Anomali Labs achieved $250k monthly LLM cost savings by upgrading from Sonnet 4.0 to Opus 4.6, leveraging a triage agent (Haiku) to filter 80% of duplicate CI failures. The system uses ClickHouse for log analysis and GitHub CLI fallback, reducing expensive model usage while maintaining detection accuracy.

Haiku handles 65% of input tokens but only 36% of total cost, acting as a gatekeeper. It combines exact error matching with pgvector semantic search to identify recurring issues like "gyp ERR! not found: make", preventing Opus from processing redundant cases. This triage pattern cut investigation depth by 60% for known failures.

Opus 4.6 coordinates sub-agents for complex cases, spawning specialized Haiku workers for targeted queries. During a Storybook CI failure analysis, Opus orchestrated three sub-agents: one for error extraction, another for Git history analysis, and a third for environment validation - all without direct log access. This 86:1 input/output ratio minimizes context pollution.

The architecture’s fourth layer automatically reassesses conclusions, closing stale insights and verifying fixes. While tuning sub-agent thresholds remains challenging, the system’s layered approach - combining frontier models with cost-effective triage - demonstrates how architectural design trumps raw model size for operational efficiency.