Limits

These are the limits as Pando runs today. Many come from the Cloudflare products Pando runs on; each says why.

Pushes and files

One push: at most 64 MiB (67,108,864 bytes). That is Artifacts’ limit for one push. Pando refuses a larger push and says so; nothing of it lands. Push it in steps, oldest commits first, each under the limit.
pando init brings in a larger history by itself, in steps of about 16 MiB: older commits first, then main. A single commit over 64 MiB goes up too: its files are sent ahead of it.
One repository: at most 1 GB. That is Artifacts’ limit for one repository, so it is also the largest history pando init can bring in.
One file in a repo: at most 32 MB. That is Artifacts’ limit for one file.
pando checks the push and file limits before git sends anything, and says which limit a push is over. git push --no-verify skips the check, and the server then refuses the push.
About 2 pushes at once per repo. Artifacts takes about 2 writes at once; Pando queues the rest, so a repo takes about 5 to 10 small pushes a second. A queued push gives up after 120 seconds and git says the repo is busy: push again. Pando retries a refused push of up to 1 MiB once by itself.

Branches, diffs and merges

The branch diff skips text files over 8 MiB on either side. Files changed says “Too large to show” and links to the file.
Files changed lists at most 5,000 files, and shows at most 32 MiB of diffs in all. Past that, the later files are listed without their diff. A branch that changes more files says how many there are.
Code with more than 12,000 lines on a side shows without colour, in Files changed and in the code view. Colouring that much at once would stall scrolling.
A branch’s commit list shows its newest 250 commits.
A commit’s page shows the files it changed with the same limits as Files changed: 5,000 files, 32 MiB of diffs in all, and no diff for a text file over 8 MiB on either side. It names the branch a commit came from when the commit is one of that branch’s newest 250 commits, or its head.
A short sha in a commit’s address (7 to 39 characters) finds the commits Pando has recorded (branch heads, branches’ newest 250 commits, merges, commits with checks or sessions) and main’s newest 1,000 commits along its first parents. An older commit opens by its full sha.
Finding where a branch left main stops after 5,000 commits. Past that, the answer is too_large.
After main moves, Pando re-checks the open branches pushed in the last 7 days, at most 100, most recently pushed first. Any other branch shows “pending”, with its last known answer, for at least 30 seconds; a branch list then works out at most 25 such branches at a time.

Worktrees and shared files

A machine’s read-only main can trail the server by up to 10 seconds while merges keep landing in that repo. It moves at the first merge, then again once merges pause for 3 seconds, or every 10 seconds if they never pause.
Each worktree takes the disk space of its branch’s files, like a clone, plus its history without old file versions. Name folders after the branch (pando worktree add <repo> <branch> <folders...>) to check out only those.
A read-only main in a repo where the machine has no branch worktree is not followed live. It catches up within 5 minutes, or at once when a branch worktree is added there.
One shared file: at most 100 MB. A larger file stays on its own machine.
Every event is kept. A repository’s event log has no cap. Each event takes 0.3 to 1.3 KB, under Cloudflare’s 10 GB per Durable Object: about 8 to 30 million events per repository.

A browser session ends after 30 days without use. Each use pushes the end back.
A revoked credential, or a removed member, keeps working for up to 15 seconds. Each Cloudflare server remembers a sign-in check that long.
For up to about 15 seconds after a repository is deleted, a git request can still be answered from a Cloudflare server that cached the repository’s record. After that, git gets “this monorepo was deleted” (the server’s own words).

Your home

Your activity feed keeps 7 days, up to 1,000,000 lines. Older pages are read from each repository’s own log.
A page of activity is 1 to 200 lines (50 by default), and reads at most 20 repositories’ logs. The rest are listed as skipped.
A repository with more than 100 members is read from its own log on each page, rather than copied into each member’s feed.
A new member sees the latest 500 lines at once; older ones come from the log.
After a lost connection, the home replays up to 500 lines. Past that, the page reloads.
Counts can be behind: a repository’s line and the Needs you counts by up to 10 seconds; a membership change reaches the live feed within 60 seconds. Over 100 members, a repository’s line and counts are read when your home loads, and again when you come back to its tab; its last activity moves as its lines arrive.
Needs you covers 50 repositories and 500 rows at a time.
At most 32,768 people can have one repository open live at once. That is Cloudflare’s limit on connections to one Durable Object.
One machine reports at most 1,000 worktrees.
A repo’s first push to main counts up to 250 commits in the activity.

Profiles

The graph shows the last 12 months, from the Sunday 52 weeks back to today.
A bio is at most 160 characters; a name and a location 100; at most 4 links, each an https address of at most 2,048 characters.
Days follow the viewer’s time zone at today’s offset: up to an hour off across a daylight-saving change, and half-hour zones are rounded to the hour.
A repository’s history and a merge are counted about 10 seconds per 1,000 commits, in the background. A commit dated in the future counts on the day it landed.

Agent sessions

A piece of a session is at most 8,000,000 bytes of lines, sent one at a time: parsing a piece takes about five times its size in a Worker’s 128 MB of memory. A longer backlog goes as several pieces. A single line over that size is kept as a note that it was not kept.
A string in a session is cut at 64 KB, and an encoded run of 200 characters or more (an image, a signature) is replaced by its length. A tool call’s input and result show their first 2 KB.
A session sends at most one piece every 30 seconds, and at once after a commit names it; agents’ folders are looked at every 5 seconds.
A session is Active while it has a record from the last 30 minutes. No agent records when a session ends.
The newest 250 commits of a branch are read for Pando-Session lines; a session lists at most 500 commits, and its files come from its first 50.
A conversation is read about 2 MB of lines at a time; More reads the next.
Your own list of what is not recorded holds 200 entries; a machine reports at most 50 folders.
A person’s sessions page reads 50 at a time, across the repositories you both can open.
A repository cannot be named sessions: /<login>/sessions is a person’s sessions.

Releases

One release file: at most 100 MB (100,000,000 bytes). That is Cloudflare’s limit on one upload to a Worker on the Free and Pro plans (200 MB on Business). Larger files would need uploading in parts, which is not built.
At most 20 files per release. Pando’s number; GitHub allows 1,000.
A file’s name: letters, digits, ., _, + and -, starting with a letter or digit; at most 200 characters.
Generated notes list at most 500 merges since the previous release; more says “and N more”. Pando’s number.
Notes: at most 100,000 characters. Pando’s number.
A release’s title: at most 200 characters.
Releases list 30 a page, 100 at most. Deployments the same.
Builds of main share your CI’s minutes: every merge adds one build. On Buildkite’s free plan, all builds share about 1,000 job minutes a month.
Tags pushed while a push’s record failed are in the repository but not in Pando’s list until pushed again or named by a release.

Artifacts on a branch’s page

One artifact: at most 10 MiB in all, its document and its images together. An HTML artifact’s images are written into its page as one string (a third larger that way), and the browser holds all of it. Well under a Worker request’s 100 MB. Pando’s number.
Its document (Markdown or HTML): at most 1.5 MiB. The largest text Pando’s shared files carry live; the viewer draws the whole document at once.
At most 20 files in one artifact: a document and its images. More is a folder of assets, not a document.
At most 100 artifacts on one branch, read as one list with their comment counts. A new version of one already there is always taken.
Every version is kept. At 10 MiB each, 100 artifacts with 20 versions is 20 GB, about $0.30 a month in R2.
At most 500 threads on one version of an artifact: each is placed again in the browser every time the page draws. To be measured.
At most 100 replies in a thread. A longer talk belongs in an issue.
A comment: at most 65,536 characters, as an issue comment. Its anchor: at most 16,384 bytes and 16 extra HTML elements, Plannotator’s own limits.
At most 10 people named with @ in one comment, as an issue’s assignees.
A name: letters, digits, ., _, + and -, starting with a letter or digit; at most 200 characters, as release files. An image’s path is such names joined by /.
Deleting an artifact has no undo: every version, its bytes and its comments go at once. Any member may delete one, as anyone may merge.

Hooks

5 tries per delivery, after 10 seconds, 1 minute, 5 minutes and 30 minutes: about 36 minutes in all. Then the delivery is dead until an owner redelivers it or replays the hook.
Each try waits at most 10 seconds for an answer.
The latest 1,000 deliveries per hook are kept, with the last 10 tries of each. One replay re-sends at most 1,000 deliveries.
A payload is under about 30 KB. Its read token lasts 30 minutes.
Deliveries arrive at least once and not in order. Drop a repeat by its seq, and sort by it.
A hook never reaches a Worker on the Pando server’s own Cloudflare account through that Worker’s workers.dev address: Cloudflare refuses it. The delivery shows as 404. Hooks to any other address are not affected.

CI with Buildkite

Pando’s side:

One Buildkite API token per Pando server. Pando starts builds and reads their details with the server’s own token, so builds start only for Buildkite organizations that token can reach. A token per repository is not built yet.
One Buildkite organization per repository.
At most 40 calls to Buildkite a minute per repository. Buildkite allows 50 per token; repositories sharing one token can together reach Buildkite’s limit, and Pando then waits for it to reset.
A job’s log shows its last 1 MiB. A log over 64 MiB opens only in Buildkite.
The first 100 annotations and build files of a build (Buildkite calls the files artifacts). Download links last about 60 seconds (Buildkite’s).
30 builds a page, 100 at most.
A pipeline’s settings are read again at most every 5 minutes, and a running build’s details every 10 seconds.
Webhook bodies up to 5 MiB; a signature is good for 5 minutes.
A build’s clone token reads one repo for 24 to 25 hours, which lets Buildkite’s Retry work for a day after the push. Anyone who can see the pipeline in Buildkite can see it on a job’s Environment tab.
A status token posts checks on its one commit for 24 hours. Other hook deliveries’ read tokens last 30 minutes.
A pipeline builds each branch push and main’s merge commit at each merge, so every merge adds one build. A pipeline added before this builds pushes only; add it again to build merges.

Buildkite’s free plan, after its 30-day trial (Buildkite’s numbers, read 2026-10-03):

2,000 Linux vCPU minutes a month, on Small (2 vCPU) machines only: about 1,000 minutes of jobs.
20 vCPU at once: 10 jobs; the rest wait.
A job stops after 4 hours.
Builds and logs are kept 30 days.
5 users and 1 cluster.
15 webhooks per organization, so one Buildkite organization serves at most 15 Pando repositories.