Sabi

The evidence shows unusual candor about security boundaries: docs/security.md openly admits the inference proxy has no credential auth (origin check only), the controller daemon uses a 256-bit bearer token with timingSafeEqual, logs use allowlists with 0600/0700 modes, the install flow requires stating exact files and obtaining confirmation before host changes, and connect scripts default to refusing paid upstreams in non-interactive runs. Deductions: least_privilege — the proxy remains callable by any local process to spend paid credits and SABI_HOST can bind off-loopback; external_effects — real third-party egress (OpenRouter, TypeSafe Jev judge) and a terminal dispatch path exist, fixed but with blast radius depending on an unconfirmed external host; sensitive_data_handling — keys rely on file permissions only, no at-rest encryption, and saveOpenRouterKey has a TOCTOU window; dependency_security — zero runtime deps and read-only CI permissions, but no lockfile audit or dependency scanning evidence; rollback — backups and uninstall notes exist but no unified rollback script; source_attribution — MIT with author attribution, but publisher identity is unverified by the FollowAgents registry.

self_consistency — docs largely match code and the security review even records its own fixes being superseded and corrected, but README and install docs differ slightly on whether the controller package contains the proxy server (README says sabi serve is available; install says the controller package does not contain the proxy server), a minor inconsistency; dependency_availability — requires Node 22.6+, a global npm package, and several optional hosts, with external dependencies (OpenRouter, TypeSafe, Hermes, Command Code) outside repo control; failure_messages — strong, with documented ECONNREFUSED, 403 MODEL_NOT_IN_PLAN, 400 modality refusals, and config-not-found listing every searched path, hence 3.

audience_and_scenarios covers Command Code, OpenCode, Hermes, Claude Code, Codex, Orca with native vs proxy paths distinguished, hence 3; capability_boundaries clearly separates Class A/B, states hooks are not model switching and catalog listing is not plan entitlement, hence 3; trigger_precision has a clear routing rule table (exploration→cheap, failure→strong, etc.) but Jev judge trigger conditions and ambiguity handling are scattered across docs and depend on host signals, hence 2; environment_fit defaults to loopback and supports WSL/containers with explicit warnings about off-loopback binding, and POSIX permission bits do not apply on Windows, hence 2.

information_architecture has a clear repo map, multilingual READMEs, llms.txt and layered docs, hence 3; install_notes separate user-level install, maintainer checkout, per-host commands and completion checks, hence 3; naming_stability — aliases like sabi-code/sabi-cheap are stable, but dual package lines @vizuh/sabi and @vizuh/sabi-controller with separate controller-v* and v* tags are confusing, hence 2; examples_and_faq include a 60-second mental model, round table, cost estimate example and troubleshooting table, hence 3; known_limitations are extensive with dedicated decisions and security docs listing non-claims and open gaps, hence 3; license is full MIT, hence 3; versioning_changelog mentions controller-v0.1.8 and has release workflows but no standalone CHANGELOG file, hence 2; maintenance_responsibility has a SECURITY.md reporting channel and maintainer contract, but publisher identity is unverified and the line is 0.x pre-stable, hence 2.

output_usability — the proxy returns OpenAI-compatible responses and rewrites the model field back to the alias, with readable decision logs and report/dashboard, hence 2 (no full end-to-end output sample shown); marginal_value — the author concedes adaptive tiering does not guarantee beating fixed mid, and the cost example shows savings vs all-strong but higher cost than all-mid, so the value proposition is conditional, hence 2; cost_benefit — transparent rate examples and separately accounted judge overhead exist, but no universal savings claim and no completed-task cost/quality measurement, hence 2.

claim_traceability — most README claims map to docs/security.md, docs/install.md, the security review and test files, with verification dates, hence 3; cross_source_corroboration — the security review and security.md corroborate each other, but the review is self-conducted and some conclusions (e.g. Orca host reachability) are explicitly unconfirmed, with no independent external corroboration, hence 2; fact_inference_separation — docs repeatedly separate evidence layers (source/tests/protocol tests/live smoke/completed-task evals) and state mock success is not savings, hence 3.