Module limits 

Resource caps (DoS limits) shared by every adapter — the single source of truth for fact size, recall limit, and why hop depth. Resource caps shared by every adapter (the MCP server and the language bindings).

These are security-relevant DoS limits. They live here — not inside any one adapter — so every transport enforces the same numbers without a manual “keep in sync” comment, and so a build without the mcp feature still sees them. Each adapter formats its own transport-native error; only the values and the clamping policy are shared.

Constants

DEFAULT_WHY_HOPS

Default hop budget for why traversal when the caller supplies none.

MAX_FACT_BYTES

Maximum accepted fact size (1 MiB) — prevents allocating huge embeddings.

MAX_FRAGMENTS

Cap on the number of fragments in one compile request — bounds the work a single call can demand across every adapter.

MAX_FRAGMENT_BYTES

Maximum accepted size of a single context-compiler fragment (1 MiB, the same ceiling as MAX_FACT_BYTES) — prevents a single fragment from forcing huge allocations in the compile pipeline.

MAX_MEDIA_BYTES

Maximum accepted size of a fragment’s base64-encoded media payload (US-009, PR1: inline images) — 4 MiB of base64 text, roughly 3 MiB of raw bytes once decoded. Deliberately separate from MAX_FRAGMENT_BYTES, which only ever measures crate::context::model::ContextFragment::content (the caption): a screenshot is not text, and capping it at the 1 MiB text ceiling would reject ordinary screenshots outright. Measured against bytes_b64.len() (the encoded string), so the cap can reject an oversized payload before any base64 decoding is attempted.

MAX_METADATA_BYTES

Maximum accepted size of caller-supplied metadata (64 KiB), measured as its serialized JSON form. Metadata is a keyed lookup facet (project, author, status, …) — a porte-clés, not a payload — so it gets a much tighter ceiling than MAX_FACT_BYTES: without one, a caller could smuggle an arbitrarily large JSON blob through metadata on every write path (remember, remember_with_ttl, remember_extracted, and each context-compiler fragment’s own metadata) and force the same unbounded allocation and storage growth the fact-size cap exists to prevent.

MAX_RECALL_LIMIT

Cap on a recall limit — prevents unbounded vector scans (core does not cap k, so the adapters do).

MAX_TOKEN_BUDGET

Cap on a caller-supplied token budget. A budget cannot force allocations by itself, but an absurd value would make the savings arithmetic meaningless, so adapters clamp to this ceiling instead of erroring.

MAX_TOTAL_MEDIA_BYTES

Aggregate cap on ALL media payloads of one request (base64 length, summed). Without it, MAX_FRAGMENTS fragments each at MAX_MEDIA_BYTES would let a single request carry 4 GiB of media — far past the ~1 GiB worst case the text caps allow. 64 MiB comfortably fits a real screenshot-heavy session while bounding decode work.

MAX_WHY_HOPS

Cap on why hop depth — prevents exponential graph fan-out.

Functions

clamp_hops

Clamp a caller-supplied why hop budget to MAX_WHY_HOPS.

clamp_recall_limit

Clamp a caller-supplied recall limit to MAX_RECALL_LIMIT.

clamp_token_budget

Clamp a caller-supplied token budget to MAX_TOKEN_BUDGET.

metadata_bytes

The serialized JSON size of meta, in bytes. Returns usize::MAX if the map somehow fails to serialize (it never should — Metadata is always valid JSON), so a serialization hiccup fails a size check closed rather than silently passing an unmeasured payload.