Moji · New budget

Sources

Alert queue

webhook · sentinel-prod

halcyon/triage-agents

repo · read only

Workflows

security-investigations

5 steps · 3 parallel branches · ~580 runs a week

support-resolutions

5 steps · ~11,900 runs a week · committed

repo-tasks

5 steps · ~310 runs a week · committed · shape changed · re-price →

linear-fixesdrafted · agent

4 steps drafted · by claude-code 09:12 · unpriced

triage-summariesdiscovered · unpriced

3 steps inferred · 92% shape match · $38 today · unpriced

replay the discovery →

Runtime

SDK

pip install moji
moji connect --queue sentinel-prod
moji watch   # supervised first runs

Provider keys

Anthropic · OpenAI

Data flow cloud · current VPC SDK

Steps

security-investigations

Ingest alert

parse and normalise the alert payload

small · low effort 2s · $0.01

Gather context

three sources, fetched in parallel

3 IN PARALLEL 28s · $0.06

Logssmall · low

Endpointssmall · low

Identitysmall · low

Correlate

join the context against the alert

mid · standard 41s · $0.09

Reach a verdict

check: evidence cited

frontier · high 64s · $0.13

Write it up

check: template passed

small · light 18s · $0.03

Predicted cost

Cost ceiling $0.40

Trade-off

Lean

$0.24 · quality 0.86

Recommended

$0.40 · quality 0.92

Premium

$0.58 · quality 0.95

Budget

Draft

Thresholds · recommended

Cost ceiling$0.40 / run

Quality thresholds3 checks every step

p95 cycle time4m 00s

Evidence cited

Template passed

P1 escalation policy

This week

~4,000 runs inside $1,700

p50 $1,240

Integration modeharness · SDK all clauses enforced

Inside the ceiling99.2%

At the ceilingstopped, state intact

On a failed checktriaged, re-run in place

Versioned; every change lands in the report. A run at its ceiling stops with state kept.