Operating Cost Model

This page estimates the monthly cost of running probectl itself. It is not the tenant FinOps feature in finops.md, which prices customer network egress. This is the operator's planning worksheet: compute, storage, query load, and optional remote-model RCA bursts.

The executable, offline version of this worksheet is pricing/tco-calculator.md. Its versioned input and output cover 10/100/1,000 tenants, retention/sampling/replication/query sensitivity, labor, support, migration, plan caps, and explicit unknowns.

The model is intentionally formula-first. Cloud list prices, discounts, hardware leases, and reserved capacity vary too much for one table to be universal, so the tables below use explicit unit assumptions. Swap the assumptions with your own rates before using the totals for a budget.

Unit Assumptions

Formulas:

compute_month = vcpu * vcpu_month + ram_gib * ram_gib_month
hot_storage_month = retained_hot_gib * nvme_gib_month * replicas
object_storage_month = retained_object_gib * object_gib_month * replicas
monthly_infra = compute_month + hot_storage_month + object_storage_month
host_month = monthly_infra / monitored_hosts
retention_day_delta = rows_per_second * 86,400 * bytes_per_row * replicas * storage_gib_month / 1,073,741,824
query_vcpu = query_per_second * cpu_seconds_per_query / target_cpu_utilization
rca_remote_usd = calls * ((input_tokens / 1,000,000) * input_price + (output_tokens / 1,000,000) * output_price)

Tier Run-Cost Worksheet

These rows tie to the capacity tiers in capacity.md and the receipt state in scale-gate.md. The example monthly cost is a starting infrastructure budget before backup copies, support contracts, and tenant-specific retention overrides.

Do not treat the L/XL/XXL prices as verified throughput prices until the matching scale-fullstack result rows are recorded. The worksheet is tied to those rows so the cost claim moves with the performance claim.

Retention Cost

Retention is usually the biggest variable cost because flow/eBPF rows dominate volume. Use the bytes-per-row constants from capacity.md.

At 0.10 USD/GiB-month hot storage and one replica:

Example: moving a tenant from 30 to 90 days of 10,000 flow rows/s adds roughly 60 * 10 * 4.12 = 2,472 USD/month of hot ClickHouse storage before replicas. That is why retention belongs in the tenant governance discussion, not only in a storage alarm.

For a normalized buyer comparison, the executable calculator reports:

infrastructure_per_logical_retained_tb = infrastructure / logical_retained

One logical retained TB is the compressed, sampled data volume before replicas. Hot and backup copies are costed separately, so replication cannot disappear from the denominator. Revision 1's storage prices are dated planning inputs; ingest and compression remain clearly labeled engineering assumptions until the L/XL/XXL receipts replace them.

Query Load Cost

Query load becomes dollars when it forces more CPU or shards. Measure cpu_seconds_per_query from pprof or node CPU divided by successful queries for the route class, then use:

query_vcpu = query_per_second * cpu_seconds_per_query / 0.65
query_month = query_vcpu * vcpu_month

Use 65% target CPU utilization so bursts and compaction have room.

The cost guard in fairness.md protects shared tenants from one caller turning query CPU into a platform-wide bill.

RCA And Model-Call Bursts

The default AI path is local/builtin, so remote model cost is 0 USD and no tenant data leaves the operator network. Remote models are opt-in and consent-gated; the egress behavior is documented in ai-egress.md.

When a remote model is enabled, budget for incident storms:

Formula:

remote_model_cost = calls * ((input_tokens / 1,000,000) * input_rate + (output_tokens / 1,000,000) * output_rate)

The real limiter is often not dollars but privacy and audit posture: remote RCA must pass the AI egress gate, tenant consent, redaction policy, and audit trail.

Budget Review Loop

Run this loop whenever scale rows, retention, or tenant mix changes:

1. Copy the latest verified capacity row from docs/scale-gate.md.
2. Replace the unit prices above with your current infrastructure and model rates.
3. Compute hot storage from actual row rates and retention using docs/capacity.md.
4. Compute query CPU from measured query CPU/query, not request count alone.
5. Divide by monitored hosts and tenants, then compare against your target gross margin or sovereign-operator budget.

If a budget does not work, the safest knobs are retention, tenant sharding, and query budgets. Do not solve cost by weakening tenant isolation, TLS, audit, or redaction.