Module limits 

Resource caps (DoS limits) shared by every adapter — the single source of truth for fact size, recall limit, and why hop depth. Resource caps shared by every adapter (the MCP server and the language bindings).

These are security-relevant DoS limits. They live here — not inside any one adapter — so every transport enforces the same numbers without a manual “keep in sync” comment, and so a build without the mcp feature still sees them. Each adapter formats its own transport-native error; only the values and the clamping policy are shared.

Constants

DEFAULT_WHY_HOPS

Default hop budget for why traversal when the caller supplies none.

MAX_FACT_BYTES

Maximum accepted fact size (1 MiB) — prevents allocating huge embeddings.

MAX_FRAGMENTS

Cap on the number of fragments in one compile request — bounds the work a single call can demand across every adapter.

MAX_FRAGMENT_BYTES

Maximum accepted size of a single context-compiler fragment (1 MiB, the same ceiling as MAX_FACT_BYTES) — prevents a single fragment from forcing huge allocations in the compile pipeline.

MAX_RECALL_LIMIT

Cap on a recall limit — prevents unbounded vector scans (core does not cap k, so the adapters do).

MAX_TOKEN_BUDGET

Cap on a caller-supplied token budget. A budget cannot force allocations by itself, but an absurd value would make the savings arithmetic meaningless, so adapters clamp to this ceiling instead of erroring.

MAX_WHY_HOPS

Cap on why hop depth — prevents exponential graph fan-out.

Functions

clamp_hops

Clamp a caller-supplied why hop budget to MAX_WHY_HOPS.

clamp_recall_limit

Clamp a caller-supplied recall limit to MAX_RECALL_LIMIT.

clamp_token_budget

Clamp a caller-supplied token budget to MAX_TOKEN_BUDGET.