Storage limits and rate limits

This is the reference for the ceilings the host and the manifest schema enforce. Limits are per install unless a row says otherwise. Crossing one returns an error with a code you can act on, never a silent truncation.

​

Hosted storage

The scope key is the user id for a user collection, the literal install for an install one, and the organization id for an organization one, so three owners of the same install each get their own thousand documents in a user collection. Overwriting a document frees the bytes it replaces before the 50 MB is measured.

​

Procedures

kind: "read" is retried twice when the connection fails. kind: "write" is never retried, and neither kind is retried after a timeout or an oversized answer — the window is already spent and the answer would be oversized again.

​

Rates

Counted in a fixed window, per install unless the row says otherwise: Over a rate, the call returns RATE_LIMIT_EXCEEDED with the surface and the window in the message. The data hooks cache and dedupe across mounts, so two widgets asking for the same series in the same range spend one query. An organization-scoped install has no project, so the workspace stands in for one on the two project rows. The alert ceiling refuses differently from the others: a fourth alert in a day is stored and marked rate-limited rather than answered with an error, and the owner is not told. An action run is counted when the run is created, so a run the owner rejects spends one.

​

The manifest

Every one of these is a schema rule, so breaking one fails the manifest.schema check in tappify extension doctor and again at publish.

​

The files the manifest points at

The manifest holds the path; the file itself is measured, so these report their own check ids rather than manifest.schema. The screenshots are measured only while visibility is public, by doctor and at publish alike, so a private extension learns about a wrong size on the publish that makes it public. Release notes are capped at 1,000 characters too, and that one is neither a schema rule nor a check: tappify extension publish refuses a longer --notes before it sends anything.

​

The bundle and the runtime

A redirect from a health check counts as a failure. An event subscription starts from the moment your mount subscribes, so a widget never receives the backlog of a quiet week. All four attempts of a sync are one run, and a stale metric keeps its stored points — its line is drawn dashed with the time of the last sync.

​

Limits on the assistant surfaces

How many tools, mentions, actions, skills, prompts and context providers you may declare is in the manifest table above. These are the ceilings on what each one may spend, and on how much of your text the assistant reads. The 8 KB is shared: blocks are added in the order Tappify built them, and the first one that would cross the budget is dropped along with every block after it. That is why a knowledge file with a long heading, or a context provider that returns everything it has, costs another extension its place in the turn.