How Mendral Cut LLM Costs by Upgrading to Opus: Triager Pattern, SQL Access, and Sub-Agent Architecture

Mendral recently published details on how they upgraded to Opus 4.6 for CI failure analysis while reducing overall LLM costs compared to their previous setup with Sonnet 4.0. The key is an architecture that separates triage from investigation and uses cheap sub-agents for heavy lifting.
Architecture: Cheap triager, expensive planner
Out of ~4,000 CI failures analyzed, 3,187 were duplicates — a known flaky test, infrastructure hiccup, or network blip. Waking up an expensive model for those is wasteful. But deduplication isn't deterministic: the same job can fail for different reasons. Their solution is a triager pattern:
- A Haiku agent handles the narrow job: decide if a failure is already tracked. It uses exact matching and semantic search (pgvector) against known error messages. Two different strings like
operator does not exist bigint character varyingandmigration type mismatch on installation_idare the same root cause — semantic search catches that. - When in doubt, Haiku escalates to Opus 4.6. A false positive costs a little; a false negative misses a real bug.
- 4 out of 5 failures never reach Opus. A triager match costs ~25x less than a full investigation.
Let agents pull context, don't push it
Instead of stuffing 200K+ line logs into prompts, agents get a SQL interface to ClickHouse. There's a raw table (github_logs, one row per log line) and materialized views with pre-aggregated data: failure rates by workflow, job timings, outcome counts. Most investigations start with the views to narrow down, then drill into raw logs. If a query returns too many rows, the system truncates and suggests a more specific view. If logs aren't ingested yet, agents fall back to the GitHub CLI.
Expensive models plan, cheap models execute
Opus forms a hypothesis and spawns Haiku sub-agents capped at one level deep — no unbounded fan-out. Each sub-agent gets a prompt from Opus: exactly what to search and how. Example from a real case:
Three Storybook CI jobs failed on the same commit, crashing at pnpm install. Opus dispatched a sub-agent to fetch error messages from that step. ClickHouse didn't have the logs yet, so the sub-agent used GitHub CLI and returned: gyp ERR! not found: make — [email protected] couldn't compile because make wasn't on the runner. Opus then queried ClickHouse for the failure trend over 14 days, found the inflection point, and escalated. Sub-agent prompts are explicit: "Fetch the CI logs for this run. Return the exact error messages from the pnpm install step, the full error output, especially the last 50-100 lines."
Who this is for
Teams building LLM-powered agents for CI debugging or any task where context size and cost are concerns.
📖 Read the full source: HN LLM Tools
👀 See Also

Developer builds Rust compression library with Claude Opus 4.6, questions utility
A developer used Claude Opus 4.6 for two weeks to create a 15,800-line Rust compression library with 449 passing tests, Python bindings, and C FFI layer, but questions whether another compression library was needed.

Claude Code Plugin for D&D Campaigns Using Markdown State Tracking
A Claude Code plugin uses markdown files to track campaign state and lets Claude act as Dungeon Master for solo D&D sessions. The system is free and open-source, requiring installation as a plugin followed by the /claude-dnd:new-campaign command to start.

Temporal-MCP: Wall-Clock Awareness for LLMs with OAuth Support
Temporal-MCP is a minimal MCP server that provides wall-clock awareness to LLMs, addressing time-related failure modes like incorrect greetings and stale context. It offers two tools (temporal_tick and temporal_peek) returning elapsed time, day-rollover detection, and fresh-thread flags.

Claude Code v2.1.76 System Prompt Updates: Security Monitor Refinements and New Hook Event
Claude Code v2.1.76 includes updates to system prompts with 43 new tokens, featuring refinements to the security monitor for autonomous agents and the addition of a PostCompact hook event. Changes include clarified sensitive data detection, expanded code deserialization examples, and improved formatting for irreversible local destruction guidance.