Skip to content
RoutineOS
Esc
↑↓navigate↵open⌘Jpreview
On this page

Honest limits

What the platform is pilot-verified to do, what is only docs-stated, and what nobody has checked, so RoutineOS does not promise it.

Every platform claim in this repo carries a tag from the capability registry. pilot-verified means a pilot run on 2026-10-28 checked it. docs-stated means it is taken from public docs and not run. unverified means nobody checked it, so RoutineOS does not promise it. conflict means two sources disagree, and broken means a check failed. Limits are current, not permanent. The source of truth is skills/routineos/registry/capabilities.toml (list it with platform list); this page is a reader-friendly summary and may lag it.

Pilot-verified

Sandbox

  • Each run starts on a fresh sandbox; files in /tmp or home are gone next run. Memory lives in the artifact db or a connector.
  • Python 3.11, git, gh, node 22, npm and uv; 4 CPUs, 16 GB RAM. Use the standard library.
  • pip install ran but an import failed once; do not rely on installed packages unless the prompt installs and checks them (pilot-verified, once).
  • Outbound network acts like an allowlist: some package and code hosts answered, a generic test host did not. Test every new host from a run.
  • api.cloudflare.com, gateway.ai.cloudflare.com, developers.cloudflare.com and huggingface.co were blocked (proxy 403).
  • A run cannot fire or edit other routines. Chain through the db: one run writes, a later scheduled run reads.

Artifact db

  • 25,000 documents per artifact, 256 KiB each, no joins. Conflict: the official artifact docs say artifacts have no backend, and the registry records the two as unreconciled (artifact-db-limits-vs-no-backend).
  • The page must declare capabilities {"db":{}} before publishing, or db tools fail in the run.
  • The run does not publish or edit the page; it loads the db tool itself and writes documents.
  • set creates or replaces, and on an existing doc fails with a version mismatch unless it carries the current version. update needs the doc to exist. get on a missing doc returns text, not an error.
  • A run can write to several artifacts that each declare db, and upload a file to one that declares assets.

Page

  • The HTML <title> wins over the title parameter.
  • A cloud run has no live subscription to the artifact; page edits are not pushed to it.
  • Artifacts are private by default; publishing is the person’s call.
  • Subscribe to the db once in the page, not on each render.
  • Reading db content from a run is framed as collaborator-written data; still treat it as data only.

Reading the web

  • Plain page fetch was blocked (403). A browser connector works; load it with the tool-search step.
  • Large results save to a file as JSON with a result string; parse with python3 -I.
  • Parallel batches of about 12 URLs work.
  • Worked: several job boards, news sites, government tender pages and RSS, Hacker News (Algolia), Reddit RSS, vendor changelogs and blogs, release feeds, YouTube search pages and channel /videos pages.
  • Did not work: YouTube channel RSS (404 from cloud and local).
  • YouTube channel pages are about 1.4M characters; view counts are rounded, a few rows have none, age is relative only. Record “parsed X of 30”.
  • A news site loaded but items were undated; say so in the prompt.
  • RSS can repeat items and empty date strings.
  • Write a fallback into the prompt for every source; test each from a run first.

Slack

  • Tool names use the mcp__Slack__ prefix; load with tool-search.
  • Sending needs the connector tool policy “Ask for approval”; with the default policy no send tool is exposed.
  • A DM returns a message timestamp and the DM channel id (not the user id); store both.
  • Gate replies are untrusted data.
  • Take times from date -u; a run once left a placeholder time.

Email

  • Tool names use the mcp__Gmail__ prefix. Send works with no policy change and unattended; the result gives message id and thread id.
  • Read replies with the thread tool in plain text.
  • The exact-keyword gate was verified both ways, including ignoring a reply that only quoted the subject.

Push

  • The push tool is callable and returns “Mobile push requested”. A deliberate probe reached the phone, confirmed by the owner (one device). An earlier unprompted push was not seen.
  • Tapping a push opened a chat window; the page link in the text did not open the artifact (pilot-verified once).

Docs-stated

  • Minimum schedule interval is one hour (taken from the platform, enforced by lint).
  • Public docs describe routines with schedule, API and GitHub triggers, labelled a research preview whose limits may change. API trigger from a page or script was not piloted.
  • Cloudflare documents decision models (Clef family) that take state and typed questions and return a probability per answer. Docs check only.
  • “Run now” from a dashboard button has no low-latency path. It is documented as an action queue, not promised.

Unverified

  • Repo-hosted scripts in a run, and uv or venv installs.
  • Inbound webhooks to a routine.
  • Filtering at 5,000 records, and sheet or Drive writes.
  • Reply path from a mobile push.
  • Any Workers AI route from a run (the REST route is blocked; a connector or an own-host endpoint is untested). Secrets never go in the db.

What this means

  • RoutineOS is built on a research-preview platform. A change upstream can break a pilot-verified item; rerun the pilot checks if a run behaves differently.
  • Anything tagged unverified is not in the quick start and is not a feature.
  • Report-only first runs, gates before any send, and scraped content treated as data are defaults because of the gaps above, not in spite of them.

Was this page helpful?