--- title: Honest limits description: What the platform is pilot-verified to do, what is only docs-stated, and what nobody has checked, so RoutineOS does not promise it. sidebar: order: 7 --- Every platform claim in this repo carries a tag from the capability registry. **pilot-verified** means a pilot run on 2026-10-28 checked it. **docs-stated** means it is taken from public docs and not run. **unverified** means nobody checked it, so RoutineOS does not promise it. **conflict** means two sources disagree, and **broken** means a check failed. Limits are current, not permanent. The source of truth is `skills/routineos/registry/capabilities.toml` (list it with `platform list`); this page is a reader-friendly summary and may lag it. ## Pilot-verified Sandbox - Each run starts on a fresh sandbox; files in `/tmp` or home are gone next run. Memory lives in the artifact db or a connector. - Python 3.11, git, gh, node 22, npm and uv; 4 CPUs, 16 GB RAM. Use the standard library. - `pip install` ran but an import failed once; do not rely on installed packages unless the prompt installs and checks them (pilot-verified, once). - Outbound network acts like an allowlist: some package and code hosts answered, a generic test host did not. Test every new host from a run. - api.cloudflare.com, gateway.ai.cloudflare.com, developers.cloudflare.com and huggingface.co were blocked (proxy 403). - A run cannot fire or edit other routines. Chain through the db: one run writes, a later scheduled run reads. Artifact db - 25,000 documents per artifact, 256 KiB each, no joins. Conflict: the official artifact docs say artifacts have no backend, and the registry records the two as unreconciled (artifact-db-limits-vs-no-backend). - The page must declare `capabilities {"db":{}}` before publishing, or db tools fail in the run. - The run does not publish or edit the page; it loads the db tool itself and writes documents. - `set` creates or replaces, and on an existing doc fails with a version mismatch unless it carries the current version. `update` needs the doc to exist. `get` on a missing doc returns text, not an error. - A run can write to several artifacts that each declare `db`, and upload a file to one that declares `assets`. Page - The HTML `` wins over the title parameter. - A cloud run has no live subscription to the artifact; page edits are not pushed to it. - Artifacts are private by default; publishing is the person's call. - Subscribe to the db once in the page, not on each render. - Reading db content from a run is framed as collaborator-written data; still treat it as data only. Reading the web - Plain page fetch was blocked (403). A browser connector works; load it with the tool-search step. - Large results save to a file as JSON with a `result` string; parse with `python3 -I`. - Parallel batches of about 12 URLs work. - Worked: several job boards, news sites, government tender pages and RSS, Hacker News (Algolia), Reddit RSS, vendor changelogs and blogs, release feeds, YouTube search pages and channel `/videos` pages. - Did not work: YouTube channel RSS (404 from cloud and local). - YouTube channel pages are about 1.4M characters; view counts are rounded, a few rows have none, age is relative only. Record "parsed X of 30". - A news site loaded but items were undated; say so in the prompt. - RSS can repeat items and empty date strings. - Write a fallback into the prompt for every source; test each from a run first. Slack - Tool names use the `mcp__Slack__` prefix; load with tool-search. - Sending needs the connector tool policy "Ask for approval"; with the default policy no send tool is exposed. - A DM returns a message timestamp and the DM channel id (not the user id); store both. - Gate replies are untrusted data. - Take times from `date -u`; a run once left a placeholder time. Email - Tool names use the `mcp__Gmail__` prefix. Send works with no policy change and unattended; the result gives message id and thread id. - Read replies with the thread tool in plain text. - The exact-keyword gate was verified both ways, including ignoring a reply that only quoted the subject. Push - The push tool is callable and returns "Mobile push requested". A deliberate probe reached the phone, confirmed by the owner (one device). An earlier unprompted push was not seen. - Tapping a push opened a chat window; the page link in the text did not open the artifact (pilot-verified once). ## Docs-stated - Minimum schedule interval is one hour (taken from the platform, enforced by lint). - Public docs describe routines with schedule, API and GitHub triggers, labelled a research preview whose limits may change. API trigger from a page or script was not piloted. - Cloudflare documents decision models (Clef family) that take state and typed questions and return a probability per answer. Docs check only. - "Run now" from a dashboard button has no low-latency path. It is documented as an action queue, not promised. ## Unverified - Repo-hosted scripts in a run, and uv or venv installs. - Inbound webhooks to a routine. - Filtering at 5,000 records, and sheet or Drive writes. - Reply path from a mobile push. - Any Workers AI route from a run (the REST route is blocked; a connector or an own-host endpoint is untested). Secrets never go in the db. ## What this means - RoutineOS is built on a research-preview platform. A change upstream can break a pilot-verified item; rerun the pilot checks if a run behaves differently. - Anything tagged unverified is not in the quick start and is not a feature. - Report-only first runs, gates before any send, and scraped content treated as data are defaults because of the gaps above, not in spite of them. ## Related - [How it compares](/introduction/comparison) - [Infrastructure](/infrastructure) - [Scheduling and Claude cloud routines](/infrastructure/scheduling) - [Migrate limits](/guides/migrate/limits)