THE TOKEN GOVERNOR

An always-on agent fleet running against a fixed subscription has one failure mode nobody plans for: burning the week's budget in a night. Not a budget in dollars — a budget in compute allocation. Frontier models are heavy. Orchestration layers spawn sub-agents. Each planning pass, each verification loop, each independent check: tokens out. Nobody meters agents by default. They spend until the resource is gone, then stop, which is the worst possible time to stop.

The naive fix — rate-limit everything — just means slower work. The actual problem is the wrong model doing the wrong job. A frontier model writing a commit message. A frontier model formatting a JSON file. A frontier model doing the work a local open-weight model could do at zero marginal cost. Every unnecessary frontier call is borrowing from the judgment work that actually needs it.

Running a fleet this way is like a startup spending runway on catered lunches: not obviously wrong in isolation, catastrophic at the margin.

The governor is not a single script — it's an economics layer the fleet runs inside. Four interacting components:

Model weights underpin all of it. The frontier tier costs roughly 3.6× the baseline. The mid tier costs roughly 0.3×. A local open-weight model costs 0 marginal tokens — just electricity, which goes untracked (more on that in the honesty section). The governor uses these weights to convert band decisions into concrete model assignments, not suggestions.

The most important design decision in the governor is what happens when an agent asks for a model tier the current band doesn't allow. The naive answer: return an error. The correct answer: downshift silently and tell the agent what it got.

An agent asking for the frontier tier in a lean band gets the mid tier and a note explaining the band. It can proceed. If it genuinely needs frontier for a judgment call, it flags the exception explicitly — the governor has a judgment-exception path that bypasses the band check for specific task classes. The exception is logged, not silently granted. A cap self-declared by the spender is not a cap.

The five TEMPO bands, in order of spend pressure:

The 5-hour window band runs orthogonally: full-speed, wind-down, local-tail. The effective band is the intersection — the more restrictive of the two wins. At 68% weekly consumed and 9% of the 5-hour window used, the fleet runs in judgment-premium: frontier available but not default, mid tier as the workhorse. That was the live snapshot when this page was being built.

The governor is fed by a usage ledger parsed from on-box session transcripts: 48,769 rows of recorded usage, attributed by agent role and model tier.

Per-agent attribution is one of the ledger's design requirements: it must name the role that burned the tokens, not just the model tier. The planner role — responsible for decomposition, verification, and adversarial checks — accounts for 11.8M output tokens. That's the cost of thinking. The ledger names its own author.

The live snapshot at fact-gathering time: 5-hour window at 9% consumed, weekly window at 68% consumed. Effective band: judgment-premium. The site's case study pages were being written in mid-band, with the mid tier as the default builder model and the frontier tier reserved for verification and judgment calls.

The governor has blind spots. The ledger reads only on-box session transcripts — usage from other surfaces (a mobile app, a web interface, anything outside the local session files) is invisible. Coverage percentage: UNKNOWN. The system could be measuring 60% of actual consumption or 90%. It cannot tell.

Weekly capacity is calibrated at a LOW-CONFIDENCE level. The bands were set from observation — watching what ran out when, adjusting thresholds accordingly — not from vendor-provided reconciliation data or a documented capacity contract. The governor is well-tuned for the workload it has seen. It is not validated against ground truth.

Local open-weight model electricity cost is untracked. The "zero marginal cost" framing is accurate for subscription metering; it is not accurate for total operating cost. The electricity draw of inference hardware running overnight is real. It goes into UNMEASURED.

The low-confidence calibration is known and documented — the fleet constitution calls it out directly. A cap self-declared by the spender is not a cap: the governor is aware of its own approximation.

The fleet runs continuously. It has not burned a weekly budget in a single night since the governor was in place. The downshift cascade means work continues during lean bands — at reduced capability, not at zero. Emergency mode produces maintenance work. Local-tail mode keeps monitoring alive. The floor is never a wall.

The spend-week anchor matters more than the band thresholds. Anchoring to the subscription's actual reset day means the fleet front-loads judgment work when the pool is fresh and defers bulk work to the tail. A calendar-week anchor would misalign the heavy window with the actual available budget by up to a week.

The ledger's per-agent attribution has compounding value: when a workload category starts consuming unexpectedly, it surfaces immediately. Not "the fleet used more tokens than expected" — but which role, which task class, which model tier. The difference between a budget problem and an optimization target.

Cross-link: THE CONDUCTOR PATTERN — how the fleet uses the governor's model weights to route frontier tokens to thinking and mid-tier tokens to typing. THE INFERENCE RIG — the local open-weight infrastructure behind the local-tail band's zero-marginal-cost floor.