The Constraint Atlas
The limits we measure, and what moves them
Short answer: a living registry of hard limits on what builders can do, from how slowly security fixes reach your code to what compute and AI cost. Each entry has the evidence, what would move it, the experiment we are running, measured progress, and what you can do today. Every number links to its source. Agents can read all of it at /data/v1/atlas.json.
A limit is not a fact of nature until someone has tried to move it. We track 3 so far and add more as we pull the data.
Software supply chain · status: measuring
Security fixes take weeks to reach the code that needs them
The limit: A fixed version on crates.io protects nobody until it is in each project's Cargo.lock. When the fix only ships in a new major version, cargo update cannot reach it at all.
Headline number: 17 days after the first zip crate advisory, 16.4% of zip downloads were a patched version.
AI compute · status: measuring
The same AI job can cost 1,500 times more depending on the model you pick
The limit: What builders can afford to automate is capped by price per token, and most teams pay far more than the cheapest model that does the job.
Headline number: Across 71 models we track, output prices run from $0.40 to $600 per million tokens.
AI compute · status: measuring
Renting a top GPU costs half as much from the cheapest cloud as from the typical one
The limit: Training and serving your own models is capped by GPU rental prices, and the spread between clouds is wide and moves daily.
Headline number: The cheapest H100 offer fell from $1.99 to $1.39 an hour between Oct 24 and Oct 26; the median stayed at $3.99.
Art: Nicholas Roerich, Himalayas, Sikkim (c. 1928-29). Public domain, via Wikimedia Commons.
