​

Result budgets and provider estimates

The credential-free local gate makes no request to EvalGate. Arbitrary code in your own evals can call a provider directly; EvalGate cannot cap charges made outside its managed dispatch path. Keep the first gate deterministic.

​

Evaluation results

The candidate starts every organization at 10,000 results per UTC calendar month. Its durable admission check reserves the complete result count before paid work starts, across hosted runs, imports, shadow runs and portable executions. Concurrent requests share the same organization lock. Unknown billing or producer outcomes keep their holds; a timeout does not make reserved usage free. The cap counts results, including failures, rather than dollars. Included plan allowances still apply. Additional results cost $1 per 1,000; provider charges are separate. Existing subscriptions are not changed by this policy. Read GET /api/costs/result-budget. Administrators can change the limit in Settings → Billing, or PUT /api/costs/result-budget with monthlyResultLimit, the current expectedRevision, and a non-empty reason. The service rechecks current administrator membership and records the change in the same transaction as its audit fact. Stale approvals return a conflict. Zero stops new work. Lowering the cap does not cancel admitted work.

​

Agent top-ups

An agent can buy eval results for its own organization with a machine payment (the Machine Payments Protocol). It is a source candidate and needs a Stripe account with machine payments enabled; both calls return 503 while it is unavailable.

1. With an API key that holds admin:workspace, call POST /api/billing/agent-payments/top-ups with {"amountUsd": 5}, 25 or 100 for 5,000, 25,000 or 100,000 results. The response carries payUrl, valid for 30 minutes.
2. POST the payUrl with an MPP client. The first call returns 402 with a WWW-Authenticate: Payment challenge; the client pays with a Stripe shared payment token (card or Link) or USDC on Tempo, and retries with Authorization: Payment. A settled top-up returns 200 with a Payment-Receipt header.

The pack is credited to the organization once, as a one-time eval-result balance. Repeating the pay call returns the top-up’s state without charging again. Purchased results still count toward the monthly result cap above.

​

Judges before CI

Before scheduling a hosted judge, call POST /api/llm-judge/estimate with its organization-owned configId and caseCount. The response separates:

• the reviewed upper bound for provider charges, including criteria, stability repeats, retries and configured fallbacks;
• the maximum EvalGate result charge before included allowances;
• pricing identifiers, expiry, possible provider-call count and currently available provider budget.

Missing, expired or mismatched pricing returns a conflict and blocks paid execution. An estimate reserves no budget and authorizes no execution. Admission rechecks the current request and atomically reserves its durable provider budget. Cost alerts are notifications; they are not this hard admission control.

​

Copilot before a model call

The first send prepares a cost estimate. Review its provider upper bound and choose Approve and send. Preparation makes no model call. The approval covers one reply, all possible tool rounds and optional history compression; future proposal execution requires its own review. Automation uses the existing action endpoint: POST /api/copilot/threads/{id}/actions with preview: true, then sends the same message with an explicit finite maxProviderCostUsd. Missing approval, unknown pricing or an estimate above the approval blocks execution. The physical dispatch boundary enforces approved organization, model, bytes, call count and cumulative provider liability alongside the existing durable daily budget. TypeScript/Python generated operations and the api CLI use these same API contracts after the matching package release. No browser-only budget bypass is supported.