This week we gave our own automation something it never had: a bill it can't quietly ignore. We shipped two counterpart cost watchers — a hard cap on what our automated lanes spend calling Claude, and a separate watch over what GitHub and our infrastructure actually charge us — then, the same morning, removed a fallback credential that could only ever fail.
Six of our automated lanes already run headless Claude sessions, and every step toward more autonomy adds another. That's the one cost line that scales exactly with the thing we're building, and until this week nothing metered it, capped it, or said a word when it grew. So we built a meter: one Redis counter per UTC day, the same shape as an existing per-day send cap we already trusted elsewhere. Cross a soft band and the run is reported. Cross a hard cap and it's denied outright, with an exit code distinct from a genuine failure — because a capped run isn't a broken one, it's a run that did exactly what it was told to stop doing.
Our safety kill switch is an authority control: if it can't be read, it halts everything, because letting an ungated agent run on ambiguous state is the worse failure. The inference meter is deliberately built the opposite way, and we wrote the reasoning directly into the module so nobody tidies the two into matching later. If the meter itself goes dark — a Redis blip, nothing more — treating that as a halt would take down working lanes like our morning digest, PR review, and the Telegram agent over an availability problem in the safety mechanism, not the automation it's watching. So a blind meter still lets the run through, and still raises a loud alert, because spend underneath is already bounded by caps on each individual lane. Failing open here is not looser. It's aimed at a different failure mode than the kill switch is.
Metering what we spend on inference only covers one side of the ledger. The other side is what GitHub and our infrastructure providers actually charge, and nothing was watching that either — until a billing surprise on Actions consumption a few weeks back made the gap obvious. The new watch reads GitHub's org billing usage, rolled up by product, and compares bands against net cost — the real money — while still reporting gross, because gross crossing the included allowance is the leading indicator that precedes net moving at all. A pure net-only check stays quiet right up until the bill actually lands.
Building it against the live API instead of memory mattered immediately: the billing endpoint we'd have guessed from training data, `/orgs/{org}/settings/billing/actions`, now returns HTTP 410 — moved to `/organizations/{org}/settings/billing/usage`. Run against the real org, the numbers were more useful than we expected: the prior month's allowance had already been fully used, and the current month's gross usage sits right at that same boundary, meaning the next increase is the one that starts costing real money.
An unmetered cost that scales with autonomy is how an autonomy programme dies — not from a bad merge, from a bill.
The billing watch shipped with a fallback: if the dedicated token wasn't set, it would try an existing cross-repo credential instead. This morning the founder confirmed that token carries no billing scope at all — the fallback could only ever return a permission error. Removing it wasn't just tidying dead code. That credential is write-capable across repos, and routing it to a billing endpoint it could never use widened its exposure for zero chance of it working. Now, with no token set, the section renders a plain, visible UNREADABLE instead of quietly trying and failing — and the reasoning is written at the module, the workflow, and the registry, specifically so a future "helpful" fallback doesn't get reintroduced.
Both watchers are merged and scheduled. The inference meter is wired into one reference lane today, with five more still to connect before its count reflects the full picture; its dollar thresholds are a starting guess, to be tuned once a week of real data exists. The platform-spend watch runs weekly already, but still shows UNREADABLE until a purpose-scoped, read-only token gets minted — a small, deliberate gap left open rather than papered over with a credential that was never going to work.
This post was drafted by an AI system from Dekimu's public engineering record and published with automated checks, without per-post human editing.
← Back to blog