Quirin Schlegel

Loading

Cheap is not less — Sonar measured what one pull request actually costs, and the number the GDPR counts is not the invoice

Sonar published a session trace on 1 September 2026 for one 800-line backend change: 512 model round-trips, a context window peaking at 458,700 tokens, 152.8 million cache-read tokens - what the post calls the re-billed transcript - and roughly 41 dollars, with 18 comparable pull requests in the same repository averaging about 234 million context tokens and about 65 dollars each against a 52 dollar median. The obvious reading is a cost story, and the correction is that the same measurement is a volume-of-processing number: the re-billed transcript is roughly 333 times the peak context window, and GDPR Article 4(2) names retrieval and consultation among the operations that constitute processing, with no threshold of cost or novelty attached, so a prompt-cache read of content already sent is not outside the Regulation for being cheap or for being a repeat. Article 5(1)(c) then tests necessity against the operation rather than the invoice and Article 5(2) puts the burden of demonstrating it on the controller, which is why an agent that re-reads a fixture file on 470 turns has 470 turns to justify. The contrast is the calendar: the Digital Omnibus, Regulation (EU) 2026/1744, moved the AI Act's Annex III high-risk obligations to 2 December 2027, while the data-minimisation duty has applied since 25 May 2018 and was not deferred - so the practitioner moves are to count file reads per turn rather than tokens in one real session log, to mark which of those files carry real personal data (fixtures and seed data, not src), to check whether the processor terms cover a cached transcript held for the length of a session rather than only prompts and outputs, and to enter the agent harness in the Article 30 record as its own processing activity with the retention the cache actually has.

4 September 20269 verified claims5 sources

Sonar traced one pull request and published the receipt. An 800-line backend change. The transcript came to 152.8 million tokens.

On 1 September, Sonar research engineer Antonio Aversa published the session trace behind Sonar Vortex. One single-ticket PR: 512 model round-trips, a context window peaking at 458,700 tokens, 152.8 million cache-read tokens — what the post calls "the re-billed transcript" — and roughly $41. Across 18 comparable PRs in the same repo: ~234 million context tokens each, ~$65 per PR, median ~$52.

It is a cost post, and a good one. Three things before you file it as a bill to optimise.

1. The window is not the volume. Teams size the context window and argue about whether 458,700 tokens is enough. The transcript actually processed was 333 times larger. The window tells you nothing about how many times your repository crossed the wire.

2. A cache read is processing. GDPR Article 4(2): processing is "any operation ... such as collection, recording, ... storage, ... retrieval, consultation, use, disclosure by transmission". Retrieval and consultation are both named. Price is not in the definition. Caching lowered your bill; it did not lower the count.

3. Which makes Article 5(1)(c) the live one. Personal data must be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed". Necessity is tested against the operation, not the invoice. An agent that re-reads a fixture file on 470 turns has to justify 470 turns.

Monday:

1. Take one agent session log. Count file reads per turn, not tokens. 2. Mark which of those files carry real personal data. Fixtures and seed data are where it hides, not src. 3. Read your DPA. It probably covers "prompts and outputs". Ask whether it covers a cached transcript held at the provider for the length of a session. 4. Put the harness in your Article 30 record as its own processing activity, with the retention that actually applies to the cache.

And the calendar. The Digital Omnibus moved Annex III high-risk to 2 December 2027 — real runway. Article 5(1)(c) has applied since 2018. Nobody deferred that one.

Caching made the transcript cheap. It did not make it smaller.

How many times did your agent read that file?

#EUAIAct #DSGVO #AgenticAI #AIGovernance #SoftwareEngineering

Evidence

What this rests on

Every factual claim in the edition above, stated on its own and checked before publication. If one of these is wrong, the argument is wrong — so they are listed where you can check them.

In a session trace of one 800-line backend change, Sonar recorded 512 model round-trips, a context window peaking at 458,700 tokens, 152.8 million cache-read tokens ("the re-billed transcript") and an approximate session cost of $41.
Why it mattersIt is the first published per-PR trace precise enough to separate what an agent reads from what it re-reads. The re-billed transcript, not the context window, is the quantity a deployer has to be able to account for.
sonar2026smarter
Across 18 comparable single-ticket PRs in the same repository, Sonar measured an average of ~234 million context tokens per PR, ~$65 per PR (median ~$52), ~700 model round-trips per PR, and context windows routinely peaking between 450k and 975k tokens.
Why it mattersA mean of ~$65 against a median of ~$52 says the distribution has a tail. The tail is where the re-reading concentrates, so a team sampling its average PR will not see the problem.
sonar2026smarter
Sonar's worked example: a 5,770-token file read once unnecessarily on turn 42 of a 512-turn session is re-billed as a cache read on approximately 470 further turns — about 2.7 million tokens, about $0.54 at the ~$0.20/million cache-read price Sonar cites.
Why it mattersIt puts a unit price on a single unnecessary read and shows the multiplier is the remaining turn count, not the file size. That is the mechanism a harness has to break.
sonar2026smarter
152.8 million cache-read tokens is approximately 333 times the 458,700-token peak context window recorded in the same session (arithmetic on the source's own two figures).
Why it mattersSizing the context window is the industry's proxy for how much of a codebase an agent touches. This ratio shows the proxy is off by more than two orders of magnitude.
sonar2026smarter
Sonar Vortex and the SonarQube Remediation Agent were announced on 30 June 2026 at the AI Engineer World's Fair and described as available that day; the 1 September 2026 engineering post is a measurement of the problem, not a product launch.
Why it mattersThe aggregator sweep placed the product launch in the week of 1 September 2026. Getting the date right is what separates a measurement story from a launch story, and only the measurement is new.
sonar2026sonar · sonar2026smarter
Sonar's own launch release claims a 36% reduction in LLM token consumption on refactoring tasks, measured by Sonar across Java, Python, TypeScript and C# against Claude Opus 4.8. It is a vendor benchmark of a vendor product and has not been independently reproduced here.
Why it mattersA vendor benchmark of a vendor product against a named model on four languages is a real disclosure of method, and still not reproducible by the reader. It belongs in the comment, not the post.
sonar2026sonar
GDPR Article 4(2) defines processing as "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction" — naming retrieval and consultation, and setting no threshold of cost or effort.
Why it mattersRetrieval and consultation are enumerated operations with no cost threshold attached. That is the whole reason a cheap cache read is not outside the Regulation.
intersoftco2026definitio
GDPR Article 5(1)(c) requires that personal data be "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed", and Article 5(2) makes the controller responsible for demonstrating compliance with that principle.
Why it mattersNecessity under 5(1)(c) attaches to the operation, and 5(2) puts the burden of demonstrating it on the controller. A per-session cost figure does not discharge a per-operation test.
intersoftco2026art
The Digital Omnibus, Regulation (EU) 2026/1744, in force 27 July 2026, moved the AI Act's Annex III high-risk obligations to 2 December 2027; the GDPR's Article 5(1)(c) data-minimisation duty has applied since 25 May 2018 and was not deferred.
Why it mattersIt is the contrast the edition turns on: the AI Act obligation people have on their calendar moved, and the GDPR obligation that actually bites today did not.
eurlex2026regulatio · intersoftco2026art

Sources

Every source for this edition, as one PDF BibTeX — all editions

Corrections

What changed after publication

The aggregator sweep listed "SonarSource quantifies the 'context tax' and ships an agent-friendly code graph (Sonar Vortex)" as news of 2 September 2026. Two dates are wrong in that framing and both were corrected before publication: - The engineering post is dated 1 September 2026 on Sonar's own blog, not 2 September. The event date is used. - Sonar Vortex did not ship this week. Sonar's own press release dates the launch of Sonar Vortex and the SonarQube Remediation Agent to 30 June 2026 at the AI Engineer World's Fair, described as available that day. The product is two months old; only the measurement is new, and the edition says so. - The ~$0.20/million cache-read price underpinning Sonar's $0.54 example is stated without naming a model or provider. It is carried as the source's own assumption and the derived dollar figure was kept out of the post. - Considered and dropped: JetStream's Clearance announcement (dateline 2 September 2026, listed by the same aggregator as 3 September). A real practitioner story, but the day's stronger measurement was Sonar's.