{"record":{"id":"139e3fe87afa46e0","repo":"JuliusBrussee/caveman","slug":"cache-replay-execute-requires-accept-live-cost","errorCode":null,"errorMessage":"cache-replay: -execute requires -accept-live-cost, -output, and -verifier-command","messagePattern":"cache-replay: -execute requires -accept-live-cost, -output, and -verifier-command","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"cacheengine/cmd/cache-replay/main.go","lineNumber":253,"sourceCode":"\t}\n\tpreflight, err := cachebench.ValidateReplay(records, limits, *timeScale)\n\tif err != nil {\n\t\tfatalConfig(err)\n\t}\n\ttarget := cachebench.Target{RequestHitRate: *targetRate, TokenHitRate: *targetRate, MinEligibleRequest: *minEligible}\n\tif err := cachebench.ValidateReplayTarget(records, target); err != nil {\n\t\tfatalConfig(err)\n\t}\n\tif !*executeReplay {\n\t\twriteStdout(map[string]any{\n\t\t\t\"schema\": \"caveman.cachebench.replay-preflight.v1\", \"execute\": false,\n\t\t\t\"trace_sha256\": traceSHA, \"preflight\": preflight, \"target\": target,\n\t\t\t\"message\": \"preflight only; no provider request sent\",\n\t\t})\n\t\treturn\n\t}\n\tif !*acceptCost || *outputPath == \"\" || !filepath.IsAbs(*outputPath) || *verifierPath == \"\" || !filepath.IsAbs(*verifierPath) {\n\t\tfatalConfig(errors.New(\"cache-replay: -execute requires -accept-live-cost, -output, and -verifier-command\"))\n\t}\n\tverifierInfo, err := os.Stat(*verifierPath)\n\tif err != nil || !verifierInfo.Mode().IsRegular() {\n\t\tfatalConfig(errors.New(\"cache-replay: verifier command must be an existing regular file\"))\n\t}\n\tif err := validateProviderCredentials(records); err != nil {\n\t\tfatalConfig(err)\n\t}\n\tenvironment, err := verifierEnvironment(verifierEnv)\n\tif err != nil {\n\t\tfatalConfig(err)\n\t}\n\ttransport, err := cachebench.NewHTTPReplayTransport(cachebench.HTTPReplayConfig{\n\t\tCredentials: cachebench.HTTPReplayCredentials{\n\t\t\tOpenAIAPIKey: os.Getenv(\"OPENAI_API_KEY\"), AnthropicAPIKey: os.Getenv(\"ANTHROPIC_API_KEY\"),\n\t\t\tGeminiAPIKey: os.Getenv(\"GEMINI_API_KEY\"), BedrockAPIKey: os.Getenv(\"AWS_BEARER_TOKEN_BEDROCK\"),\n\t\t\tAWS: awssig.Credentials{AccessKeyID: os.Getenv(\"AWS_ACCESS_KEY_ID\"), SecretAccessKey: os.Getenv(\"AWS_SECRET_ACCESS_KEY\"), SessionToken: os.Getenv(\"AWS_SESSION_TOKEN\")},\n\t\t},","sourceCodeStart":235,"sourceCodeEnd":271,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/cacheengine/cmd/cache-replay/main.go#L235-L271","documentation":"Fatal config error from cache-replay: -execute was requested but the required safety/artifact flags are missing. Live execution sends real requests costing real money, so it demands -accept-live-cost (explicit cost acknowledgement), -output with an absolute path for the results artifact, and -verifier-command with an absolute path to the verifier executable.","triggerScenarios":"Passing -execute without -accept-live-cost; giving -output or -verifier-command a relative path (filepath.IsAbs fails); omitting either flag while -execute is set.","commonSituations":"Promoting a preflight command to live replay and forgetting the cost acknowledgement; scripts using relative paths that worked for other tools; CI writing outputs to a relative artifacts/ directory.","solutions":["Add -accept-live-cost to explicitly acknowledge live spend","Pass absolute paths for both -output and -verifier-command (e.g. \"$PWD/out.json\")","If you only wanted the preflight report, remove -execute"],"exampleFix":"# before\ncache-replay -execute -trace /abs/t.jsonl -output out.json -verifier-command ./verify.sh\n\n# after\ncache-replay -execute -accept-live-cost -trace /abs/t.jsonl -output \"$PWD/out.json\" -verifier-command \"$PWD/verify.sh\"","handlingStrategy":"validation","validationCode":"if execute {\n\tif !acceptCost || !filepath.IsAbs(outputPath) || !filepath.IsAbs(verifierPath) {\n\t\treturn errors.New(\"live replay needs -accept-live-cost plus absolute -output and -verifier-command\")\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Make live replay a two-step pipeline: preflight command, then the same command with -execute -accept-live-cost and absolutized paths appended","Gate -accept-live-cost behind a budget approval step in automation"],"tags":["go","cli","configuration","cost-control","security"],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}