Honesty rules

When in doubt, the code picks the honest zero.

Three words, kept apart

The stack is careful about three labels, and never blurs them:

• inferred — local estimate from bytes, token counters, and local records. Public offline tools emit this.
• measured — observed traffic, not proof of a saved dollar.
• verified — proof label reserved for hosted rollout systems, not emitted by local public tools.

The four rules

1 — No fake savings

Headline figures in public docs are local examples or target ranges. They stay labeled inferred, and they are not multiplied into monthly savings. Where code only supports a target range, docs show the range.

2 — Byte-safe

record mode is pass-through. On parse problems, unsupported inputs, missing recovery store, or not-smaller output, the engine and proxy keep the original bytes.

record mode        → never transforms
transform error    → forward the original bytes
result not smaller → keep the original

3 — No placeholders, fail closed

No hardcoded or stub responses on shippable paths. And unknown cases fail closed, toward the conservative answer:

unknown engine/proxy mode → record (pass-through)
low-confidence content    → text
unknown grader            → passed: false
unknown proxy route       → 404
unknown model price       → zero + an "unpriced:" tag

A grader it doesn't recognize returns passed: false. A model it can't price returns zero and a tag instead of borrowing a nearby price.

4 — Recoverable, so lossy stays honest

Engine compressors drop bytes from the model-visible payload. A lossy result is emitted only after the original is stored under a content-addressed handle. Retrieve(handle) returns the original byte-for-byte. See recoverable compression →

Why this matters

If a tool lies about savings, every downstream report and rollout decision inherits that lie. Public Caveman tools report what they can support locally and stop there.