After the fact, a trace tells you a request misbehaved; it can't tell you the request was refused, because nothing refused it. Langfuse is a strong open-source observability and prompt-evaluation platform: tracing, datasets, prompt experiments, with a real self-host option. By design it sits alongside your app and observes calls it already made — it cannot be in the request path. Wardin is a gateway first: every gateway-routed call passes through it before reaching a provider, so a budget hard-stop, a policy block, or a rate limit is enforceable in a way a downstream observer structurally cannot replicate. And every one of those decisions — allowed or blocked — is captured on the same ED25519-signed, hash-chained receipt as the evidence of it.
For the team whose main workflow is prompt engineering and evaluation, Langfuse is ahead: dataset-based experiments and collaboration workflows that have had longer to mature, and a genuine open-source, self-hostable core, which we are not. If evaluation depth is the job, it's the better fit today. What it can't become, without changing what it is, is the thing that stops the bad request — it observes the call, it was never in front of it.
Because Wardin sits in the request path, it can do the thing a downstream tool can't: refuse a call before it bills — over budget, off the allowlist, or past a rate limit — and it captures that decision, and every allowed call, in an ED25519-signed, hash-chained receipt scoped to gateway-routed traffic. It also attributes cost to a team, a key, and a session, and runs a GitHub-PR-outcome quality signal that ties accepted work back to spend. Langfuse can observe and evaluate calls after they happen, but it was never positioned to stop one or to produce a signed record.
Choose Langfuse if your priority is open-source prompt engineering and evaluation and you don't need in-path enforcement. Choose Wardin when a request has to be genuinely stoppable — a budget hard-stop or a policy violation that never reaches the provider, plus a signed receipt for every gateway-routed call. Langfuse can prove, later, that something went wrong. Wardin makes sure it doesn't — and signs proof it didn't.