Triage agent costs ~$1.78/business day on the shared Anthropic key — move it to subscription auth

[rafaelgiln]

What was measured

An Anthropic Console usage breakdown for 2026-08-07 showed 2,885,814 tokens on claude-sonnet-5 — 98.5% of the day's 2,928,587 total. The key is configured in .env and as secrets.ANTHROPIC_API_KEY, and is used only by this repo, so the question was where the volume came from.

It came from one run.

Fact	Value
Anthropic agent runs that day	1 — triage-dispatch.yml job Propose triage plan, run 31165533824
Result envelope	num_turns: 28, duration_ms: 443332, total_cost_usd: 1.7802987
Model	claude-sonnet-5, pinned at triage-dispatch.yml:119 / :152 (#1178)
Spec-side provider tokens, same period	8,741 for a whole daily (reports/token-history.jsonl), and on gpt-4o-mini / gemini-flash-latest — not Anthropic

$1.78 is consistent with ~2.9M tokens under the Sonnet introductory band once cache reads dominate, which is what 28 turns re-reading CI logs produces.

Two corroborations that this is the whole story:

• claude-haiku-4-5 at 41,551 tokens is the spec suite (local .env points at Anthropic/haiku while the OpenAI key is drained) — three orders of magnitude below the agent.
• claude-opus-5 at 862 tokens proves local Claude Code is not billing this key. If it were, that line would be the largest one on the chart.

This is a fresh, larger data point for axis A of #1183 (the triage agent measured at ~10x the entire spec suite): the historical mean was ~$1.05/run, this one was $1.78.

Why it recurs

propose auto-fires on every red scheduled daily, and the daily is red on essentially every business day — 9 agent runs across the 9 business days from 07-24 to 08-07. So the standing cost is $1.78 per business day ($37/month), and it steps up ~50% on 2026-09-01 when the Sonnet introductory band expires, with no change in consumption.

Decision

Switch both agent jobs from anthropic_api_key to claude_code_oauth_token, the action's documented alternative (anthropics/claude-code-action@v1, action.yml):

claude_code_oauth_token:
  description: "Claude Code OAuth token (alternative to anthropic_api_key)"

The job then draws on an already-paid Claude Code subscription. Marginal dollar cost of the triage agent becomes zero.

Two alternatives considered and not taken:

• Drop the CI agent, run /langflow-e2e-triage locally. Also $0, but it loses the property the propose phase exists for — the plan is already commented on the umbrella when someone opens the day.
• Keep the API key and cut consumption (gate the trigger on a changed failure signature; truncate what the agent reads; A/B haiku). Reduces, does not zero, and triage-dispatch: the agent pays full price to triage a daily that produced zero results, on an unpinned Opus #1178 is explicit that a cheaper model must be validated rather than assumed.

What this costs instead

Not free — relocated, and each of these is a real trade:

1. The run consumes the subscription's rate-limit window, shared with interactive sessions. The daily fires ~09:20 BRT and the measured run was 2.9M tokens.
2. The spend leaves the Console dashboard. Silver lining: ANTHROPIC_API_KEY remains for the specs' provider calls only, so a future spike there is unambiguously the specs.
3. The OAuth token expires. When it does, the step fails and a red daily goes untriaged until someone notices the failed workflow run.

Required before merge

The secret does not exist yet (gh secret list shows no CLAUDE_CODE_OAUTH_TOKEN). Merging first would break both jobs.

claude setup-token
gh secret set CLAUDE_CODE_OAUTH_TOKEN --repo oriontech-me/langflow-e2e