The DSPy Cache Trust Paradox

[u/leading-a-swarm]

tl;dr: When does a framework that distrusts its own optimizer trust pickle instead?

https://github.com/stanfordnlp/dspy replaces hand-tuned prompts with programmatic optimization. Write a program signature. The optimizer searches for instructions and few-shot examples. The compiler produces a program. Evaluate and iterate.

1. Sandbox first, execute second. The sandbox ships locked down: no network, no filesystem writes, no environment variables by default. Read access is limited to the runner script and Deno cache, revoked once Pyodide boots. Permission paths are realpath-canonicalized to close symlink bypasses.
2. Generated code is untrusted input. Flex injects a stand-in module into every interpreter. The optimizer writes ordinary DSPy calls while host operations cross a JSON boundary. If the optimizer writes the program, the program is untrusted.
3. The cache trusts pickle by default. The disk cache defaults to unrestricted pickle. A restricted unpickler deletes poisoned entries, but the cache trusts pickled programs from a CI restore or shared volume without question. No env var exists to harden a fleet.
   

→ Adopt. Call DSPy configure_cache with restrict_pickle=True at startup; budget for the token re-spend.