agent double-counted findings when re-running a fixed template

TL;DR

Re-running a repaired template is normal; counting its results twice is not. The import path appends the new run's results beside the old run's, and the report totals both. Scope result replacement by run identity: results carry the template id, target, and run batch, and importing a fresh batch for that template and target supersedes the earlier batch, which is archived, not counted.

agent double-counted findings when re-running a fixed template

Use this when

• Finding counts rise after a template fix and re-run, with the same issue listed twice for one host.
• The duplicates differ only in timestamp or run reference, not in evidence.

Not for this skill when

• The second run genuinely found a new instance on a different path or parameter. That is a separate finding and should stay.
• The duplicates come from two different scanners. That is correlation work, not re-run replacement.

Steps

1. Confirm the duplication source: match the paired findings by template id, host, and matched location, and check their run timestamps bracket the template fix. Verify: Verify: the pairs are the same template's old and new runs, itemised.
2. Decide the counting rule in writing: for one template and target, only the latest completed batch counts toward the report; earlier batches are superseded evidence. Verify: Verify: the rule is stated in the pipeline notes where a reviewer can find it.
3. Add batch identity to imported results: template id plus target plus run batch id on every record, assigned by the runner at execution time. Verify: Verify: every stored result can name its batch.
4. Change the import so a new batch for a template and target marks the previous batch superseded in the data store, excluding it from report queries while keeping it readable. Verify: Verify: re-importing a corrected run leaves the report count unchanged when the results are the same.
5. Regenerate the affected report, reconcile totals before and after, and note the correction if a doubled draft was delivered. Verify: Verify: the totals diff is fully explained by the superseded batches.

Variant phrasings

rerun fixed template findings counted twice supersede batch

The batch phrasing.

agent report duplicate same template old new run

The symptom phrasing.

idempotent reimport scanner results run identity

The idempotency phrasing.

Compatibility: Compatibility: any agent pipeline that re-runs templates or scans; batch identity must be assigned where the tool is invoked.

Why it happens

Pipelines usually treat imports as additive history, which is right for evidence and wrong for counting. A re-run is a replacement measurement, not an additional one, and without a batch concept the data model cannot express that. The double count then looks like diligence, more findings after more work, so nobody questions it until a client recounts by hand.

Edge cases / pitfalls

• A re-run that finds less than the original may have been run with different options; record the options hash per batch so superseding is defensible.
• Never delete superseded batches; a finding that vanishes between batches is itself reportable history.
• Partial re-runs covering only some targets must supersede per target, never for the whole template across the engagement.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstoEVenRtwxG73iRmUWxTzA