Module limits 

Execution limits: the one limits: block every scope carries (spec 2026-09-12 execution-limits §3.1), its duration grammar, the built-in defaults (§3.3) and the resolver that says what is in force and where it came from (§3.9).

Three knobs, no more: deadline (wall clock for the unit of work), stuck (minutes of no progress before a stop, or off) and cost_usd (only meaningful on a metered model — applicability is the caller’s call, this module resolves the number). Inner scopes REPLACE a key; nothing here adds two caps together, because the product of caps is the problem the spec exists to remove.

Structs

GlobalLimits

Limits

The block as written in YAML. Every key optional; an absent key means “inherit”, never “unlimited” — stuck: off is the explicit opt-out.

Resolved

ResolvedLimits

Enums

GlobalSource

Which file the global scope was read from.

Scope

Which built-in deadline applies when no scope sets one.

Source

Where a resolved value came from — the half of mur limits that makes it worth running.

Stuck

The stuck detector’s setting once resolved.

Constants

DEFAULT_DEADLINE_FLEET

DEFAULT_DEADLINE_TASK

DEFAULT_STUCK

§3.3 — the constants mur limits prints as (built-in default).

GLOBAL_LIMITS_DIR

Directory under mur_home holding the global scope. Granted read-only to sealed agents as a directory, so edits that replace the file stay visible.

GLOBAL_LIMITS_FILE

The global scope’s file inside GLOBAL_LIMITS_DIR: a bare Limits mapping, no limits: wrapper.

LEGACY_CONFIG_FILE

The user config that carried the global scope before #1794.

Functions

global_limits_dir

global_limits_path

legacy_block_present

Whether config.yaml still carries a non-empty limits: block. Doctor uses it to say the block is ignored once the new file exists; MUR never removes it — that file is the user’s.

legacy_config_path

load_global

The global scope for CLI readers. The new file is strict; the legacy fallback keeps the old lenient Config::load_or_default behaviour, so a config.yaml broken somewhere unrelated still reads as “no global limits” exactly as before #1794.

load_global_strict

The global scope for a reader that already holds a good copy and must not trade it for defaults (the agent runtime’s hot reload): both files strict.

parse_duration

30s, 5m, 2h, 1d, 1h30m, or a bare integer (seconds). None on anything else — the caller turns that into a load error naming the key.

read_global_file

The new file alone. Ok(None) when it does not exist; an empty file is an empty scope (it still shadows the legacy block). A file that is present and does not parse is an error, never the defaults.

resolve

The resolver. Precedence, narrowest wins: flag > agent > fleet > global > built-in. Each key is resolved on its own; a scope that sets only stuck leaves deadline to the next scope out.

validate

§4: an unparsable value is an error naming the key, never a silent default.