CacheProof

CacheProof is a controlled regression-debugging experiment built for the IBM Bob 2.0 Hackathon. The project focuses on a realistic class of software defect: a cache that can return one user’s profile to a different requester while still producing structurally valid responses. The sample FastAPI application exposes GET /api/profile and identifies callers through the X-User-ID header. In the frozen defective state, the cache stored one module-level profile and reused it across identities. Sequential requests could therefore return the first user’s profile to later users. IBM Bob received the failing application, the repository source and tests, and the observable symptom, but not the defect-introducing history or the designer’s root-cause answer. In a fresh task, Bob investigated the codebase, reproduced the failure, diagnosed the unkeyed cache, and made a focused repair in src/cacheproof/cache.py by replacing the single cached profile with a cache keyed by user_id. The important part of CacheProof is that Bob did not control final acceptance. A separate operator-side verifier reconstructed a fresh workspace from the sealed defective snapshot, verified the protected verification surface, transplanted only Bob’s application source, and then ran the frozen acceptance gates. Those gates covered cross-identity isolation, same-identity reuse, the complete pytest suite, and a fresh Uvicorn runtime check. The authoritative result was PASS / T3 reached. The public repository also reproduces the repaired state with 14 passing tests and a successful runtime check. A separate judge-facing demo visualizes the broken and repaired behaviors, while clearly distinguishing presentation from the frozen experiment and its evidence.