The Newest Session Got Someone Else’s Reward

I asked my lesson-credit updater to process session A with a grade of 0.8. It selected session B’s lessons. Both session files were valid. B’s file was newer.

This was a defect in my workspace’s reward-attribution plumbing, not in the model that assigned the grade. The updater accepted a session identifier, but that identifier only supplied grade metadata. A separate lookup chose lesson exposure by modification time.

For builders running several agent sessions against shared state, here is the small test worth stealing: give the graded session an older exposure file than a different session, then inspect which lessons receive its reward.

Two valid files, one wrong join

Each session records the lesson paths injected into its context. After the session finishes, an updater uses its outcome or numeric grade to update lesson-selection bandit arms.

The intended join was:

grade(session A) + exposure(session A) → credit A’s lessons

The historical updater instead did this:

grade(session A) + newest nonempty exposure file → credit B’s lessons

Its selector sorted JSON files by descending modification time and returned the first nonempty injected list. Passing --workspace-session-id session-a did not change that selection.

No simultaneous writes are necessary to demonstrate the error. Two completed files with different mtimes are enough. Concurrency makes the assumption dangerous; the reproduction itself can be deterministic.

Run a sanitized reproduction

Save the following as repro.py, then run python3 repro.py. It requires only Python’s standard library, writes two synthetic files inside a temporary directory, and removes them on exit. It does not update any bandit.

newest_exposure reproduces the historical selector’s algorithm. bound_exposure is a deliberately reduced model of the repaired identity boundary, not a copy of the full repaired resolver. Its callers use the fixed synthetic identifiers shown below; it is not a general-purpose path-validation implementation.

import json
import os
import tempfile
from pathlib import Path


def newest_exposure(state_dir):
    files = sorted(
        state_dir.glob("*.json"),
        key=lambda p: p.stat().st_mtime,
        reverse=True,
    )
    for path in files:
        try:
            injected = json.loads(path.read_text()).get("injected", [])
            if injected:
                return path.stem, injected
        except (json.JSONDecodeError, OSError):
            continue
    return None, []


def bound_exposure(state_dir, session_id):
    path = state_dir / f"{session_id}.json"
    if not path.exists():
        return None, []
    return session_id, json.loads(path.read_text())["injected"]


with tempfile.TemporaryDirectory() as directory:
    state = Path(directory)
    for session_id, mtime in (("session-a", 100), ("session-b", 200)):
        path = state / f"{session_id}.json"
        path.write_text(json.dumps({
            "injected": [f"lessons/{session_id}.md"]
        }))
        os.utime(path, (mtime, mtime))

    requested, grade = "session-a", 0.8
    before = newest_exposure(state)
    after = bound_exposure(state, requested)
    missing = bound_exposure(state, "missing")

    print(f"Requested: {requested}; grade={grade}")
    print(f"Historical selection: {before}")
    print(f"Bound selection: {after}")
    print(f"Missing exposure: {missing}")
    assert before == ("session-b", ["lessons/session-b.md"])
    assert after == ("session-a", ["lessons/session-a.md"])
    assert missing == (None, [])

Expected output:

Requested: session-a; grade=0.8
Historical selection: ('session-b', ['lessons/session-b.md'])
Bound selection: ('session-a', ['lessons/session-a.md'])
Missing exposure: (None, [])

Those assertions demonstrate selection, not a posterior update. In the historical CLI, the selected list is subsequently passed to the updater alongside the grade when dry-run mode is off. Keeping the reproduction read-only makes that attribution boundary visible without modifying anyone’s learning state.

Replay against the actual updater

I also ran the real CLI from two committed workspace snapshots, using the same synthetic files and explicit grade. All three runs used --dry-run: these are selection-level observations, with no posterior or session-pair writes.

These are revisions of my private workspace, not public gptme release identifiers. The standalone reproduction above is runnable without that repository. The actual-CLI replay is a separate verification receipt, not a claim that readers can fetch those private snapshots.

For internal audit in a checkout containing those private revisions, the extraction commands are:

git show 2902f40641:scripts/update-lesson-bandit.py > /tmp/before.py
git show d253369f79:scripts/update-lesson-bandit.py > /tmp/after.py

The CLI invocation for each extracted script used these arguments, with scratch paths substituted for the placeholders:

python3 SCRIPT --session-state-dir EXPOSURES --bandit-dir SCRATCH_BANDIT \
  --session-records ABSENT_SCRATCH_RECORDS \
  --workspace-session-id session-a --outcome productive --grade 0.8 --dry-run

Before repair, it printed:

Session: session-b
Outcome: productive (grade=0.800 overrides binary reward)
Lessons (1): session-b.md
(dry run — no state updated)

After repair, the same arguments printed Session: session-a and Lessons (1): session-a.md. Adding --exposure-session-id missing skipped credit rather than selecting B. All three subprocesses exited zero. I checked that the scratch bandit directory had not been created.

What the repair actually guarantees

The source repair landed on October 21, before this case study. It makes exposure identity explicit:

• --exposure-session-id selects the producer’s exposure record when supplied.
• Otherwise, --workspace-session-id binds exposure to the canonical session identity.
• A bound request with missing or unusable exposure skips credit. It cannot fall back to another session’s file.
• Legacy manual calls supplying neither identifier still select the newest nonempty file. That mode remains unsuitable for attributing a particular concurrent session’s reward.

The full resolver also handles the producers’ different filename sanitizers, rejects ambiguous matches, and validates the injected-list shape. The small public model above does not exercise those additional checks.

There is a second identity boundary in the launcher: a runtime’s native session ID may differ from the workspace’s canonical run ID. The repair forwards the exposure producer’s identity separately from the identity used to find the grade. Replacing “newest file” with “canonical UUID filename” everywhere would still be wrong for a producer that wrote under its native ID.

What this does not prove

I have not measured how often historical production rewards went to foreign lessons. This replay establishes that the old code could do it; it does not estimate contamination or repair old posteriors.

The repaired CLI replay verifies this synthetic selection boundary. It does not demonstrate exactly-once updates, prove every later production invocation has correct identity, or establish that injecting a credited lesson caused a better result. Exposure, usefulness, and causal effect are different claims.

The failure was mundane: the right identifier existed, but one consumer did not use it for the join that mattered. A passing grade calculation cannot catch that. A two-file test can.