |
| Pool RAM fraction | 0.5 fraction | src/subagent/sizing.ts |
Total pool memory | Reserves the other half for daemon, database and host. | Fixed: product envelope; tuning not established |
| Spawn headroom | 1.5 x runner RSS | src/subagent/sizing.ts |
Available memory for a new runner | Allows module-load and boot peaks. | Fixed: product envelope; tuning not established |
| Automatic CPU cap | max(1, floor(cpus) - 1) runners | src/subagent/sizing.ts |
Automatic runner admission | Reserves one core for the daemon while allowing single-core offload. | Fixed: product envelope; tuning not established |
| Memory cap | floor(totalRAM x 0.5 / RSS) runners | src/subagent/sizing.ts |
Automatic and explicit runner admission | Keeps the memory budget authoritative even with an explicit pool cap. | Fixed: product envelope; tuning not established |
| Saturation lag | 250 ms p99 | src/subagent/sizing.ts |
Runner growth trigger | Detects sustained event-loop load. | Fixed: product envelope; tuning not established |
| Saturation samples | 2 heartbeats | src/subagent/sizing.ts |
Runner growth trigger | Rejects single-sample spikes. | Fixed: product envelope; tuning not established |
| Saturating turns | 4 turns | src/subagent/sizing.ts |
Runner growth trigger | Starts spreading concurrent work before saturation. | Fixed: product envelope; tuning not established |
| Runner turns | 8 turns | src/subagent/sizing.ts |
Per-runner concurrent work | Bounds one event loop's workload. | Fixed: product envelope; tuning not established |
| Growth cooldown | 15000 ms | src/subagent/sizing.ts |
Runner spawning frequency | Lets the previous boot affect observed load. | Fixed: product envelope; tuning not established |
| Idle reap | 120000 ms | src/subagent/sizing.ts |
Idle runner lifetime | Reclaims unused process memory. | Fixed: product envelope; tuning not established |
| Heartbeat | 2000 ms | src/subagent/sizing.ts |
Runner telemetry cadence | Balances observation latency and IPC traffic. | Fixed: product envelope; tuning not established |
| Lag window | 10000 ms | src/subagent/sizing.ts |
Runner lag sample window | Smooths short scheduling spikes. | Fixed: product envelope; tuning not established |
| Descendant scan | 256 processes | src/subagent/sizing.ts |
Runner tree RSS walk | Bounds accounting work. | Fixed: product envelope; tuning not established |
| Thread scan | 1024 threads | src/subagent/sizing.ts |
Runner tree discovery | Bounds process-tree enumeration. | Fixed: product envelope; tuning not established |
| Pool maintenance | 5 x heartbeat | src/subagent/pool.ts |
Pool cleanup cadence | Shares the telemetry clock. | Fixed: product envelope; tuning not established |
| Idle route | 30 min | src/subagent/pool.ts |
Idle session routing retention | Avoids retaining stale runner routing indefinitely. | Fixed: product envelope; tuning not established |
| Runner boot | 60000 ms | src/subagent/runnerHost.ts |
Fork readiness handshake | Bounds a failed startup. | Fixed: product envelope; tuning not established |
| Boot retry cooldown | 60000 ms | src/subagent/runnerHost.ts |
Repeated failed runner starts | Avoids repeated failing forks. | Fixed: product envelope; tuning not established |
| Process RPC | 2000 ms | src/subagent/runnerHost.ts |
Process query and live tap response | Keeps caller-visible introspection bounded. | Fixed: product envelope; tuning not established |
| Live tap RPC | 2000 ms | src/subagent/runnerHost.ts |
Live tap response | Keeps live introspection bounded. | Fixed: product envelope; tuning not established |
| Process sweep | 3000 ms | src/subagent/runnerHost.ts |
Account/session child cleanup acknowledgement | Allows process stop confirmation before timeout. | Fixed: product envelope; tuning not established |
| Host API RPC payload | 8 MiB | src/subagent/hostRpc.ts |
Serialized API request | Matches the bounded API transport. | Fixed: protocol payload contract |
| Host ordinary RPC payload | 64 KiB | src/subagent/hostRpc.ts |
Non-API request JSON | Bounds IPC validation and workflow expansion input. | Fixed: protocol payload contract |
| Process list | 4096 entries | src/subagent/protocol.ts |
IPC process metadata | Bounds one process registry snapshot. | Fixed: protocol payload contract |
| Process metadata value | 128 characters | src/subagent/protocol.ts |
IPC metadata string | Bounds private metadata. | Fixed: protocol payload contract |
| Process error | 1000 characters | src/subagent/protocol.ts |
IPC error string | Bounds error payload. | Fixed: protocol payload contract |
| Runner exit grace | 5000 ms | src/subagent/runner.ts |
Child shutdown | Allows cleanup before forced exit. | Fixed: product envelope; tuning not established |
| Settlement keepalive | 30000 ms | src/brain/service/delegatedSettlement.ts |
Waiting-child progress | Keeps the parent informed while helpers finish. | Fixed: product envelope; tuning not established |
| Settlement initial backoff | 250 ms | src/brain/service/delegatedSettlement.ts |
Helper settlement checks | Allows prompt completion without a busy loop. | Fixed: product envelope; tuning not established |
| Settlement maximum backoff | 5000 ms | src/brain/service/delegatedSettlement.ts |
Helper settlement checks | Caps idle polling delay. | Fixed: product envelope; tuning not established |
Delegation and workflows
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Workflow nodes | 128 nodes | plugins/subagent/lib/dag.mjs |
DAG size | Bounds graph validation and execution state. | Fixed: product envelope; tuning not established |
| Workflow task | 16000 characters | plugins/subagent/lib/dag.mjs |
Node task text | Bounds delegated context. | Fixed: product envelope; tuning not established |
| Workflow identifier | 64 characters | plugins/subagent/lib/dag.mjs |
Node identifiers | Bounds persisted graph identifiers. | Fixed: product envelope; tuning not established |
| Workflow cwd | 4096 characters | plugins/subagent/lib/dag.mjs |
Node working directory | Matches the bounded path contract. | Fixed: product envelope; tuning not established |
| Active workflows | 16 workflows | plugins/subagent/lib/workflow.mjs |
Concurrent workflow admission | Bounds in-memory workflow coordination. | Fixed: product envelope; tuning not established |
| Workflow result | 8000 characters | plugins/subagent/lib/workflow.mjs |
Node result in context | Keeps summaries bounded. | Fixed: product envelope; tuning not established |
| Workflow handover | 4000 characters | plugins/subagent/lib/workflow.mjs |
Dependency handover text | Keeps direct-dependent context bounded. | Fixed: product envelope; tuning not established |
| Workflow display throttle | 500 ms | plugins/subagent/lib/workflow.mjs |
Progress snapshots | Bounds live display traffic. | Fixed: product envelope; tuning not established |
| Delegation context chunk | 7000 characters | plugins/subagent/lib/limits.mjs |
One context attachment | Bounds a single prompt contribution. | Fixed: product envelope; tuning not established |
| Delegation context chunks | 12 chunks | plugins/subagent/lib/limits.mjs |
Context attachments | Bounds fan-in. | Fixed: product envelope; tuning not established |
| Delegation context total | 40000 characters | plugins/subagent/lib/limits.mjs |
Combined context | Bounds cumulative delegated prompt size. | Fixed: product envelope; tuning not established |
Guest files
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
Guest request frame (GUEST_FILE_REQUEST_FRAME_BYTES) |
1 MiB | plugins/sandbox/lib/guestFileAgent.mjs |
One request frame | Matches the Python framing contract. | Fixed: shared guest transport contract |
Guest reply frame (GUEST_FILE_REPLY_FRAME_BYTES) |
16 MiB | plugins/sandbox/lib/guestFileAgent.mjs |
One reply frame | Bounds transport buffering; must match Python. | Fixed: shared guest transport contract |
| Guest operation deadline | 120000 ms | plugins/sandbox/lib/guestFileAgent.mjs |
One pending file request | Fails a wedged request without making process lifetime a deadline. | Fixed: shared guest transport contract |
| Idle guest agent | 60000 ms | plugins/sandbox/lib/guestFileAgent.mjs |
Unused persistent agent session | Reclaims idle sessions. | Fixed: shared guest transport contract |
| Guest agents per process | 4 agents | plugins/sandbox/lib/guestFileAgent.mjs |
Each daemon or runner's agent pool | Bounds local sessions; root's global cap remains independent. | Fixed: shared guest transport contract |
Python request frame (GUEST_FILE_REQUEST_FRAME_BYTES) |
1 MiB | plugins/sandbox/lib/guestFiles.py |
One request frame | Must match the JS file-agent client. | Fixed: guest file protocol |
Python reply frame (GUEST_FILE_REPLY_FRAME_BYTES) |
16 MiB | plugins/sandbox/lib/guestFiles.py |
One reply frame | Must match the JS file-agent client. | Fixed: guest file protocol |
| Python file workers | 4 threads | plugins/sandbox/lib/guestFiles.py |
Concurrent file operations | Bounds executor work while mutations serialize. | Fixed: guest file protocol |
| Python upload chunk | 512 KiB | plugins/sandbox/lib/guestFiles.py |
One uploaded chunk | Matches the shared chunk protocol. | Fixed: guest file protocol |
| Python list page | 1000 entries | plugins/sandbox/lib/guestFiles.py |
One list response | Bounds directory response. | Fixed: guest file protocol |
| Walk entries | 20001 entries | plugins/sandbox/lib/guestFiles.py |
Tree scan | 20000 usable paths plus completeness sentinel. | Fixed: guest file protocol |
| Walk depth | 64 levels | plugins/sandbox/lib/guestFiles.py |
Recursive tree walk | Bounds recursion. | Fixed: guest file protocol |
| Walk skip names | 64 names | plugins/sandbox/lib/guestFiles.py |
Excluded directory names | Bounds request parsing. | Fixed: guest file protocol |
| Walk skip name length | 255 characters | plugins/sandbox/lib/guestFiles.py |
One excluded name | Matches filesystem component constraints. | Fixed: guest file protocol |
| Walk deadline | 10000 ms | plugins/sandbox/lib/guestFiles.py |
One tree walk | Bounds guest scan duration. | Fixed: guest file protocol |
| Walk payload | 8 MiB | plugins/sandbox/lib/guestFiles.py |
Serialized walk entries | Leaves room inside reply framing. | Fixed: guest file protocol |
| Guest path | 4096 characters | plugins/sandbox/lib/guestFiles.py |
Filesystem operation paths | Bounds path parsing. | Fixed: guest file protocol |
| List cursor | 4096 characters | plugins/sandbox/lib/guestFiles.py |
Continuation cursor | Bounds pagination input. | Fixed: guest file protocol |
| Version cache | 64 records | plugins/sandbox/lib/guestFiles.py |
Cached file versions | Bounds process memory. | Fixed: guest file protocol |
| File hash/read buffer | 64 KiB | plugins/sandbox/lib/guestFiles.py |
Streaming file reads | Avoids whole-file allocation. | Fixed: guest file protocol |
| Upload state read | 65537 bytes | plugins/sandbox/lib/guestFiles.py |
Upload journal read | Detects state exceeding 64 KiB. | Fixed: guest file protocol |
| Shared upload chunk | 512 KiB | packages/plugin-shared/guestFiles.mjs |
One transport upload | Matches Python and transport chunking. | Fixed: shared file protocol |
| Shared read chunk | 128 KiB | packages/plugin-shared/guestFiles.mjs |
One transport read | Bounds read memory. | Fixed: shared file protocol |
| Shared list page | 1000 entries | packages/plugin-shared/guestFiles.mjs |
One list request | Matches Python list paging. | Fixed: shared file protocol |
| Transport upload chunk | 512 KiB | plugins/sandbox/lib/guestFileTransport.mjs |
One upload operation | Matches shared and Python chunking. | Fixed: shared file protocol |
| Upload reservation TTL | 24 h | plugins/sandbox/lib/guestFileTransport.mjs |
Abandoned uploads | Reclaims stale staging reservations. | Fixed: shared file protocol |
| Version string | 256 characters | plugins/sandbox/lib/guestFileTransport.mjs |
CAS version input | Bounds protocol validation. | Fixed: shared file protocol |
Privileged worker
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Worker frame | 24 MiB | scripts/elowen-privileged-worker.mjs |
Control frame | Bounds root-side JSON processing. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Worker outbound backlog | 24 MiB | scripts/elowen-privileged-worker.mjs |
Peer's queued responses | Bounds memory for slow readers. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Worker queue | 128 requests | scripts/elowen-privileged-worker.mjs |
Waiting operations | Bounds admission. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Unclassified connections | 128 connections | scripts/elowen-privileged-worker.mjs |
Peers before header classification | Bounds socket admission. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Requests per connection | 32 requests | scripts/elowen-privileged-worker.mjs |
In-flight work per peer | Bounds one peer's resource share. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Operation workers | 4 processes | scripts/elowen-privileged-worker.mjs |
Root operation parallelism | Fixed worker envelope. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Bulk worker slots | 3 slots | scripts/elowen-privileged-worker.mjs |
Parallel bulk operations | Reserves one of four workers for control. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Ordinary execution sessions | 32 sessions | scripts/elowen-privileged-worker.mjs |
Pending and live guest executions | Independent admission ceiling. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| File-agent sessions | 16 sessions | scripts/elowen-privileged-worker.mjs |
Global persistent guest file agents | Separate cap from ordinary execution. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| First header | 1 KiB | scripts/elowen-privileged-worker.mjs |
Unclassified peer input | Bounds parsing before admission. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Stream attach deadline | 5000 ms | scripts/elowen-privileged-worker.mjs |
Attaching execution streams | Reclaims partial sessions. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Orphan result TTL | 15 min | scripts/elowen-privileged-worker.mjs |
Undelivered execution results | Bounds retention. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Orphan result count | 128 results | scripts/elowen-privileged-worker.mjs |
Undelivered execution results | Bounds memory independently of TTL. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Control operation deadline | 15 min maximum | scripts/elowen-privileged-worker.mjs |
Privileged handler lifetime | Caps operation budgets. | Fixed: root-enforced cap; service-user configuration cannot raise it |
Privileged gateway
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Guest helper source | 1 MiB | scripts/elowen-site-gateway.mjs |
Installed Python source | Bounds root-owned helper installation. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Root command timeout | 30000 ms | scripts/elowen-site-gateway.mjs |
Ordinary host commands | Bounds synchronous operation occupancy. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Package operation timeout | 5 min | scripts/elowen-site-gateway.mjs |
Package-manager operations | Allows package work within the control deadline. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Disk tree timeout | 15 min | scripts/elowen-site-gateway.mjs |
Disk/tree operations | Allows expensive traversal without an unbounded handler. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Resource usage timeout | 15000 ms | scripts/elowen-site-gateway.mjs |
Resource measurement | Bounds metric collection. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Root command output | 2 MiB | scripts/elowen-site-gateway.mjs |
Command capture | Bounds root memory. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Nginx test timeout | 20000 ms | scripts/elowen-site-gateway.mjs |
Gateway configuration test | Bounds validation command. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Nginx reload timeout | 20000 ms | scripts/elowen-site-gateway.mjs |
Gateway reload | Bounds service operation. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Guest argv count | 256 arguments | scripts/elowen-site-gateway.mjs |
Guest execution request | Bounds launch input. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Guest argv total | 64 KiB | scripts/elowen-site-gateway.mjs |
All argument text | Bounds launch input. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Guest execution maximum | 900000 ms | scripts/elowen-site-gateway.mjs |
Ordinary guest runtime | Root ceiling for requested execution duration. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Guest unit stop | 5000 ms | scripts/elowen-site-gateway.mjs |
Transient unit teardown | Bounds shutdown. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Publication batch groups | 128 groups | scripts/elowen-site-gateway.mjs |
Publication status query | Bounds batch work. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Publication units per group | 128 units | scripts/elowen-site-gateway.mjs |
One machine's status query | Bounds per-machine work. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Publication units total | 512 units | scripts/elowen-site-gateway.mjs |
Whole status batch | Bounds aggregate work independently of group maxima. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Tree-size batch | 1000 paths | scripts/elowen-site-gateway.mjs |
Disk usage measurement | Bounds one traversal batch. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Tree-copy sources | 32 trees | scripts/elowen-site-gateway.mjs |
Copy preflight | Bounds simultaneous source inputs. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Bind mounts | 8 mounts | scripts/elowen-site-gateway.mjs |
Runtime spec | Bounds and validates the host mount surface. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Environment entries | 64 entries | scripts/elowen-site-gateway.mjs |
Runtime environment | Bounds launch input. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Inbound ports | 32 ports | scripts/elowen-site-gateway.mjs |
Runtime network spec | Bounds firewall rules. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Environment value | 4096 characters | scripts/elowen-site-gateway.mjs |
One environment value | Bounds launch input. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Certificate lineage listing | MAX_BINDINGS x 4 entries | scripts/elowen-site-gateway.mjs |
Certificate discovery | Bounds directory enumeration relative to gateway capacity. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| UID registry | 1 MiB | scripts/elowen-site-gateway.mjs |
UID allocation evidence | Bounds root-owned state parsing. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| UID slots | 4096 slots | scripts/elowen-site-gateway.mjs |
Managed machine identities | Fixed allocation namespace. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| UID range | 65536 UIDs | scripts/elowen-site-gateway.mjs |
One managed machine | User-namespace identity contract. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Gateway bindings | 4096 bindings | scripts/siteGatewayContract.mjs |
Gateway mapping table | Bounds host routing configuration. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Gateway bindings bytes | 512 KiB | scripts/siteGatewayContract.mjs |
Serialized gateway mappings | Bounds configuration input. | Fixed: root-enforced cap; service-user configuration cannot raise it |
Privileged services
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Worker memory | 512 MiB | src/cli/install/systemdUnits.ts |
Worker cgroup including children | Contains the whole privileged service. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Worker tasks | 128 tasks | src/cli/install/systemdUnits.ts |
Worker cgroup | Contains process/thread fan-out. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Worker file descriptors | 1024 descriptors | src/cli/install/systemdUnits.ts |
Worker service | Contains socket and file handles. | Fixed: root-enforced cap; service-user configuration cannot raise it |
| Worker socket backlog | 128 connections | src/cli/install/systemdUnits.ts |
Socket activation queue | Bounds pending kernel connections. | Fixed: root-enforced cap; service-user configuration cannot raise it |
Privileged client
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Client handshake | 5000 ms | src/privileged/workerClient.ts |
Worker handshake | Bounds handshake within overall operation budget. | Fixed: privileged transport contract |
| Client preparation | 120000 ms | src/privileged/workerClient.ts |
Execution preparation | Bounds preparation within overall operation budget. | Fixed: privileged transport contract |
| Client attachment | 5000 ms | src/privileged/workerClient.ts |
Stream attachment | Matches root attach budget. | Fixed: privileged transport contract |
| Client stdin | 1 MiB | src/privileged/workerClient.ts |
Captured operation input | Bounds buffered input. | Fixed: privileged transport contract |
| Client output | 16 MiB | src/privileged/workerClient.ts |
Captured operation output | Bounds buffered output. | Fixed: privileged transport contract |
Sandbox lifecycle
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Nspawn default timeout | 120000 ms | plugins/sandbox/lib/nspawn.mjs |
Internal runtime requests | Bounds a runtime control operation. | Fixed: lifecycle envelope; tuning not established |
| Nspawn timeout cap | 900000 ms | plugins/sandbox/lib/nspawn.mjs |
Internal timeout validator | Matches root operation maximum. | Fixed: lifecycle envelope; tuning not established |
| Nspawn probe | 5000 ms | plugins/sandbox/lib/nspawn.mjs |
Guest probes | Keeps readiness checks short. | Fixed: lifecycle envelope; tuning not established |
| Nspawn guest command | 30000 ms | plugins/sandbox/lib/nspawn.mjs |
Guest helper command | Bounds ordinary helper work. | Fixed: lifecycle envelope; tuning not established |
| Disk usage cache | 300000 ms | plugins/sandbox/lib/nspawn.mjs |
Single-flight disk measurements | Balances expensive traversal against disk enforcement latency. | Fixed: lifecycle envelope; tuning not established |
| Disk cache validator | 3600000 ms | plugins/sandbox/lib/nspawn.mjs |
Injected disk cache interval | Bounds the internal injection contract. | Fixed: lifecycle envelope; tuning not established |
| Live-limit retry | 300000 ms | plugins/sandbox/lib/nspawn.mjs |
Failed live-limit application | Bounds repair frequency. | Fixed: lifecycle envelope; tuning not established |
| Machine registration deadline | 60000 ms | plugins/sandbox/lib/nspawn.mjs |
Machine registration after start | Bounds boot wait. | Fixed: lifecycle envelope; tuning not established |
| Machine registration poll | 100 ms | plugins/sandbox/lib/nspawn.mjs |
Registration probes | Responsive bounded boot polling. | Fixed: lifecycle envelope; tuning not established |
| Bus/network readiness poll | 250 ms | plugins/sandbox/lib/nspawn.mjs |
Readiness probes | Balances boot latency and probe frequency. | Fixed: lifecycle envelope; tuning not established |
| Host readiness cache | 15000 ms | plugins/sandbox/lib/environmentRuntime.mjs |
Readiness facts | Avoids repeated host checks. | Fixed: lifecycle envelope; tuning not established |
| Recovery backoff | 0, 30000, 120000, 600000 ms | plugins/sandbox/lib/environmentRuntime.mjs |
Successive recovery attempts | Spaces repeated failed starts. | Fixed: lifecycle envelope; tuning not established |
| Recovery stability | 15 min | plugins/sandbox/lib/environmentRuntime.mjs |
Recovery failure reset | Requires stable operation before forgiving failures. | Fixed: lifecycle envelope; tuning not established |
| Recovery safety sweep | 60000 ms | plugins/sandbox/lib/environmentRuntime.mjs |
Lifecycle reconciliation | Repairs missed runtime transitions. | Fixed: lifecycle envelope; tuning not established |
| Environment logs | 1000 lines | plugins/sandbox/lib/environmentRuntime.mjs |
Log response | Bounds returned diagnostic text. | Fixed: lifecycle envelope; tuning not established |
| Runtime stdin | 1 MiB | plugins/sandbox/lib/runtimeProcess.mjs |
Process input capture | Bounds process I/O memory. | Fixed: process transport contract |
| Runtime output | 256 KiB | plugins/sandbox/lib/runtimeProcess.mjs |
Process output capture | Bounds process I/O memory. | Fixed: process transport contract |
| Runtime kill escalation | 250 ms | plugins/sandbox/lib/runtimeProcess.mjs |
Signal escalation | Allows termination before SIGKILL. | Fixed: process transport contract |
Desktop protocol
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Desktop PNG | 3 MiB | plugins/sandbox/lib/desktopLimits.mjs |
Screenshot image | Bounds the baked guest transport. | Fixed: baked guest protocol |
| Desktop request | 1 MiB | plugins/sandbox/lib/desktopLimits.mjs |
Command frame | Bounds the baked guest transport. | Fixed: baked guest protocol |
| Desktop reply | 1 MiB | plugins/sandbox/lib/desktopLimits.mjs |
Ordinary reply frame | Bounds the baked guest transport. | Fixed: baked guest protocol |
| Desktop screenshot reply | base64(3 MiB) + 65536 bytes | plugins/sandbox/lib/desktopLimits.mjs |
Image reply frame | Accounts for base64 expansion and metadata. | Fixed: baked guest protocol |
| Desktop edge | 2048 pixels | plugins/sandbox/lib/desktopLimits.mjs |
Image geometry | Bounds rendering memory. | Fixed: baked guest protocol |
| Desktop minimum scale | 0.25 ratio | plugins/sandbox/lib/desktopLimits.mjs |
Coordinate scaling | Fixed geometry validation. | Fixed: baked guest protocol |
| Desktop maximum scale | 4 ratio | plugins/sandbox/lib/desktopLimits.mjs |
Coordinate scaling | Fixed geometry validation. | Fixed: baked guest protocol |
| Desktop coordinates | 100000 maximum | plugins/sandbox/lib/desktopLimits.mjs |
Coordinate inputs | Bounds command validation. | Fixed: baked guest protocol |
| Desktop batch | 20 steps | plugins/sandbox/lib/desktopCommands.mjs |
Command sequence | Bounds one desktop operation. | Fixed: product command contract |
Files and tools
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Read-state sessions | 64 sessions | plugins/files/lib/readState.mjs |
Read-before-write evidence | Bounds session memory. | Fixed: product envelope; tuning not established |
| Read-state files | 512 files/session | plugins/files/lib/readState.mjs |
Read-before-write evidence | Bounds per-session memory. | Fixed: product envelope; tuning not established |
| Text read chunk | 64 KiB | plugins/files/lib/readState.mjs |
Host file reads | Streams content without whole-file allocation. | Fixed: product envelope; tuning not established |
| Search timeout | 5000 ms | plugins/files/lib/search.mjs |
Ripgrep search | Bounds one search. | Fixed: product envelope; tuning not established |
| Search line cap | 500 characters | plugins/files/lib/search.mjs |
One matching line | Keeps minified hits from filling the page. | Fixed: product envelope; tuning not established |
| Diff output | 200 lines | plugins/files/lib/editCore.mjs |
Rendered edit diff | Bounds response text. | Fixed: product envelope; tuning not established |
| PDF image pages | 5 pages | plugins/files/lib/documents.mjs |
Scanned PDF rendering | Bounds media output. | Fixed: product envelope; tuning not established |
| PDF image edge | 2000 pixels | plugins/files/lib/documents.mjs |
Rendered PDF page | Bounds image memory. | Fixed: product envelope; tuning not established |
| PDF process timeout | 30000 ms | plugins/files/lib/documents.mjs |
Document helper commands | Bounds conversion duration. | Fixed: product envelope; tuning not established |
| PDF process output | 8000000 bytes | plugins/files/lib/documents.mjs |
Helper command capture | Bounds conversion output memory. | Fixed: product envelope; tuning not established |
| File image | 3750000 bytes | plugins/files/lib/imageFormats.mjs |
Image tool result | Bounds model-facing image payload. | Fixed: product envelope; tuning not established |
| Persisted tool output | 8000000 bytes | src/shared/toolOutput.ts |
Full captured tool output | Bounds spill storage per call. | Fixed: product envelope; tuning not established |
Terminal
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Terminal inline output | 60000 characters | plugins/terminal/index.mjs |
Foreground and background response | Bounds inline text. | Fixed: product envelope; tuning not established |
| Bash minimum timeout | 1 ms | plugins/terminal/index.mjs |
Caller timeout validation | Preserves explicit millisecond waits. | Fixed: product envelope; tuning not established |
| ProcessOutput default wait | 30 s | plugins/terminal/index.mjs |
Blocking output collection | Allows completion without polling. | Fixed: product envelope; tuning not established |
| ProcessOutput maximum wait | 600 s | plugins/terminal/index.mjs |
One blocking output read | Bounds a single tool wait; process continues afterwards. | Fixed: product envelope; tuning not established |
| Progress throttle | 100 ms | plugins/terminal/index.mjs |
Live output pushes | Bounds event traffic. | Fixed: product envelope; tuning not established |
| Progress tail | 2000 characters | plugins/terminal/index.mjs |
Live output preview | Bounds each progress frame. | Fixed: product envelope; tuning not established |
| Cleanup poll | 25 ms | plugins/terminal/index.mjs |
Direct child exit confirmation | Checks actual termination before cleanup returns. | Fixed: product envelope; tuning not established |
| Standalone sleep refusal | 2 s minimum | plugins/terminal/index.mjs |
Polling command policy | Discourages waiting by launching sleep commands. | Fixed: product envelope; tuning not established |
Code mode
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Schema rendering budget | 16000 bytes | plugins/code-mode/src/protocol/schemaTypes.ts |
TypeScript tool previews | Bounds prompt output. | Fixed: product envelope; tuning not established |
| Schema work budget | 4 x rendering budget | plugins/code-mode/src/protocol/schemaTypes.ts |
Schema traversal | Bounds work even if little output is emitted. | Fixed: product envelope; tuning not established |
| Observation text | 8 MiB | plugins/code-mode/src/protocol/observation.ts |
Text observation validation | Bounds observation transport. | Fixed: observation protocol |
| Observation image | 28000000 characters | plugins/code-mode/src/protocol/observation.ts |
Encoded image observation | Bounds base64 media transport. | Fixed: observation protocol |
Plugin infrastructure
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Default hook timeout | 2000 ms | src/plugins/hookBus.ts |
Ordinary hook execution | Bounds contributed work. | Fixed: product envelope; tuning not established |
| After-tool hook timeout | 12000 ms | src/plugins/hookBus.ts |
tools.call.after | Allows evidence persistence before tool completion. | Fixed: product envelope; tuning not established |
| Plugin stop grace | 30000 ms | src/plugins/serviceRunner.ts |
Service shutdown | Bounds service teardown. | Fixed: product envelope; tuning not established |
| Service reconcile | 20000 ms | src/plugins/serviceRunner.ts |
Service reconciliation | Bounds one repair pass. | Fixed: product envelope; tuning not established |
| Platform prompt files | 16 files | src/plugins/loader.ts |
Platform prompt contributions | Bounds contributed context. | Fixed: product envelope; tuning not established |
| Platform prompt file | 8000 characters | src/plugins/loader.ts |
One platform prompt | Bounds individual contribution. | Fixed: product envelope; tuning not established |
| Platform prompt total | 32000 characters | src/plugins/loader.ts |
Combined platform prompts | Bounds aggregate context. | Fixed: product envelope; tuning not established |
| Plugin package files | 800 files | src/plugins/marketplace.ts |
Package extraction | Bounds archive expansion. | Fixed: product envelope; tuning not established |
| Plugin package bytes | 8 MiB | src/plugins/marketplace.ts |
Extracted package content | Bounds package resource use. | Fixed: product envelope; tuning not established |
| Plugin command buffer | 8 MiB | src/plugins/marketplace.ts |
Package command output | Bounds subprocess capture. | Fixed: product envelope; tuning not established |
| Destination provider timeout | 5000 ms | src/plugins/registry.ts |
Delivery destination lookup | Bounds plugin lookup latency. | Fixed: product envelope; tuning not established |
| WebSocket ticket default TTL | 30000 ms | src/plugins/wsTickets.ts |
Single-use socket ticket | Short authentication handoff window. | Fixed: authentication contract |
| WebSocket ticket maximum TTL | 300000 ms | src/plugins/wsTickets.ts |
Caller-supplied ticket lifetime | Bounds bearer authority lifetime. | Fixed: authentication contract |
| WebSocket ticket capacity | 1000 tickets | src/plugins/wsTickets.ts |
Pending tickets | Bounds authentication-state memory. | Fixed: authentication contract |
Web tool
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Web fetch | 20000 ms | plugins/web/index.mjs |
One remote fetch | Bounds network wait. | Fixed: product envelope; tuning not established |
| Web cache | 15 min | plugins/web/index.mjs |
Fetched content retention | Avoids repeated fetching while limiting staleness. | Fixed: product envelope; tuning not established |
Daemon lifecycle
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Boot announcement debounce | 60000 ms | src/daemon/shutdown.ts |
Repeated boot announcements | Avoids duplicate notifications. | Fixed: product envelope; tuning not established |
| Pause notification | 1500 ms | src/daemon/shutdown.ts |
Pre-shutdown notification | Reserves bounded pause time. | Fixed: product envelope; tuning not established |
| Pause checkpoint | 5000 ms | src/daemon/shutdown.ts |
Checkpoint guard | Bounds persistence wait. | Fixed: product envelope; tuning not established |
| Pause unparkable work | 24000 ms | src/daemon/shutdown.ts |
Unparkable turn shutdown | Fits service shutdown envelope. | Fixed: product envelope; tuning not established |
| Pause plugin shutdown | 3000 ms | src/daemon/shutdown.ts |
Plugin stops | Bounds contributed cleanup. | Fixed: product envelope; tuning not established |
| Restart quiet | 2500 ms | src/daemon/shutdown.ts |
Restart coalescing | Groups adjacent restart requests. | Fixed: product envelope; tuning not established |
| Restart response flush | 250 ms | src/daemon/shutdown.ts |
HTTP response before exit | Allows response delivery. | Fixed: product envelope; tuning not established |
| Update lock wait | 10 min | src/shared/updateBudgets.ts |
Update transaction lock | Bounds contention wait. | Fixed: product envelope; tuning not established |
| Update boot proof | 180000 ms | src/shared/updateBudgets.ts |
Candidate boot verification | Bounds restart verification. | Fixed: product envelope; tuning not established |
| Privileged worker drain | 16 min | src/shared/updateBudgets.ts |
Worker replacement | Exceeds the 15-minute maximum operation. | Fixed: product envelope; tuning not established |
CLI presentation
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| CLI retry policy bootstrap | 3000 ms | src/cli/chat/brainClient.ts |
One cold authenticated connection-policy read | Refuse unavailable policy before SSE without defaulting or automatic retry. | Fixed: request bootstrap envelope |
| CLI stream byte silence | 75000 ms | src/cli/chat/brainStream.ts |
One conversation/instance stream attempt without received bytes | Two missed 30-second keepalives plus headroom; bytes prove liveness, not readiness. | Fixed: stream lifecycle envelope |
| Compose marker | 10000 ms | src/shared/chatPresentation.ts |
Ordinary unfinished tool authoring | Suppresses brief transient hints. | Fixed: product envelope; tuning not established |
| Long-tool compose marker | 3000 ms | src/shared/chatPresentation.ts |
Long-duration tool authoring | Names meaningful long operations sooner. | Fixed: product envelope; tuning not established |
Maintenance
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Token purge cadence | 3600000 ms | src/daemon/maintenance.ts |
Expired token sweep | Hourly bounded housekeeping. | Fixed: product envelope; tuning not established |
| Event purge cadence | 3600000 ms | src/daemon/maintenance.ts |
Expired event sweep | Hourly bounded housekeeping. | Fixed: product envelope; tuning not established |
| Artifact sweep cadence | 3600000 ms | src/daemon/maintenance.ts |
Orphan artifact sweep | Hourly bounded housekeeping. | Fixed: product envelope; tuning not established |
| Provider request retention cadence | 300000 ms | src/daemon/maintenance.ts |
Diagnostic storage retention | Reclaims large captures frequently. | Fixed: product envelope; tuning not established |
| Origin retention cadence | 3600000 ms | src/daemon/maintenance.ts |
Origin data retention | Hourly bounded housekeeping. | Fixed: product envelope; tuning not established |
| Alert retention cadence | 3600000 ms | src/daemon/maintenance.ts |
Old alert cleanup | Hourly bounded housekeeping. | Fixed: product envelope; tuning not established |
| Provider usage schedule tick | 10000 ms | src/daemon/providerUsageSchedule.ts |
Provider usage reads and quota alerts | Finest step of the cadences and retries below; a tick with nothing due costs nothing. | Fixed: product envelope; tuning not established |
| Provider usage busy cadence | 60000 ms | src/daemon/providerUsageSchedule.ts |
Account usage reads while a turn or delegated child runs | Keeps limits current during work. | Fixed: product envelope; tuning not established |
| Provider usage idle cadence | 300000 ms | src/daemon/providerUsageSchedule.ts |
Account usage reads while nothing runs | Balances freshness against provider queries. | Fixed: product envelope; tuning not established |
| Provider usage empty-read retries | 10000 ms, 30000 ms | src/daemon/providerUsageSchedule.ts |
An account whose read left nothing to show | Repairs a failed or empty first read quickly, then falls back to the cadence. | Fixed: product envelope; tuning not established |
| Disk alert cadence | 60000 ms | src/daemon/maintenance.ts |
Host disk alerts | Detects disk pressure promptly. | Fixed: product envelope; tuning not established |
| Update alert cadence | 300000 ms | src/daemon/maintenance.ts |
Update status alerts | Bounds background checks. | Fixed: product envelope; tuning not established |
| Deleted session drain cadence | 60000 ms | src/daemon/maintenance.ts |
Deferred conversation cleanup | Reclaims pending deletions promptly. | Fixed: product envelope; tuning not established |
| Stale session purge cadence | 3600000 ms | src/daemon/maintenance.ts |
Configured session retention | Hourly bounded housekeeping. | Fixed: product envelope; tuning not established |
| Memory retention cadence | 86400000 ms | src/daemon/maintenance.ts |
Memory eviction | Daily bounded maintenance. | Fixed: product envelope; tuning not established |
| Recall retention cadence | 3600000 ms | src/daemon/maintenance.ts |
Recall usage cleanup | Hourly bounded housekeeping. | Fixed: product envelope; tuning not established |
| Attachment worker timeout | 60000 ms | src/daemon/maintenance.ts |
Attachment sweep worker | Bounds one background pass. | Fixed: product envelope; tuning not established |
| Attachment sweep cadence | 86400000 ms | src/daemon/maintenance.ts |
Unused attachment cleanup | Daily bounded maintenance. | Fixed: product envelope; tuning not established |
| Licence first tick | 60000 ms | src/daemon/maintenance.ts |
Initial licence recheck | Lets boot finish before network work. | Fixed: product envelope; tuning not established |
| Licence tick cadence | 3600000 ms | src/daemon/maintenance.ts |
Active licence recheck | Maintains entitlement without frequent queries. | Fixed: product envelope; tuning not established |
| Memory eviction batch | 1000 rows | packages/db/src/maintenance/index.ts |
One keyset scan page | Bounds each awaited PostgreSQL query. | Fixed: product envelope; tuning not established |
| Memory eviction window | 86400000 ms | packages/db/src/maintenance/index.ts |
Rolling per-account deletion budget | Counts audited auto-evictions in the preceding 24 hours. | Fixed: product envelope; tuning not established |
| Worker kill grace | 5000 ms | src/brain/backgroundWorkerFork.ts |
Background-worker cancellation | Allows graceful exit before force. | Fixed: product envelope; tuning not established |
API and network
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Login attempts | 10 attempts per origin per budget | src/api/loginRateLimit.ts |
Separate password/SSO/password-proof and OTP windows | Bounds password and code guessing independently; only final authentication clears the first-step window. | Fixed: authentication policy |
| Login window | 300000 ms | src/api/loginRateLimit.ts |
Login rate accounting | Defines the authentication throttle window. | Fixed: authentication policy |
| Plugin WebSocket frame | 16 MiB | src/api/pluginWebSocket.ts |
Socket messages | Bounds authenticated transport memory. | Fixed: protocol |
| Login body | 16 KiB | src/api/server.ts |
Password login, TOTP completion and challenge cancellation HTTP requests | Bounds unauthenticated input before parsing. | Fixed: protocol |
| Browser session page | 100 sessions | src/api/routes/authSecurity.ts |
One own-session cursor page | Bounds authenticated session enumeration. | Fixed: authentication policy |
| Browser session cursor/id | 128 characters | src/api/routes/authSecurity.ts |
Session identifiers and cursor query input | Bounds opaque repository selectors. | Fixed: protocol |
| Activation body | 1024 bytes | src/api/validation.ts |
Licence activation request | Bounds unauthenticated input. | Fixed: protocol |
| Webhook body | 1 MiB | src/api/routes/hooks.ts |
Public callback input | Bounds public input buffering. | Fixed: protocol |
| Plugin API body | 8 MiB | src/api/routes/pluginApi.ts |
Plugin request input | Bounds authenticated API input. | Fixed: protocol |
| Activation flush | 250 ms | src/api/lockedServer.ts |
Activation restart response | Bounds flush before restart. | Fixed: product envelope; tuning not established |
| Project branch concurrency | 4 operations | src/api/projectSummary.ts |
Managed branch reads | Bounds concurrent guest work. | Fixed: product envelope; tuning not established |
| Project branch budget | 4000 ms | src/api/projectSummary.ts |
Managed branch reads | Bounds list response latency. | Fixed: product envelope; tuning not established |
| Project branch cache | 30000 ms | src/api/projectSummary.ts |
Managed branch facts | Avoids repeated guest work. | Fixed: product envelope; tuning not established |
| Project member samples | 16 members | src/api/projectSummary.ts |
Summary representation | Bounds list response size. | Fixed: product envelope; tuning not established |
| Plugin project indicators | 3 indicators/plugin | src/api/projectSummary.ts |
Summary contributions | Bounds each contributor. | Fixed: product envelope; tuning not established |
| Project indicators total | 8 indicators/project | src/api/projectSummary.ts |
Merged summary | Bounds aggregate response. | Fixed: product envelope; tuning not established |
| API schema text | 16000 characters | src/api/routeCatalog.ts |
Route search schema output | Bounds model context. | Fixed: product envelope; tuning not established |
| API route results | 25 routes | src/api/routeCatalog.ts |
Route search | Bounds output. | Fixed: product envelope; tuning not established |
| Agent wait timeout | 120000 ms | src/api/routes/agentRuns.ts |
Run waiter | Bounds one long-poll request. | Fixed: product envelope; tuning not established |
| Open alerts | 200 alerts | src/api/routes/alerts.ts |
Alert list | Bounds API response. | Fixed: product envelope; tuning not established |
| Conversation link batch | 100 conversations | src/api/routes/brainConversationLinks.ts |
Link resolution | Bounds batch lookup. | Fixed: product envelope; tuning not established |
| Plugin data summary entries | 50000 entries | src/brain/backgroundWorker.ts |
Directory size summary inside the plugin-data worker | Bounds traversal; a pass that hits the bound reports a partial summary. | Fixed: product envelope; tuning not established |
| Plugin data summary budget | 2000 ms | src/brain/backgroundWorker.ts |
Directory size summary inside the plugin-data worker | Bounds traversal latency independently of the entry count. | Fixed: product envelope; tuning not established |
| Search rank rate | 30 requests/min | src/api/routes/search.ts |
Ranking endpoint | Bounds inference usage. | Fixed: product envelope; tuning not established |
| Search answer rate | 10 requests/min | src/api/routes/search.ts |
Answer endpoint | Bounds inference usage. | Fixed: product envelope; tuning not established |
| Search rate window | 60000 ms | src/api/routes/search.ts |
Rate accounting | Defines request window. | Fixed: product envelope; tuning not established |
| Version cache | 30 min | src/api/version.ts |
Latest-version lookup | Bounds remote queries. | Fixed: product envelope; tuning not established |
Provider and session execution
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Catalog worker pass | 15 min | src/brain/modelCatalog.ts |
Background catalog work | Bounds refresh frequency. | Fixed: product envelope; tuning not established |
| Catalog fetch gate | 4 h | src/brain/modelCatalog.ts |
PI/models.dev fetch | Avoids unnecessary remote refreshes. | Fixed: product envelope; tuning not established |
| Catalog worker timeout | 60000 ms | src/brain/modelCatalog.ts |
Worker pass | Bounds background execution. | Fixed: product envelope; tuning not established |
| Catalog probe timeout | 10000 ms | src/brain/modelCatalog.ts |
Provider probe | Bounds one provider check. | Fixed: product envelope; tuning not established |
| Provider model fetch | 5000 ms | src/brain/providerModelCatalog.ts |
Provider model list | Bounds network request. | Fixed: product envelope; tuning not established |
| Output modalities | 32 modalities | src/brain/providerModelCatalog.ts |
Provider metadata | Bounds catalog input. | Fixed: product envelope; tuning not established |
| Output modality name | 64 characters | src/brain/providerModelCatalog.ts |
Provider metadata | Bounds catalog input. | Fixed: product envelope; tuning not established |
| Provider usage cache | 30000 ms | src/brain/providerUsage.ts |
Usage fetch cache | Stops two near-simultaneous reads from polling twice; below the busy cadence so a due read is never cached. | Fixed: product envelope; tuning not established |
| Provider usage fetch | 5000 ms | src/brain/providerUsage.ts |
Usage endpoint | Bounds provider latency. | Fixed: product envelope; tuning not established |
| Completion timeout | 180000 ms | src/brain/piInference.ts |
Sessionless inference | Bounds background inference. | Fixed: product envelope; tuning not established |
| Embedding timeout | 45000 ms | src/brain/embedBatchWorker.ts |
Embedding worker request | Bounds batch wait. | Fixed: product envelope; tuning not established |
| Image generation timeout | 120000 ms | src/brain/imageService.ts |
Image provider request | Allows rendering while bounding network wait. | Fixed: product envelope; tuning not established |
| Provider stream idle | 120000 ms | src/brain/session/providerStreamWatchdog.ts |
Silent streaming body | Detects abandoned streams. | Fixed: product envelope; tuning not established |
| Provider SSE frame | 16 MiB | src/brain/session/anthropicSseCapture.ts |
Captured SSE frame | Bounds transport buffering. | Fixed: provider transport |
| Failure evidence body | 8 KiB | src/brain/session/attemptEvidence.ts |
Provider failure response | Bounds diagnostic capture. | Fixed: product envelope; tuning not established |
| Failover accounts | 3 accounts | src/brain/session/attemptSeries.ts |
One attempt series | Bounds repeated provider attempts. | Fixed: product envelope; tuning not established |
| Same-account repeats | 1 repeat | src/brain/session/attemptSeries.ts |
One attempt series | Bounds same-route retries. | Fixed: product envelope; tuning not established |
| Credential stale lock | 30000 ms | src/brain/credentialStore.ts |
Credential lock recovery | Bounds dead lock ownership. | Fixed: product envelope; tuning not established |
| Credential lock heartbeat | 10000 ms | src/brain/credentialStore.ts |
Live lock renewal | Keeps active owners distinguishable. | Fixed: product envelope; tuning not established |
| Credential lock acquisition | 15000 ms | src/brain/credentialStore.ts |
Credential lock wait | Bounds contention. | Fixed: product envelope; tuning not established |
| Credential lock retry | 50 ms | src/brain/credentialStore.ts |
Lock acquisition polling | Avoids busy spinning. | Fixed: product envelope; tuning not established |
| Credential torn-read attempts | 3 attempts | src/brain/credentialStore.ts |
Concurrent credential reads | Bounds retry work. | Fixed: product envelope; tuning not established |
| Credential torn-read delay | 25 ms | src/brain/credentialStore.ts |
Torn-read retry | Allows a concurrent writer to finish. | Fixed: product envelope; tuning not established |
| OAuth refresh lead | 4 h | src/brain/oauthRefresh.ts |
Anthropic token renewal | Refreshes ahead of expiry. | Fixed: product envelope; tuning not established |
| OAuth refresh tick | 60000 ms | src/brain/oauthRefresh.ts |
Token renewal check | Bounds polling frequency. | Fixed: product envelope; tuning not established |
| Codex routing refresh | 5000 ms | src/brain/session/codexRouting.ts |
Routing response | Bounds network wait. | Fixed: product envelope; tuning not established |
| Codex refill backoff | 5 min | src/brain/session/codexRouting.ts |
Refill attempts | Bounds repeated refresh work. | Fixed: product envelope; tuning not established |
Recovery and sessions
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Unparkable settle wait | 20000 ms | src/brain/recovery/pause.ts |
Turn pause | Fits the outer shutdown guard. | Fixed: product envelope; tuning not established |
| Unparkable settle poll | 250 ms | src/brain/recovery/pause.ts |
Turn pause checks | Bounds wait polling. | Fixed: product envelope; tuning not established |
| Result wake attempts | 3 attempts | src/brain/recovery/parkedConversations.ts |
Recovery/delivery retry loop | Stops repeated failures from running indefinitely. | Fixed: product envelope; tuning not established |
| Park/resume attempts | 3 attempts | src/brain/recovery/types.ts |
Recovery/delivery retry loop | Stops repeated failures from running indefinitely. | Fixed: product envelope; tuning not established |
| Workflow resume attempts | 3 attempts | src/brain/recovery/workflowResume.ts |
Recovery/delivery retry loop | Stops repeated failures from running indefinitely. | Fixed: product envelope; tuning not established |
| Delegated recovery attempts | 3 attempts | src/brain/service/delegatedRecovery.ts |
Recovery/delivery retry loop | Stops repeated failures from running indefinitely. | Fixed: product envelope; tuning not established |
| Result delivery attempts | 5 attempts | src/brain/service/resultDelivery.ts |
Recovery/delivery retry loop | Stops repeated failures from running indefinitely. | Fixed: product envelope; tuning not established |
| Platform delivery attempts | 3 attempts | src/brain/platformTurnRecovery.ts |
Recovery/delivery retry loop | Stops repeated failures from running indefinitely. | Fixed: product envelope; tuning not established |
| Idle live session TTL | 30 min | src/brain/service/liveSessionReaper.ts |
In-memory live runtime | Reclaims runtime while preserving durable history. | Fixed: product envelope; tuning not established |
| Local kill timeout | 2000 ms | src/brain/processRegistry.ts |
Process stop acknowledgement | Bounds teardown wait. | Fixed: product envelope; tuning not established |
| Platform startup timeout | 30000 ms | src/brain/platformConnectionRuntime.ts |
One adapter's connect call | Bounds contributed startup work; the runtime owns the timeout, never the adapter's retry loop. | Fixed: product envelope; tuning not established |
| Branch cache TTL | 5000 ms | src/brain/service/gitBranch.ts |
Prompt branch metadata | Avoids per-turn repeated Git work. | Fixed: product envelope; tuning not established |
| Branch cache capacity | 64 entries | src/brain/service/gitBranch.ts |
Branch metadata cache | Bounds memory. | Fixed: product envelope; tuning not established |
| Session ancestry hops | 64 hops | src/brain/service/sessionQuiescence.ts |
Quiescence traversal | Bounds ancestry walk. | Fixed: product envelope; tuning not established |
Prompt and tool payloads
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Plan body | 16000 characters | src/brain/continuity/planStore.ts |
Saved plan | Bounds recovery prompt context. | Fixed: product envelope; tuning not established |
| Plan read bound | 256 KiB | src/brain/continuity/planStore.ts |
Plan file read | Bounds file parsing. | Fixed: product envelope; tuning not established |
| Plan read chunk | 64 KiB | src/brain/continuity/planStore.ts |
Plan file streaming | Bounds allocation. | Fixed: product envelope; tuning not established |
| Instruction file | 256 KiB | src/brain/session/contextFiles.ts |
One instruction file | Bounds context input. | Fixed: product envelope; tuning not established |
| Step context record | 1024 bytes | src/brain/session/contextRecordDriver.ts |
One step context contribution | Bounds per-step growth. | Fixed: product envelope; tuning not established |
| Inline tool result | 50000 bytes | src/brain/session/deliverySpill.ts |
One provider-facing tool result | Spills large outputs to bounded references. | Fixed: product envelope; tuning not established |
| Tool result group budget | 200000 bytes | src/brain/session/deliverySpill.ts |
One group of tool results | Bounds aggregate model context. | Fixed: product envelope; tuning not established |
| External tool schema | 8000 bytes | src/brain/toolSchemaCap.ts |
External tool definition | Bounds prompt schema size. | Fixed: product envelope; tuning not established |
| External tool description | 1000 bytes | src/brain/toolSchemaCap.ts |
External tool prose | Bounds prompt description size. | Fixed: product envelope; tuning not established |
| Replay events | 512 events | src/brain/session/liveEventReplay.ts |
Live replay ring | Bounds per-session event memory. | Fixed: product envelope; tuning not established |
| Replay text | 512 KiB | src/brain/session/liveEventReplay.ts |
Live replay ring | Bounds memory independently of count. | Fixed: product envelope; tuning not established |
| Hydration events | 2048 events | src/brain/session/serializedEventBuffer.ts |
Hydration buffer | Bounds reconnect buffering. | Fixed: product envelope; tuning not established |
| Hydration bytes | 4 MiB | src/brain/session/serializedEventBuffer.ts |
Hydration buffer | Bounds memory independently of count. | Fixed: product envelope; tuning not established |
| Platform history items | 100 entries | src/brain/platformTurnEnvelope.ts |
Adapter history | Bounds supplied context. | Fixed: product envelope; tuning not established |
| Platform history total | 6000 characters | src/brain/platformTurnEnvelope.ts |
Adapter history | Bounds supplied context. | Fixed: product envelope; tuning not established |
| Platform history item | 1200 characters | src/brain/platformTurnEnvelope.ts |
One history message | Bounds one message contribution. | Fixed: product envelope; tuning not established |
| Attachment bytes | 25 MiB | src/brain/channelAttachments.ts |
One incoming attachment | Bounds transfer. | Fixed: product envelope; tuning not established |
| Attachments per message | 10 attachments | src/brain/channelAttachments.ts |
Incoming message | Bounds fan-in. | Fixed: product envelope; tuning not established |
| Shared image | 10 MiB | src/brain/chatImages.ts |
Outgoing image | Bounds image transfer. | Fixed: product envelope; tuning not established |
| Encoded chat image | 7000000 characters | src/shared/chatImageLimits.ts |
Encoded image input | Bounds API payload. | Fixed: product envelope; tuning not established |
| Chat images per message | 4 images | src/shared/chatImageLimits.ts |
Chat input | Bounds image fan-in. | Fixed: product envelope; tuning not established |
| Interactive view | 48 KiB | src/shared/interactiveView.ts |
Inline HTML document | Bounds sandboxed UI payload. | Fixed: product envelope; tuning not established |
| Scope project ids | 10000 ids | src/brain/delegatedScope.ts |
Delegated permission snapshot | Bounds serialized scope. | Fixed: delegation protocol |
| Scope tool names | 2000 names | src/brain/delegatedScope.ts |
Delegated permission snapshot | Bounds serialized scope. | Fixed: delegation protocol |
| Scope tool name | 256 characters | src/brain/delegatedScope.ts |
Delegated tool identity | Bounds serialized scope. | Fixed: delegation protocol |
| Scope principal | 256 characters | src/brain/delegatedScope.ts |
Delegated principal | Bounds serialized identity. | Fixed: delegation protocol |
| Scope dream run id | 128 characters | src/brain/delegatedScope.ts |
Delegated maintenance identity | Bounds serialized identity. | Fixed: delegation protocol |
| Scope thinking level | 64 characters | src/brain/delegatedScope.ts |
Delegated model settings | Bounds serialized metadata. | Fixed: delegation protocol |
| Scope work directory | 4096 characters | src/brain/delegatedScope.ts |
Delegated cwd | Bounds path input. | Fixed: delegation protocol |
| Scope shared artifacts | 64 references | src/brain/delegatedScope.ts |
Delegated inputs | Bounds context fan-in. | Fixed: delegation protocol |
| Scope artifact reference | 4096 characters | src/brain/delegatedScope.ts |
Delegated input path | Bounds path input. | Fixed: delegation protocol |
| Scope prompt chunks | 16 chunks | src/brain/delegatedScope.ts |
Delegated context | Bounds context fan-in. | Fixed: delegation protocol |
| Scope prompt chunk | 8000 characters | src/brain/delegatedScope.ts |
Delegated context | Bounds one contribution. | Fixed: delegation protocol |
| Scope prompt total | 120000 characters | src/brain/delegatedScope.ts |
Delegated context | Bounds total context. | Fixed: delegation protocol |
| Permission boundary rules | 1024 rules | src/brain/toolPermissions.ts |
Delegated boundary | Bounds policy evaluation. | Fixed: permission contract |
| Permission pattern | 200 characters | src/brain/toolPermissions.ts |
One permission pattern | Bounds policy matching. | Fixed: permission contract |
| Permission rules per map | 200 rules | src/brain/toolPermissions.ts |
Permission map | Bounds policy evaluation. | Fixed: permission contract |
| Command warning scan | 2000 characters | src/brain/destructiveCommandWarning.ts |
Command analysis | Bounds lexical warning work. | Fixed: product envelope; tuning not established |
| Command warning candidates | 64 candidates | src/brain/destructiveCommandWarning.ts |
Command analysis | Bounds nested candidate scanning. | Fixed: product envelope; tuning not established |
| Tool awareness lines | 200 lines | src/brain/prompt/toolCatalog.ts |
Deferred catalog | Bounds prompt context. | Fixed: product envelope; tuning not established |
| Tool awareness description | 140 characters | src/brain/prompt/toolCatalog.ts |
Tool summary | Bounds each catalog row. | Fixed: product envelope; tuning not established |
| Tool catalog names | 220 names | src/brain/prompt/toolCatalog.ts |
Tool summary list | Bounds catalog context. | Fixed: product envelope; tuning not established |
| Inline child answer | 20000 characters | src/brain/persistence.ts |
Delegation answer context | Bounds parent context. | Fixed: product envelope; tuning not established |
| Tool progress throttle | 100 ms | src/brain/events.ts |
Tool events | Bounds event frequency. | Fixed: product envelope; tuning not established |
| Tool progress tail | 2000 characters | src/brain/events.ts |
Tool progress text | Bounds event size. | Fixed: product envelope; tuning not established |
| Authoring throttle | 250 ms | src/brain/events.ts |
Tool-authoring updates | Bounds update frequency. | Fixed: product envelope; tuning not established |
| Authoring state cache | 1024 entries | src/brain/events.ts |
Authoring correlation | Bounds memory after abandoned calls. | Fixed: product envelope; tuning not established |
Voice
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Voice audio frame | 96000 bytes | src/shared/voice.ts |
Audio WebSocket frame | Bounds transport buffering. | Fixed: voice protocol |
| Voice control frame | 16384 bytes | src/shared/voice.ts |
Control WebSocket frame | Bounds control payload. | Fixed: voice protocol |
| Call session drain | 15000 ms | src/shared/voice.ts |
Call transport teardown | Allows final media and accounting. | Fixed: voice protocol |
| Dictation final wait | 3000 ms | src/shared/voice.ts |
Final transcript response | Bounds completion wait. | Fixed: voice protocol |
| Dictation session drain | 2000 ms | src/shared/voice.ts |
Dictation transport teardown | Bounds shutdown. | Fixed: voice protocol |
| Transcription audio | 25 MiB | src/voice/speech.ts |
Transcription input | Bounds provider upload. | Fixed: product envelope; tuning not established |
| Finished call TTL | 6 h | src/voice/finishedCalls.ts |
Call result cache | Bounds result retention. | Fixed: product envelope; tuning not established |
| Finished call records | 500 records | src/voice/finishedCalls.ts |
Call result cache | Bounds memory independently of TTL. | Fixed: product envelope; tuning not established |
| Voice refusal body | 8 KiB | src/voice/realtime/openaiSocket.ts |
Rejected provider response | Bounds diagnostic capture. | Fixed: product envelope; tuning not established |
| Voice refusal wait | 1000 ms | src/voice/realtime/openaiSocket.ts |
Rejected response body read | Bounds diagnostic delay. | Fixed: product envelope; tuning not established |
| Voice progress throttle | 20000 ms | src/voice/live/session.ts |
Call progress events | Bounds notification frequency. | Fixed: product envelope; tuning not established |
| Voice progress text | 240 characters | src/voice/live/session.ts |
Call progress event | Bounds notification size. | Fixed: product envelope; tuning not established |
| Voice idle end | 20000 ms | src/voice/live/session.ts |
Silent ended call | Bounds idle call lifetime. | Fixed: product envelope; tuning not established |
| Dictation commit minimum | 4800 bytes | src/voice/realtime/dictation.ts |
Audio commit | Avoids too-short provider commits. | Fixed: provider media contract |
Registry plugins
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| browser: Evaluate result | 8192 bytes | registry:plugins/browser/src/browser-session.ts |
BrowserEvaluate result | Bounds model-facing data. | Fixed: product envelope; tuning not established |
| browser: Identity title | 512 characters | registry:plugins/browser/src/browser-session.ts |
Page identity | Bounds telemetry. | Fixed: product envelope; tuning not established |
| browser: Identity URL | 2048 characters | registry:plugins/browser/src/browser-session.ts |
Page identity | Bounds telemetry. | Fixed: product envelope; tuning not established |
| browser: Identity action | 512 characters | registry:plugins/browser/src/browser-session.ts |
Page identity | Bounds telemetry. | Fixed: product envelope; tuning not established |
| browser: Navigation timeout | 30000 ms | registry:plugins/browser/src/browser-session.ts |
Page navigation | Bounds a navigation wait. | Fixed: product envelope; tuning not established |
| browser: Full page height | 8000 CSS pixels | registry:plugins/browser/src/capture.ts |
Screenshot geometry | Bounds image memory. | Fixed: product envelope; tuning not established |
| browser: Capture area | 16000000 CSS pixels squared | registry:plugins/browser/src/capture.ts |
Screenshot geometry | Bounds image memory. | Fixed: product envelope; tuning not established |
| browser: Screenshot bytes | 1572864 bytes | registry:plugins/browser/src/capture.ts |
Encoded screenshot | Bounds model input. | Fixed: product envelope; tuning not established |
| browser: Thumbnail width | 480 pixels | registry:plugins/browser/src/capture.ts |
Thumbnail image | Bounds preview memory. | Fixed: product envelope; tuning not established |
| browser: Console buffer | 200 entries | registry:plugins/browser/src/page-diagnostics.ts |
Console history | Bounds diagnostic memory. | Fixed: product envelope; tuning not established |
| browser: Network buffer | 300 entries | registry:plugins/browser/src/page-diagnostics.ts |
Request history | Bounds diagnostic memory. | Fixed: product envelope; tuning not established |
| browser: Entry text | 2000 characters | registry:plugins/browser/src/page-diagnostics.ts |
Diagnostic entry | Bounds individual record. | Fixed: product envelope; tuning not established |
| browser: Console arguments | 8 arguments | registry:plugins/browser/src/page-diagnostics.ts |
Console record | Bounds diagnostic serialization. | Fixed: product envelope; tuning not established |
| browser: Argument text | 512 characters | registry:plugins/browser/src/page-diagnostics.ts |
Console argument | Bounds individual value. | Fixed: product envelope; tuning not established |
| browser: Diagnostic body | 65536 bytes | registry:plugins/browser/src/page-diagnostics.ts |
Response body | Bounds capture memory. | Fixed: product envelope; tuning not established |
| browser: Trace bytes | 8 MiB | registry:plugins/browser/src/performance-probe.ts |
Trace capture | Bounds performance diagnostics. | Fixed: product envelope; tuning not established |
| browser: Trace start | 5000 ms | registry:plugins/browser/src/performance-probe.ts |
Trace startup | Bounds provider handshake. | Fixed: product envelope; tuning not established |
| browser: Trace end | 5000 ms | registry:plugins/browser/src/performance-probe.ts |
Trace stop | Bounds stop acknowledgement. | Fixed: product envelope; tuning not established |
| browser: Trace drain | 10000 ms | registry:plugins/browser/src/performance-probe.ts |
Trace read | Bounds stream completion. | Fixed: product envelope; tuning not established |
| browser: Trace close | 2000 ms | registry:plugins/browser/src/performance-probe.ts |
Trace stream close | Bounds cleanup. | Fixed: product envelope; tuning not established |
| browser: Trace abandon | 1500 ms | registry:plugins/browser/src/performance-probe.ts |
Abandoned trace | Bounds final cleanup. | Fixed: product envelope; tuning not established |
| browser: Favicon bytes | 24 KiB | registry:plugins/browser/src/page-favicon.ts |
One favicon | Bounds small preview asset. | Fixed: product envelope; tuning not established |
| browser: Favicon candidates | 4 candidates | registry:plugins/browser/src/page-favicon.ts |
Favicon search | Bounds network attempts. | Fixed: product envelope; tuning not established |
| browser: Favicon timeout | 5000 ms | registry:plugins/browser/src/page-favicon.ts |
Favicon fetch | Bounds network wait. | Fixed: product envelope; tuning not established |
| browser: Favicon chunk | 8 KiB | registry:plugins/browser/src/page-favicon.ts |
Favicon reading | Bounds read allocation. | Fixed: product envelope; tuning not established |
| browser: Capture minimum edge | 160 pixels | registry:plugins/browser/src/site-capture.ts |
Screenshot geometry | Ensures usable preview. | Fixed: product envelope; tuning not established |
| browser: Capture width | 1920 pixels | registry:plugins/browser/src/site-capture.ts |
Screenshot geometry | Bounds viewport. | Fixed: product envelope; tuning not established |
| browser: Capture height | 1440 pixels | registry:plugins/browser/src/site-capture.ts |
Screenshot geometry | Bounds viewport. | Fixed: product envelope; tuning not established |
| browser: Capture scale | 2 ratio maximum | registry:plugins/browser/src/site-capture.ts |
Screenshot geometry | Bounds raster expansion. | Fixed: product envelope; tuning not established |
| browser: Capture minimum timeout | 1000 ms | registry:plugins/browser/src/site-capture.ts |
Capture input | Rejects unusably short deadlines. | Fixed: product envelope; tuning not established |
| browser: Capture maximum timeout | 30000 ms | registry:plugins/browser/src/site-capture.ts |
Capture input | Bounds caller wait. | Fixed: product envelope; tuning not established |
| browser: Capture default timeout | 15000 ms | registry:plugins/browser/src/site-capture.ts |
Capture wait | Default bounded capture. | Fixed: product envelope; tuning not established |
| browser: Capture bytes | 1572864 bytes | registry:plugins/browser/src/site-capture.ts |
Capture result | Bounds image transfer. | Fixed: product envelope; tuning not established |
| browser: Capture default bytes | 524288 bytes | registry:plugins/browser/src/site-capture.ts |
Capture result | Conservative preview budget. | Fixed: product envelope; tuning not established |
| browser: Capture disposal | 5000 ms | registry:plugins/browser/src/site-capture.ts |
Capture cleanup | Bounds browser teardown. | Fixed: product envelope; tuning not established |
| browser: Capture header | 4096 characters | registry:plugins/browser/src/site-capture.ts |
One header value | Bounds request metadata. | Fixed: product envelope; tuning not established |
| browser: Capture URL | 2048 characters | registry:plugins/browser/src/site-capture.ts |
Capture target | Bounds URL input. | Fixed: product envelope; tuning not established |
| browser: Thumbnail TTL | 1500 ms | registry:plugins/browser/src/thumbnail.ts |
Cached thumbnail | Keeps previews fresh. | Fixed: product envelope; tuning not established |
| browser: Thumbnail live period | 7000 ms | registry:plugins/browser/src/thumbnail.ts |
Live thumbnail state | Bounds live freshness window. | Fixed: product envelope; tuning not established |
| browser: Thumbnail entries | 200 entries | registry:plugins/browser/src/thumbnail.ts |
Thumbnail cache | Bounds cache memory. | Fixed: product envelope; tuning not established |
| browser: Tool result | 16384 bytes | registry:plugins/browser/src/tools.ts |
Browser tool output | Bounds model context. | Fixed: product envelope; tuning not established |
| browser: Display start | 10000 ms | registry:plugins/browser/src/virtual-display.ts |
Virtual display startup | Bounds startup wait. | Fixed: product envelope; tuning not established |
| browser: Closed session retention | 7 days | registry:plugins/browser/src/session-registry.ts |
Closed browser metadata | Bounds retained history. | Fixed: product envelope; tuning not established |
| browser: Pinned addresses | 4 addresses/family | registry:plugins/browser/src/navigation-policy.ts |
DNS pin set | Bounds network policy work. | Fixed: product envelope; tuning not established |
| browser: Rejection log window | 60000 ms | registry:plugins/browser/src/navigation-policy.ts |
Repeated policy logs | Bounds diagnostic noise. | Fixed: product envelope; tuning not established |
| editor: Editable file | 2 MiB | registry:plugins/editor/src/fileTypes.ts |
Editor document | Bounds editing memory. | Fixed: product envelope; tuning not established |
| editor: Office conversions | 2 concurrent jobs | registry:plugins/editor/src/fileTypes.ts |
Document conversion | Bounds CPU/memory concurrency. | Fixed: product envelope; tuning not established |
| editor: Range read | 8 MiB | registry:plugins/editor/src/fileTypes.ts |
Media byte range | Bounds response buffering. | Fixed: product envelope; tuning not established |
| editor: Buffered file | 50 MiB | registry:plugins/editor/src/fileTypes.ts |
Buffered file read | Bounds host memory. | Fixed: product envelope; tuning not established |
| editor: Office file | 20 MiB | registry:plugins/editor/src/fileTypes.ts |
Office conversion input | Bounds conversion cost. | Fixed: product envelope; tuning not established |
| editor: Media preview | 50 MiB | registry:plugins/editor/src/fileTypes.ts |
Preview input | Bounds media transfer. | Fixed: product envelope; tuning not established |
| editor: System listing depth | 0 levels | registry:plugins/editor/src/systemRoot.ts |
One-level host listing | Avoids recursive filesystem-root walks. | Fixed: product envelope; tuning not established |
| editor: Managed listing nodes | 10000 nodes | registry:plugins/editor/src/managed/files.ts |
Directory listing | Bounds one listing result. | Fixed: product envelope; tuning not established |
| editor: Execution timeout | 30000 ms | registry:plugins/editor/src/execution.ts |
Managed Git helpers | Bounds guest work. | Fixed: product envelope; tuning not established |
| editor: Execution output | 8 MiB | registry:plugins/editor/src/execution.ts |
Managed Git capture | Bounds output memory. | Fixed: product envelope; tuning not established |
| lsp: After-edit files | 20 files/session | registry:plugins/lsp/src/afterEdit.ts |
Recent edits | Bounds per-session cache. | Fixed: product envelope; tuning not established |
| lsp: After-edit sessions | 50 sessions | registry:plugins/lsp/src/afterEdit.ts |
Recent edits | Bounds total cache. | Fixed: product envelope; tuning not established |
| lsp: Idle sweep | 5000 ms | registry:plugins/lsp/src/manager.ts |
Server reclamation checks | Bounds idle detection latency. | Fixed: product envelope; tuning not established |
| sites: Hit flush | 60000 ms | registry:plugins/sites/src/index.ts |
Traffic aggregation writes | Batches persistence. | Fixed: product envelope; tuning not established |
| sites: Gateway reconciliation | 12 h | registry:plugins/sites/src/index.ts |
Full gateway reconciliation | Bounds expensive full checks. | Fixed: product envelope; tuning not established |
| sites: Gateway recovery | 60000 ms | registry:plugins/sites/src/index.ts |
Failed gateway repair | Bounds recovery frequency. | Fixed: product envelope; tuning not established |
| sites: Issue sweep | 30000 ms | registry:plugins/sites/src/index.ts |
Issue reconciliation | Bounds alert freshness. | Fixed: product envelope; tuning not established |
| sites: Preview tick | 2000 ms | registry:plugins/sites/src/index.ts |
Preview binding check | Keeps publications responsive. | Fixed: product envelope; tuning not established |
| sites: Preview retry | 15000 ms | registry:plugins/sites/src/preview.ts |
Binding retry delay | Avoids repeated unavailable binding work. | Fixed: product envelope; tuning not established |
| sites: Publication request | 5000 ms | registry:plugins/sites/src/publication.ts |
Publication request timeout | Bounds request latency. | Fixed: product envelope; tuning not established |
| sites: Publication probe | 2000 ms | registry:plugins/sites/src/publication.ts |
Publication health probe | Keeps probes short. | Fixed: product envelope; tuning not established |
| sites: Healthy probe interval | 30000 ms | registry:plugins/sites/src/publication.ts |
Publication recheck | Bounds repeated health traffic. | Fixed: product envelope; tuning not established |
| sites: Certificate probe | 5000 ms | registry:plugins/sites/src/certificate.ts |
Certificate readiness | Bounds network check. | Fixed: product envelope; tuning not established |
| sites: Worker snapshot | 16 MiB | registry:plugins/sites/src/worker/snapshot.ts |
Service snapshot file | Bounds state parsing. | Fixed: product envelope; tuning not established |
| sites: Capture grant | 60000 ms | registry:plugins/sites/src/previewImage.ts |
Preview capture authority | Short-lived handoff. | Fixed: product envelope; tuning not established |
| sites: Preview image TTL | 6 h | registry:plugins/sites/src/previewImage.ts |
Cached image | Bounds staleness. | Fixed: product envelope; tuning not established |
| sites: Preview in-flight | 120000 ms | registry:plugins/sites/src/previewImage.ts |
Capture ownership | Reclaims abandoned capture. | Fixed: product envelope; tuning not established |
| sites: Preview retry base | 60000 ms | registry:plugins/sites/src/previewImage.ts |
Failed capture | Bounds retry rate. | Fixed: product envelope; tuning not established |
| sites: Preview retry maximum | 30 min | registry:plugins/sites/src/previewImage.ts |
Failed capture backoff | Caps backoff. | Fixed: product envelope; tuning not established |
| sites: Preview bytes | 1572864 bytes | registry:plugins/sites/src/previewImage.ts |
Cached image | Bounds cache entry. | Fixed: product envelope; tuning not established |
| sites: Manual refresh gap | 30000 ms | registry:plugins/sites/src/previewImage.ts |
Manual refresh | Bounds repeated capture work. | Fixed: product envelope; tuning not established |
| sites: Preview capture timeout | 20000 ms | registry:plugins/sites/src/previewImage.ts |
Browser capture | Bounds one capture. | Fixed: product envelope; tuning not established |
| sites: Custom hostnames | 10 names | registry:plugins/sites/src/hostnameRecords.ts |
Site aliases | Bounds public routing surface. | Fixed: product envelope; tuning not established |
| sites: Ownership reservation | 24 h | registry:plugins/sites/src/hostnameRecords.ts |
Pending hostname claims | Bounds abandoned claims. | Fixed: product envelope; tuning not established |
| sites: Hit buffer | 20000 entries | registry:plugins/sites/src/worker/runtime.ts |
Worker traffic observations | Bounds worker memory. | Fixed: product envelope; tuning not established |
| cronjob: Guard output | 1 MiB | registry:plugins/cronjob/lib/scheduler.mjs |
Guard command stdout | Bounds input handed to the brain. | Fixed: product envelope; tuning not established |
| cronjob: Journal maintenance | 24 h | registry:plugins/cronjob/lib/scheduler.mjs |
Run history cleanup | Daily bounded maintenance. | Fixed: product envelope; tuning not established |
| cronjob: Pending deliveries | 50 deliveries | registry:plugins/cronjob/lib/stores.mjs |
Delivery queue | Bounds durable pending work. | Fixed: product envelope; tuning not established |
| cronjob: Delivery lease | 5 min | registry:plugins/cronjob/lib/stores.mjs |
Delivery ownership | Reclaims interrupted deliveries. | Fixed: product envelope; tuning not established |
| cronjob: Receipt retention | 24 h | registry:plugins/cronjob/lib/stores.mjs |
Delivery receipts | Bounds acknowledgement history. | Fixed: product envelope; tuning not established |
| cronjob: Receipt count | 1000 receipts | registry:plugins/cronjob/lib/stores.mjs |
Delivery receipts | Bounds retained records. | Fixed: product envelope; tuning not established |
| cronjob: Run detail retention | 7 days | registry:plugins/cronjob/lib/runJournal.mjs |
Detailed runs | Bounds detailed history. | Fixed: product envelope; tuning not established |
| cronjob: Run aggregate retention | 90 days | registry:plugins/cronjob/lib/runJournal.mjs |
Run aggregates | Bounds summary history. | Fixed: product envelope; tuning not established |
| cronjob: Result preview | 2000 characters | registry:plugins/cronjob/lib/runJournal.mjs |
Run result preview | Bounds journal payload. | Fixed: product envelope; tuning not established |
| cronjob: Error preview | 1000 characters | registry:plugins/cronjob/lib/runJournal.mjs |
Run error preview | Bounds journal payload. | Fixed: product envelope; tuning not established |
| cronjob: Calendar candidates | 100000 candidates | registry:plugins/cronjob/projection.mjs |
Calendar projection | Bounds recurrence expansion. | Fixed: product envelope; tuning not established |
| onedrive: Sync lease | 5 min | registry:plugins/onedrive/src/sync.ts |
Sync ownership | Reclaims interrupted work. | Fixed: product envelope; tuning not established |
| onedrive: Sync settle | 2000 ms | registry:plugins/onedrive/src/sync.ts |
Changed file stabilization | Avoids syncing partial writes. | Fixed: product envelope; tuning not established |
| onedrive: Pending backoff | 60000 ms | registry:plugins/onedrive/src/sync.ts |
Pending retry | Bounds repeated work. | Fixed: product envelope; tuning not established |
| onedrive: Sync files | 20000 files | registry:plugins/onedrive/src/sync.ts |
Sync traversal | Bounds pass size. | Fixed: product envelope; tuning not established |
| onedrive: Simple upload | 250 MiB | registry:plugins/onedrive/src/drive.ts |
Graph simple upload | Graph endpoint size contract. | Fixed: Graph transfer contract |
| onedrive: Upload chunk | 3276800 bytes | registry:plugins/onedrive/src/drive.ts |
Graph chunk upload | Multiple of Graph's 320 KiB quantum. | Fixed: Graph transfer contract |
| onedrive: Chunk timeout | 120000 ms | registry:plugins/onedrive/src/drive.ts |
Graph chunk request | Bounds upload request. | Fixed: Graph transfer contract |
| onedrive: Upload floor rate | 256 KiB/s | registry:plugins/onedrive/src/drive.ts |
Total upload deadline calculation | Bounds whole-upload lifetime by size. | Fixed: Graph transfer contract |
| onedrive: Upload grace | 60000 ms | registry:plugins/onedrive/src/drive.ts |
Total upload deadline | Allows setup and finalization. | Fixed: Graph transfer contract |
| onedrive: Managed Git output | 64 MiB | registry:plugins/onedrive/src/managed.ts |
Sync Git capture | Bounds output memory. | Fixed: product envelope; tuning not established |
| onedrive: Managed Git timeout | 120000 ms | registry:plugins/onedrive/src/managed.ts |
Sync Git execution | Bounds guest work. | Fixed: product envelope; tuning not established |
| image-edit: Source fetch | 120000 ms | registry:plugins/image-edit/index.mjs |
Remote source image | Bounds network wait. | Fixed: product envelope; tuning not established |
| image-edit: Source redirects | 5 redirects | registry:plugins/image-edit/index.mjs |
Source image fetch | Bounds redirection. | Fixed: product envelope; tuning not established |
| image-edit: Source bytes | 10 MiB | registry:plugins/image-edit/index.mjs |
Source image | Bounds image processing input. | Fixed: product envelope; tuning not established |
| chatbot: Service snapshot | 16 MiB | registry:plugins/chatbot/src/service/state.ts |
Service state file | Bounds state parsing. | Fixed: product envelope; tuning not established |
| chatbot: Policy TTL | 5 min | registry:plugins/chatbot/src/service/state.ts |
Cached policy | Bounds stale authorization. | Fixed: product envelope; tuning not established |
| chatbot: Serving tokens | 4096 tokens | registry:plugins/chatbot/src/service/state.ts |
Active serving snapshot | Bounds service authorization data. | Fixed: product envelope; tuning not established |
| chatbot: Intake result retention | 10 min | registry:plugins/chatbot/src/service/intake.ts |
Completed intake results | Bounds receipt memory. | Fixed: product envelope; tuning not established |
| chatbot: Action wait | 60000 ms | registry:plugins/chatbot/src/actionService.ts |
Widget action completion | Bounds response wait. | Fixed: product envelope; tuning not established |
| chatbot: Unrunnable drain | 100 entries | registry:plugins/chatbot/src/queue.ts |
One queue drain | Bounds cleanup work. | Fixed: product envelope; tuning not established |
| chatbot: Retention conversations | 25 conversations/pass | registry:plugins/chatbot/src/retention.ts |
Detailed cleanup | Bounds one pass. | Fixed: product envelope; tuning not established |
| chatbot: Retention sweep | 500 rows/pass | registry:plugins/chatbot/src/retention.ts |
History cleanup | Bounds database work. | Fixed: product envelope; tuning not established |
| chatbot: Retention cadence | 15 min | registry:plugins/chatbot/src/retention.ts |
History cleanup | Bounds maintenance rate. | Fixed: product envelope; tuning not established |
| chatbot: Stream ping | 15000 ms | registry:plugins/chatbot/src/publicContract.ts |
SSE keepalive | Keeps idle transports open. | Fixed: public widget protocol |
| chatbot: Visitor message | 2 KiB | registry:plugins/chatbot/src/publicContract.ts |
Message input | Bounds public input. | Fixed: public widget protocol |
| chatbot: Visitor image | 10 MiB | registry:plugins/chatbot/src/publicContract.ts |
Image input | Bounds public upload. | Fixed: public widget protocol |
| chatbot: Shared file | 25 MiB | registry:plugins/chatbot/src/publicContract.ts |
Outgoing attachment | Bounds transfer. | Fixed: public widget protocol |
| chatbot: Page state | 32 KiB | registry:plugins/chatbot/src/publicContract.ts |
Widget page evidence | Bounds model input. | Fixed: public widget protocol |
| chatbot: Page URL | 4096 characters | registry:plugins/chatbot/src/publicContract.ts |
Page identity | Bounds public metadata. | Fixed: public widget protocol |
| chatbot: Page snapshot elements | 500 elements | registry:plugins/chatbot/src/publicContract.ts |
Page evidence | Bounds action context. | Fixed: public widget protocol |
| chatbot: Page field value | 200 characters | registry:plugins/chatbot/src/publicContract.ts |
Page evidence | Bounds private page text. | Fixed: public widget protocol |
| chatbot: Page text | 120 characters | registry:plugins/chatbot/src/publicContract.ts |
Page evidence item | Bounds context. | Fixed: public widget protocol |
| chatbot: Widget actions | 50 actions/turn | registry:plugins/chatbot/src/publicContract.ts |
Widget execution | Bounds action fan-out. | Fixed: public widget protocol |
| chatbot: Handoff TTL | 60000 ms | registry:plugins/chatbot/src/publicContract.ts |
Page handoff | Bounds one-time authority. | Fixed: public widget protocol |
| skills: Evidence text | 6000 characters | registry:plugins/skills/lib/reviewer.mjs |
Review evidence | Bounds helper prompt. | Fixed: product envelope; tuning not established |
| skills: Evidence entries | 60 entries | registry:plugins/skills/lib/reviewer.mjs |
Review evidence | Bounds history fan-in. | Fixed: product envelope; tuning not established |
| skills: Evidence arguments | 160 characters | registry:plugins/skills/lib/reviewer.mjs |
Tool argument summary | Bounds individual entry. | Fixed: product envelope; tuning not established |
| skills: Existing skills | 80 skills | registry:plugins/skills/lib/reviewer.mjs |
Review catalog | Bounds helper prompt. | Fixed: product envelope; tuning not established |
| skills: Description | 300 characters | registry:plugins/skills/lib/reviewer.mjs |
Generated skill description | Bounds catalog text. | Fixed: product envelope; tuning not established |
| skills: Skill body | 12000 characters | registry:plugins/skills/lib/reviewer.mjs |
Generated skill body | Bounds persisted output. | Fixed: product envelope; tuning not established |
| skills: Loaded skill body | 8000 characters | registry:plugins/skills/lib/reviewer.mjs |
One review input | Bounds helper context. | Fixed: product envelope; tuning not established |
| skills: Loaded bodies total | 16000 characters | registry:plugins/skills/lib/reviewer.mjs |
Combined review inputs | Bounds helper context. | Fixed: product envelope; tuning not established |
| skills: Error text | 300 characters | registry:plugins/skills/lib/reviewer.mjs |
Review error context | Bounds diagnostic prompt. | Fixed: product envelope; tuning not established |
| skills: Load page | 500 lines | registry:plugins/skills/lib/skillLoadTool.mjs |
Default skill page | Bounds one tool response. | Fixed: product envelope; tuning not established |
| discord: Output chunk | 1990 characters | registry:plugins/discord/lib/format.mjs |
Outgoing platform message | Fits platform formatting and message-size constraints. | Fixed: platform delivery contract |
| discord: Outgoing files | 4 attachments | registry:plugins/discord/lib/adapter.mjs |
Outgoing shared files | Bounds one delivery. | Fixed: platform delivery contract |
| telegram: Output chunk | 4000 characters | registry:plugins/telegram/lib/format.mjs |
Outgoing platform message | Fits platform formatting and message-size constraints. | Fixed: platform delivery contract |
| telegram: Outgoing files | 4 attachments | registry:plugins/telegram/lib/adapter.mjs |
Outgoing shared files | Bounds one delivery. | Fixed: platform delivery contract |
| whatsapp: Output chunk | 4000 characters | registry:plugins/whatsapp/lib/format.mjs |
Outgoing platform message | Fits platform formatting and message-size constraints. | Fixed: platform delivery contract |
| whatsapp: Outgoing files | 4 attachments | registry:plugins/whatsapp/lib/adapter.mjs |
Outgoing shared files | Bounds one delivery. | Fixed: platform delivery contract |
| msteams: Output chunk | 20000 characters | registry:plugins/msteams/lib/format.mjs |
Outgoing platform message | Fits platform formatting and message-size constraints. | Fixed: platform delivery contract |
| msteams: Outgoing files | 4 attachments | registry:plugins/msteams/lib/files.mjs |
Outgoing shared files | Bounds one delivery. | Fixed: platform delivery contract |
| github: Device flow TTL | 10 min | registry:plugins/github/src/githubAuth.ts |
Account link flow | Bounds device authorization wait. | Fixed: product envelope; tuning not established |
| github: Auth output | 64 KiB | registry:plugins/github/src/githubAuth.ts |
Authentication helper output | Bounds capture. | Fixed: product envelope; tuning not established |
| github: Version output | 8 KiB | registry:plugins/github/src/githubAuth.ts |
Version probe | Bounds capture. | Fixed: product envelope; tuning not established |
| github: Process grace | 2000 ms | registry:plugins/github/src/githubAuth.ts |
Helper cleanup | Allows termination before force. | Fixed: product envelope; tuning not established |
| github: Readiness cache | 60000 ms | registry:plugins/github/src/githubAuth.ts |
Helper readiness | Avoids repeated probes. | Fixed: product envelope; tuning not established |
| parts: HTTP timeout | 15000 ms | registry:plugins/parts/src/http.ts |
Supplier HTTP request | Bounds upstream wait. | Fixed: product envelope; tuning not established |
| parts: Token minimum lifetime | 5 min | registry:plugins/parts/src/laximo/auth.ts |
Cached supplier token | Avoids using nearly expired tokens. | Fixed: product envelope; tuning not established |
| parts: Login attempts | 3 attempts | registry:plugins/parts/src/laximo/auth.ts |
Supplier authentication | Bounds retries. | Fixed: product envelope; tuning not established |
| parts: Login retry delay | 5000 ms | registry:plugins/parts/src/laximo/auth.ts |
Supplier authentication | Spaces retry attempts. | Fixed: product envelope; tuning not established |
| parts: Login redirects | 10 redirects | registry:plugins/parts/src/laximo/auth.ts |
Supplier authentication | Bounds redirect chain. | Fixed: product envelope; tuning not established |
| parts: JWT refresh lead | 60000 ms | registry:plugins/parts/src/pl24/client.ts |
Supplier token | Refreshes before expiry. | Fixed: product envelope; tuning not established |
| parts: Token rounds | 3 rounds | registry:plugins/parts/src/pl24/client.ts |
Authentication retries | Bounds retries. | Fixed: product envelope; tuning not established |
| parts: Request interval | 200 ms | registry:plugins/parts/src/pl24/client.ts |
Supplier API | Spaces requests. | Fixed: product envelope; tuning not established |
| parts: Rate-limit retries | 2 retries | registry:plugins/parts/src/pl24/client.ts |
Supplier API | Bounds retry attempts. | Fixed: product envelope; tuning not established |
| parts: Group fetch budget | 120 fetches | registry:plugins/parts/src/pl24/client.ts |
Parts group traversal | Bounds upstream fan-out. | Fixed: product envelope; tuning not established |
| parts: Group entries | 400 entries | registry:plugins/parts/src/pl24/client.ts |
Parts group traversal | Bounds response processing. | Fixed: product envelope; tuning not established |
| parts: VIN search pages | 5 pages | registry:plugins/parts/src/pl24/client.ts |
Supplier search | Bounds pagination. | Fixed: product envelope; tuning not established |
| parts: BOM detail concurrency | 6 requests | registry:plugins/parts/src/pl24/parsers/nissan.ts |
Parts detail fetches | Bounds upstream parallelism. | Fixed: product envelope; tuning not established |
| parts: Detail matches | 10 matches | registry:plugins/parts/src/tools/orders.ts |
Order detail lookup | Bounds fan-out. | Fixed: product envelope; tuning not established |
| parts: Scanned orders | 30 orders | registry:plugins/parts/src/tools/orders.ts |
Order discovery | Bounds supplier calls. | Fixed: product envelope; tuning not established |
| parts: Search default results | 10 results | registry:plugins/parts/src/tools/shop-search.ts |
Shop search | Bounds default tool output. | Fixed: product envelope; tuning not established |
| parts: Search maximum results | 30 results | registry:plugins/parts/src/tools/shop-search.ts |
Shop search | Bounds caller-requested output. | Fixed: product envelope; tuning not established |
| parts: Batch default | 5 items | registry:plugins/parts/src/tools/shop-search.ts |
Batch shop lookup | Bounds default fan-out. | Fixed: product envelope; tuning not established |
| parts: Batch maximum | 10 items | registry:plugins/parts/src/tools/shop-search.ts |
Batch shop lookup | Bounds caller-requested fan-out. | Fixed: product envelope; tuning not established |
| parts: Batch full details | 2 items | registry:plugins/parts/src/tools/shop-search.ts |
Detailed batch output | Bounds model context. | Fixed: product envelope; tuning not established |
| parts: BOM fetch timeout | 30000 ms | registry:plugins/parts/src/vin/cache.ts |
Parts diagram lookup | Bounds upstream wait. | Fixed: product envelope; tuning not established |
| parts: Diagram bytes | 10 MiB | registry:plugins/parts/src/vin/diagram.ts |
Source image | Bounds image transfer. | Fixed: product envelope; tuning not established |
| parts: Diagram timeout | 10000 ms | registry:plugins/parts/src/vin/diagram.ts |
Source image fetch | Bounds upstream wait. | Fixed: product envelope; tuning not established |
| parts: Diagram redirects | 5 redirects | registry:plugins/parts/src/vin/diagram.ts |
Source image fetch | Bounds redirect chain. | Fixed: product envelope; tuning not established |
| msteams: Graph default timeout | 15000 ms | registry:plugins/msteams/lib/delegatedGraph.mjs |
Graph request | Bounds ordinary network wait. | Fixed: product envelope; tuning not established |
| msteams: Graph output limit | 20000 characters | registry:plugins/msteams/lib/delegatedGraph.mjs |
Graph result | Bounds model context. | Fixed: product envelope; tuning not established |
| msteams: Graph maximum timeout | 20 min | registry:plugins/msteams/lib/delegatedGraph.mjs |
Graph caller deadline | Bounds long operations. | Fixed: product envelope; tuning not established |
| msteams: People directory | 500 people | registry:plugins/msteams/lib/directory.mjs |
Directory search | Bounds result enumeration. | Fixed: product envelope; tuning not established |
| msteams: Shared file bytes | 20 MiB | registry:plugins/msteams/lib/files.mjs |
Attachment transfer | Fits platform transfer envelope. | Fixed: platform transfer contract |
| msteams: Shared file TTL | 900000 ms | registry:plugins/msteams/lib/files.mjs |
Transfer reference | Bounds temporary access. | Fixed: platform transfer contract |
| msteams: Thread replies | 50 replies | registry:plugins/msteams/lib/graph.mjs |
History fetch | Bounds supplied history. | Fixed: product envelope; tuning not established |
| msteams: Workbook session TTL | 10 min | registry:plugins/msteams/lib/m365/excel.mjs |
Graph workbook session | Bounds cached session lifetime. | Fixed: product envelope; tuning not established |
| msteams: Folder depth | 4 levels | registry:plugins/msteams/lib/m365/outlook.mjs |
Mailbox traversal | Bounds recursive discovery. | Fixed: product envelope; tuning not established |
| msteams: Folder total | 500 folders | registry:plugins/msteams/lib/m365/outlook.mjs |
Mailbox traversal | Bounds enumeration. | Fixed: product envelope; tuning not established |
| msteams: Inline text | 1 MiB | registry:plugins/msteams/lib/m365/shared.mjs |
M365 response text | Bounds model output. | Fixed: product envelope; tuning not established |
| msteams: Search results | 1000 results | registry:plugins/msteams/lib/m365/sharepoint.mjs |
SharePoint search | Bounds pagination. | Fixed: product envelope; tuning not established |
| msteams: Roster sweep | 25 entries | registry:plugins/msteams/lib/proactive.mjs |
Proactive membership checks | Bounds a pass. | Fixed: product envelope; tuning not established |
| msteams: History messages | 100 messages | registry:plugins/msteams/lib/transcript.mjs |
Platform transcript | Bounds context. | Fixed: product envelope; tuning not established |
| msteams: History line | 400 characters | registry:plugins/msteams/lib/transcript.mjs |
One history item | Bounds context. | Fixed: product envelope; tuning not established |
| msteams: History block | 6000 characters | registry:plugins/msteams/lib/transcript.mjs |
Combined transcript | Bounds context. | Fixed: product envelope; tuning not established |
| meeting-confirm: Record wait | 60000 ms | registry:plugins/meeting-confirm/lib/recordTool.mjs |
Outcome recording | Bounds tool wait. | Fixed: product envelope; tuning not established |
| meeting-confirm: Scheduler retry | 300000 ms | registry:plugins/meeting-confirm/lib/scheduler.mjs |
Failed scheduled operation | Spaces repeated work. | Fixed: product envelope; tuning not established |
| meeting-confirm: Recording grace | 600000 ms | registry:plugins/meeting-confirm/lib/scheduler.mjs |
Call outcome recording | Allows completion before expiry. | Fixed: product envelope; tuning not established |
| meeting-confirm: Delivery attempts | 3 attempts | registry:plugins/meeting-confirm/lib/store.mjs |
Outcome delivery | Bounds repeated delivery. | Fixed: product envelope; tuning not established |
| raynet: API result limit | 1000 results | registry:plugins/raynet/lib/params.mjs |
CRM lookup | Bounds response size. | Fixed: product envelope; tuning not established |
| raynet: API page | 100 results | registry:plugins/raynet/lib/routes.mjs |
CRM pagination | Bounds one request. | Fixed: product envelope; tuning not established |
| discord: Select options | 25 options | registry:plugins/discord/lib/ask.mjs |
Interactive picker | Platform component limit. | Fixed: platform protocol |
| discord: Channel cache | 60000 ms | registry:plugins/discord/lib/channels.mjs |
Channel discovery | Bounds platform requests. | Fixed: product envelope; tuning not established |
| telegram: Caption limit | 1024 characters | registry:plugins/telegram/lib/adapter.mjs |
Image caption | Platform rejects longer captions. | Fixed: platform protocol |
| telegram: Commands | 100 commands | registry:plugins/telegram/lib/commands.mjs |
Registered bot commands | Platform command cap. | Fixed: platform protocol |
| telegram: Command description | 256 characters | registry:plugins/telegram/lib/commands.mjs |
Command metadata | Platform metadata cap. | Fixed: platform protocol |
| whatsapp: Sent-message store | 1000 messages | registry:plugins/whatsapp/lib/adapter.mjs |
Retry/edit history | Bounds adapter memory. | Fixed: product envelope; tuning not established |
| whatsapp: Caption limit | 1024 characters | registry:plugins/whatsapp/lib/adapter.mjs |
Image/document caption | Platform caption contract. | Fixed: product envelope; tuning not established |
| whatsapp: Edit throttle | 1500 ms | registry:plugins/whatsapp/lib/stream.mjs |
Live reply edits | Stays within platform edit rate. | Fixed: product envelope; tuning not established |
| voice-bot: Response cap | 8000 characters | registry:plugins/voice-bot/lib/store.mjs |
Recorded response | Bounds persistence. | Fixed: product envelope; tuning not established |
| voice-bot: Prompt cap | 4000 characters | registry:plugins/voice-bot/lib/tool.mjs |
Call brief | Bounds voice context. | Fixed: product envelope; tuning not established |
| voice-bot: Excerpt | 200 characters | registry:plugins/voice-bot/lib/tool.mjs |
Call result preview | Bounds tool context. | Fixed: product envelope; tuning not established |
| todo: Task subject | 200 characters | registry:plugins/todo/lib/tasks.mjs |
Task input | Bounds cards and persistence. | Fixed: product envelope; tuning not established |
| todo: Task owner | 64 characters | registry:plugins/todo/lib/tasks.mjs |
Task owner label | Bounds metadata. | Fixed: product envelope; tuning not established |
| todo: Completed display | 10 tasks | registry:plugins/todo/lib/render.mjs |
Task card | Bounds card output. | Fixed: product envelope; tuning not established |
| todo: Running-work reminder | 20 min | registry:plugins/todo/lib/render.mjs |
Progress reminder | Bounds reminder frequency. | Fixed: product envelope; tuning not established |
| todo: Anomaly ids | 10 ids | registry:plugins/todo/lib/render.mjs |
Diagnostic task output | Bounds context. | Fixed: product envelope; tuning not established |
| todo: Step label | 70 characters | registry:plugins/todo/lib/render.mjs |
Step display | Bounds card rows. | Fixed: product envelope; tuning not established |
Shared infrastructure
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Shared retry exponential cap | 60000 ms | packages/plugin-shared/retry.mjs |
Exponential delay in the shared controller, not a longer valid Retry-After minimum | Deterministic timing with no jitter; callers supply policy and retry eligibility. | Fixed: shared retry contract |
| Shared retry ready stability | 60000 ms | packages/plugin-shared/retry.mjs |
Continuous application readiness before resetting a connection's consecutive retry count and backoff | Flapping cannot erase consecutive failures; the timer never dispatches or creates an episode. | Fixed: shared retry contract |
| Delete batch rows | 64 rows | packages/plugin-shared/dbBatches.mjs |
One deletion transaction | Bounds lock duration. | Fixed: product envelope; tuning not established |
| Delete batch bytes | 256 KiB | packages/plugin-shared/dbBatches.mjs |
One deletion transaction | Bounds work; a single oversized row runs alone. | Fixed: product envelope; tuning not established |
| Tool media | 10 MiB | packages/plugin-shared/media.mjs |
Media result | Bounds output payload. | Fixed: product envelope; tuning not established |
| Observation media | 20 MiB | packages/plugin-shared/media.mjs |
Code-mode media reservations | Bounds one cell's media. | Fixed: product envelope; tuning not established |
| Media prefix | 256 characters | packages/plugin-shared/media.mjs |
Media reference prefix | Bounds validation. | Fixed: product envelope; tuning not established |
| Live edit throttle | 1200 ms | packages/plugin-shared/liveMessage.mjs |
Platform message edits | Stays below common platform edit rates. | Fixed: product envelope; tuning not established |
| Live stall hint | 60000 ms | packages/plugin-shared/liveMessage.mjs |
Silent platform progress | Signals a prolonged wait. | Fixed: product envelope; tuning not established |
| Typing interval | 8000 ms | packages/plugin-shared/turnRunner.mjs |
Platform typing indicators | Bounds keepalive traffic. | Fixed: product envelope; tuning not established |
| Shared audio | 25 MiB | packages/plugin-shared/voice.mjs |
Audio download | Bounds platform voice input. | Fixed: product envelope; tuning not established |
| Picker list | 200 entries | packages/plugin-shared/chatCommands.mjs |
Platform command chooser | Bounds list payload. | Fixed: product envelope; tuning not established |
| Subagent name words | 5 words | packages/plugin-shared/subagentName.mjs |
Child label | Keeps labels readable. | Fixed: product envelope; tuning not established |
| Subagent name characters | 40 characters | packages/plugin-shared/subagentName.mjs |
Child label | Bounds display. | Fixed: product envelope; tuning not established |
Store maintenance
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Vector cache | 5000 entries | src/search/siteSearchRank.ts |
Command-palette candidate vectors (PALETTE_VECTOR_CACHE_MAX) |
Bounds memory; past it SemanticVectorStore.evictOldest drops the oldest rows. |
Fixed: product envelope; tuning not established |
| Skin snapshots | 2 snapshots/skin | src/shared/skinStore.ts |
Rollback history | Bounds stored versions. | Fixed: product envelope; tuning not established |
Semantic index and ranking
The shared derived-vector corpora (documentation, the route catalog and the palette) and their ranking
are described in docs/modules/store/semantic-index.md.
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Reciprocal rank fusion constant | 60 | src/embeddings/semanticRank.ts |
Fusing a corpus's lexical and vector rankings | Weights a list's head far above its tail while every rank keeps a non-zero contribution; the RRF paper's value. | Fixed: product envelope; tuning not established |
| Corpus documents per request | 50 documents | src/embeddings/embedQueue.ts |
One corpus indexing embeddings request | Bounds one request; corpus requests run back to back within a drain. | Fixed: product envelope; tuning not established |
| Corpus characters per request | 60000 characters | src/embeddings/embedQueue.ts |
One corpus indexing embeddings request | Keeps one request inside what an embeddings endpoint accepts. | Fixed: product envelope; tuning not established |
| Palette semantic hits | 12 hits | src/search/siteSearchRank.ts |
Ranked command-palette results | The palette shows them as a secondary group, so a long tail is noise rather than help. | Fixed: product envelope; tuning not established |
| Catalog search results | 25 results | src/api/routeCatalog.ts |
API catalog search answer | Bounds one search response. | Fixed: product envelope; tuning not established |
Compaction and context
| Name | Value and unit | Owner file | What it bounds | Why this value | harness.json or fixed |
|---|---|---|---|---|---|
| Compaction output | 20000 tokens | src/brain/session/compactionPrompt.ts |
Summary generation | Bounds summary request. | Fixed: product envelope; tuning not established |
| Typical compaction output | 5000 tokens | src/brain/session/compactionPrompt.ts |
Summary space estimate | Reserves expected summary room. | Fixed: product envelope; tuning not established |
| Context hard ceiling | 95 percent | src/brain/session/compactionThreshold.ts |
Compaction threshold | Leaves room below provider window. | Fixed: product envelope; tuning not established |
| Provider context safety | 4096 tokens | src/brain/session/compactionThreshold.ts |
Input headroom | Allows token estimation error. | Fixed: product envelope; tuning not established |
| Threshold crossing | 12000 tokens | src/brain/session/compactionThreshold.ts |
Compaction crossing budget | Allows the next step to complete. | Fixed: product envelope; tuning not established |
| Summary room share | 0.1 fraction | src/brain/session/compactionThreshold.ts |
Summary reservation | Bounds reserved context. | Fixed: product envelope; tuning not established |
| Recent compaction tokens | 1 token | src/brain/session/compactionThreshold.ts |
PI recent-turn selection | Preserves required recent context selection. | Fixed: product envelope; tuning not established |
| Compaction trigger margin | 5000 tokens | src/brain/session/compactionThreshold.ts |
Early compaction | Triggers before hard failure. | Fixed: product envelope; tuning not established |
| Compaction failure limit | 3 failures | src/brain/session/compactionCircuitBreaker.ts |
Repeated compaction | Stops repeated failing summaries. | Fixed: product envelope; tuning not established |
| Fork child reserve | 16000 tokens | src/brain/session/forkPrefix.ts |
Fork context admission | Leaves room for child work. | Fixed: product envelope; tuning not established |
| Clear minimum | 4096 bytes | src/brain/session/toolResultPlaceholder.ts |
Tool-result clearing | Avoids churn for small results. | Fixed: product envelope; tuning not established |
| Cold clear minimum | 1024 bytes | src/brain/session/toolResultPlaceholder.ts |
Cold-context clearing | Bounds retained cold results. | Fixed: product envelope; tuning not established |
| Spill preview | 2000 characters | src/brain/session/toolResultPlaceholder.ts |
Placeholder preview | Retains concise evidence. | Fixed: product envelope; tuning not established |
| Kept user turns | 2 turns | src/brain/session/toolResultPlaceholder.ts |
Tool-result clearing protection | Preserves recent interaction. | Fixed: product envelope; tuning not established |
| History segments | 512 segments | src/brain/session/cacheWatch.ts |
Cache diagnosis state | Bounds memory. | Fixed: product envelope; tuning not established |
| Tool segments | 256 segments | src/brain/session/cacheWatch.ts |
Cache diagnosis state | Bounds memory. | Fixed: product envelope; tuning not established |
| Pending snapshots | 2 snapshots | src/brain/session/cacheWatch.ts |
Cache comparisons | Bounds memory. | Fixed: product envelope; tuning not established |
| Position lookback | 20 positions | src/brain/session/cacheWatch.ts |
Cache shift search | Bounds comparison work. | Fixed: product envelope; tuning not established |
| Shift probe | 16 positions | src/brain/session/cacheWatch.ts |
Cache shift search | Bounds comparison work. | Fixed: product envelope; tuning not established |
Existing administrator settings
Do not add parallel harness keys for these authorities:
- Runtime-limit validation in
packages/db/src/config/codecs/store/config/limits.ts: CLI local shell, code-mode yield/output, memory thresholds and maintenance, skill review, deferral, step context, plan agents, retention, stream watchdog UI settings and notifications. runtime.subagentRunnerPoolMaxinsrc/shared/wireContract.tsand the configuration API: the sole pool-cap owner. It currently has no Runtime-dialog control. Keeping it here preserves the existing public configuration contract; its former environment override is removed.- Delegation
stallMinutesand result retention inplugins/subagent/elowen-plugin.json: the sole watchdog and result-retention settings. The former stall environment override is removed. - Brain provider retry, compaction and model limits in the config repository's
packages/db/src/config/document.tsdefaults and provider settings. - Files
readCap,searchMaxMatches,globMaxandpdfMaxPages; TerminalmaxBackgroundProcesses; MCP connect/call timeouts in their plugin manifests. - Sandbox CPU, memory, PID, disk, I/O, swap and network limits; Sites proxy settings.
- Registry plugin settings stay in each plugin's manifest: Cronjob job/rate/guard/retry settings, LSP idle TTL, platform attachment/picker/stream settings, Chatbot rate and retention settings and Voice Bot call duration/rate. Their schema bounds are product validation, not an additional operator authority.
Retired environment inputs and test seams
ELOWEN_SUBAGENT_HOST_RPC_TIMEOUT_MS, BASH_DEFAULT_TIMEOUT_MS and BASH_MAX_TIMEOUT_MS
are replaced by the three operator keys above. ELOWEN_SUBAGENT_POOL_MAX and
ELOWEN_SUBAGENT_TURN_STALL_MS no longer override the existing administrator settings.
ELOWEN_COMPOSE_MARKER_MS was test-only and is removed; CLI tests pass marker timings to
createChatComposition, and watchdog tests inject the stall dependency.
Short host-RPC tests use the existing constructor argument.
The environment audit covers src/, bundled plugins/, packages/, production scripts/,
tests and E2E/deployment sources, including indirect numeric parsing. Service ports, paths, Unix
identity fields and boolean build/test switches are not numeric harness tuning. External Node/PI
environment contracts remain with their dependencies, including PI_CACHE_RETENTION and
PI_OFFLINE; no copied precedence chain is introduced here.
Verification
tests/shared/harnessConfig.test.ts checks parser failures, inclusive bounds, defaults and immutable
generations. Runner protocol and host/runner tests check boot propagation. Terminal tests verify
schema and actual execution deadlines. The one catalog contract file,
tests/contract/harnessLimits.test.ts, checks every operator default and owner path. Registry owner
verification uses the existing ELOWEN_PLUGIN_REGISTRY test input or a sibling checkout; the
external check is visibly skipped when that optional repository is absent. A full inventory check
supplies it explicitly. There is no AST extractor, fixture mutation framework or docs aggregation job.
See configuration storage and deployment for the operator lifecycle and migration.