[Dream Cycle 2026-08-28] security-adversarial: npm audit findings unreported/ungated in CI + redblue,supply-chain scan

[ruvnet]

Rotation

DEEP=security-adversarial, SCAN=redblue,supply-chain (SLOT=3, DAYINT % 5). Nightly Dream Cycle, 2026-08-28.

Ledger Check

dream-machine ledger signals on docs/dream-cycle/LEDGER.md: zeroMergeStreak: true (6/6 nights considered, 0 candidate PRs merged). This biased tonight's candidate toward a tiny, one-function, easily reviewable change rather than the larger vitest/vite major-version upgrade issue #37 also proposes.

Deep Dive

npm ci on this repo's own lockfile reports 8 dependency vulnerabilities (2 critical, 1 high, 3 moderate, 2 low), but CI does not gate on any of them — this is exactly the gap issue #43 already names. npm audit --omit=dev --json, run live tonight, shows all 8 findings live in the vitest/vite/esbuild/eslint dev toolchain; the 13 production dependencies show 0 findings.

Hypothesis

Given this repo's CI pipeline, which currently reports npm audit findings without gating on them, when a deterministic classifier is added that parses npm audit --omit=dev --json output and fails CI only on a high/critical finding within that production-scoped report, then CI should correctly distinguish reachable production risk (0 findings, confirmed live) from dev-toolchain risk (8 findings, confirmed live) — subject to: no existing test modified/weakened, no re-derivation of npm's own dependency-graph reachability computation, zero-false-negative against a synthetic high/critical finding, zero-false-positive against tonight's real dev-only findings. Frozen before implementation.

Evaluation Receipt

Real evaluator: npm test (vitest). Baseline (parent 7933c359): 98/98 passing. Candidate: 111/111 passing (+13 new, 0 removed/modified). Lint and build clean. Live end-to-end: dream-machine audit-gate against tonight's real npm audit --omit=dev --json returns clear (exit 0); against the real dev-inclusive report it returns blocked (exit 1) — proves it is not a rubber stamp.

Darwin Results

DARWIN=not-applicable. Probed live tonight (npx @metaharness/darwin evolve --sandbox mock → real leaderboard, winner g2_v5, LIVE) — no evolvable population exists for a single, already-minimal pure classifier (same rationale as ADR-0002 / PR #19).

Evidence

Grade A (reproduced live tonight): npm audit --omit=dev --json → metadata.vulnerabilities all-zero, metadata.dependencies.prod: 13. Grade A: npm audit --json (dev-inclusive) → 2 critical / 1 high / 3 moderate / 2 low, matching issue #37's independently-reported findings exactly. Grade B: npm's own --omit=dev dependency-graph walk is the standard/authoritative reachability computation (not re-derived here, by design — see Reward-Hack Check).

Reward-Hack Check

Self-adversarial (solo session, no separate critic agent available): does not touch any existing test/gold/threshold/evaluator entrypoint; delegates production-reachability to npm's own graph walk rather than re-implementing it (avoiding PR #19's false-positive/negative class of bug); malformed/partial audit JSON classifies as malformed (exit 2), never silently clear; CI's || true only survives npm audit's own nonzero exit on findings, the gate command itself still determines the job's real exit code. Full detail in the committed report.

Security Review

No prompt-injection surface (pure JSON parsing, no LLM calls). No credential exposure, no new network I/O. New filesystem I/O is a single local read of a caller-supplied JSON path, same pattern as every other CLI command.

Scan Findings

• supply-chain: 8 real advisories confirmed live, 100% dev-toolchain-scoped, 0% production-scoped. Remediation (actual vitest/vite upgrade) is issue Security: update Vitest and Vite dev stack past published file access advisories #37's separate scope, deliberately left untouched tonight.
• redblue: no new work tonight; PR security-adversarial: detect unpinned npx supply-chain risk in evaluator entrypoints #19 (2026-08-18) already covers unpinned-npx detection on this surface and remains open.

Competitors

npm CLI's own --omit=dev graph walk (A, reproduced live) · GitHub Dependabot/Advisory DB (B, vendor docs — surfaces alerts but doesn't itself gate CI) · OWASP Dependency-Check/Dependency-Track reachability-based gating (B, established practice) · Sakana AI Scientist / OpenHands / DSPy-GEPA / SWE-agent / AutoGPT lineage (C, no evidence any publishes a comparable supply-chain gating policy for its own harness).

Gist

No gist-creation tool available this session (no gh CLI, no gist MCP tool). Report committed at docs/dream-cycle/2026-08-28-security-adversarial-report.md. GIST=LOCAL.

Witness

report_sha256 : 409d5fc4902ebdaec272ee495583a56cd95cc18b2077097c82daa3e4045bdc9e
session_commit: 7933c3599abe22df5290f4609d1f93f598feb3de
witness       : fe3d8a92497e59700481b6ce27ba5fec39804c7f61fa18f7f6e2a3a52d7d3caa

Verify: sha256sum docs/dream-cycle/2026-08-28-security-adversarial-report.md, then printf '%s%s' "<that hash>" "7933c3599abe22df5290f4609d1f93f598feb3de" | sha256sum must equal the witness above. Confirmed tonight via dream-machine witness verify (✓ VALID).

Recommendation

evaluated: accepted — sufficient evidence to recommend human review. Draft PR to follow, referencing this issue.