JuliusBrussee/caveman · critical

cache-replay: -execute requires -accept-live-cost, -output,

Error message

cache-replay: -execute requires -accept-live-cost, -output, and -verifier-command

What it means

Fatal config error from cache-replay: -execute was requested but the required safety/artifact flags are missing. Live execution sends real requests costing real money, so it demands -accept-live-cost (explicit cost acknowledgement), -output with an absolute path for the results artifact, and -verifier-command with an absolute path to the verifier executable.

Source

Thrown at cacheengine/cmd/cache-replay/main.go:253

	}
	preflight, err := cachebench.ValidateReplay(records, limits, *timeScale)
	if err != nil {
		fatalConfig(err)
	}
	target := cachebench.Target{RequestHitRate: *targetRate, TokenHitRate: *targetRate, MinEligibleRequest: *minEligible}
	if err := cachebench.ValidateReplayTarget(records, target); err != nil {
		fatalConfig(err)
	}
	if !*executeReplay {
		writeStdout(map[string]any{
			"schema": "caveman.cachebench.replay-preflight.v1", "execute": false,
			"trace_sha256": traceSHA, "preflight": preflight, "target": target,
			"message": "preflight only; no provider request sent",
		})
		return
	}
	if !*acceptCost || *outputPath == "" || !filepath.IsAbs(*outputPath) || *verifierPath == "" || !filepath.IsAbs(*verifierPath) {
		fatalConfig(errors.New("cache-replay: -execute requires -accept-live-cost, -output, and -verifier-command"))
	}
	verifierInfo, err := os.Stat(*verifierPath)
	if err != nil || !verifierInfo.Mode().IsRegular() {
		fatalConfig(errors.New("cache-replay: verifier command must be an existing regular file"))
	}
	if err := validateProviderCredentials(records); err != nil {
		fatalConfig(err)
	}
	environment, err := verifierEnvironment(verifierEnv)
	if err != nil {
		fatalConfig(err)
	}
	transport, err := cachebench.NewHTTPReplayTransport(cachebench.HTTPReplayConfig{
		Credentials: cachebench.HTTPReplayCredentials{
			OpenAIAPIKey: os.Getenv("OPENAI_API_KEY"), AnthropicAPIKey: os.Getenv("ANTHROPIC_API_KEY"),
			GeminiAPIKey: os.Getenv("GEMINI_API_KEY"), BedrockAPIKey: os.Getenv("AWS_BEARER_TOKEN_BEDROCK"),
			AWS: awssig.Credentials{AccessKeyID: os.Getenv("AWS_ACCESS_KEY_ID"), SecretAccessKey: os.Getenv("AWS_SECRET_ACCESS_KEY"), SessionToken: os.Getenv("AWS_SESSION_TOKEN")},
		},

View on GitHub (pinned to 27d5a3981a)

Solutions

1. Add -accept-live-cost to explicitly acknowledge live spend
2. Pass absolute paths for both -output and -verifier-command (e.g. "$PWD/out.json")
3. If you only wanted the preflight report, remove -execute

Example fix

# before
cache-replay -execute -trace /abs/t.jsonl -output out.json -verifier-command ./verify.sh

# after
cache-replay -execute -accept-live-cost -trace /abs/t.jsonl -output "$PWD/out.json" -verifier-command "$PWD/verify.sh"

if execute {
	if !acceptCost || !filepath.IsAbs(outputPath) || !filepath.IsAbs(verifierPath) {
		return errors.New("live replay needs -accept-live-cost plus absolute -output and -verifier-command")
	}
}

When it happens

Trigger: Passing -execute without -accept-live-cost; giving -output or -verifier-command a relative path (filepath.IsAbs fails); omitting either flag while -execute is set.

Common situations: Promoting a preflight command to live replay and forgetting the cost acknowledgement; scripts using relative paths that worked for other tools; CI writing outputs to a relative artifacts/ directory.

Related errors

• cache-replay: custom base URLs require -allow-custom-base-ur
• want provider=https://host
• cache-replay: -trace and positive request/token/trace/respon
• cache-replay: verifier command must be an existing regular f
• invalid agent evidence identity

AI-assisted analysis of JuliusBrussee/caveman@27d5a3981a (2026-08-15). Data as JSON: /api/errors/139e3fe87afa46e0. Report an issue: GitHub.