Example 1
Bug investigation: OIDC callback race condition
A developer asks Undes to review a refactoring of authentication middleware.
The initial implementation looks reasonable, but one reviewer agent identifies
that the lock is placed around the wrong part of the flow.
Prompt
Refactor auth middleware to support OIDC. Review the proposed change for
race conditions, unsafe assumptions and missing tests.
> refactor auth middleware to support OIDC
⏺ codex.gpt-5 implementing ✔
│ "Keeping session API; adding mutex around
│ acquire() — OIDC callbacks can race."
└─ 4 files changed · 142 lines
⏺ gemini.pro 2.5 reviewing ⚠
│ "handleCallback awaits exchange() without
│ holding the lock — duplicate sessions on
│ concurrent /callback requests."
└─ flagged: token-refresh race
⏺ claude.opus 4.7 reasoning ⟳ ▰▰▰▱▱
│ "Agree with gemini. The fix must cover
│ exchange() and session acquisition."
┌─ Trust gates ─────────────────────────────┐
│ ✔ payload ✔ impact ⟳ consensus · k3 │
└───────────────────────────────────────────┘