Proxyd budget.yaml + CLI route banners

Leave an agent running overnight and it will spend your money with the patience of a machine that never sleeps. No coffee break, no second thoughts, no glance at the meter. Mundi, who tracks the haus finances, would like a word — and this file is that word, written down so nobody has to have the conversation at 3am.

The live proxyd on manoir (:4040) is a Rust binary. Operator knobs live in YAML so you never recompile to change the daily cap or a model rate — you edit a line, and the gauge reads differently within a second.

Files

The policy is spread across two YAML files you edit by hand and three Rust files you don’t.

Path	Role
~/.sanctum/sanctum-proxy/budget.yaml	Live policy (hot-reloaded)
~/.sanctum/sanctum-proxy/config.yaml	Models + fallback chains
services/sanctum-proxy/src/budget_policy.rs	Loader + pricing + sanctum seat filter
services/sanctum-proxy/src/proxy.rs	Green ROUTE / red DEGRADED banners
services/sanctum-proxy/src/transform.rs	fit_context_to_budget for cathedral ~32k

Override path: SANCTUM_PROXY_BUDGET=/path/to/budget.yaml.

Claude CLI pool (USD/day)

The Claude CLI is the one agent that can spend real metered money, so it gets its own leash:

• Agent id: claude-code (from User-Agent: claude-code…)
• One shared USD/day across every seat that CLI can land on (Fable, Opus, glm-52, …)
• Max / Gemini free / local charge $0 when free-path flags are on
• Token soft-breaker off for CLI (token_circuit.enabled: false) — USD only
• At cap: metered seats dropped → local only
• Live / intended default: daily_cap_usd: 50.0 (a temporary $150 raise during Max weekly limit was reverted)

Edit live:

claude_cli:
  daily_cap_usd: 50.0
  token_circuit:
    enabled: false

proxyd logs budget policy hot-reloaded … claude_cli_cap_usd=… within ~1s. No restart. The needle moves; nothing gets rebuilt.

Free-sub-first fallbacks (config.yaml)

Hitting the cap should not mean the night ends. It means the night gets cheaper. CLI-facing Opus/Fable chains prefer subscription bridges before metered glm-52:

claude-cli-offline (Max :3456) → gemini-3-pro → grok-oauth → glm-52 → council-local-think

So a capped agentic night lands on free subs first, not the cathedral 27B. The Temple of the Kyber is the blackout tail only — the last thing standing when every paid seat is dark. How the turn survives that handoff is its own story, told in fallback continuity.

Sanctum haus agents

Everyone not in claude_cli.agents is sanctum by default — the family agents, who never get a metered wallet at all:

• Metered OpenRouter stripped
• Subscription bridges + local only (only_subscription_and_local: true)
• OpenRouter *:free still allowed if allow_openrouter_free: true

iTerm2 banners (one line)

proxyd narrates its own decisions in a single coloured line, so you learn what happened without reading a log:

Color	Meaning
Green (\x1b[32m)	Route diversion — healthy ops notice
Red (\x1b[91m)	Context truncated — quality DEGRADED

Examples:

[sanctum-proxy] ROUTE claude-fable-5 → glm-52 (openrouter · z-ai/glm-5.2) · via [claude-fable-5✗…]
[sanctum-proxy] ⚠ DEGRADED CONTEXT · 136000→27500 tok (cap 28000) · actions=[drop-middle-history+…] · double-check facts

Green is the proxy telling you it rerouted and everything is fine. Red is the proxy telling you it had to cut something, and you should not fully trust what comes back.

Local context fit (the oversized-session hack)

Cathedral operational cap is ~32k. When a local / mTLS seat would 413, proxyd trims the session in five escalating steps rather than refusing the turn outright:

1. Drops middle history
2. Squashes huge tool_result payloads
3. Hard-tail keep
4. Nuclear tail (last 2) if needed
5. Re-estimates (double-check); sets still_over if still above cap

Tune:

local_context:
  enabled: true
  max_prompt_tokens: 28000

Pricing table

pricing.models / pricing.providers — USD per 1M tokens. Lookup: seat name → api_model → provider default. This is the rate card clipped to the gauge; change a number here and every future turn is billed against it.

Ops checks

To confirm the leash is set where you think it is:

curl -sk --cacert ~/.sanctum/certs/ca.crt https://127.0.0.1:4040/stats | jq .agents
# claude-code.cap_usd should be 50

bash ~/Projects/sanctum-rs/services/sanctum-proxy/test_e2e_budget_route.sh

Caution

Red DEGRADED means history was cut. The answer can still complete, but facts from dropped turns may be missing — treat as best-effort local, not full-session Claude.

That is the whole bargain this file strikes: spend freely up to $50, then spend nothing, and never let a long night quietly become an expensive one.