[Dream Cycle 2026-09-27] intelligence: expose fisherDecayRate via env override + capabilities,memory scan #3475

1. Tonight's Rotation

DATE=2026-09-27
DEEP=intelligence
SCAN=capabilities,memory
SLOT=2 (DAYINT % 5 == 2)
COMMIT=a5adb5aadc8378169c7ad9ddee8c942bc3f9f9a1
BRANCH=dream/2026-09-27-intelligence

No bonus deep dive (DAYINT % 25 == 2, DAYINT % 75 == 52 — neither trigger condition met).

2. Ledger Check

Read docs/dream-cycle/LEDGER.md (last 14+ rows inspected). GitHub-verified (via MCP pull_request_read, gh CLI unavailable this session — confirmed command not found) fates for the last 8 dream-cycle nights, all re-checked directly rather than trusted from the ledger's own prose:

A large batch merge landed 2026-09-26 (yesterday), clearing nearly the entire prior backlog — reverses the "0 of last 14 merged" bias condition from earlier in the ledger's history; tonight did not bias toward an artificially small candidate on that basis (though the candidate landed small anyway, on its own merits).

No-run gap, confirmed via git ls-remote --heads origin "dream/*": 2026-09-23, 2026-09-25, and 2026-09-26 have no dream/* branch, issue, or PR — same verification standard as the documented 08-20..23 and 09-13/09-14 gaps, root cause still undiagnosed. (2026-09-24 has a branch/PR — dream/2026-09-24-github-safe-artifact-parity / PR #3412 — but it is a genuine off-cycle security fix for a separately-reported issue #3411, not a rotation night; merged.)

3. Deep Dive Findings

Full detail in the committed gist. Headline: EWCConsolidator's fisherDecayRate (default 0.01) now has one consistent, correct EMA direction across all three globalFisher-mutating sites (post-#3395), but had no env override — unlike its closest sibling tunable, ModelRouter.priorDecay (CLAUDE_FLOW_PRIOR_DECAY, #3350). Verified via direct code read that intelligence.ts:326 never passes an explicit fisherDecayRate, so production always used the hardcoded default.

4. Hypothesis

Given EWCConsolidator's fisherDecayRate now correctly gating one consistent EMA direction across all three globalFisher-mutating sites (post-#3395), when a CLAUDE_FLOW_FISHER_DECAY env override is added — mirroring envPriorDecay()/envMaxUncertainty() exactly (validated via Number.isFinite, range (0,1], silent fallback to the unchanged default on invalid/unset input) — then operators/future Dream Cycle nights should be able to experiment with different decay-rate values without a source change, subject to: (1) unset/invalid env leaves default behavior byte-identical; (2) an explicit constructor value still takes precedence; (3) all existing EWC tests remain green; (4) deterministic, $0 evaluation.

Deliberately scoped to making the parameter tunable, not finding a better value — see Darwin Results.

Frozen before evaluation; not modified after seeing results.

5. Evaluation Receipt

evaluated: accepted (ACCEPT-scoped). Real evaluator: Vitest 4.1.8, deterministic, $0, zero LLM calls, run against a freshly pnpm install-ed workspace (this checkout's v3/ pnpm workspace and dist/ were not pre-built at session start — confirmed via node bin/cli.js metaharness --help failing ERR_MODULE_NOT_FOUND).

New file __tests__/ewc-fisher-decay-env-override.test.ts (5 tests). Stash-isolated baseline (source reverted, test file kept): exactly 1/5 fails against real baseline (0.158... not < 0.104..., the "wires the env var" discriminator), 4/5 pass both ways (correct non-discriminating controls: out-of-range/non-numeric/zero-value fallback, and explicit-config-precedence). Candidate: 5/5 pass.

Full failed-file set for @claude-flow/cli's vitest suite: byte-identical 108 pre-existing files baseline vs. candidate (diffed, not just counted) — the unbuilt-sibling-package/environmental class documented by nearly every prior night. tsc --noEmit: byte-identical 475 pre-existing errors (unbuilt @claude-flow/memory/@claude-flow/neural/@claude-flow/cli-core sibling packages), none in changed files. EWC-adjacent suites (ewc-fisher-ema-direction.test.ts, ewc-distill-confidence-gate.test.ts): 7/7 passing, no regression.

6. Darwin Results

Skipped — for a different reason than every prior night. fisherDecayRate genuinely is now a real, bounded (0,1], correctly-directioned scalar — Darwin's real interface (npx ruvector harness darwin <config> --execute, confirmed available) could in principle sweep it, unlike every prior candidate (binary correctness fixes with no continuous parameter). Not invoked because doing so honestly requires a fitness function tied to a real downstream outcome, and none exists yet in this repo for Fisher-decay values specifically (existing/new tests validate EMA direction and env-wiring correctness at fixed decay values, not a quality tradeoff across values). Declined to fabricate a synthetic proxy purely to produce a Darwin result. Concrete named follow-up (per independent adversarial critique's ask, not left open-ended): a future night should replay real trajectory/distill history through intelligence.ts's actual distillLearning() path and measure downstream pattern-reuse/success-rate under different decay values, then run Darwin against that real signal.

7. Flywheel Evidence

No .claude-flow/flywheel/ state exists in this repo (direct check) and no signed @metaharness/flywheel bundle applies (confirmed via npx ruvector harness flywheel --help: real verify/gate interface targets a replay bundle this deterministic config-fix doesn't produce). Evidence retained as: 5 new discriminating tests, this issue, the committed gist, the stash-isolated comparison, the independent adversarial critique transcript, and this issue's own control-plane discovery notes.

8. Reward Hack Check

Manual checklist (no standalone reward-hack CLI reachable — confirmed via npx ruvector harness --help: status/route/flywheel/darwin only), independently re-verified by the adversarial critic: no existing test weakened (diff is additive-only, one new file); no gold/expected data touched; no cherry-picking (full EWC-adjacent suite and full package failed-file set reported, not just the new file); no seed manipulation (fully deterministic, re-run 4 times with zero flakiness); zero cost hiding.

9. Security Review

Not security-sensitive. envFisherDecayRate() uses the identical safe pattern as sibling envPriorDecay()/envMaxUncertainty() (Number() + Number.isFinite + explicit range check, silent-safe fallback, no eval/exec). Independently confirmed by the adversarial critic: no request-body/API/MCP-input path can set CLAUDE_FLOW_FISHER_DECAY — operator-set process env only, same trust boundary as the existing CLAUDE_FLOW_PRIOR_DECAY.

10. Scan Findings: capabilities

Verified live (full-file reads, independently re-confirmed by two research roles): plugins.ts's installCommand declares a --verify flag (default true) that is parsed and never referenced again; manager.ts's installFromNpm()/installFromLocal() have zero policy check against declared trustLevel/permissions before running npm install. A real, tested Ed25519 verifier already exists for exactly this — @claude-flow/security/src/plugins/integrity-verifier.ts's PluginIntegrityVerifier (ADR-145 P1, Status: Proposed, not Accepted) — but is imported nowhere outside the security package/tests/ADRs. trust-anchors.json holds only a placeholder all-zero key. Evidence grade A. Not selected (SCAN surface tonight; wrong surface for a DEEP fix anyway) — flagged as the single most actionable finding across all three surfaces tonight: every real external comparator (npm provenance/Sigstore, VS Code Marketplace, Chrome Web Store, even the bare MCP spec plus NSA/CISA guidance) has some enforced install-time control; Ruflo's is currently cosmetic. Strong <300-line candidate for the next capabilities night.

11. Scan Findings: memory

Two findings, both independently confirmed still-live via direct code read (checked against git log for what #3169/#3266 actually fixed, to avoid double-counting an already-fixed bug): (1) smart-retrieval.ts's mmrRerank() — token-Jaccard caching was fixed by #3169/#3266, but the cosine-similarity path still recomputes O(N·L) against every selected item on every pass, no running max-similarity cache; realistic scale (N=30, L=20 for a typical limit=10 request) matches this repo's own existing mmr-rerank.bench.ts. (2) hnsw-index.ts's distance() now correctly dispatches 'product'-quantized vectors (a real fix landed since last flagged) but still has no case for 'binary'/'scalar' quantization types — those fall to generic cosine/euclidean on a packed, non-metric-comparable representation; a real (312-line, wasm-backed) rabitq-index.ts exists but lives in a different package and has zero test coverage anywhere. Both grade A, both <200-line-scoped for a future memory night. Neither selected tonight (SCAN surface; wrong surface for tonight's intelligence DEEP).

12. Competitors Reviewed

Full three-table comparison (intelligence/capabilities/memory) in the committed gist. Headline sources: Chaudhry et al. ECCV 2018 (arXiv:1801.10112) + arXiv:2502.11756 for EWC EMA convention (grade A, no source found on decay-value tuning specifically); npm provenance/Sigstore (GA Oct 2023), VS Code Marketplace publisher-trust, Chrome Web Store review policy, and NSA/CISA's 2026 MCP security guidance for capabilities (grade A/B); Zep/Graphiti (arXiv:2501.13956), Mem0 (mem0.ai blog + github.com/mem0ai/mem0 #5330), Qdrant RaBitQ/TurboQuant for memory (grade A/B, two figures flagged as vendor-single-sourced and not independently reproduced: Qdrant's 32x/40x, Microsoft Agent Framework's 50-70% cost-cut claim).

13. Gist

docs/dream-cycle/dream-gist-2026-09-27.md (this branch) — full SOTA report per the structure above, under 1500 words, 5 competitor rows minimum met per table, 3+ specific executable recommendations (5 given), no fabricated benchmarks.

14. Witness

Self-verified end-to-end against the committed file before this issue was written (not assumed) — see the gist's own verifier procedure.

15. Recommendation

ACCEPT-scoped. Human review recommended for the linked draft PR (small, ~25 net source lines + one new test file, one conceptual change, zero regressions, matches the exact precedent of #3350's priorDecay exposure). Independent adversarial critique: CONFIRMED-WITH-CAVEATS (both caveats closed same-session — operator doc note added; gist now committed for verifiability). Priority follow-ups for future nights, ranked: (1) capabilities — wire the existing tested PluginIntegrityVerifier behind the dead --verify flag; (2) memory — mmrRerank() cosine-recompute cache; (3) intelligence — build a real (non-synthetic) Fisher-decay fitness signal before attempting Darwin on this parameter again; (4) flagged-not-fixed: @claude-flow/neural's SONAManager has a permanently-empty ewcState.fisher/.means, making its own EWC penalty a silent no-op across all three learning modes — reachability from any production path is unconfirmed, needs a short investigation before scoping a fix on a future intelligence night.

🤖 Generated with RuFlo

https://claude.ai/code/session_017NSCBLZggg81jUaa8RvZV7