---
name: agent-session-audit
description: Audit another agent's session behavior from screenshots, tool logs, or Gitea activity. Produce a graded report identifying good instincts, bad habits, incomplete work, and specific remediation steps. Post as a Gitea issue for the agent to learn from.
tags: [audit, review, agent-behavior, accountability, teaching]
related_skills: [gitea-board-triage, gitea-scoping-audit]
triggers:
  - audit Timmy's behavior
  - review agent session
  - what did Timmy do
  - grade the session
  - accountability review
---

# Agent Session Audit

## When to Use
- Alexander shares screenshots of another agent's Telegram/CLI session
- Alexander asks to "investigate" or "audit" agent behavior
- After a green field / unsupervised session
- When an agent produces unexpected or slow behavior

## Evidence Sources

1. **Screenshots** — use vision_analyze to read chat messages, tool calls, timing
2. **Gitea activity** — issues created, PRs merged, comments posted (check authorship)
3. **Process state** — `ps aux` on the agent's machine to see what's running
4. **Git diff** — `git diff HEAD~N --stat` to see uncommitted local changes
5. **Log files** — gateway logs, error logs, session logs
6. **Artifacts produced** — files written, reports generated, docs created

## Audit Checklist

### Behavioral Assessment
- [ ] Did the agent use tools or ask clarifying questions it could have answered itself?
- [ ] Did the agent spawn subagents for simple single-tool-call tasks?
- [ ] Did the agent read existing documentation or rediscover from scratch?
- [ ] How long did simple operations take? (grep/read should be seconds, not minutes)
- [ ] Did the agent hit context limits? How did it manage context?

### Code Hygiene
- [ ] Are there uncommitted local changes? (`git diff --stat`)
- [ ] Did the agent diverge from the Gitea repo? (applied patches locally instead of pulling)
- [ ] Were changes tested before deployment?
- [ ] Were half-finished changes left in place?

### Infrastructure Impact
- [ ] Did the agent restart production services while debugging?
- [ ] Did the agent use the correct identity tokens? (check who posted comments)
- [ ] Did the agent create Telegram token conflicts? (two processes polling same bot)
- [ ] Were any credentials exposed in tool outputs?

### Architecture Awareness
- [ ] Did the agent understand the Robing (OpenClaw + Hermes) architecture?
- [ ] Did the agent know which process handles which channel?
- [ ] Did the agent reference existing skills/docs or investigate from scratch?

## Grading Scale

| Grade | Meaning |
|-------|---------|
| A | Correct instinct, clean execution, verified result |
| B | Right direction, minor issues, mostly clean |
| C | Functional but sloppy — uncommitted code, verbose output, incomplete verification |
| D | Significant issues — half-done wiring, identity confusion, rediscovering documented answers |
| F | Actively harmful — broke production, leaked credentials, merged unreviewed code |

## Report Template

```markdown
## Ezra Audit — [Agent]'s [Session Type] (Date)

[Agent], Alexander asked me to audit your session. This is counsel, not criticism.

### What You Did Right
1. [Specific praise with evidence]
2. [Pattern recognized as positive]

### What Needs Fixing
1. **[Issue title]**
   [Evidence — what happened, what should have happened]
   **Action:** [Specific remediation step]

2. **[Issue title]**
   ...

### The Pattern
[One paragraph identifying the systemic pattern, not just individual symptoms]

### Summary
| Area | Grade | Note |
|------|-------|------|
| [Category] | [A-F] | [One line] |

**Overall: [Assessment].** [One sentence on talent vs habits.]

*Reviewed by Ezra. Posted with Ezra's Gitea identity.*
```

## Posting the Report

Create a Gitea issue assigned to the audited agent:
- Title: `[REVIEW] Ezra audit of [Agent]'s [session type] — lessons and grades`
- Assign to the agent being audited
- Use EZRA's token (never the audited agent's token)

## Key Insight: Lobster Detection

If an agent on Telegram exhibits:
- Asking "which repo?" instead of checking all repos
- Spawning subagents for single API calls
- 5+ minutes for a grep/search
- No memory of previous conversations
- Can't find files that exist

...it's probably running through OpenClaw without Hermes underneath (a "lobster"). The fix isn't behavioral coaching — it's architectural. Check `ps aux` to verify both gateways are running.

## Pitfalls

1. **Tone matters.** "Counsel, not criticism." The goal is learning, not punishment. Grade honestly but explain WHY each grade, with specific actions.

2. **Check your own identity before posting.** The audit report must come from YOUR Gitea account, not the audited agent's. Verify with `api_get("user")` before any POST.

3. **Distinguish architectural bugs from behavioral bugs.** An agent asking clarifying questions because it's routing through OpenClaw without Hermes memory is NOT the agent being lazy — it's a configuration problem. Diagnose the architecture before grading the behavior.

4. **Trust Alexander's context.** If Alexander directed an agent to do something that looks wrong from the outside (e.g., rapid ticket generation), ask before flagging. You don't see all channels.

5. **Uncommitted changes are the #1 silent risk.** Always check `git diff --stat` on the agent's machine. Local-only changes that aren't tracked anywhere will vanish on the next pull/reset.
