security-review's 5-minute cache TTL expires between every invocation (82.2% hit vs 97% fleet) #173

New issue

Closed

opened 2026-08-15 17:14:10 +00:00 by john · 1 comment

john commented

2026-08-15 17:14:10 +00:00

Owner

Traced from the 3.x cache figures. The decline is one surface, not a fleet-wide drift.

/security-review runs on claude-opus-4-7 at xhigh: 61 invocations in the 3.x era, each a fresh ~2-minute process reviewing one commit's diff. 12.57M writes against 58.2M reads, 82.2% hit, versus 96-98% everywhere else. Cost ~$138, of which $78.57 is pure cache-write.

Excluding it, the 3.x fleet sits at 97.0%.

Surface	Writes	Reads	Hit
opus-5 sub	32.14M	844.3M	96.3%
opus-5 main	18.97M	807.6M	97.7%
opus-4-7 main (security-review)	12.57M	58.2M	82.2%
fable-5 main	10.21M	376.2M	97.4%
sonnet-5 sub	2.80M	78.9M	96.6%

The mechanism. Every subagent and one-shot write uses the 5-minute TTL (100% of them; only the main session gets 1h). Security-review invocations are a median 27 minutes apart, and zero of the 60 gaps fall under 5 minutes. The shared system+tools prefix expires before the next invocation, every single time.

Two exits: raise that surface to a 1h TTL (2x write, but converts the next cold write into a 0.1x read), or batch the reviews so consecutive invocations land inside the window.

Not reachable from config. Both the TTL selection and the model pin are compiled into the claude binary (~/.local/share/claude/versions/2.1.233): the TTL is chosen at the call site (ae==="1h"?3600000:300000) and claude-opus-4-7 is pinned in the skill's own definition. Nothing in settings.json reaches either, so this is an upstream ask rather than a local fix.

Ruled out: subagent turns are 98.8% under one minute apart, with only 0.2M tokens of writes following a >5m gap. The 5-minute TTL is not expiring mid-dispatch, it only bites across the short-session boundary.

Traced from the 3.x cache figures. The decline is one surface, not a fleet-wide drift. `/security-review` runs on `claude-opus-4-7` at `xhigh`: 61 invocations in the 3.x era, each a fresh ~2-minute process reviewing one commit's diff. 12.57M writes against 58.2M reads, 82.2% hit, versus 96-98% everywhere else. Cost ~$138, of which $78.57 is pure cache-write. Excluding it, the 3.x fleet sits at 97.0%. | Surface | Writes | Reads | Hit | |---|---|---|---| | opus-5 sub | 32.14M | 844.3M | 96.3% | | opus-5 main | 18.97M | 807.6M | 97.7% | | opus-4-7 main (security-review) | 12.57M | 58.2M | 82.2% | | fable-5 main | 10.21M | 376.2M | 97.4% | | sonnet-5 sub | 2.80M | 78.9M | 96.6% | **The mechanism.** Every subagent and one-shot write uses the 5-minute TTL (100% of them; only the main session gets 1h). Security-review invocations are a median 27 minutes apart, and zero of the 60 gaps fall under 5 minutes. The shared system+tools prefix expires before the next invocation, every single time. Two exits: raise that surface to a 1h TTL (2x write, but converts the next cold write into a 0.1x read), or batch the reviews so consecutive invocations land inside the window. **Not reachable from config.** Both the TTL selection and the model pin are compiled into the `claude` binary (`~/.local/share/claude/versions/2.1.233`): the TTL is chosen at the call site (`ae==="1h"?3600000:300000`) and `claude-opus-4-7` is pinned in the skill's own definition. Nothing in `settings.json` reaches either, so this is an upstream ask rather than a local fix. Ruled out: subagent turns are 98.8% under one minute apart, with only 0.2M tokens of writes following a >5m gap. The 5-minute TTL is not expiring mid-dispatch, it only bites across the short-session boundary.

john added this to the v3.4.1 milestone

2026-08-15 17:14:10 +00:00

john referenced this issue

2026-08-15 17:15:57 +00:00

Batch security reviews into one process: 61 invocations paid 61 cold prefixes #174

john referenced this issue

2026-08-15 17:15:58 +00:00

Retire opus-4-7 from the security-review route: previous-gen at opus-5 pricing #175

john commented

2026-08-15 17:21:34 +00:00

Author

Owner

Closing: not actionable here. The 5-minute/1-hour TTL selection is compiled into the claude binary and no settings key reaches it. #174 gets the same result by running the reviews close enough together that the prefix is still warm.

john closed this issue

2026-08-15 17:21:34 +00:00