Limits

Collected for reference. Each is enforced where noted; several are asserted in more than one place as defence in depth.

Identity and naming

Thing	Bound
App id	4–30 chars, ^[a-z0-9]+(?:_[a-z0-9]+)*$
App name	3–20 chars, letters/digits/spaces
Description	1–280 chars
Method name (logical)	1–128 ASCII, Motoko identifier
Longest generated public app-method V1 wrapper	164 ASCII characters
Raw-call transport method name	up to 192 ASCII bytes
Memory id	1–128 chars, ^[A-Za-z_][A-Za-z0-9_]{0,127}$
Dependency alias	^[a-z][a-z0-9_]{0,29}$
Tile id	1–30 chars, ^[a-z_0-9]+$
Tile title	1–40 chars
Asset path	1–120 chars, safe relative
Public-ingress protocol / route id	1–63 chars, ^[a-z][a-z0-9_]{0,62}$; combined protocol:id ≤ 64
HTTP mount / Certified Assets collection id	1–40 chars, ^[a-z][a-z0-9_]{0,39}$

Manifest structure

Thing	Bound
Release version	Packed integer, minimum 100; minor and patch 0–99
Functions / arguments	256 functions per app; 16 arguments per function
Tiles	32 per app
Positional init resources	64 (Kernel-only declaration)
Memory roots	64 per app
Memory schemas per root	64
Migration edges per root	128
Migration edges	256 per app total
Dependencies	32 per app, 64 functions each
Public-ingress routes	1–32 per app
HTTPS outcall endpoints	1–8 per app
Chain-key signing slots	1–4 per app
Stable stores	1–8 per app
vetKeys slots	1–4 per app
Connection providers	1–8 unique providers per app; 0–32 unique scopes per provider
Scheduled tasks	2 per app
Preapproved self-call methods	32
Agent entrypoints	4
Background UI request categories	4
Ethereum chains	8
Backend-call install reservations	64

Compile-time ceilings (across all apps)

Resource	Ceiling
Installed app instances	256, including Kernel
Resident backgrounds	32
Runtime capability resources	8,192
Connection providers	256
HTTPS outcall endpoints	2,048
Chain-key signing slots	2,048
vetKeys slots	128
Stable stores	2,048
Stable-store entries	65,536
Stable-store declared bytes	268,435,456
Backend-call install reservations	2,048
Scheduled tasks	64 per assembled actor
Public-ingress routes	2,048
Public-ingress update calls	16,384 per hour
POST external calls	1,024 per hour
POST replay replies	1,024 entries / 64 MiB

The compiler rejects these before activation. Actor configuration also asserts mirrored limits as defence in depth.

Certified Assets uses a physical reservation model rather than one global object count: projected charged bytes plus 72,000,528 allocator-metadata bytes must not exceed 2,890,572,816; projected arena bytes must not exceed 1,879,048,192; and 2 × projected extents + 1 must not exceed 250,000.

Backend calls

Thing	Bound
max_concurrency	1–20 (also the batch size)
max_cycles_per_call	0–100,000,000,000,000
max_cycles_per_day	0–1,000,000,000,000,000, not below per-call
Canister cycle reserve	250 billion, on top of platform call cost

Stable stores

Thing	Bound
Entries	1–4,096 per store; 8,192 per app; 65,536 globally
Declared bytes	1–16 MiB per store; 32 MiB per app; 256 MiB globally
Key / value	1–256 bytes / 1–262,144 bytes
Schema version	1–65,535

HTTPS outcalls

Thing	Bound
URL prefix	4,096 characters
Declared request headers	0–16
Request / response	1–65,536 bytes / 1–524,288 bytes
Methods per endpoint	1–3 from get, head, post

Public ingress

Thing	Bound
Request / response bytes	1–1,048,576 each
max_calls_per_hour (updates)	1–3,600 per route; 3,600 per app total
Optional per-caller update rate	1 through the route's max_calls_per_hour
required_cycles (canister updates)	Positive, ≤ 100,000,000,000,000
Pending updates	1 per route, 2 per app, 8 globally

Query routes declare neither a rate nor a cycle floor.

HTTP POST routes

Thing	Bound
POST and derived certified-read mounts	16 total per app
Request / reply	1–65,536 bytes each
Declared forwarded header names	0–8 per mount
Forwarded header value	4,096 bytes; each declared header may occur once
External rate	1–240 calls/hour per mount; 240 per app
Pending calls	1 per mount, 2 per app, 8 globally
Replay capacity	240 entries / 8 MiB per app; 1,024 entries / 64 MiB globally
Idempotency-Key	16–64 ASCII letters, digits, _, or -
Idempotency replay window	1 hour

Certified Assets API 2

Thing	Bound
Collections	1–16 per app scope
Committed records	1–100,000
Committed bytes	1–1,073,741,824
Publication object	up to 67,108,864 bytes
Portable immutable/mutable object	up to 1,048,576 bytes
Pending stage	1 per scope; 4 active globally
Staged bytes	1–67,108,864
Batch	1–16 operations; 1–67,108,864 bytes
Idempotency receipts	2–4,096

Scheduled tasks

Thing	Bound
interval_seconds	10 – 2,592,000 (30 days)
max_backend_calls	1–100 per active callback

Message bus

Thing	Bound
Payload	1 MiB
Tool input/output schema	32 KiB each
Whole tool descriptor	64 KiB
Exposed tools	64 per endpoint
In-flight calls per endpoint	8 ordinary calls, plus a separate 1-call control lane
Progress event	64 KiB
Progress events per request	2,000
Clipboard text	256 KiB
Self-call metadata	64 KiB
Self-call value depth / container size	32 levels / 4,096 elements
Binary leaves per self call	512 per direction
Self-call aggregate binary	1,900,000 bytes per direction
Tool attachment	1 per direction, 16 MiB each
Attachment bytes in flight	32 MiB per endpoint, 64 MiB per frontend broker realm
Attachment delegation	10 seconds; 4 pending per endpoint, 64 per frontend broker realm
Retained state invalidations	128 apps, 64 topics per app
Tray badge	0–9,999, or null
Audit ring	200 entries, in memory

Agent Mode

Thing	Bound
Root turn lifetime	5 minutes
Invocation depth	8
Calls per root	64
Parallel children per invocation	4
Consent challenges	6 per root, 2 per invocation
Root starts per installed app scope	6/minute and 20/10 minutes

Workspace

Thing	Bound
Workspaces	3 by default, up to 20
Split ratio	0.15 – 0.85
Workspace gap	8px
Tray panel	min(380px, 50dvw − 8px) × min(520px, available height − env(safe-area-inset-bottom))

vetKeys

Thing	Bound
Derivation challenge lifetime	60 seconds
Transport public key	48 bytes

Package decoding

Limits differ by how a package arrived.

Bound	Local file	Remote URL / repository
Raw archive bytes	128 MiB	32 MiB
Entry count	16,384	4,096
UTF-8 path bytes	4,096	512
One decoded entry	64 MiB	16 MiB
Total decoded bytes	256 MiB	64 MiB

Repository imports use the remote per-package set. Across one setup manifest they additionally allow at most 64 packages, 64 MiB raw package bytes, 16,384 archive entries, and 128 MiB decoded bytes.

Provisioning

Thing	Bound
Local fleet nodes	16
Config format	3
Artifact-set format	1
Session schema	3
Local fleet schema	1
Session file mode	Written as 0600; an existing file must be 0600 or stricter

Storage and upload

Thing	Value
Default static-asset chunk size	1 MiB
File operations per update call	Exactly 1
Compressible asset default	gzip
Image asset default	identity
Content-addressed Motoko modules and explicit JSON/text records	identity

Cycle accounting bases (13-node estimate)

Used for the presentation-only Settings estimate, not for billing.

Item	Cycles
Per Wasm instruction	1
Measured update execution	5,000,000
Ingress reception (authorized or direct-authenticated update)	1,200,000
Brokered call, or measured timer/handler self-call	260,000

Paid canister public updates omit the ingress base — the calling canister owns the inter-canister fee.