One wrapper class around the API call, and everything downstream reads from the logs it writes.
LLMWrapper replaces the direct SDK call. Each request records model, endpoint, prompt and completion tokens, cost (from a per-model price table, where output tokens cost roughly five times input), latency, status and a prompt hash into SQLite. One line changes in the calling application.
On top of the logs: an Isolation Forest over cost, token volume and latency flags unusual calls without needing labelled examples (contamination set at 5%); Holt-Winters exponential smoothing with weekly seasonality projects daily spend 14 days ahead; and an LLM-as-judge step scores a 10% sample of responses from 1 to 10 with a cheap model, so quality is tracked at a small fraction of the cost of the traffic itself.
Decisions worth naming: P95 latency rather than the mean, because averages hide the slow tail users actually feel; SQLite rather than Postgres until there are concurrent writers; and a mock mode so the whole pipeline runs, and can be demoed, without API credits.