/ax-audit

Agent session starts without knowing what data exists

Static system prompt, no dynamic context. Every session starts ignorant of projects, preferences, and prior work that already exists. Violates Improvement Over Time: each session should build on the last.

What goes wrong

User opens a design review agent for the third time today. It has no memory of earlier sessions, the 5 files reviewed, or the user's accessibility-first preference. It asks "What would you like me to review?" again.

Detection

Surfaces: agent-chat

Static signals:

1. Find session initialization: agent constructors, chat init, session start handlers.
2. Check whether initialization loads dynamic context (context files, preferences, recent activity).
3. Flag sessions that use only static/hardcoded prompt content.

Concrete commands:

rg '(new Agent|createAgent|initSession|startChat)' --type=ts -A 15 src/
rg 'messages\s*[:=]\s*\[' --type=ts -A 5 src/ | rg 'role.*system' | rg -v 'await|fetch|load|get'
rg '(context\.md|loadContext|getContext|sessionContext)' --type=ts src/

False-positive guards:

• Skip files with // ax-audit-ignore:context-no-injection.
• Skip test files and fixtures.
• Skip constructors where context is injected by a parent orchestrator.

Fix

// before: static initialization
function createSession(userId: string) {
  return { messages: [{ role: "system", content: STATIC_PROMPT }] };
}

// after: read context.md at session start
async function createSession(userId: string) {
  const ctx = await readContextFile(userId);
  const prefs = await getUserPreferences(userId);
  return {
    messages: [{ role: "system", content: `${STATIC_PROMPT}\n\n${ctx}\n\n${prefs.summary}` }],
  };
}

Default tier and overrides

Defaults to: fix-this-sprint

Examples

Anti-pattern (fails): private messages = [{ role: "system", content: "You review code." }]

Applied (passes): static async create(uid) { const ctx = await loadProjectContext(uid); ... }

Suppression

// ax-audit-ignore:context-no-injection, stateless utility agent, no user context needed
const agent = new StatelessAgent(STATIC_PROMPT);