Spanfold demo · Spend Guard

It's 2 a.m. The booking agent is stuck in a loop.
Watch the guard stop the bill.

The Website Assistant's booking agent tries to book a physio slot. At 01:58 the calendar starts timing out and the agent keeps retrying. Every Spanfold build runs inside this harness: it stops the spend at a cap, keeps the customer served, and lets a manager decide from their phone.

  • Real model callsReal token counts at real list prices, capped at about 2 cents a run.
  • Every step in a ledgerOne hash-chained row per stage, written beside the stage that wrote it.
  • No customer sees an errorThey get a polite fallback while the manager decides.

The incident, live

Clinic time 01:58:00 01:5802:05
This run has cost $0.0000 Run cap —× a normal booking
Status Ready Checking whether a live run is available…

Control panelYou are the ops lead on call tonight.

Pause works at any moment: before the start, mid-run or after the stop. It takes effect at the next stage.

    What the customer saw

    Harbourline Physio · booking chat
    1. The chat appears here when the run starts.

    The customer never sees an error. While the calendar is down they get a promise and a way to be called back.

    The 2 a.m. alert

    01:58
    Wednesday 28 October
    No alerts. The agent is handling the night shift.

    Email me this alert

    Sent from demo@spanfold.com with one-tap links for options A, B and D.

    Available once the alert has fired.

    Side by side

    The same agent, the same outage, with and without the guard

    The unguarded run isn't burned live: it was run once with a higher safety cap and recorded. Its numbers are real.

    Recorded real run

    Without the guard

    Cost
    —
    Identical attempts
    —
    Model calls
    —
    Clinic time burned
    —

    The customer got—

    This run

    With the guard

    Cost
    —
    Identical attempts
    —
    Model calls
    —
    Clinic time to stop
    —

    The customer got—

    Cost over clinic time, both runs on the same scale

    Start the incident above to fill in the guarded side.

    At 9 a.m.

    The morning report

    One page, in business language. This is what an owner forwards to the board.

    The report is written when the run stops. Start the incident above.

    The product side

    One gateway for all your agents

    Agents point their base URL at Spend Guard instead of the model vendor. Keys stay on the server; every call is metered, checked against its agent's and team's daily budget, and lands here.

    // your agent, unchanged except one line
base_url = "https://guard.spanfold.com/v1"
headers  = { "x-spanfold-agent": "booking-agent",
             "x-spanfold-team":  "clinic",
             "x-spanfold-task":  "booking" }

    How well it works

    Replayed against three recorded runs

    Loading the evaluation…

    Known limits

    • The calendar outage is simulated (an 8-second timeout injected on purpose). The model calls, token counts and prices are real.
    • Pause takes effect at the next stage, so a model call already in flight finishes first.
    • When there is no live budget left today, the page replays the recorded real run and says so.
    • The slow cost-drift case was missed by the per-run cap and the drift rule (see above). Only the cap and loop warning run live.
    • One customer chat per run. We don't invent traffic.

    The earlier scripted simulation is still available.