Autopsy / AUT-2026-08
on £4,472.62 spend over 30 days (29 Jul – 27 Aug) · 18.3% of monthly run rate · 4 counted findings, ranked by confidence × value.
Daily spend across the report window; the amber band is the spend flowing through the key–model pairs the counted findings identify.
Findings
ranked by confidence × value · headline sums HIGH and MED onlyFrontier-tier spend where a mid-tier sibling exists at a large price delta. Short-output workloads (classification, extraction, routing) rarely need the frontier model.
Assumes 40% of the workload migrates after eval parity is confirmed on your own data. The price delta is computed from the observed input and output token mix.
| Key | Model | Alternative | Spend (window) | Price delta | Workload shape | Saving (window) |
|---|---|---|---|---|---|---|
| evals-nightly | gpt-4.1 | → gpt-4.1-mini | £613.06 | 80% | mixed | £196.18 |
| mk-tern | gpt-4.1 | → gpt-4.1-mini | £371.55 | 80% | short outputs | £118.90 |
| mk-corvid | gpt-4.1 | → gpt-4.1-mini | £281.61 | 80% | mixed | £90.12 |
- Run your evals for the short-output tasks on the mid-tier model.
- Route classification and extraction traffic to it behind a flag.
- Keep the frontier model for the calls that actually earn it.
Same-day spikes above 5× the hourly baseline on a single key, the signature of a retry loop or runaway job burning at full price.
Assumes 80% of spike spend is recoverable with idempotency keys and bounded retries. At least one key has fewer than 24 hourly data points, so its baseline rests on a thin sample — graded MED rather than HIGH for that reason.
| Key | Spike days | Spike hours | Hourly baseline | Excess (window) | Saving (window) |
|---|---|---|---|---|---|
| evals-nightly | 2026-08-14 | 5 | £6.59 | £256.90 | £205.52 |
- Add idempotency keys so retried work is deduplicated, not re-billed.
- Bound retries: exponential backoff, max 3 attempts, then dead-letter.
- Set an anomaly alert. Ratelytics fires within two hours of onset.
2 high-volume key–model pairs ran the whole window with zero cached input tokens on cache-capable models. Repeated system prompts are billed at full input rate on every call.
Net of the cache WRITE premium: writes are billed at 1.25× the input rate, and 25% of adopted input is assumed to be writes rather than reads — one write for every three reads. Write frequency depends on how often calls fall inside the cache TTL, which daily-granularity usage records cannot show, so it is assumed rather than measured and the finding shrinks if the real ratio is worse. Adoption assumed at 60% of eligible input tokens.
| Key | Model | Input tokens | Input cost | Cache discount | Saving (window) |
|---|---|---|---|---|---|
| mk-substrate | claude-sonnet-4 | 132.6M | £292.40 | 61% | £107.46 |
| prod-api | claude-sonnet-4 | 94.1M | £207.50 | 61% | £76.26 |
- Mark the static prompt prefix cacheable (system prompt, tools, few-shot examples).
- Move volatile fields after the cache point.
- Verify cached % climbs above 40% in the Ledger's By model table.
2 key–model pairs cache but reads back under 20% of input from cache. The mechanism is already wired up; this is a tuning problem, not an adoption one.
Assumes a 60% hit rate is reachable, which holds when the prefix is genuinely stable and requests fall inside the cache window. The net discount is already reduced by the cache WRITE premium. Where the prefix changes every call, no hit rate fixes it and this finding does not apply.
| Key | Model | Hit rate now | Target | Input cost | Saving (window) |
|---|---|---|---|---|---|
| mk-corvid | gpt-4.1-mini | 20% | 60% | £68.17 | £13.63 |
| mk-northgate | gpt-4.1-mini | 20% | 60% | £54.38 | £10.88 |
- Check the cache breakpoint sits AFTER everything that varies per request.
- Confirm requests arrive inside the cache TTL; a long gap expires the entry.
- Watch cached % in the Ledger's By model table.
£580.11 of window spend lands between 00:00 and 06:00 workspace-local on non-batch usage. If nothing should run at night, something is running anyway.
Review item: night work can be legitimate (batch jobs, global users).
| Key | Model | Night spend (window) | Share of key's spend |
|---|---|---|---|
| evals-nightly | gpt-4.1 | £580.11 | 67% |
- Identify each key's night workload: cron, agent loop, or forgotten script.
- Kill what should not exist; batch what should.
Methodology: 30 days of provider usage APIs, priced at your rates. The headline sums HIGH and MED findings only; LOW sits under “Possible, verify first”. Reproducible: every figure recomputes from its evidence table.