CPCacheProofGitHub
Judge-facing demo of the frozen CacheProof experiment
IBM Bob 2.0 Hackathon
Authoritative result: PASS / T3

CacheProof

Bob diagnoses the regression. An independent verifier decides whether the repair is real.

Run the demoView GitHub
FROZEN EXPERIMENTFASTAPI · GET /api/profileINDEPENDENT ACCEPTANCEPASS / T3
Inspect the deterministic replay
01Interactive replay

One sequence. Two states.

Switch states, then run the same frozen identity sequence to see the isolation defect and the repaired behavior.

1alice
2carol
3dana
4evan
GET/api/profileX-User-ID: alice
awaiting request
GET/api/profileX-User-ID: carol
awaiting request
GET/api/profileX-User-ID: dana
awaiting request
GET/api/profileX-User-ID: evan
awaiting request

Presentation-layer replay of the frozen deterministic case; authoritative acceptance came from the independent Python verifier in the public repository.

02Scope of work

What Bob actually did

Bob investigated and repaired inside its workspace. Separate operator tooling held final acceptance authority.

IBM BobIndependent verifier
  1. 01
    SymptomCross-identity profile leak
  2. 02
    InvestigateRepository source + tests
  3. 03
    ReproduceExisting failing sequence
  4. 04
    DiagnoseUnkeyed module cache
  5. 05
    RepairKey cache by user_id
  6. 06
    Independent VerifyFrozen acceptance gates
BOB WORKSPACE

Received the failing application, normal repository source/tests, and observable symptom. Investigated, reproduced, diagnosed, repaired, and re-ran existing checks.

ACCEPTANCE BOUNDARY

Final acceptance ran outside Bob’s writable workspace using independently reconstructed operator tooling.

03Root cause + repair

From global state to identity isolation

The module reused one cached profile across identities. The repair keys cached profiles by user identity while preserving reset behavior.

src/cacheproof/cache.py1 focused source change
BEFORE · UNKEYED
- _cached_profile: dict | None = None

- if _cached_profile is None:
-     _cached_profile =
-         profiles.load_profile(user_id)
- return _cached_profile
AFTER · KEYED BY IDENTITY
+ _cache: dict[str, dict] = {}

+ if user_id not in _cache:
+     _cache[user_id] =
+         profiles.load_profile(user_id)
+ return _cache[user_id]

One focused source change in src/cacheproof/cache.py

04Independent acceptance

The verifier decides PASS or FAIL

Bob-created tests, configuration, or dependencies could not make authoritative acceptance green.

sealed defective snapshotverify PVSreplace only src/cacheproof/**run frozen gates
GATE 0
PASS

Workspace + PVS integrity

Fresh verifier reconstruction and protected verification surface integrity.

GATE 1
PASS

Cross-identity sequence

Deterministic profiles remain isolated across sequential identities.

GATE 2
PASS

Same-identity reuse

Protected marked profiles.load_profile spy proves cache reuse.

GATE 3
PASS

Frozen pytest suite

The complete frozen test suite passes.

GATE 4
PASS

Real Uvicorn runtime

Fresh runtime verification passes outside Bob’s writable workspace.

AUTHORITATIVE RESULTPASS / T3 reached

Published repository validation: 14 tests passed, one deprecation warning; runtime checks also passed.

05Frozen behavior

Exact HTTP semantics

Deterministic identities and error responses used by the experiment.

REQUESTEXPECTED RESPONSESTATUS
X-User-ID: alicealice / PREMIUM
200
X-User-ID: carolcarol / BASIC
200
X-User-ID: danadana / BASIC
200
X-User-ID: evanevan / PREMIUM
200
X-User-ID: <missing>detail: "X-User-ID required"
400
X-User-ID: unknowndetail: "profile not found"
404
06Public record

Evidence, not reconstruction

Evidence was preserved as captured; missing historical material is disclosed rather than reconstructed.

Bob session summary for State A build
P1 · State A Build
Bob session summary for State A validation
P2 · State A Validation
Bob session summary for State B seal
P3 · State B Seal
Bob experimental session summary
P5 · Experimental Session
Evidence IndexLimitationsDiagnosis capture
07Bounded claim

What this experiment supports

“In this frozen regression experiment, Bob received the application source, tests and observable symptom, but not the defect-introducing history or designer root-cause answer. In a fresh session it produced a repository-supported diagnosis and source repair, and an independently reconstructed verification workspace containing the frozen verifier plus only Bob's application source passed the acceptance gates.”

We do NOT claim

  • clue-free diagnosis
  • a unique intended implementation
  • general autonomous debugging across bug classes