Stale session id sent a review agent to audit the wrong subsystem for $1.35

coding-os · reddit · 2026-09-14

A post-mortem of a cross-model review agent setup: when a task enters testing, a hook dispatches a reviewer and security auditor on a different provider than the session's own, on the theory that a different model covers independent blind spots. Four runs cost $2.85 total — but one agent audited the wrong subsystem, wasting $1.35.

Root cause analysis:

The prompt builder loads prior evidence by session id. That id dated back to May 27 and never rotated across three months of resumes and compactions; two different panels carried the identical id, so every task ever stamped with it — including an archived July task — counted as current context.
Three of four agents reconciled conflicting task identifiers; the fourth didn't, took the wrong one, and audited a graph subsystem for what was a single test file.

Second finding: the findings never reach the parent agent. It only sees a status line (reviewer@codex/gpt-5.6=ok$0.92); the 50KB of review text sits unread in a database row. The author asks how others scope reviewer context and route findings back.

Original post →

Stale session id sent a review agent to audit the wrong subsystem for $1.35

More from coding & agent