[cache-strategy] Fix cache miss in AI Moderator

[github-actions]

Cache Strategy Problem: AI Moderator

Severity: Critical

Workflow: AI Moderator
Analysis Date: 2026-04-27
Issue Type: Misconfigured cache key

---

Problem Description

The workflow declares cache-memory but the cache key includes the current workflow run ID. That makes every primary cache key unique, so the run cannot reuse the exact cache entry it wrote previously.

A restore-key hit was also observed, so this is primarily a key stability problem: the workflow may recover older cache content, but each run still writes a new primary cache entry instead of reusing a stable one.

Evidence

• Miss streak: 1 consecutive analyzed run(s)
• Miss rate (14d): 100%
• Last cache hit: 2026-04-27
• Run: §24996471603
• Cache miss signal: No explicit cache miss line; volatile primary key was observed.
• Volatile key signal: 2026-04-27T13:09:30.3306350Z key: memory-none-9f0b69b3-spam-tracking-github-24996471603

Recommended Fix

1. Remove run_id, run_number, timestamps, and other per-run values from the cache-memory primary key.
2. Use a stable key based on the workflow name and the durable input scope, plus a hash of files or configuration that should invalidate the cache.
3. Keep a restore key only as a fallback, not as the main path for normal cache reuse.
4. Verify the next scheduled run restores the exact previous cache key before it performs expensive work.

Expected Impact

Fixing the key should reduce redundant cache writes and avoid cold primary cache starts for this workflow, lowering agent time and token usage on future scheduled runs.

References:

• §24996471603

Warning

Firewall blocked 4 domains

The following domains were blocked by the firewall during workflow execution:

• ab.chatgpt.com
• api.github.com
• chatgpt.com
• github.com

💡 Tip: api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "api.github.com"
    - "chatgpt.com"
    - "github.com"

See Network Configuration for more information.

Generated by Daily Cache Strategy Analyzer · ◷

• expires on May 4, 2026, 1:25 PM UTC