[Dream Cycle 2026-09-03] security-adversarial: independent re-derivation finds unfixed floating-tag bypass in open PR #19's unpinned-npx detector + redblue,supply-chain scan

[ruvnet]

Rotation

DEEP=security-adversarial, SCAN=redblue,supply-chain (slot 3, DAYINT % 5 = 3). No bonus deep dive (DAYINT % 25 = 3, DAYINT % 75 = 28).

Ledger Check

docs/dream-cycle/LEDGER.md on main ends at the 2026-08-26 row (stale — see below). ledger signals: {"zeroMergeStreak":true,"duplicateDirections":[],"lowScoreStreak":false,"blockedEvalStreak":false,"nightsConsidered":6}. Checking actual GitHub state (this session has GitHub MCP tools, no gh CLI): 29 open PRs, 30 open issues. Critically, issue #18 / PR #19 (2026-08-18) already targets this exact rotation slot's finding (unpinned npx in evaluatorEntrypoints), and issue #39 / PR #40 (2026-08-27) already ships a verify-entrypoints CLI aggregator. Both open, unmerged, zero review comments before tonight.

Deep Dive

Rather than open a third implementation of the same detector, this session built one from scratch locally and put it through three rounds of independent adversarial critique (fresh subagent each round, no shared context with the implementer):

• Round 1: found and fixed 3 real bypasses — floating dist-tags/bare major-minor tags (@latest, @1, @1.6) misclassified as pinned; only the first npx in a chained command inspected; sh -c "npx …" indirection invisible to a position-anchored regex.
• Round 2: found and fixed 1 more — npx's own -p/--package flag can install a second, unpinned package alongside a pinned-looking primary spec.
• Round 3: no further bypass found across -n/-c/-q/-y, chained/piped/sh -c-wrapped commands, -p/--package (space and = forms) — clear to ship as a standalone module.

Cross-checking that process's findings against PR #19's already-shipped packages/compile/src/supplychain.ts found the same class of bug still present and unfixed: isUnpinned only checks that the version segment starts with a digit (/^\d/.test(version)), not that it's a full exact major.minor.patch. isUnpinned('@metaharness/darwin@1') and @metaharness/darwin@1.6 both return false (pinned) — traced logically against the diff, not merely asserted. Today's actual dream.config.json#evaluatorEntrypoints.darwin (no @ at all) is still correctly flagged by PR #19 as-is — this is a latent gap for a future half-pin, not an active miss on current data.

Hypothesis

Frozen before evaluation: "Given a from-scratch, independent implementation of an unpinned-npx supply-chain detector, subjected to three rounds of adversarial critique, the implementation should either converge bypass-free, and/or surface bypasses also present in any existing open implementation of the same idea — in which case reporting the cross-check is higher-value than shipping a duplicate." Confirmed: converged bypass-free (round 3), and found one bypass shared with PR #19.

Evaluation Receipt

Real evaluator: npm test (vitest). Local candidate (not committed — see Recommendation): 98 → 116 tests, 0 regressions, clean build, clean lint. Live receipt against this repo's real dream.config.json: bench: live, darwin: SKIPPED — unpinned npx package, supply-chain policy forbids auto-exec (never executed the live registry package). Full report + evidence trail: docs/dream-cycle/2026-09-03-security-adversarial-report.md.

Darwin Results

DARWIN=not-applicable — same rationale as ADR-0002 / PR #19: a single detector function has no meaningful mutable population.

Reward-Hack Check

N/A in the conventional sense — no code ships tonight, so no benchmark/gold/threshold surface to game. Full local diff, test counts, and reasoning are published in the committed report and the PR #19 comment rather than suppressed.

Security Review

No prompt injection surface, no credential exposure, no new filesystem/network I/O. The round-2 -p/--package finding is itself security-relevant and was relayed to PR #19's thread since its detector has the same blind spot in principle (latent, not active, on today's config).

Scan Findings

redblue: not re-probed (no new evidence justifying revisiting the 2026-08-13 suspicious-silent finding).
supply-chain: this issue's whole subject — adversarial verification of an existing detector (PR #19) rather than a new one, finding one real residual gap via independent re-derivation.

Competitors

Unchanged from 2026-08-18's survey (Sakana AI Scientist, OpenHands, DSPy/GEPA, SWE-agent/SWE-bench, AutoGPT lineage) — no new external research tonight; this cycle's contribution is a cross-check of existing in-repo work.

Gist

No gist-creation MCP tool available this session. Report committed at docs/dream-cycle/2026-09-03-security-adversarial-report.md. GIST=LOCAL.

Witness

report_sha256 : 2c8b3bf5f406bb9b6ce11b743308c9e3d259c19fd02e0e1c6e32e4c9d3e891be
session_commit: 7933c3599abe22df5290f4609d1f93f598feb3de
witness       : 9a21363d3adf50a6ef1e8f7ad70c39a5b6254525874cebcfd51e6a69879867c6

Verify: sha256sum docs/dream-cycle/2026-09-03-security-adversarial-report.md, then printf '%s%s' "<hash>" "7933c3599abe22df5290f4609d1f93f598feb3de" | sha256sum must equal the witness above. Independently confirmed via dream-machine witness stamp tonight.

Recommendation

evaluated: yes / verdict: REJECT (the candidate — not because it's wrong, it passed 3 adversarial rounds clean, but because it duplicates already-open, more complete work). Concretely:

1. Fix PR security-adversarial: detect unpinned npx supply-chain risk in evaluator entrypoints #19's isUnpinned to require a full exact-semver match before merging — repro + suggested diff posted at security-adversarial: detect unpinned npx supply-chain risk in evaluator entrypoints #19 (comment).
2. Consider merging PR security-adversarial: detect unpinned npx supply-chain risk in evaluator entrypoints #19 and/or fix(config): darwin evaluatorEntrypoint missing required <repo> positional + verify-entrypoints #40 — both complete, tested, address a real live exposure. Note PR fix(config): darwin evaluatorEntrypoint missing required <repo> positional + verify-entrypoints #40's verify-entrypoints has no pinning awareness of its own; merged alone it would still auto-exec the unpinned darwin entrypoint.
3. The ledger-staleness / duplicateDirections blindness that let tonight almost repeat existing work is already tracked ([Dream Cycle 2026-08-26] ledger-signals: duplicateDirections can't see still-open PRs (+ 9-PR unmerged backlog) #32/ledger-signals: extend duplicateDirections to see still-open PRs #33, [Dream Cycle 2026-09-01] ledger-signals: cross-night ledger staleness goes undetected + witness,verify scan #61/ledger-signals: detect a stale cross-night ledger (main frozen 6d) #62) — no new action proposed here.

[ruvnet]

Status update — 2 of the 3 bypass classes are fixed on main; one is still live.

Verified directly against packages/compile/src/supplychain.ts at current main, not inferred:

• ✅ Floating/partial version tags — fixed by security-adversarial: detect unpinned npx supply-chain risk in evaluator entrypoints (supersedes #19) #84 (merged 2026-09-05). isUnpinned now requires an exact major.minor.patch via EXACT_SEMVER, so @1, @1.6, @1.x, ^1.2.3, latest etc. are all correctly flagged.
• ✅ Only the first --package/-p scanned — fixed by security-adversarial: detect unpinned npx supply-chain risk in evaluator entrypoints (supersedes #19) #84. extractPackageSpecs now collects every --package=/--package <spec>/-p <spec> before the command positional.
• ❌ sh -c "npx …" indirection — STILL BYPASSES THE DETECTOR.

findUnpinnedNpxInvocations tokenizes with command.split(/\s+/), which is whitespace-only and never unwraps shell quoting. For sh -c "npx foo@latest" the tokens are sh, -c, "npx, foo@latest" — so the tokens[i] === 'npx' test never matches (the token carries a leading quote) and no finding is produced.

Worth noting the outer scan loop does handle chained commands correctly — it iterates all tokens rather than stopping at the first npx — so that half of the round-1 finding is not a live gap.

This one is well-scoped and has no competing open PR, unlike the duplicated clusters that were just consolidated. A fix needs real shell-aware lexing (quote/sh -c unwrapping) rather than a wider regex, so it deserves its own change rather than being bolted onto the existing tokenizer.

Keeping this issue open for that remaining gap.

Co-Authored-By: RuFlo ruv@ruv.net
Claude-Session: https://claude.ai/code/session_01Ff2xRKvYrqXJhefvcapfE1