Enforce Cost Contracts for Paid API Calls

A cost-discipline skill treating dollar cost as a third complexity dimension alongside time and space: every call site to a paid API must have a written "wallet invariant" - max calls per run, max dollars per run, and a matching provider-side hard cap - before code is written. Its Iron Law requires a cap enforced at both the code and provider level, since a code-only cap can be bypassed by a bug and a provider-only cap degrades the product under normal use. It documents a seven-rule discipline: a one-line cost contract per call site (max calls, max $/run computed as calls times unit cost, max $/day); a concrete integer iteration bound rather than a vague termination argument; retry paths bounded by both attempt count and total cost, with 4xx errors never retried; an explicit concurrency limit at code, queue, and provider level; a provider-side hard cap configured out of band for defense in depth, with a table of exactly where to set it for Fal.ai, Anthropic, OpenAI, Replicate, and ElevenLabs, flagging that OpenAI's per-project budgets are soft-only and need an org-level Usage Limit for a real block; idempotency keys on every mutating or charging call; and six named "amplifier" patterns forbidden by default - self-rescheduling jobs, webhook handlers that call back the API that triggered them, unbounded LLM-driven recursion, deadline-less polling, streaming reconnect storms, and cache-miss stampedes. It walks through a canonical worked incident - an Inngest function fanning out an unbounded Promise.all to Fal.ai, where a fetchPrompts bug doubled the list on every retry and produced a $200 overnight bill - showing exactly which of the seven rules would have caught it, and the fixed version with a MAX_IMAGES_PER_RUN constant, p-limit concurrency, an idempotency key, and a documented provider cap.

Use it when writing or reviewing code that calls a paid AI or inference API in a loop, queue, retry path, agent step, webhook handler, or background job; when importing SDKs like @fal-ai/*, @anthropic-ai/sdk, openai, replicate, elevenlabs, together-ai, groq-sdk, cohere-ai, or @mistralai/*; when designing an agent loop, fan-out pipeline, or self-rescheduling job that may hit a billed endpoint; or when auditing a codebase for unbounded fan-out, missing idempotency keys, or missing spend caps. It explicitly rejects "I'm only testing locally" as a reason to skip the discipline, since local code hits the same paid endpoint as production.

Input is a request to write, review, or audit code that calls a billed API. Output, before any code, is a filled cost contract - provider, unit cost, max calls, max $/run, max $/day, concurrency limit, retry policy, amplifier audit - followed by code with the contract as a comment and a concrete bound, for example:

const MAX_CALLS = 20;
for (let i = 0; i < MAX_CALLS && job.status !== 'done'; i++) {
  await fal.run(...);
}
if (job.status !== 'done') throw new Error('exceeded MAX_CALLS budget');

plus a closing self-check stating the worst-case bill and the provider cap that backstops it.

Names specific billed SDKs - Fal.ai, Anthropic, OpenAI, Replicate, ElevenLabs, Together, Groq, Cohere, Mistral - and queue/orchestration layers such as Inngest, BullMQ, Sidekiq, Cloud Tasks, and p-limit, with provider-specific instructions for setting hard spend caps. It pairs with sibling skills invariant-guard (loop termination is a precondition for a cost cap), complexity-cuts (diagnosing an already-shipped runaway bill), lemmaly (algorithm and data-structure choice before the wallet invariant), and mathguard (algorithmic cost floor for compute-bound, non-per-call billing).

Engineers and coding agents writing or reviewing any code path that calls a metered, paid API - anyone about to ship a loop, fan-out, retry, or agent step that could turn a small bug into an unbounded bill.