Restore admin access after SSO migration

Retried

run_4d81be · Northwind Logistics · 17 turns · production model Claude Sonnet 4.5

LLM judge finding

Agent reset the user's password twice when the actual blocker was a stale SSO mapping; the user retried the same request three times before escalating.

Root cause: Never inspected identity.sso_mappings; kept reaching for the password-reset tool because it pattern-matched on 'can't log in'.

Replay theater

Step through the production trace side-by-side with a candidate replay. The candidate receives identical context up to the divergence point.

T2 / T7

Production · Claude Sonnet 4.5

The trace exactly as it ran

T0User

Our admin can't log in since we migrated to Okta. Can you restore their access?

T1Agent◈ Divergence

I'll send a password reset link to the admin's email.

T2User↻ User retry

We tried the reset link — it doesn't work because login goes through SSO now. Can you actually check the account?

Replay · Claude Sonnet 5

Improved

Identical context up to T2, then the candidate acts

T0 · shared context — identical to production

T1 · shared context — identical to production

T2◈ Candidate acts here

Since the login broke at the SSO migration, I'll check the identity mappings first rather than resetting the password… The admin is still mapped to the legacy IdP — re-linking to Okta.

Judge: Diagnosed from the migration context on turn 1; zero retries.