dream(security-adversarial): disclose devDependency exclusion in harness audit/sbom (evaluated)

[ruvnet]

Hypothesis

Given harness audit/harness sbom in default mode (no --include-dev),
when a disclosure patch reports the suppressed advisory count (audit) /
excluded package count (sbom) without changing default PASS/FAIL gating,
then a reviewer should be able to tell from default output alone that
devDependencies were excluded — subject to: (a) default audit gating
unchanged, (b) no new dependency/external destination, (c) 0 regressions,
(d) new tests must fail against pre-patch code.

Candidate

Two files, ~70 lines of source change:

• packages/create-agent-harness/src/audit-cmd.ts — when !includeDev,
  runs one additional best-effort npm audit (no --omit=dev) to compute
  a suppressed-advisory count, surfaced as a new line (text) /
  devDependenciesSuppressed field (--bundle). Never affects the
  existing pass/fail code. Also fixes a pre-existing double-counting bug
  in the total calculation (see Reward Hack Check).
• packages/create-agent-harness/src/sbom-cmd.ts — counts dev-scope
  packages excluded from the SPDX document, adds creationInfo.comment
  plus a matching CLI line when any were excluded.

Evaluation Receipt

Deterministic code-correctness fix (no benchmark corpus/model calls
needed; LLM_EVAL=available but unused). Real before/after repro against
this repo's own package-lock.json:

BEFORE  harness audit          → PASS: 0 advisories at high+  (no mention
                                   that 8 exist in devDependencies)
        harness sbom            → 1 package, no indication 197 dev
                                   packages were excluded

AFTER   harness audit          → devDependencies not counted: 8 advisories
                                   (5 at high+) — re-run with --include-dev
                                   PASS: 0 advisories at high+  (gate unchanged)
        harness audit --include-dev → FAIL: 5 advisories at high+
        harness sbom            → creationInfo.comment: "197 devDependency
                                   package(s) excluded ... --include-dev
                                   for a build/CI-time-complete SBOM."

New tests: sbom-cmd.test.ts (4), audit-cmd.test.ts (6) — all verified
to fail against pre-patch code (git stash + re-run: 2/4 and 2/6
failed on exactly the new-disclosure assertions), then pass post-patch.

Baseline Comparison

create-agent-harness full suite: baseline 467/467 passed (2 skipped)
→ candidate 468/468 passed (2 skipped). 0 regressions. tsc --noEmit
clean. Diff: 2 source files (~70 lines) + 2 new test files (~180 lines) —
under the 300-line target, one conceptual change applied to both commands.

Darwin Lineage

Not run — this is a CLI-tooling correctness/disclosure fix, not a
genome/routing/topology/prompt/tool/tier parameter; no bounded-evolution
mutation surface applies.

Flywheel Evidence

Not applicable — generator-CLI fix, not a harness-runtime promotion
candidate. Evidence retained as the committed tests + gist + this PR.

Reward Hack Check

No test/benchmark weakened; no evaluator exploited (no corpus exists to
exploit); no hidden preprocessing. Disclosed cost: harness audit's
default path now makes 2 npm audit calls instead of 1 — real
latency/network increase, not hidden, left as a future-work
cache/memoize item rather than solved here. Bug caught and fixed in
this diff: npm audit's metadata.vulnerabilities object includes a
total key alongside the 5 severity keys; both my first draft of the new
disclosure line and the pre-existing total variable summed
Object.values(counts), double-counting that key (invisible previously
only because this repo's --omit=dev scope happens to be all-zero). Fixed
both occurrences to sum only the 5 known severity keys; added a regression
test with a realistic total key in the mock so it can't silently
reappear.

Security Review

No new dependency, no new external destination (same npm registry
harness audit already contacts). Strictly more honest default-mode
output; no reduction in security posture. Only tradeoff is the disclosed
latency/network increase, avoidable via --include-dev (which already
skips the second call).

ADR

None created — this is a bug-fix-shaped correctness/disclosure change to
existing CLI commands, not an architectural decision (no new component,
no new policy). Per this repo's own guidance, ADRs are for architectural
decisions, not parameter/output-format fixes.

Research Gist

docs/dream-cycle/2026-08-28-gist.md (committed on this branch,
GIST=LOCAL — no gist-creation tool available this session, matching
every prior Dream Cycle night). Includes sourced 2025-2026 supply-chain
research (Shai-Hulud worm, May 2026 node-ipc CI-credential exfiltration),
a competitor comparison table, and a second, unfixed finding
(threat-model's MCP-in-use false negative) flagged for a future night.

Issue

Closes evidence for #242.

Witness

session_commit : 6f8c60216f47eac391a076fe27fd804470a07e10
report_sha256  : 216c5f512f49c4bc4d0256259581560703370722d35ac905320b582fe01e251b
witness        : 77fae59b62c547aa6b67189154890d0e37c85925ee72dc8071f3ed109e4ecdf6

Verifier procedure in the gist file itself.

Merge Policy

Human review required. Do not self-merge. Do not autonomously promote
Flywheel state.

---

Generated by Claude Code