Butler

Use the bundled runtime for local project-budget custody. Read README.md for installation and references/accounting.md before GPU work.

Resolve the user's explicit BUTLER_ROOT and project. A fresh install has no accounts, projects, reservations or usage. Do not invent a budget or scan transcripts automatically. Configure limits only from the user's authority. Registration and policy changes write state.

For a budget check, use scripts/butler.py gate --project SLUG or gpu-gate: a preview does not reserve GPU capacity. When compute launch is separately authorized, use gpu-reserve with a stable idempotency key before launch; reconcile actual terminal usage afterwards. No command here launches compute, bills a provider, changes provider authentication, or deletes provider disks. A disk-release entry is evidence recording, not cleanup.

The local Claude weighted-token proxy is not actual Codex quota. Optional cached Claude utilization is dated provider evidence, not a fresh quota query. Report unavailable evidence as unavailable. Gate results are advisory unless the actual execution path obeys them. Missing GPU limits are not a cap; verify policy explicitly. Never clear limits through --unlimited without explicit budget-owner authorization.

Use session-log for an authorized run summary and artifact paths. Keep ledgers and transcripts out of the public package. Open the dashboard only on loopback. Remote SSH collection and local process inspection are optional opt-ins, never implicit task steps.