Production guards

The guardrails that make unattended runs safe to walk away from.

Run budget kill-switch

/set max_run_tokens 200000

Checked before every LLM call. Crossing the cap pauses the run cleanly - state stays resumable, nothing committed is lost, and the dashboard shows tokens / budget the whole time. Run again (or raise the cap) to continue.

By default (cost_mode: budget) the budget auto-scales with unit count (budget_tokens_per_unit × units + overhead) so a full piece finishes rather than pausing mid-run, and the spend-heavy judgment nodes are flash-routed to target ≤100k tokens per article. An explicit max_run_tokens is always the hard ceiling and overrides the auto-scaled budget. See Cost & performance.

Model-call resilience

Per-call hardening so one flaky response degrades instead of killing an unattended run:

• Truncation recovery - a reasoning model can spend its whole budget thinking and come back empty / cut off with finish_reason=length; structured calls raise max_tokens and retry the same model rather than wasting retries and degrading to a weaker one.
• Model fallback - after a node’s primary model exhausts its retries (outage, 5xx, content filter), the call retries once on the global fallback: slug (default DeepSeek V4 Flash).
• Context-overflow recovery - an over-long prompt is shrunk and retried once instead of failing.
• Repair retry - invalid structured output is re-requested with the model shown its own error.

See Model routing → Call resilience.

Telemetry & /dashboard

Every LLM call appends one JSONL record - timestamp, run, project, unit (ch03/sec02/production), kind, model, latency, attempts, tokens, real USD cost, and the error string for failed calls - under .index/telemetry/. Best-effort by design: observability can never take down a run.

/dashboard                 # totals + per-model + recent runs
/dashboard <project>       # per-chapter/section breakdown

Rows with project - are calls made outside a run (chat, one-off commands). An error means a call that failed after all retries.

Prompt-injection defense

All web-fetched text - search snippets, deep-research page text, the interview’s quick peek - is fenced before entering any prompt: data-only markers, neutralization of spoofed markers inside the content, and a standing data-not-instructions notice.

Fetch safety

The deep researcher’s fetcher enforces an SSRF guard, robots.txt, and per-host rate-limiting on every uncached fetch.

Durable state

• Every brain write is atomic (temp file + rename); a corrupt run_state.json reads as empty rather than crashing resume.
• Resume guards skip already-committed units - no double-commits, no duplicated canon facts, ever.
• The chat assistant cannot auto-execute delete / write / /user, project ids are path-validated, deletes are confined to the brain directory, and exported HTML is sanitized.

Chat safety

A chat-proposed project only gets created on your explicit go-ahead - the shell verifies your own message was a confirmation (“go ahead”, “run it”) before executing a chat-emitted new. Model enthusiasm can’t spend your money.