akm-cli 0.9.4 → 0.9.6

package/dist/workflows/exec/scheduler.js

@@ -15,17 +15,9 @@
  *   - Cooperative cancellation via AbortSignal (workers stop claiming items;
  *     the same signal is passed into each dispatch so in-flight units can be
  *     preempted too).
- *
- * The lifetime unit cap ({@link LIFETIME_UNIT_CAP}) is DECLARED here but
- * enforced per actual dispatch by the native executor: a pre-batch check
- * (`journaled + items.length`) counted durable-row REUSES as new dispatches,
- * which made any partially-completed fan-out with more than ~cap/2 journaled
- * units impossible to resume (peer review R1). Only work that really
- * dispatches consumes the cap.
  */
 import { concurrentMap } from "../../core/concurrent.js";
 import { cpuDerivedUnitConcurrency, workflowMaxConcurrency } from "../concurrency-policy.js";
-import { WORKFLOW_MAX_MAP_EXPANSION } from "../resource-limits.js";
 export { clampMaxConcurrency, cpuDerivedUnitConcurrency, WORKFLOW_MAX_CONCURRENCY_CEILING, } from "../concurrency-policy.js";
 /**
  * Hard ceiling on an EXPLICIT `workflow.maxConcurrency`. A user value above
@@ -49,21 +41,13 @@ export { clampMaxConcurrency, cpuDerivedUnitConcurrency, WORKFLOW_MAX_CONCURRENC
 export function maxUnitConcurrency(cpuCount, configured) {
     return workflowMaxConcurrency(configured, cpuCount);
 }
-/** Lifetime unit cap per run — a runaway-loop backstop, far above real use. */
-export const LIFETIME_UNIT_CAP = WORKFLOW_MAX_MAP_EXPANSION;
-export class UnitCapExceededError extends Error {
-    constructor(cap) {
-        super(`workflow run exceeded the lifetime unit cap (${cap}). Aborting dispatch — check for a runaway fan-out.`);
-        this.name = "UnitCapExceededError";
-    }
-}
 /**
  * Run `dispatch` over `items` under the engine concurrency caps. Individual
  * failures do not cancel siblings (allSettled semantics from `concurrentMap`);
  * a slot whose dispatch threw or that was never claimed after an abort stays
- * `undefined` in the result array. The lifetime unit cap is NOT checked here
- * — the executor consumes it per actual dispatch, so durable-row reuses on
- * resume stay free.
+ * `undefined` in the result array. A declared `budget.max_units` ceiling is
+ * NOT checked here — the executor consumes it per actual dispatch, so
+ * durable-row reuses on resume stay free.
  */
 export async function scheduleUnits(items, dispatch, options = {}) {
     const concurrency = Math.max(1, Math.min(options.concurrency ?? 1, options.maxConcurrency ?? Number.POSITIVE_INFINITY, options.llmConcurrency ?? Number.POSITIVE_INFINITY, options.hostConcurrency ?? cpuDerivedUnitConcurrency()));

package/dist/workflows/exec/step-work.js

@@ -22,7 +22,7 @@ import { canonicalInputJson, validateInputs } from "../../execution/input-contra
 import { withWorkflowRunsRepo, } from "../../storage/repositories/workflow-runs-repository.js";
 import { canonicalJson as canonicalJsonString } from "../ir/plan-hash.js";
 import { parseReference, resolveReferenceString, } from "../program/expressions.js";
-import { clip, WORKFLOW_MAX_MAP_EXPANSION, WORKFLOW_UNIT_DIAGNOSTIC_CLIP } from "../resource-limits.js";
+import { clip, WORKFLOW_UNIT_DIAGNOSTIC_CLIP } from "../resource-limits.js";
 import { completeWorkflowStep, isTruncatedEvidence, } from "../runtime/runs.js";
 import { GATE_EVALUATION_PHASE } from "../runtime/unit-phases.js";
 import { parseJudgeVerdict } from "../validate-summary.js";
@@ -60,9 +60,6 @@ const GATE_ARTIFACT_CLIP = 4_000;
  * deterministically, before dispatch.
  */
 function validateFanOutItems(stepId, items) {
-    if (items.length > WORKFLOW_MAX_MAP_EXPANSION) {
-        return `Step "${stepId}" fan-out expands to ${items.length} units, exceeding the ${WORKFLOW_MAX_MAP_EXPANSION}-unit resource limit.`;
-    }
     const nullIndex = items.findIndex((item) => item === null || item === undefined);
     if (nullIndex !== -1) {
         return (`Step "${stepId}" fan-out list contains a null item (index ${nullIndex}). ` +

package/dist/workflows/exec/unit-dispatch.js

@@ -2,7 +2,7 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { ConfigError } from "../../core/errors.js";
-import { assertFrozenDirectoryIdentity } from "../../execution/directory-identity.js";
+import { assertFrozenDirectoryContained } from "../../execution/directory-identity.js";
 import { assertFrozenExecutableIdentity } from "../../execution/executable-identity.js";
 import { canonicalResolvedExecutionRequest, decodeResolvedExecutionRequest, } from "../../execution/resolved-request.js";
 import { dispatchLoweredExecutionRequest, lowerResolvedExecutionRequestWithRunner, } from "../../integrations/agent/execution-lowering.js";
@@ -11,7 +11,7 @@ import { getHarness } from "../../integrations/harnesses/index.js";
 export function prepareWorkflowExecution(request, prompt = request.prompt) {
     const target = request.frozenTarget;
     if (target.cwdIdentity)
-        assertFrozenDirectoryIdentity(target.cwdIdentity);
+        assertFrozenDirectoryContained(target.cwdIdentity);
     if (target.executable)
         assertFrozenExecutableIdentity(target.executable, `unit ${request.unitId} executable`);
     const wire = JSON.parse(canonicalResolvedExecutionRequest(target.request));

package/dist/workflows/exec/worktree.js

@@ -67,7 +67,7 @@ import { spawnSync } from "node:child_process";
 import fsp from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { isWithinAsync, safeRealpathAsync } from "../../core/common.js";
+import { isProcessAlive, isWithinAsync, safeRealpathAsync } from "../../core/common.js";
 import { serializeByKey } from "../../core/concurrent.js";
 import { runManagedSubprocess } from "../../core/subprocess.js";
 import { warn } from "../../core/warn.js";
@@ -417,18 +417,6 @@ async function isWorktreeLeaseLive(candidate) {
         return false;
     return isProcessAlive(lease.pid);
 }
-/** `kill(pid, 0)` liveness probe. EPERM proves the process exists but is not ours. */
-function isProcessAlive(pid) {
-    if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 0)
-        return false;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (err) {
-        return err.code === "EPERM";
-    }
-}
 // ── Garbage collection ──────────────────────────────────────────────────────
 /**
  * Drop the run-scoped root once its last unit worktree is gone. `rmdir`

package/dist/workflows/freeze/targets/child-workflow.js

@@ -31,7 +31,7 @@ import { UsageError } from "../../../core/errors.js";
 import { GuardedExecutionSourceCollector } from "../../../execution/guarded-source.js";
 import { workflowParamContract } from "../../ir/params.js";
 import { canonicalJson, canonicalPlanJson } from "../../ir/plan-hash.js";
-import { utf8Bytes, WORKFLOW_MAX_COMPOSITION_DEPTH, WORKFLOW_MAX_EMBEDDED_CHILD_PLAN_BYTES, } from "../../resource-limits.js";
+import { utf8Bytes, WORKFLOW_MAX_EMBEDDED_CHILD_PLAN_BYTES } from "../../resource-limits.js";
 import { loadWorkflowAsset } from "../../runtime/workflow-asset-loader.js";
 import { resolveOwnedAsset } from "../environment.js";
 import { declaredParamNames, earlierStepIds } from "../step-values.js";
@@ -91,13 +91,6 @@ function assertNoCompositionCycle(stepId, childRef, refPath) {
         `Path: ${compositionPath(refPath, childRef)}.`, "COMPOSITION_INVALID", "Break the cycle: remove or redirect one of the compositions in the path above so no workflow ends up " +
         "composing itself, directly or through intermediates.");
 }
-function assertCompositionDepthAllowed(stepId, childRef, childDepth, refPath) {
-    if (childDepth <= WORKFLOW_MAX_COMPOSITION_DEPTH)
-        return;
-    throw new UsageError(`Workflow step ${stepId} cannot compose ${childRef}: workflow composition is limited to ` +
-        `${WORKFLOW_MAX_COMPOSITION_DEPTH} levels. Path: ${compositionPath(refPath, childRef)}.`, "COMPOSITION_INVALID", `Flatten the composition chain to ${WORKFLOW_MAX_COMPOSITION_DEPTH} levels or fewer — inline one of the ` +
-        "intermediate workflows, or restructure the chain so fewer child compositions are nested.");
-}
 /**
  * Add the child's embedded plan bytes to the shared, tree-wide budget
  * (A-N6) and fail before publication if the AGGREGATE crosses the cap.
@@ -126,10 +119,9 @@ export async function childWorkflowDispatch(input) {
     // path to reach the child run and must reject, not vanish (see
     // assertNoStepEnvironment's doc comment).
     assertNoStepEnvironment(source.id, childRef, source);
-    // §4.2 steps 2-3: the composition bounds, before any child compilation.
+    // §4.2 step 2: the composition cycle check, before any child compilation.
     assertNoCompositionCycle(source.id, childRef, context.composition.refPath);
     const childDepth = context.composition.depth + 1;
-    assertCompositionDepthAllowed(source.id, childRef, childDepth, context.composition.refPath);
     // §4.2 step 4: freeze the child COMPLETELY (compile -> validate -> freeze),
     // with its OWN fresh collector (A-N7) so its plan is a pure function of its
     // own source, and the SAME mutable budget object so the aggregate bound

package/dist/workflows/ir/plan-hash.js

@@ -13,7 +13,7 @@
  * Pure module: no IO beyond node:crypto, no engine imports.
  */
 import { createHash } from "node:crypto";
-import { utf8Bytes, WORKFLOW_MAX_JSON_DEPTH, WORKFLOW_MAX_PLAN_BYTES } from "../resource-limits.js";
+import { utf8Bytes, WORKFLOW_MAX_PLAN_BYTES } from "../resource-limits.js";
 import { decodeWorkflowPlanV4, WORKFLOW_IR_V5_VERSION } from "./schema-v4.js";
 /** sha256 hex of the canonical (recursively sorted-keys) JSON of the plan. */
 export function computePlanHash(plan) {
@@ -53,9 +53,7 @@ export function decodeCanonicalPlan(runId, planJson, planHash, expectedVersion)
         throw new Error(`Workflow run ${runId} has noncanonical frozen plan JSON.`);
     return plan;
 }
-function sortKeys(value, depth = 0) {
-    if (depth > WORKFLOW_MAX_JSON_DEPTH)
-        throw new TypeError("JSON value exceeds maximum depth");
+function sortKeys(value) {
     if (value === null || typeof value === "string" || typeof value === "boolean")
         return value;
     if (typeof value === "number") {
@@ -64,11 +62,11 @@ function sortKeys(value, depth = 0) {
         return value;
     }
     if (Array.isArray(value))
-        return value.map((item) => sortKeys(item, depth + 1));
+        return value.map((item) => sortKeys(item));
     if (value && typeof value === "object") {
         return Object.fromEntries(Object.entries(value)
             .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
-            .map(([k, v]) => [k, sortKeys(v, depth + 1)]));
+            .map(([k, v]) => [k, sortKeys(v)]));
     }
     throw new TypeError("JSON value contains a non-JSON value");
 }

package/dist/workflows/ir/schema-v4.js

@@ -182,15 +182,6 @@ function decodeFrozenTarget(value, unit, environment, requiredSources, depth, bu
         return decodeChildWorkflowTarget(target, unit, depth, budget);
     fail(`unit ${unit.id} frozenTarget has unsupported kind ${String(target.kind)}`);
 }
-/**
- * Composition-depth corruption bound (spec §3.6 step 6, §4.5, row A-23).
- * Mirrors `WORKFLOW_MAX_COMPOSITION_DEPTH` (= 8), which Lane B adds to
- * `src/workflows/resource-limits.ts` in a later commit as the freeze-time
- * `COMPOSITION_INVALID` gate. Reproduced here — the decode-time corruption
- * gate — rather than imported across the lane boundary, matching
- * `tests/workflows/plan-v5-schema.test.ts`'s own header comment.
- */
-const CHILD_WORKFLOW_DECODE_MAX_DEPTH = 8;
 /**
  * Decode a `kind: "child-workflow"` frozen target (§3.5): the embedded
  * COMPLETE child plan, re-verified against its own `planHash` and this
@@ -241,9 +232,6 @@ function decodeChildWorkflowTarget(target, unit, depth, budget) {
         fail(`unit ${unit.id} child workflow contentHash does not match its frozen dispatch`);
     }
     const childDepth = depth + 1;
-    if (childDepth > CHILD_WORKFLOW_DECODE_MAX_DEPTH) {
-        fail(`unit ${unit.id} child workflow ${target.ref} exceeds the max composition depth of ${CHILD_WORKFLOW_DECODE_MAX_DEPTH}`);
-    }
     const frozenPlan = decodeWorkflowPlanV4(target.frozenPlan, {}, childDepth, budget);
     const embeddedPlanJson = canonicalJsonLocal(frozenPlan);
     const actualPlanHash = sha256(embeddedPlanJson);

package/dist/workflows/ir/schema.js

@@ -5,12 +5,11 @@ import { isContainedRelativePath } from "../../core/common.js";
 import { UsageError } from "../../core/errors.js";
 import { parseReference } from "../program/expressions.js";
 import { PROGRAM_PARAM_NAME_PATTERN, PROGRAM_RETRY_REASONS, PROGRAM_STEP_ID_PATTERN } from "../program/schema.js";
-import { jsonBytes, utf8Bytes, WORKFLOW_ENV_VAR_NAME_PATTERN, WORKFLOW_MAX_CONCURRENCY, WORKFLOW_MAX_EXEC_ARG_BYTES, WORKFLOW_MAX_EXEC_ARGV, WORKFLOW_MAX_EXEC_CWD_LENGTH, WORKFLOW_MAX_EXEC_PASS_ENV, WORKFLOW_MAX_GATE_LOOPS, WORKFLOW_MAX_INPUTS, WORKFLOW_MAX_INSTRUCTION_BYTES, WORKFLOW_MAX_JSON_DEPTH, WORKFLOW_MAX_MAP_EXPANSION, WORKFLOW_MAX_PARAMS, WORKFLOW_MAX_PLAN_BYTES, WORKFLOW_MAX_RETRIES, WORKFLOW_MAX_ROUTE_BRANCHES, WORKFLOW_MAX_SCHEMA_BYTES, WORKFLOW_MAX_STEPS, WORKFLOW_MAX_TIMEOUT_MS, } from "../resource-limits.js";
+import { jsonBytes, utf8Bytes, WORKFLOW_ENV_VAR_NAME_PATTERN, WORKFLOW_MAX_CONCURRENCY, WORKFLOW_MAX_INSTRUCTION_BYTES, WORKFLOW_MAX_PLAN_BYTES, WORKFLOW_MAX_SCHEMA_BYTES, WORKFLOW_MAX_TIMEOUT_MS, } from "../resource-limits.js";
 // Shared dispatch-significant bounds now live in `../resource-limits` so the
 // parser, the published JSON Schema, and this decoder enforce identical
 // values. Re-exported here for existing importers (e.g. `commands/workflow-cli.ts`).
-export { WORKFLOW_MAX_CONCURRENCY, WORKFLOW_MAX_GATE_LOOPS, WORKFLOW_MAX_RETRIES, WORKFLOW_MAX_TIMEOUT_MS };
-export const WORKFLOW_MAX_UNITS = WORKFLOW_MAX_MAP_EXPANSION;
+export { WORKFLOW_MAX_CONCURRENCY, WORKFLOW_MAX_TIMEOUT_MS };
 const MAX_LIST_ITEMS = 1024;
 const MAX_STRING_LENGTH = 1_000_000;
 /** Validate the current durable execution graph. */
@@ -33,8 +32,8 @@ export function validateWorkflowPlanStructure(input, options, hooks = {}) {
         fail(`execution.maxConcurrency must be an integer from 1 through ${WORKFLOW_MAX_CONCURRENCY}`);
     }
     assertKeys(plan.execution, ["maxConcurrency"], "execution");
-    if (!Array.isArray(plan.steps) || plan.steps.length === 0 || plan.steps.length > WORKFLOW_MAX_STEPS)
-        fail("steps must contain 1 through 256 entries");
+    if (!Array.isArray(plan.steps) || plan.steps.length === 0)
+        fail("steps must be a non-empty array");
     const stepIds = new Set();
     const nodeIds = new Set();
     for (let index = 0; index < plan.steps.length; index++) {
@@ -126,7 +125,7 @@ function validateNode(node, stepId, nodeIds, unitExtraKeys) {
         validateSchema(node.schema, `unit ${node.id} schema`);
     validateRetry(node.retry, node.id);
     validateStringArray(node.env, `unit ${node.id} env`, MAX_LIST_ITEMS, true);
-    validateStringArray(node.inputs, `unit ${node.id} inputs`, WORKFLOW_MAX_INPUTS, true);
+    validateStringArray(node.inputs, `unit ${node.id} inputs`, Infinity, true);
     validateSource(node.source, `unit ${node.id} source`);
 }
 /**
@@ -143,15 +142,11 @@ function validateExecSpec(value, label) {
     const command = value.command;
     if (!Array.isArray(command) ||
         command.length === 0 ||
-        command.length > WORKFLOW_MAX_EXEC_ARGV ||
-        !command.every((arg) => typeof arg === "string" && arg.length > 0 && utf8Bytes(arg) <= WORKFLOW_MAX_EXEC_ARG_BYTES)) {
-        fail(`${label}.command must be an argv array of 1 through ${WORKFLOW_MAX_EXEC_ARGV} bounded non-empty strings`);
+        !command.every((arg) => typeof arg === "string" && arg.length > 0)) {
+        fail(`${label}.command must be an argv array of non-empty strings`);
     }
     if (value.cwd !== undefined) {
-        if (typeof value.cwd !== "string" ||
-            value.cwd.length === 0 ||
-            value.cwd.length > WORKFLOW_MAX_EXEC_CWD_LENGTH ||
-            !isContainedRelativePath(value.cwd)) {
+        if (typeof value.cwd !== "string" || value.cwd.length === 0 || !isContainedRelativePath(value.cwd)) {
             fail(`${label}.cwd must be a relative path contained in the unit working directory`);
         }
     }
@@ -183,11 +178,10 @@ function validateExecEnvScope(value, label) {
     const passEnv = value.passEnv;
     if (!Array.isArray(passEnv) ||
         passEnv.length === 0 ||
-        passEnv.length > WORKFLOW_MAX_EXEC_PASS_ENV ||
         !passEnv.every((name) => typeof name === "string" && WORKFLOW_ENV_VAR_NAME_PATTERN.test(name)) ||
         new Set(passEnv).size !== passEnv.length) {
-        fail(`${label}.passEnv must be 1 through ${WORKFLOW_MAX_EXEC_PASS_ENV} distinct environment variable names ` +
-            `matching ${WORKFLOW_ENV_VAR_NAME_PATTERN.source}`);
+        fail(`${label}.passEnv must be a non-empty list of distinct environment variable names matching ` +
+            `${WORKFLOW_ENV_VAR_NAME_PATTERN.source}`);
     }
 }
 function validateGate(gate, stepId, nodeIds, gateExtraKeys) {
@@ -199,8 +193,7 @@ function validateGate(gate, stepId, nodeIds, gateExtraKeys) {
         gate.criteria.length > MAX_LIST_ITEMS ||
         !gate.criteria.every((x) => typeof x === "string" && x.length > 0 && x.length <= MAX_STRING_LENGTH) ||
         !Number.isInteger(gate.maxLoops) ||
-        gate.maxLoops < 1 ||
-        gate.maxLoops > WORKFLOW_MAX_GATE_LOOPS)
+        gate.maxLoops < 1)
         fail(`gate for step ${stepId} is invalid`);
     if (nodeIds.has(gate.id))
         fail(`gate id ${gate.id} collides with a node`);
@@ -213,7 +206,6 @@ function validateRoute(route, stepId) {
         !route.input ||
         !isRecord(route.when) ||
         Object.keys(route.when).length === 0 ||
-        Object.keys(route.when).length > WORKFLOW_MAX_ROUTE_BRANCHES ||
         !Object.keys(route.when).every((match) => match.length > 0 && match.length <= MAX_STRING_LENGTH) ||
         !Object.values(route.when).every((target) => typeof target === "string" && target))
         fail(`route for step ${stepId} is invalid`);
@@ -226,9 +218,7 @@ function assertKeys(value, allowed, label) {
         if (!allowed.includes(key))
             fail(`${label} contains unknown key ${key}`);
 }
-function assertJson(value, depth = 0) {
-    if (depth > WORKFLOW_MAX_JSON_DEPTH)
-        fail("plan exceeds JSON depth limit of 64");
+function assertJson(value) {
     if (value === null || typeof value === "boolean")
         return;
     if (typeof value === "string") {
@@ -243,23 +233,23 @@ function assertJson(value, depth = 0) {
     }
     if (Array.isArray(value)) {
         for (const item of value)
-            assertJson(item, depth + 1);
+            assertJson(item);
         return;
     }
     if (isRecord(value)) {
         for (const item of Object.values(value))
-            assertJson(item, depth + 1);
+            assertJson(item);
         return;
     }
     fail("plan contains a non-JSON value");
 }
 function validateParams(params, schemas) {
-    validateStringArray(params, "params", WORKFLOW_MAX_PARAMS, true);
+    validateStringArray(params, "params", Infinity, true);
     if (params?.some((name) => !PROGRAM_PARAM_NAME_PATTERN.test(name)))
         fail("params contains an invalid name");
     if (schemas !== undefined) {
-        if (!isRecord(schemas) || Object.keys(schemas).length > WORKFLOW_MAX_PARAMS)
-            fail("paramSchemas must be a bounded object");
+        if (!isRecord(schemas))
+            fail("paramSchemas must be an object");
         for (const [name, schema] of Object.entries(schemas)) {
             if (!PROGRAM_PARAM_NAME_PATTERN.test(name))
                 fail(`paramSchemas.${name} is invalid`);
@@ -284,9 +274,8 @@ function validateBudget(budget) {
         fail("budget must declare a ceiling");
     validateOptionalPositiveInteger(budget.maxTokens, "budget.maxTokens");
     const maxUnits = budget.maxUnits;
-    if (maxUnits !== undefined &&
-        (!Number.isSafeInteger(maxUnits) || maxUnits < 1 || maxUnits > WORKFLOW_MAX_UNITS))
-        fail(`budget.maxUnits must be an integer from 1 through ${WORKFLOW_MAX_UNITS}`);
+    if (maxUnits !== undefined && (!Number.isSafeInteger(maxUnits) || maxUnits < 1))
+        fail("budget.maxUnits must be a positive integer");
 }
 function validateRetry(retry, nodeId) {
     if (retry === undefined)
@@ -294,7 +283,7 @@ function validateRetry(retry, nodeId) {
     if (!isRecord(retry))
         fail(`unit ${nodeId} retry must be an object`);
     assertKeys(retry, ["max", "on"], `unit ${nodeId} retry`);
-    if (!Number.isSafeInteger(retry.max) || retry.max < 0 || retry.max > WORKFLOW_MAX_RETRIES)
+    if (!Number.isSafeInteger(retry.max) || retry.max < 0)
         fail(`unit ${nodeId} retry.max is invalid`);
     validateStringArray(retry.on, `unit ${nodeId} retry.on`, PROGRAM_RETRY_REASONS.length, true);
     if (retry.on === undefined ||

package/dist/workflows/parser.js

@@ -38,7 +38,7 @@ import { formatExtraParamsIssue, validateExtraParams } from "../core/extra-param
 import { checkJsonSchemaDefinition, JSON_SCHEMA_SUBSET_SUPPORTED_KEYWORDS } from "../core/json-schema.js";
 import { parseReference } from "./program/expressions.js";
 import { PROGRAM_ISOLATION_KINDS, PROGRAM_ON_ERROR, PROGRAM_PARAM_NAME_PATTERN, PROGRAM_REDUCERS, PROGRAM_RETRY_REASONS, PROGRAM_STEP_ID_PATTERN, } from "./program/schema.js";
-import { jsonBytes, utf8Bytes, WORKFLOW_ENGINE_NAME_PATTERN, WORKFLOW_ENV_VAR_NAME_PATTERN, WORKFLOW_MAX_CONCURRENCY, WORKFLOW_MAX_ENGINE_NAME_LENGTH, WORKFLOW_MAX_EXEC_ARG_BYTES, WORKFLOW_MAX_EXEC_ARGV, WORKFLOW_MAX_EXEC_CWD_LENGTH, WORKFLOW_MAX_EXEC_PASS_ENV, WORKFLOW_MAX_EXTRA_PARAMS_BYTES, WORKFLOW_MAX_GATE_LOOPS, WORKFLOW_MAX_INPUTS, WORKFLOW_MAX_MAP_EXPANSION, WORKFLOW_MAX_OUTPUTS, WORKFLOW_MAX_PARAMS, WORKFLOW_MAX_RETRIES, WORKFLOW_MAX_ROUTE_BRANCHES, WORKFLOW_MAX_SCHEMA_BYTES, WORKFLOW_MAX_SOURCE_BYTES, WORKFLOW_MAX_STEPS, WORKFLOW_MAX_TIMEOUT_MS, } from "./resource-limits.js";
+import { jsonBytes, utf8Bytes, WORKFLOW_ENGINE_NAME_PATTERN, WORKFLOW_ENV_VAR_NAME_PATTERN, WORKFLOW_MAX_CONCURRENCY, WORKFLOW_MAX_ENGINE_NAME_LENGTH, WORKFLOW_MAX_EXTRA_PARAMS_BYTES, WORKFLOW_MAX_SCHEMA_BYTES, WORKFLOW_MAX_SOURCE_BYTES, WORKFLOW_MAX_TIMEOUT_MS, } from "./resource-limits.js";
 import { WORKFLOW_SCHEMA_VERSION, } from "./schema.js";
 import { runSemanticChecks } from "./validator.js";
 /** Envelope keys every AKM markdown asset carries ($ref'd from schemas/akm-asset-envelope.json). */
@@ -406,9 +406,6 @@ function parseParams(ctx, raw) {
         ctx.err(["params"], `"params" must be a mapping of param name to a JSON Schema object (e.g. changed_files: { type: array }).`);
         return undefined;
     }
-    if (Object.keys(raw).length > WORKFLOW_MAX_PARAMS) {
-        ctx.err(["params"], `"params" must contain at most ${WORKFLOW_MAX_PARAMS} entries.`);
-    }
     const params = {};
     for (const [paramName, value] of Object.entries(raw)) {
         if (!PROGRAM_PARAM_NAME_PATTERN.test(paramName)) {
@@ -448,9 +445,6 @@ function parseOutputs(ctx, raw) {
         ctx.err(["outputs"], `"outputs" must be a mapping of output name to { from, schema? } (e.g. report: { from: steps.summarize.output }).`);
         return undefined;
     }
-    if (Object.keys(raw).length > WORKFLOW_MAX_OUTPUTS) {
-        ctx.err(["outputs"], `"outputs" must contain at most ${WORKFLOW_MAX_OUTPUTS} entries.`);
-    }
     const outputs = {};
     for (const [outputName, value] of Object.entries(raw)) {
         const path = ["outputs", outputName];
@@ -546,14 +540,11 @@ function parseBudget(ctx, raw) {
         }
     }
     if (raw.max_units !== undefined) {
-        if (typeof raw.max_units === "number" &&
-            Number.isInteger(raw.max_units) &&
-            raw.max_units >= 1 &&
-            raw.max_units <= WORKFLOW_MAX_MAP_EXPANSION) {
+        if (typeof raw.max_units === "number" && Number.isInteger(raw.max_units) && raw.max_units >= 1) {
             budget.maxUnits = raw.max_units;
         }
         else {
-            ctx.err([...path, "max_units"], `"budget.max_units" must be an integer from 1 through ${WORKFLOW_MAX_MAP_EXPANSION}.`);
+            ctx.err([...path, "max_units"], `"budget.max_units" must be an integer >= 1.`);
         }
     }
     return Object.keys(budget).length > 0 ? budget : undefined;
@@ -563,9 +554,6 @@ function parseSteps(ctx, raw) {
         ctx.err(["steps"], `"steps" is required and must be a list with at least one step.`);
         return [];
     }
-    if (raw.length > WORKFLOW_MAX_STEPS) {
-        ctx.err(["steps"], `"steps" must contain at most ${WORKFLOW_MAX_STEPS} entries.`);
-    }
     // First pass: collect ids so route targets can be checked against ALL steps
     // (including ones that fail their own validation).
     const idIndex = new Map();
@@ -775,11 +763,6 @@ function parseExecPassEnv(ctx, raw, path, stepLabel) {
             `akm's own environment, e.g. pass_env: [CARGO_HOME]. Values never appear here — use "env:" bindings for those.`);
         return undefined;
     }
-    if (raw.length > WORKFLOW_MAX_EXEC_PASS_ENV) {
-        ctx.err(path, `${stepLabel} "exec.pass_env" must have at most ${WORKFLOW_MAX_EXEC_PASS_ENV} entries. A command needing ` +
-            `more than that should use explicit named "env:" bindings instead.`);
-        return undefined;
-    }
     const names = [];
     for (const [index, entry] of raw.entries()) {
         if (typeof entry !== "string" || !WORKFLOW_ENV_VAR_NAME_PATTERN.test(entry)) {
@@ -795,17 +778,13 @@ function parseExecPassEnv(ctx, raw, path, stepLabel) {
     }
     return names;
 }
-/** The argv array itself: 1..WORKFLOW_MAX_EXEC_ARGV bounded non-empty strings. */
+/** The argv array itself: a non-empty list of non-empty strings. */
 function parseExecCommand(ctx, raw, path, stepLabel) {
     if (!Array.isArray(raw) || raw.length === 0) {
         ctx.err(path, `${stepLabel} "exec" requires "command": a non-empty argv list, e.g. command: ["bun", "run", "test:unit"]. ` +
             `A single shell string is not accepted — the command is spawned directly, never through a shell.`);
         return undefined;
     }
-    if (raw.length > WORKFLOW_MAX_EXEC_ARGV) {
-        ctx.err(path, `${stepLabel} "exec.command" must have at most ${WORKFLOW_MAX_EXEC_ARGV} entries.`);
-        return undefined;
-    }
     const argv = [];
     for (const [index, entry] of raw.entries()) {
         if (typeof entry !== "string" || entry === "") {
@@ -816,10 +795,6 @@ function parseExecCommand(ctx, raw, path, stepLabel) {
             ctx.err([...path, index], `${stepLabel} "exec.command[${index}]" may not contain NUL bytes.`);
             return undefined;
         }
-        if (utf8Bytes(entry) > WORKFLOW_MAX_EXEC_ARG_BYTES) {
-            ctx.err(path, `${stepLabel} "exec.command[${index}]" exceeds ${WORKFLOW_MAX_EXEC_ARG_BYTES} bytes.`);
-            return undefined;
-        }
         argv.push(entry);
     }
     return argv;
@@ -837,10 +812,6 @@ function parseExecCwd(ctx, raw, path, stepLabel) {
         return undefined;
     }
     const value = raw.trim();
-    if (value.length > WORKFLOW_MAX_EXEC_CWD_LENGTH) {
-        ctx.err(path, `${stepLabel} "exec.cwd" exceeds ${WORKFLOW_MAX_EXEC_CWD_LENGTH} characters.`);
-        return undefined;
-    }
     if (!isContainedRelativePath(value)) {
         ctx.err(path, `${stepLabel} "exec.cwd" (${JSON.stringify(value)}) must be a RELATIVE path inside the unit's working ` +
             `directory — absolute paths, Windows drive letters, "~", and ".." segments are rejected.`);
@@ -876,14 +847,11 @@ function parseMap(ctx, raw, path, stepLabel) {
     }
     let concurrency;
     if (raw.concurrency !== undefined) {
-        if (typeof raw.concurrency === "number" &&
-            Number.isInteger(raw.concurrency) &&
-            raw.concurrency > 0 &&
-            raw.concurrency <= WORKFLOW_MAX_CONCURRENCY) {
-            concurrency = raw.concurrency;
+        if (typeof raw.concurrency === "number" && Number.isInteger(raw.concurrency) && raw.concurrency > 0) {
+            concurrency = Math.min(raw.concurrency, WORKFLOW_MAX_CONCURRENCY);
         }
         else {
-            ctx.err([...path, "concurrency"], `${stepLabel} "concurrency" must be an integer from 1 through ${WORKFLOW_MAX_CONCURRENCY}.`);
+            ctx.err([...path, "concurrency"], `${stepLabel} "concurrency" must be a positive integer.`);
         }
     }
     const reducer = parseEnumField(ctx, raw.reducer, [...path, "reducer"], `${stepLabel} "reducer"`, PROGRAM_REDUCERS);
@@ -917,9 +885,6 @@ function parseRoute(ctx, raw, path, stepLabel, stepIndex, routeChecks) {
         ctx.err(whenPath, `${stepLabel} "route" requires "when": a non-empty list of { match, step } branches (e.g. when: [{ match: pass, step: ship }]).`);
     }
     else {
-        if (raw.when.length > WORKFLOW_MAX_ROUTE_BRANCHES) {
-            ctx.err(whenPath, `${stepLabel} "when" must contain at most ${WORKFLOW_MAX_ROUTE_BRANCHES} branches.`);
-        }
         const seenMatches = new Map();
         raw.when.forEach((branch, i) => {
             const branchPath = [...whenPath, i];
@@ -980,9 +945,6 @@ function parseInputs(ctx, raw, path, stepLabel) {
         ctx.err(path, `${stepLabel} "inputs" must be a non-empty list of reference strings.`);
         return undefined;
     }
-    if (raw.length > WORKFLOW_MAX_INPUTS) {
-        ctx.err(path, `${stepLabel} "inputs" must contain at most ${WORKFLOW_MAX_INPUTS} entries.`);
-    }
     const out = [];
     // The frozen-plan decoder requires uniqueness (validateStringArray(..., true)),
     // so duplicates parsed and linted clean and then failed the run with an
@@ -1012,14 +974,11 @@ function parseGate(ctx, raw, path, stepLabel) {
     checkUnknownKeys(ctx, raw, path, GATE_KEYS, `${stepLabel} "gate"`);
     const gate = {};
     if (raw.max_loops !== undefined) {
-        if (typeof raw.max_loops === "number" &&
-            Number.isInteger(raw.max_loops) &&
-            raw.max_loops >= 1 &&
-            raw.max_loops <= WORKFLOW_MAX_GATE_LOOPS) {
+        if (typeof raw.max_loops === "number" && Number.isInteger(raw.max_loops) && raw.max_loops >= 1) {
             gate.maxLoops = raw.max_loops;
         }
         else {
-            ctx.err([...path, "max_loops"], `${stepLabel} "gate.max_loops" must be an integer from 1 through ${WORKFLOW_MAX_GATE_LOOPS}.`);
+            ctx.err([...path, "max_loops"], `${stepLabel} "gate.max_loops" must be an integer of at least 1.`);
         }
     }
     return gate;
@@ -1056,8 +1015,8 @@ function parseRetry(ctx, raw, path, stepLabel) {
     }
     checkUnknownKeys(ctx, raw, path, RETRY_KEYS, `${stepLabel} "retry"`);
     let ok = true;
-    if (!(typeof raw.max === "number" && Number.isInteger(raw.max) && raw.max >= 0 && raw.max <= WORKFLOW_MAX_RETRIES)) {
-        ctx.err([...path, "max"], `${stepLabel} "retry.max" is required and must be an integer from 0 through ${WORKFLOW_MAX_RETRIES}.`);
+    if (!(typeof raw.max === "number" && Number.isInteger(raw.max) && raw.max >= 0)) {
+        ctx.err([...path, "max"], `${stepLabel} "retry.max" is required and must be a non-negative integer.`);
         ok = false;
     }
     const on = [];

package/dist/workflows/renderer.js

@@ -87,9 +87,8 @@ function projectParameters(sourceIr) {
  * visible in the workflow file `show` is rendering, and (b) pointless to clip:
  * the whole finding this projection answers is `show` describing something
  * other than what runs, and a truncated argv is that same bug in miniature.
- * The parser bounds it anyway (`WORKFLOW_MAX_EXEC_ARGV` entries of
- * `WORKFLOW_MAX_EXEC_ARG_BYTES`), and it is far smaller than the step
- * `instructions` this same projection already carries whole.
+ * It is far smaller than the step `instructions` this same projection
+ * already carries whole.
  */
 function summarizeStepOrchestration(step, defaults) {
     const unit = step.unit;

package/dist/workflows/resource-limits.js

@@ -4,22 +4,12 @@
 import { EXECUTION_MAX_TIMEOUT_MS } from "../execution/limits.js";
 export const WORKFLOW_MAX_PLAN_BYTES = 2 * 1024 * 1024;
 export const WORKFLOW_MAX_SOURCE_BYTES = 1024 * 1024;
-export const WORKFLOW_MAX_STEPS = 256;
-export const WORKFLOW_MAX_ENGINES = 64;
-export const WORKFLOW_MAX_PARAMS = 128;
-export const WORKFLOW_MAX_ROUTE_BRANCHES = 256;
 export const WORKFLOW_MAX_INSTRUCTION_BYTES = 256 * 1024;
 export const WORKFLOW_MAX_SCHEMA_BYTES = 256 * 1024;
 export const WORKFLOW_MAX_EXTRA_PARAMS_BYTES = 64 * 1024;
-export const WORKFLOW_MAX_JSON_DEPTH = 64;
-export const WORKFLOW_MAX_MAP_EXPANSION = 10_000;
-/** Max declared `inputs:` reference strings on one unit/map step. */
-export const WORKFLOW_MAX_INPUTS = 64;
-/** Max declared `outputs:` entries on one workflow document (P3b, spec §4.1). */
-export const WORKFLOW_MAX_OUTPUTS = 64;
 // ── Dispatch-significant bounds shared across validation layers ──────────────
 //
-// Defined ONCE here so the three enforcement layers cannot drift:
+// Defined ONCE here so the enforcement layers cannot drift:
 //   1. the parser (`../parser.ts`) — line-anchored authoring-time errors,
 //   2. the published JSON Schema (`schemas/akm-workflow.json`) — mirrored
 //      `maximum`/`pattern`/`maxLength` values, pinned against these constants
@@ -31,33 +21,12 @@ export const WORKFLOW_MAX_OUTPUTS = 64;
 // `workflow create` already said the document was fine.
 /** Max per-step map fan-out concurrency (also the run-level concurrency ceiling). */
 export const WORKFLOW_MAX_CONCURRENCY = 64;
-/** Max evaluator-optimizer gate loops per step. */
-export const WORKFLOW_MAX_GATE_LOOPS = 100;
-/** Max retry attempts per unit. */
-export const WORKFLOW_MAX_RETRIES = 100;
 /** Max timeout in milliseconds (setTimeout's 32-bit signed ceiling: 2^31-1, ~24.8 days). */
 export const WORKFLOW_MAX_TIMEOUT_MS = EXECUTION_MAX_TIMEOUT_MS;
 /** Engine names: lowercase dash-separated runs of letters/digits, starting with a letter. */
 export const WORKFLOW_ENGINE_NAME_PATTERN = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
 export const WORKFLOW_MAX_ENGINE_NAME_LENGTH = 63;
 // ── exec (shell) unit bounds ─────────────────────────────────────────────────
-/**
- * Max entries in an exec unit's `command:` argv array. Generous for a real
- * command line, small enough that a corrupted plan cannot ask the OS to spawn
- * a megabyte of arguments.
- */
-export const WORKFLOW_MAX_EXEC_ARGV = 64;
-/** Max UTF-8 bytes of ONE argv entry (well under every platform's ARG_MAX per-arg limit). */
-export const WORKFLOW_MAX_EXEC_ARG_BYTES = 4096;
-/** Max characters of an exec unit's relative `cwd:`. */
-export const WORKFLOW_MAX_EXEC_CWD_LENGTH = 1024;
-/**
- * Max entries in an exec unit's `pass_env:` list.
- *
- * `pass_env` is bounded; use explicit named `env:` bindings for a larger set.
- * New v4 starts do not offer whole-process inheritance.
- */
-export const WORKFLOW_MAX_EXEC_PASS_ENV = 32;
 /**
  * Grammar for an env var NAME in `pass_env:`. Matches the frozen-plan
  * `envPassthrough` grammar in `ir/schema.ts` so both allowlist surfaces accept
@@ -86,8 +55,7 @@ export const DEFAULT_EXEC_TIMEOUT_MS = 600_000;
  * ten minutes to do so. What the cap buys is a BOUND where there was none: the
  * retained prefix is promoted into the unit's outcome text and every outcome is
  * held until the step reduces, so the worst case is (units in the STEP × this
- * cap) rather than unbounded — the step's width, not the in-flight width, is
- * what sizes it, up to {@link WORKFLOW_MAX_MAP_EXPANSION}.
+ * cap) — the step's width, not the in-flight width, is what sizes it.
  *
  * On reaching the cap the reader switches to DRAIN-AND-DISCARD: it keeps
  * pulling from the pipe (so the child never blocks on backpressure) and stops
@@ -180,11 +148,10 @@ export function clip(text, max) {
  *
  * The promoted step artifact (`evidence.output`) is deliberately NOT clipped
  * when it is built — gates judge the full artifact and downstream
- * `steps.<id>.output` references need it intact — but a `collect`
- * reducer over a fan-out bounded only by {@link WORKFLOW_MAX_MAP_EXPANSION}
- * (10 000 units, each contributing up to a full unit result) would otherwise
- * write an unbounded blob into a single SQLite row. Persistence is therefore
- * bounded here, at the write boundary, by
+ * `steps.<id>.output` references need it intact — but a `collect` reducer
+ * over an unbounded fan-out (each unit contributing up to a full unit
+ * result) would otherwise write an unbounded blob into a single SQLite row.
+ * Persistence is therefore bounded here, at the write boundary, by
  * `clipStepEvidenceForPersistence` (`runtime/runs.ts`), which replaces
  * oversized values with an explicitly-marked truncation envelope rather than
  * silently shortening them.
@@ -213,8 +180,11 @@ export function jsonBytes(value) {
 // (`src/workflows/ir/schema-v4.ts`'s recursive `decodeChildWorkflowTarget`).
 // Full design history, including the rejected alternative for the byte cap:
 // docs/architecture/decisions/0007-workflow-composition-bounds.md.
-/** Max workflow composition depth (root = depth 0; a 9th descendant level fails). */
-export const WORKFLOW_MAX_COMPOSITION_DEPTH = 8;
+//
+// Composition DEPTH is unbounded — `assertNoCompositionCycle` (freeze/targets/
+// child-workflow.ts) already makes infinite composition mathematically
+// impossible, so a depth ceiling on top of it only bounded how many
+// legitimately distinct workflows an author could nest.
 /**
  * Max AGGREGATE canonical-JSON bytes of every embedded child plan in ONE root
  * freeze (the sum across the whole composition tree, not per child).