RateCardProof

RateCardProof binds an LLM usage log to an exact dated rate-card snapshot, recomputes every accepted call, and flags missing rates, impossible cached-token counts, duplicate calls, invalid usage, and recorded-cost mismatches.

Use the local-only browser app, CLI, JavaScript library, or GitHub Action.

Inputs

Usage JSONL contains one row per provider call:

{"call_id":"q1","case_id":"c1","arm":"model-a","model":"provider/model-a","input_tokens":1000,"cached_input_tokens":200,"output_tokens":100,"recorded_cost":0.0026}

Rate-card JSON stores prices per one million tokens:

{"currency":"USD","unit":"per_1m_tokens","effective_at":"2026-08-25","retrieved_at":"2026-08-25T00:00:00Z","source":"Provider pricing page","rates":{"provider/model-a":{"input":2,"cached_input":1,"output":8}}}

CLI

npx ratecardproof usage.jsonl --rate-card rates.json

Formats: text, json, and github. --output FILE creates a receipt without overwriting. Exit codes: 0 consistent, 1 findings, 2 input/operational error. Use --no-fail for advisory rollout.

GitHub Action

- uses: wedo911/ratecardproof@v0
  with:
    usage: eval/usage.jsonl
    rate-card: eval/rates.json

The receipt stores separate SHA-256 fingerprints for usage and rates, effective/retrieval dates, source, per-arm totals, cached-token share, and arithmetic deltas. It intentionally performs no live price lookup.

Read the method, research boundary, and security policy.

Node.js 20+, zero runtime dependencies, MIT licensed.