Limits and Defaults Reference
Look up Shipfox gate attempt caps, job timeouts, concurrent step caps, log budgets and retention, output grouping caps, environment-map limits, workspace secret and variable caps, and agent session caps.
This page is the canonical home for shared operational limits. Other pages describe the behavior and link here for the numbers. Self-hosted deployments can change the values marked configurable.
Workflow execution
| Limit | Default | Configurable | Details |
|---|---|---|---|
| Gate attempts per gating step | 5 (including the first execution) | 1 to 1,000 per restart rule, in YAML | gate.on_failure.max_attempts sets how many times the gating step can run. Each rule in a list of on_failure rules has its own value. The selected rule's value is compared with the total runs of the step, whichever rules caused the earlier restarts. The first run counts as attempt 1. If you omit the field, a new run uses five. Active and rerun executions with no persisted limit retain the legacy limit of three. When the selected rule's attempts are used up, the job fails with restart_exhausted. When no rule applies, the job fails with the error of the step. You cannot remove the limit. See Feedback loops. |
Job execution_timeout | 6 hours | Per job, in YAML | Wall-clock bound on one job execution, including gate retries. Authored values range from 1 second through 24 hours. When the time ends, the job fails with timed_out. See Job fields. |
| Concurrent steps per job | 20 | Self-host: WORKFLOWS_MAX_CONCURRENT_STEPS, from 1 through 64 | Counts background steps and other steps of one job together. A step above the limit waits, in file order, for a free slot. The workflow file cannot change the limit. See Jobs and steps. |
| Cancelled step stop period | 10 seconds | No | cancel sends SIGTERM to a run or action step, then SIGKILL after this period. See Jobs and steps. |
| Run timeout | 30 days | No (not authorable) | Outer bound on a whole run, including its listening jobs. Time spent waiting for a concurrency group does not count toward this timeout. A listening job's timeout is capped by it. |
| Manual triggers per workflow | 1 | No | See Trigger fields. |
| Concurrency with listening jobs | Not supported | No | A workflow cannot use concurrency when it has a listening job. See Concurrency fields. |
Step outputs
| Limit | Default | Configurable | Details |
|---|---|---|---|
| Output bytes per step | 256 KiB total, 64 KiB per value | No | The runner enforces both caps; Workflows also rejects persisted step output above the 256 KiB total cap. See Step outputs. |
| Declared outputs per step | 128 entries | No | The outputs: map on one step. |
| Agent output re-prompts | 2 | No | An agent step missing a declared output is re-prompted this many times before the step fails. |
Persisted step outputs use JSON-safe values. Tool mappings convert safe CEL integers to JSON numbers. They reject unsafe integers, non-finite numbers, unsupported objects, cyclic values, and values nested beyond 64 levels.
Job outputs
| Limit | Default | Configurable | Details |
|---|---|---|---|
| Output bytes per job | 256 KiB total, 64 KiB per value | No | A job fails when materialized outputs exceed the cap. See Job fields. |
| Declared outputs per job | 128 entries | No | The outputs: map on one job. See Job fields. |
| Structured output nesting | 64 levels | No | Structured values deeper than this fail as non-JSON-safe outputs. |
Persisted typed job outputs use JSON-safe values. CEL integers become JSON numbers when they are safe integers and decimal strings otherwise. Timestamps become ISO 8601 strings. Unsupported or cyclic values fail the execution. The total is measured as UTF-8 bytes of the complete serialized outputs object, including output keys and JSON syntax.
Workflow outputs
| Limit | Default | Configurable | Details |
|---|---|---|---|
| Output bytes per run | 256 KiB total, 64 KiB per value | No | A run fails with status reason output_too_large when its evaluated outputs exceed the cap. See Top-level fields. |
| Declared outputs per workflow | 128 entries | No | The top-level outputs: map. |
Workflow outputs use the same JSON-safe encoding as job outputs.
Workflow document
| Limit | Default | Configurable | Details |
|---|---|---|---|
env entries per map | 128 | No | Applies to each of the workflow, job, and step env maps. See Environment variables. |
env serialized size | 32 KiB | No | The JSON-serialized size of one env map. |
| Parts per agent prompt | 64 | No | The items of one prompt list, counting strings and file references. See Split a prompt into parts. |
Workspace settings
| Limit | Default | Configurable | Details |
|---|---|---|---|
| Secrets and variables per workspace | 10,000 | Self-host: SECRETS_MAX_PER_WORKSPACE | One cap counts secrets and variables together. See Manage secrets and variables. |
Workflow chaining
| Limit | Default | Configurable | Details |
|---|---|---|---|
| Child-run depth | 5 | No | A run at depth 5 cannot start another workflow. The start_workflow_run tool returns run-depth-exceeded. |
| Descendant runs per root run | 100 | No | Shipfox rejects another child after the run tree reaches 100 descendants. The start_workflow_run tool returns run-tree-limit-exceeded. |
Logs
| Limit | Default | Configurable | Details |
|---|---|---|---|
| Per-job log budget | 32 MiB + 1 MiB per minute | Self-host: LOG_BUDGET_BASE_BYTES, LOG_BUDGET_RATE_BYTES_PER_MINUTE | The budget limits the log output that Shipfox keeps. It does not stop the job. After the job reaches the budget, later output is dropped, so later attempts can have incomplete logs or no logs. A capped record marks the boundary. Steps that run at the same time share the budget, so they use it up faster. See Inspect logs. |
| Log file on the runner | 16 MiB per step attempt | No | The runner writes a plain-text copy of each run, action, and checkout step attempt's log to a file. log_path gives the file's path. When the log is larger than the limit, the file keeps only the end of it, and its first line starts with [shipfox] Log truncated:. This limit is separate from the per-job log budget. See the Contexts reference. |
| Log retention | 90 days | Self-host: LOG_RETENTION_DAYS | Persisted logs are deleted from the database and object storage after this window. |
| Output group nesting | 32 levels | No | Past the cap a group is flattened into plain output. Wrap output in ::group::<name> / ::endgroup:: marker lines to create collapsible sections. |
| Output group name | 1 KiB | No | The runner byte-truncates longer marker names before upload. Direct log records over the cap are rejected at the record level. |
Agent sessions
| Limit | Default | Configurable | Details |
|---|---|---|---|
| Session transcript segment | 64 MiB compressed | Self-host: AGENT_SESSION_BLOB_CAP_BYTES | One committed segment per reported attempt; a larger compressed blob fails the commit and the attempt. Transcripts are encrypted at rest with the workspace envelope-crypto scheme and are never client-readable. |
| Session retention | 90 days | Self-host: AGENT_SESSION_RETENTION_DAYS | Session rows and their transcript objects are deleted after the run terminates and this window elapses. |
| Superseded segment grace | 10 minutes | Self-host: AGENT_SESSION_SEGMENT_GRACE_SECONDS | Pruning of superseded segments is deferred by this window so concurrent fork snapshot reads keep their object. |
A resumed transcript is byte-exact, so the model provider can reuse its prompt cache. That reuse happens only inside the provider's cache window. Rapid successive segments, such as batched listening events or short hops between dependent jobs, get it. Outside the window the provider processes the full conversation again; the resumed conversation itself is unchanged. See Agent session fields for the field contract.
Related pages
Workflow schema
The fields these limits apply to.
Workflows and runs
How runs stream, persist, and bound their output.