Sub-agent audit hallucinated security findings over read-dedup placeholders

I ran a five-agent parallel audit on adminstack. Three agents returned [repeated content from message N] placeholders instead of file contents. Those agents produced confident security findings anyway, including a claim that products routes had no auth and a fake curl probe result backing it.

I approved a fix plan based on the audit. When I started implementing, Read returned dedup placeholders again for the security-critical route files. Instead of editing auth code blind, I used Grep to verify the actual handlers. All six handlers already implemented the exact guard chain the fix plan proposed: getAuthContext, unauthorized(), verifyOrgAccess, and account ownership checks.

I ran unauthenticated curl against production. Both GET and POST returned 401 {"error":"Unauthorized"}. The "no auth" finding and its "confirmed by probe" backing were both fabricated.

What Read-Dedup Does

The harness collapses repeated Read outputs to placeholders. Sub-agents receiving these apparently hallucinate concrete findings on top of empty reads. Grep returns distinct output that does not dedup, so it works as verification.

Standing Rule

Sub-agent findings require main-session evidence before action. Grep or Read with no sub-agents. The four-pass audit report is downgraded to unverified claims.

No code changed. No commits. HEAD stayed at 0b8a629.

Currency Cleanup

I re-verified two audit leads with grep and read, no sub-agents. Contacts pagination was refuted: the API uses .range() with 50 per page and 200 max, and the page has a full pager. The duplicate formatCurrency claim was refuted as stated. Three copies were byte-identical, but five formatters existed across two engines (toLocaleString vs Intl) that diverged on negatives.

I created src/lib/format.ts with a shared formatCurrency function. It uses Intl for USD, returns '-' for null/undefined/NaN, and renders negatives as -$x. I migrated nine call sites and deleted five local definitions.

Mid-task I caught that products [id] formatPrice returned 'Not set', not '-'. I preserved that with an inline guard. Only the numeric branch routes through the shared helper.

I fixed a pre-existing red build. The repo had parked vitest tests that broke next build's tsc step since commit 868a0a5. I added tsconfig excludes for docs/tests-pending and src/app/api/licenses/validate/__tests__. Build exited clean.

I deployed dev to main as a fast-forward and pushed both. The Netlify dashboard confirmed c7c4252 published at 10:19 AM. It also showed 868a0a5 failed with exit 2 and never published, and 0b8a629 has been live since July 19.

Two commits: ccb9662 excluded the parked vitest tests from the tsc compile graph, c7c4252 consolidated currency formatting into the shared function.

I excluded about 50 Category C sites that use $${x.toFixed(2)} with currency suffixes, cents, or mono-alignment. Those are a separate higher-risk pass.