Budget Guard

Every paid call is paid for before it happens.

Before any cloud call, the worst case (the input plus the maximum allowed output, at list price) is reserved against the budget. If it doesn't fit, a capable local model takes the request, or nothing runs.

See it reroute a request

Session budget

Started Nov 4 08:52 UTC

$0.00of $2.000% used

Remaining: $2.00
Paid: $0.00
Simulated (shown, not counted): $0.00

The worst-case check

Runs before every cloud request. Three outcomes, and none of them can overspend.

01The worst case fitsCloud call proceedsThe reservation is replaced by the real, provider-reported cost afterwards.
02It doesn't fit; a local model clears the barRerouted to Local AIBudget Guard reroutes the request on-device, at $0 in API fees.
03It doesn't fit; no local model clears the barBlockedNothing runs and nothing is spent. The request fails closed.

Lifetime paid spend

Protects the overall budget across sessions. Only real, provider-reported usage counts.

$0.00of $10.00 cap

Cached live responses0

Cloud execution: simulated

Portfolio Mode

Paid execution is rejected server-side, whatever a request asks for.
No provider credentials are used in Portfolio Mode, and no cloud provider client exists in the server process.
Ollama is never contacted; local models are simulated.
Budget Guard runs for real. The budget scenario sets the session spend explicitly; visitors' simulated spend is shown but never counts toward the guard.

Safeguards

Why paid testing stays inside a small budget.

Two-key live mode
Paid calls need AI_LIVE_MODE=true and DEFAULT_PROVIDER=live. Anything else serves cloud models from a simulated provider.
Worst-case reservation
Input plus max_tokens at list price must fit the remaining session and lifetime budget before a call.
Budget Guard reroute
When cloud doesn't fit, a capable local model takes the request; otherwise it is blocked.
Hard token caps
max_tokens comes from the router's estimate, capped by LIVE_MAX_OUTPUT_TOKENS.
No uncontrolled retries
SDK retries are off. The same model is never retried; at most three attempts across the pre-approved fallback chain.
Explicit confirmation
The interface asks for a second click showing the worst-case cost before any paid call.
Response cache
Identical live requests are answered from cache at $0 instead of being paid for twice.
Tests can't spend
Unit tests block network access, and providers refuse paid calls under the test runner.
LLM-as-judge off
Evaluation is heuristic by default, so scoring never adds API spend.

Spend ledger

Every charge, tagged paid or simulated.

No charges yet

Local runs never create charges. Simulated cloud runs appear here, tagged as simulated.

Safeguards

Why paid testing stays inside a small budget.

Two-key live mode

Paid calls need AI_LIVE_MODE=true and DEFAULT_PROVIDER=live. Anything else serves cloud models from a simulated provider.

Worst-case reservation

Input plus max_tokens at list price must fit the remaining session and lifetime budget before a call.

Budget Guard reroute

When cloud doesn't fit, a capable local model takes the request; otherwise it is blocked.

Hard token caps

max_tokens comes from the router's estimate, capped by LIVE_MAX_OUTPUT_TOKENS.

No uncontrolled retries

SDK retries are off. The same model is never retried; at most three attempts across the pre-approved fallback chain.

Explicit confirmation

The interface asks for a second click showing the worst-case cost before any paid call.

Response cache

Identical live requests are answered from cache at $0 instead of being paid for twice.

Tests can't spend

Unit tests block network access, and providers refuse paid calls under the test runner.

LLM-as-judge off

Evaluation is heuristic by default, so scoring never adds API spend.