afi / afi · cli reviewed proxy at 9b51f95e with Default profile / OpenAI · gpt 5.6 luna high on afi 0.30.0
Unavailable values retain their exported state and reason
Lifecycle, reviewer, build, settings, and normalized execution limits
8c8c79c46163config-657388b88e14616db0f313c0b59a66ecc7612396dc8db0ea5da13a7acomparison-2f7717ed5785716dbuild-33906dcd701a0660cohort-fdab2adfb8a4bd39631c4107752a97104719622800c9815e030613cf dirtysha256:a1a935298956020ee6d767a756847abb4c00694c88c2eb80d454886ebc4acf8cNormalized reviewer-tool usage projection
Normalized assessment summary
Review text is escaped; normalized decisions follow each finding
clear_partials` deletes every file in `incoming` without coordinating with active writers, so a live fetch can lose its temporary path and fail when `BlobWriter::commit` renames it.
services/proxy/src/sweep.rs:91
Evidence quote
Not recorded
Suggested fix
Not recorded
The index snapshot is not synchronized with fetch commits; a sweep can see a newly committed but not-yet-linked blob as unreferenced, delete it, and leave the subsequent index entry pointing to a… The index snapshot is not synchronized with fetch commits; a sweep can see a newly committed but not-yet-linked blob as unreferenced, delete it, and leave the subsequent index entry pointing to a missing blob.
services/proxy/src/sweep.rs:119
Evidence quote
Not recorded
Suggested fix
Not recorded
On-demand sweeps bypass the `running` mutex used by periodic sweeps, allowing concurrent sweeps to race while collecting, unlinking blobs, and removing index entries.
services/proxy/src/routes/admin.rs:76
Evidence quote
Not recorded
Suggested fix
Not recorded
The handler performs a potentially huge recursive filesystem walk synchronously on a Tokio worker, which can block cache requests and health probes while sweeping a large store.
services/proxy/src/routes/admin.rs:76
Evidence quote
Not recorded
Suggested fix
Not recorded
forget` runs during dry runs even though selected blobs are not removed, so `?dry_run=true` deletes their index entries and can cause a later sweep to delete those still-present blobs.
services/proxy/src/sweep.rs:140
Evidence quote
Not recorded
Suggested fix
Not recorded
When `remove_file` fails, execution still counts the candidate as removed and adds it to `gone`, so the response and metrics report reclaimed bytes while the blob remains and its index entries are… When `remove_file` fails, execution still counts the candidate as removed and adds it to `gone`, so the response and metrics report reclaimed bytes while the blob remains and its index entries are then deleted.
services/proxy/src/sweep.rs:126
Evidence quote
Not recorded
Suggested fix
Not recorded
values()` supplies reclaimed bytes in the slot declared for removed blobs and blobs in the slot declared for bytes, so Prometheus exposes both sweep counters under the wrong names.
services/proxy/src/metrics.rs:94
Evidence quote
Not recorded
Suggested fix
Not recorded
tokio::time::interval` fires its first tick immediately, contrary to the stated one-interval delay, so every restart sweeps the cache immediately instead of waiting for `CAIRN_SWEEP_INTERVAL`.
services/proxy/src/main.rs:108
Evidence quote
Not recorded
Suggested fix
Not recorded
Open a row to inspect or download evidence from this atomically published local run
Open this path at the exported commit
The artifact is present; its content is available through the verified source link
Open this path at the exported commit
The artifact is present; its content is available through the verified source link
Open this path at the exported commit
The artifact is present; its content is available through the verified source link
Open this path at the exported commit
The artifact is present; its content is available through the verified source link
Open this path at the exported commit
The artifact is present; its content is available through the verified source link
Open this path at the exported commit
The artifact is present; its content is available through the verified source link
Open this path at the exported commit
The artifact is present; its content is available through the verified source link
Open this path at the exported commit
The artifact is present; its content is available through the verified source link