{
  "assessment": {
    "decisions": [
      {
        "decided_by": "locality",
        "defect_id": "12",
        "finding_id": "f1",
        "id": "d1",
        "outcome": "matched",
        "reason": null
      },
      {
        "decided_by": "locality",
        "defect_id": "1",
        "finding_id": "f2",
        "id": "d2",
        "outcome": "matched",
        "reason": null
      },
      {
        "decided_by": "locality",
        "defect_id": "18",
        "finding_id": "f3",
        "id": "d3",
        "outcome": "matched",
        "reason": null
      },
      {
        "decided_by": "locality",
        "defect_id": "17",
        "finding_id": "f4",
        "id": "d4",
        "outcome": "matched",
        "reason": null
      },
      {
        "decided_by": "locality",
        "defect_id": "13",
        "finding_id": "f5",
        "id": "d5",
        "outcome": "matched",
        "reason": null
      },
      {
        "decided_by": "locality",
        "defect_id": "11",
        "finding_id": "f6",
        "id": "d6",
        "outcome": "matched",
        "reason": null
      },
      {
        "decided_by": "locality",
        "defect_id": "6",
        "finding_id": "f7",
        "id": "d7",
        "outcome": "matched",
        "reason": null
      }
    ],
    "judge": null,
    "judged": false,
    "scorer": {
      "commit": "d5372b5a9797137af68e35c478f308f58ca4510c",
      "digest": "sha256:a1a935298956020ee6d767a756847abb4c00694c88c2eb80d454886ebc4acf8c",
      "id": "bench-score",
      "version": "1"
    },
    "state": "measured"
  },
  "benchmark": {
    "input_fingerprint": "69301578538a",
    "key_fingerprint": "bd331c0b144e",
    "policy_fingerprint": "c53f8cfc8c75",
    "prompt_fingerprint": "74234e98afe7",
    "subject": "proxy"
  },
  "build": {
    "commit": "b0f313c0b59a66ecc7612396dc8db0ea5da13a7a",
    "digest": null,
    "dirty": false,
    "label": "afi 0.30.0",
    "version": "0.30.0"
  },
  "configuration": {
    "fingerprint": "8232536cf248",
    "label": "default",
    "models": [
      {
        "effort": "high",
        "model": "anthropic/claude-fable-5",
        "protocol": null,
        "provider": "anthropic",
        "role": "agent"
      }
    ],
    "profile": null,
    "resolved": {
      "effort": "high",
      "instructions": [],
      "sandbox": {
        "backend": "macOS Seatbelt",
        "mode": "read-only",
        "network": "denied"
      },
      "source": "openrouter",
      "system_prompt": {
        "file": null,
        "mode": "builtin"
      },
      "tools": [
        "read_file",
        "write_file",
        "edit_file",
        "list_dir",
        "search_files",
        "glob_files",
        "run_bash",
        "wait_background"
      ]
    }
  },
  "coverage": {
    "chunks": null,
    "files_failed": 0,
    "files_kept": null,
    "files_skipped": 0,
    "files_unreviewed": 0,
    "hunks": null,
    "state": "measured"
  },
  "evidence": [
    {
      "digest": "sha256:1b5c7cab342087fc56a3f2716133b40edf8904894b78da1569b66fca1c73a02c",
      "media_type": "application/json",
      "path": "summary.json",
      "role": "summary"
    },
    {
      "digest": "sha256:3b9fa950f00ef9bf317d5a87a69b9fbdfd983a322f73420de385bb529b8b2bc1",
      "media_type": "application/json",
      "path": "findings.json",
      "role": "findings"
    },
    {
      "digest": "sha256:9361f24e4dcb37cc0176d2b55fa7d942cda3eb4393fe6d1bd935b1d81a028acd",
      "media_type": "application/json",
      "path": "meta.json",
      "role": "meta"
    },
    {
      "digest": "sha256:3a6a4be4dfa5f3e177fcb86184f7b6e66907cab8de7f1b4709ac25fd53fdc333",
      "media_type": "application/json",
      "path": "spend.json",
      "role": "spend"
    },
    {
      "digest": "sha256:963a1f333cc0b6555695f809968278fb983706685096d3faee022213b173c6aa",
      "media_type": "application/jsonl",
      "path": "result.jsonl",
      "role": "result"
    },
    {
      "digest": "sha256:1fab37736ee914eabac3100e7dca69078d98299a6e63aa5c4719804096112365",
      "media_type": "text/plain",
      "path": "stderr.txt",
      "role": "stderr"
    },
    {
      "digest": "sha256:2641e5025811069213f5560a55092f8a4f103bf6f91fdc6f8a0a89ca184e2966",
      "media_type": "application/gzip",
      "path": "afi-home/logs.tar.gz",
      "role": "traffic"
    }
  ],
  "execution": {
    "billing_limit_usd": 20.0,
    "budget_usd": 20.0,
    "deadline_exceeded": false,
    "exit_code": 0,
    "finished_at": "2026-08-31T17:36:24Z",
    "started_at": "2026-08-31T17:32:42Z",
    "wall_seconds": 222.0
  },
  "extensions": {
    "afi": {
      "found_per_pass": {
        "agent": 7
      },
      "passes": null,
      "review_seconds": 220.086,
      "tier1_only": false,
      "variant_hash": null
    }
  },
  "findings": {
    "items": [
      {
        "attributes": {
          "category": "bug",
          "confidence": null,
          "evidence_quote": null,
          "suggested_fix": null
        },
        "body": "forget(&index, &gone)` is not gated on `dry_run` and `gone` is filled even in a dry run (lines 136-137 run unconditionally), so `POST /v1/admin/cache/sweep?dry_run=true` really unlinks the index\u2026\n\nforget(&index, &gone)` is not gated on `dry_run` and `gone` is filled even in a dry run (lines 136-137 run unconditionally), so `POST /v1/admin/cache/sweep?dry_run=true` really unlinks the index entries of every blob it merely reported \u2014 the blobs it \"did not remove\" become unreachable cache misses immediately and are deleted as unreferenced on the very next real sweep, the opposite of the documented \"reports \u2026 without removing anything\".",
        "id": "f1",
        "locations": [
          {
            "end_line": 140,
            "path": "services/proxy/src/sweep.rs",
            "start_line": 140
          }
        ],
        "severity": "bug",
        "title": "bug"
      },
      {
        "attributes": {
          "category": "bug",
          "confidence": null,
          "evidence_quote": null,
          "suggested_fix": null
        },
        "body": "sort_by_key(|c| c.age)` orders candidates  youngest first  (smallest `now - mtime` first), yet the eviction loop removes from the front, so an over-ceiling sweep deletes the most recently fetched\u2026\n\nsort_by_key(|c| c.age)` orders candidates  youngest first  (smallest `now - mtime` first), yet the eviction loop removes from the front, so an over-ceiling sweep deletes the most recently fetched blobs and keeps the oldest \u2014 an inverted LRU that thrashes exactly the packages current builds are using; the sort needs to be descending by age.",
        "id": "f2",
        "locations": [
          {
            "end_line": 102,
            "path": "services/proxy/src/sweep.rs",
            "start_line": 102
          }
        ],
        "severity": "bug",
        "title": "bug"
      },
      {
        "attributes": {
          "category": "bug",
          "confidence": null,
          "evidence_quote": null,
          "suggested_fix": null
        },
        "body": "a blob with no index entry is removed with no `min_age` grace, but on the miss path a blob exists unlinked for the whole window between `writer.commit()` (services/proxy/src/routes/cache.rs:151) and\u2026\n\na blob with no index entry is removed with no `min_age` grace, but on the miss path a blob exists unlinked for the whole window between `writer.commit()` (services/proxy/src/routes/cache.rs:151) and `store.link()` (cache.rs:163), which includes a network round-trip to the registry \u2014 a sweep in that window deletes the just-committed blob and the request 500s at cache.rs:90; reading the index snapshot (line 92) *before* walking blobs (line 95) widens the race further.",
        "id": "f3",
        "locations": [
          {
            "end_line": 119,
            "path": "services/proxy/src/sweep.rs",
            "start_line": 119
          }
        ],
        "severity": "bug",
        "title": "bug"
      },
      {
        "attributes": {
          "category": "bug",
          "confidence": null,
          "evidence_quote": null,
          "suggested_fix": null
        },
        "body": "clear_partials` unlinks every file in `incoming` with no age or liveness check, but `incoming` is where `BlobWriter` (store.rs:171-180) is actively writing in-flight downloads \u2014 a sweep during a\u2026\n\nclear_partials` unlinks every file in `incoming` with no age or liveness check, but `incoming` is where `BlobWriter` (store.rs:171-180) is actively writing in-flight downloads \u2014 a sweep during a fetch unlinks the live temp file, and `commit`'s `fs::rename` (store.rs:259) then fails with NotFound, failing the request; the doc's claim that \"a file in `incoming` is a fetch that is not coming back\" is false while any fetch is in flight.",
        "id": "f4",
        "locations": [
          {
            "end_line": 230,
            "path": "services/proxy/src/sweep.rs",
            "start_line": 230
          }
        ],
        "severity": "bug",
        "title": "bug"
      },
      {
        "attributes": {
          "category": "bug",
          "confidence": null,
          "evidence_quote": null,
          "suggested_fix": null
        },
        "body": "values()` loads `sweep_bytes_reclaimed` at index 4 and `sweep_blobs_removed` at index 5, but `COUNTERS` (lines 50-57) names index 4 `cairn_proxy_sweep_blobs_removed_total` and index 5\u2026\n\nvalues()` loads `sweep_bytes_reclaimed` at index 4 and `sweep_blobs_removed` at index 5, but `COUNTERS` (lines 50-57) names index 4 `cairn_proxy_sweep_blobs_removed_total` and index 5 `..._bytes_reclaimed_total` \u2014 each sweep counter is exported under the other's name, which is precisely the mix-up the comment on `COUNTERS` warns about, and docs/operations.md tells operators to alert on the bytes counter that will actually carry the blob count.",
        "id": "f5",
        "locations": [
          {
            "end_line": 94,
            "path": "services/proxy/src/metrics.rs",
            "start_line": 94
          }
        ],
        "severity": "bug",
        "title": "bug"
      },
      {
        "attributes": {
          "category": "bug",
          "confidence": null,
          "evidence_quote": null,
          "suggested_fix": null
        },
        "body": "the admin route calls `app.sweeper.sweep(dry_run)` directly instead of `run()`, skipping the `running` mutex (sweep.rs:83), so an on-demand sweep runs concurrently with the background sweep (or\u2026\n\nthe admin route calls `app.sweeper.sweep(dry_run)` directly instead of `run()`, skipping the `running` mutex (sweep.rs:83), so an on-demand sweep runs concurrently with the background sweep (or another admin sweep) \u2014 the exact two-sweeps-over-one-total situation the module doc (sweep.rs:10-12) says must never happen, each deleting from a total the other is changing.",
        "id": "f6",
        "locations": [
          {
            "end_line": 76,
            "path": "services/proxy/src/routes/admin.rs",
            "start_line": 76
          }
        ],
        "severity": "bug",
        "title": "bug"
      },
      {
        "attributes": {
          "category": "performance",
          "confidence": null,
          "evidence_quote": null,
          "suggested_fix": null
        },
        "body": "sweeper.sweep()` is a fully synchronous filesystem walk (readdir + stat over up to 65k directories, plus reading every index file) executed inline on a tokio worker thread \u2014 routes/mod.rs:125 itself\u2026\n\nsweeper.sweep()` is a fully synchronous filesystem walk (readdir + stat over up to 65k directories, plus reading every index file) executed inline on a tokio worker thread \u2014 routes/mod.rs:125 itself says a sweep \"legitimately takes longer than ten seconds\" \u2014 blocking that runtime thread for the duration; the same applies to `app.sweeper.run().await` in the spawned task at services/proxy/src/main.rs:116; both should go through `spawn_blocking`.",
        "id": "f7",
        "locations": [
          {
            "end_line": 76,
            "path": "services/proxy/src/routes/admin.rs",
            "start_line": 76
          }
        ],
        "severity": "performance",
        "title": "performance"
      }
    ],
    "problems": [],
    "state": "measured"
  },
  "harness": {
    "adapter": {
      "digest": "sha256:a1a935298956020ee6d767a756847abb4c00694c88c2eb80d454886ebc4acf8c",
      "id": "afi",
      "version": "1"
    },
    "commit": "d5372b5a9797137af68e35c478f308f58ca4510c",
    "digest": "sha256:a1a935298956020ee6d767a756847abb4c00694c88c2eb80d454886ebc4acf8c",
    "dirty": false,
    "id": "bench",
    "repository_url": "https://github.com/smykla-skalski/benchee",
    "version": "1"
  },
  "incremental": {
    "carried_count": null,
    "mode": "not_recorded",
    "prior_reviewed_sha": null,
    "reused_tokens": null,
    "state_source": null
  },
  "label": "fable-5",
  "metrics": {
    "anchor_max": {
      "reason": null,
      "state": "measured",
      "unit": "count",
      "value": 0
    },
    "anchor_median": {
      "reason": null,
      "state": "measured",
      "unit": "count",
      "value": 0
    },
    "anchor_missed": {
      "reason": "no judging pass has looked beyond the scored slack",
      "state": "not_recorded",
      "unit": "count",
      "value": null
    },
    "carried": {
      "reason": "the reviewer reported no reuse figure",
      "state": "not_recorded",
      "unit": "count",
      "value": null
    },
    "category_defect": {
      "reason": null,
      "state": "measured",
      "unit": "ratio",
      "value": 0.46153846153846156
    },
    "category_maintainability": {
      "reason": null,
      "state": "measured",
      "unit": "ratio",
      "value": 0.0
    },
    "category_performance": {
      "reason": null,
      "state": "measured",
      "unit": "ratio",
      "value": 0.3333333333333333
    },
    "category_security": {
      "reason": null,
      "state": "measured",
      "unit": "ratio",
      "value": 0.0
    },
    "f1": {
      "reason": "no qualified judge decided these findings, so only locality was measured",
      "state": "not_applicable",
      "unit": "ratio",
      "value": null
    },
    "finding_count": {
      "reason": null,
      "state": "measured",
      "unit": "count",
      "value": 7
    },
    "found": {
      "reason": null,
      "state": "measured",
      "unit": "count",
      "value": 7
    },
    "intended": {
      "reason": null,
      "state": "measured",
      "unit": "count",
      "value": 0
    },
    "judge_bill": {
      "reason": "no qualified judge decided these findings, so only locality was measured",
      "state": "not_applicable",
      "unit": "usd",
      "value": null
    },
    "missed": {
      "reason": null,
      "state": "measured",
      "unit": "count",
      "value": 13
    },
    "precision": {
      "reason": "no qualified judge decided these findings, so only locality was measured",
      "state": "not_applicable",
      "unit": "ratio",
      "value": null
    },
    "recall": {
      "reason": null,
      "state": "measured",
      "unit": "ratio",
      "value": 0.35
    },
    "review_bill": {
      "reason": null,
      "state": "measured",
      "unit": "usd",
      "value": 2.26771
    },
    "seconds": {
      "reason": null,
      "state": "measured",
      "unit": "seconds",
      "value": 222.0
    },
    "tier_1": {
      "reason": null,
      "state": "measured",
      "unit": "ratio",
      "value": 0.3333333333333333
    },
    "tier_2": {
      "reason": null,
      "state": "measured",
      "unit": "ratio",
      "value": 0.14285714285714285
    },
    "tier_3": {
      "reason": null,
      "state": "measured",
      "unit": "ratio",
      "value": 0.5
    },
    "tier_4": {
      "reason": null,
      "state": "measured",
      "unit": "ratio",
      "value": 0.5
    },
    "tokens": {
      "reason": null,
      "state": "measured",
      "unit": "count",
      "value": 147334
    },
    "total_bill": {
      "reason": null,
      "state": "measured",
      "unit": "usd",
      "value": 2.26771
    },
    "unkeyed": {
      "reason": null,
      "state": "measured",
      "unit": "count",
      "value": 0
    }
  },
  "producer": {
    "commit": "d5372b5a9797137af68e35c478f308f58ca4510c",
    "digest": "sha256:a1a935298956020ee6d767a756847abb4c00694c88c2eb80d454886ebc4acf8c",
    "dirty": false,
    "id": "benchee",
    "repository_url": "https://github.com/smykla-skalski/benchee",
    "version": "1"
  },
  "reviewer": {
    "id": "afi",
    "label": "afi review",
    "repository_url": "https://github.com/smykla-skalski/afi",
    "tool": {
      "interface": "cli",
      "name": "afi"
    }
  },
  "run_id": "afi/fable-5/20260831T172437Z",
  "runtime": {
    "architecture": "arm64",
    "cache_mode": null,
    "cpus": 14,
    "memory_bytes": 38654705664,
    "os": "Darwin",
    "provider_route": "openrouter",
    "region": null,
    "runner_image": null
  },
  "schema": "benchee-run-1",
  "stamp": "20260831T172437Z",
  "status": {
    "reason": null,
    "state": "completed"
  },
  "target": {
    "base_sha": null,
    "diff_digest": "sha256:c921265207938d025d4f2fb47329c377b767144efa630b4072a3836de9cea371",
    "pull_request": 8,
    "repository_url": "https://github.com/smykla-skalski/cairn",
    "reviewed_sha": "9b51f95ef609a219e211e37b082cd2e6913190e0"
  },
  "usage": {
    "reason": null,
    "state": "measured",
    "value": {
      "cached_input_tokens": 0,
      "input_tokens": 145251,
      "models": null,
      "output_tokens": 2083,
      "reasoning_tokens": 14221,
      "requests": 4,
      "stages": []
    }
  }
}