Budgets & the Runaway Circuit Breaker

Two ceilings, checked before the spend happens

A workspace carries a daily cost ceiling; an individual agent can carry its own monthly cap. Before an operation spends anything, assertCanSpend sums the remaining headroom across every capped agent in the workspace — an agent with no cap set is treated as having infinite headroom for that check, so an uncapped agent's spend simply isn't the thing limiting the workspace ceiling — and throws BUDGET_LIMIT_EXCEEDED outright if the requested amount would exceed what's left. This is a pre-spend gate: the check happens before the expensive call, not as a post-hoc audit after the money's already gone.

A circuit breaker that actually cancels in-flight work

Catching a runaway spend after the fact isn't enough for a genuinely stuck loop — the breaker threads an AbortSignal end to end, so tripping it doesn't just block the next call, it cancels work already in flight. Today's spend for the day is computed live from the audit trail rather than a separately-maintained running counter, which means the number shown is always derived from the same ledger everything else in governance reads from — never a second source of truth that could quietly drift out of sync.

Continue