[ruvnet]

1. Hypothesis

Given authorizeMcpTool's unsigned-env-var identity (v3/@claude-flow/cli/src/services/policy-runtime.ts, identity.id sourced from the plain CLAUDE_FLOW_PRINCIPAL_ID env var with zero verification), when isMcpCallerAuthEnabled() is true and DualModeOrchestrator mints a per-worker Ed25519 InvocationToken (worker-lifetime TTL = config.timeout, wildcard toolName: '*' — a disclosed scope reduction from the primitive's original per-call/30s design) that authorizeMcpTool verifies before trusting identity, then a process without a validly-signed token should be rejected (fail-closed) while a legitimate token's callerId is used even when it disagrees with the raw env var — subject to: (1) disabled behavior is byte-identical to today; (2) existing suites stay green; (3) zero LLM/API cost.

Frozen before evaluation began; not modified after seeing results.

2. Candidate

v3/@claude-flow/security/src/mcp-caller-identity.ts (ADR-377 Phase 3, merged 2026-07-30) already implements Ed25519 issueInvocationToken/verifyInvocationToken — fully tested, but a repo-wide grep confirmed zero production call sites. Last night's research recommended wiring it into AgentAuthorizationPropagator.checkToolCall — tonight's deep research corrected that mid-pipeline: checkToolCall also has zero production callers. The actual live chokepoint (used by both stdio and HTTP MCP transports) is authorizeMcpTool(), whose identity.id was process.env.CLAUDE_FLOW_PRINCIPAL_ID ?? 'legacy-cli' — verified nowhere downstream in AgenticPolicyEngine.evaluate(). DualModeOrchestrator sets this value for every spawned worker subprocess, a process running arbitrary LLM-driven tool calls.

Diff (5 source files + 2 test files, ~345 lines net):

• mcp-caller-identity.ts — added publicKeyFromHex, encodeTokenEnvelope, decodeTokenEnvelope (purely additive).
• security/src/index.ts — exported the three new functions.
• orchestrator.ts — workerEnvironment() mints and sets CLAUDE_FLOW_MCP_INVOCATION_TOKEN/CLAUDE_FLOW_MCP_CALLER_PUBKEY when caller-auth is enabled, via a lazily-generated keypair cached once per orchestrator instance (private key never leaves the process).
• policy-runtime.ts — new resolveMcpCallerIdentity() wired into authorizeMcpTool's identity construction; disabled branch is a verbatim copy of the two lines it replaced.
• codex/package.json — added @claude-flow/security as an intra-monorepo workspace dependency (not a new third-party package).

3. Evaluation Receipt

evaluated: accepted, with disclosed caveats. Real evaluator: Vitest, zero LLM calls. 6 new deterministic scenarios (disabled-baseline-spoofing-succeeds; enabled+no-token→reject; enabled+forged-signature→reject; enabled+expired→reject; enabled+legitimate-token→accept via verified callerId; orchestrator env-var-gating+round-trip) — all pass post-fix, all correctly fail/error pre-fix via git stash source isolation. Full receipt: docs/dream-cycle/dream-gist-2026-08-26.md.

4. Baseline Comparison

Suite	Result
@claude-flow/security full	583/583
@claude-flow/codex full	241/241 (32/32 in dual-mode.test.ts)
@claude-flow/cli policy-runtime.test.ts	18/18 (13 pre-existing + 5 new)
@claude-flow/cli full suite, diff applied	19 files / 74 tests failing, 3053 passed
@claude-flow/cli full suite, git stash (clean HEAD)	19 files / 73 tests failing, 3049 passed — same 79 failing test names, sorted-list diff empty

Pre-existing WASM-module-resolution/Docker-integration failures, proven identical with and without this diff by direct stash-and-diff comparison (both by the implementer and independently re-derived by the critic below). tsc --noEmit clean for security/codex; cli's ~467 pre-existing errors (missing workspace type declarations) are unrelated, none reference policy-runtime.ts.

5. Darwin Lineage

Skipped — scope mismatch, confirmed via npx ruvector harness darwin --help: real interface evolves continuous/categorical genome parameters against an LLM-scored bench corpus. A binary Ed25519 signature-verification gate has no such tunable parameter space. Same class of skip as 5 of the last 6 dream-cycle nights.

6. Flywheel Evidence

No signed @metaharness/flywheel bundle — deterministic Vitest evidence, not an LLM-task corpus the replay/verify tooling targets (library-only, no standalone CLI), same as every accepted night since 08-18. Evidence retained as the committed tests + issue #3102 + the gist.

7. Reward Hack Check

Independent adversarial critic (fresh session, no authoring context) confirmed: no existing test weakened (diff purely additive in both test files); no gold-value tuning; no cherry-picking; zero LLM/API cost. Critic independently verified the Ed25519 SPKI DER prefix against real node:crypto output byte-for-byte, probed cross-worker token confusion (rejected), probed NUL-byte field-injection into callerId (rejected — verification always uses structured JSON fields, never re-parses a flat delimited string), and traced every fail-closed branch line-by-line — none falls through to the unverified env var once the flag is on.

8. Security Review

This IS the security-sensitive candidate. Critic confirmed: the private key never leaves the DualModeOrchestrator process (only public-key hex and the signed token envelope are exported to worker env); the existing sensitive-env-var strip loop correctly excludes the two new vars before re-setting them fresh per worker; JSON→base64url envelope encoding is injection-proof by construction.

Disclosed, not hidden, residual risk: the per-worker token is a worker-lifetime capability credential (not the originally-designed 30s/single-tool proof) — a leaked copy remains valid for that worker's remaining lifetime. Narrows "any process can freely impersonate any identity" to "only credential theft from an already-compromised worker grants impersonation" — a real reduction, not a complete solution. Two other call sites (harness-flywheel-runtime.ts:101, metaharness.ts:146,173) still trust the bare env var unconditionally — out of tonight's scope, flagged as follow-up. A pre-existing, unrelated quirk (4 literal NUL bytes as field separators in signingPayload(), present at HEAD) was probed for exploitability by the critic (none found) and correctly left unfixed (out of frozen scope).

Verdict: CONFIRMED-SAFE-WITH-CAVEATS (full adversarial review in the gist).

9. Regression Analysis

Zero regressions: off-by-default behavior is provably byte-identical (the disabled branch of resolveMcpCallerIdentity is a verbatim copy of the two lines it replaced); all pre-existing test assertions across every touched file are unchanged (only additive new describe/it blocks); the ~19-file pre-existing CLI failure set is proven identical with/without this diff via stash-and-diff comparison, not assertion.

10. ADR

None created — this activates already-decided ADR-377 Phase 3 architecture (implemented, merged, never wired) rather than introducing a new architectural decision. Matches repo convention for scoped correctness/reachability fixes (08-18 hybridSearch, 08-19 MessageBus, 08-24 weightedConsensus, 08-25 PQ distance dispatch).

11. Research Gist

docs/dream-cycle/dream-gist-2026-08-26.md (committed on this branch; no gist-creation MCP tool available in this session, consistent with every dream-cycle night since 2026-08-14). Full SOTA research: 5-role parallel fan-out, ledger check with verified 8-night fates, intelligence/swarm scan findings (CP-WBFT AAAI-2026 reference for the still-open ConsensusVote.confidence gap; FederationHub.vote() stale-vote bug and TopologyManager.rebalanceHybrid() adjacency bug both re-confirmed still open), and competitor analysis (LangGraph/AutoGen/CrewAI/OpenAI Agents SDK/MCP spec itself — none verify inter-agent caller identity, a genuine field-wide open gap per two independently-closed-not-planned RFCs).

12. Issue

Closes #3102 (full research: 5-role parallel fan-out, ledger check incl. verified fates for the last 8 nights, intelligence/swarm scan findings, competitor comparison).

13. Witness

Field	Value
Session commit	e21aa352fdc80fd2d3cc4e83404a76a18d118b96
Gist SHA-256 (pre-witness content)	a590238de9502914cdcca27a2ceb9426b2cda590c0c4fd4be84cc03f5deefb52
Witness stamp	fd944eaaea6d669f9c62355bd95c339f97313faa4b999510b454002e85714ee2

Verifier procedure: fetch docs/dream-cycle/dream-gist-2026-08-26.md from this branch, strip the witness table's filled values back to placeholders, SHA-256 it, concatenate with the session commit above, SHA-256 again — result must equal the witness stamp.

14. Merge Policy

Human review required. Do not self-merge. Do not autonomously promote Flywheel state.

---

Generated by Claude Code

[ruvnet]

CI red on this PR — root-caused, not this PR's:

6 checks failed (witness verify precondition smoke #1880, memory stats legacy-DB smoke #2120, neural-trader backtest signing smoke #2068, neural-trader feature attribution smoke #2068, plugin-registry signature verification smoke #1922, graph schema smoke ADR-130 P1). All 6 fail at the identical step — a root-level npm ci/npm install — with:

npm error code ETARGET
npm error notarget No matching version found for @claude-flow/mcp@3.0.0-alpha.10.

Root package.json pins "@claude-flow/mcp": "3.0.0-alpha.10", but that version was never published to npm (npm view @claude-flow/mcp versions tops out at 3.0.0-alpha.9). Confirmed pre-existing and unrelated to this diff:

• The most recent V3 CI/CD Pipeline run on main at this PR's exact base commit (e21aa352f, 2026-08-24T19:45Z) already shows conclusion: failure.
• This PR's own diff never touches root package.json/package-lock.json — confirmed via git diff origin/main -- package.json package-lock.json (empty).
• Two already-open PRs document the same blocker: feat(mcp): ADR-179 + implementation — MCP 2026-07-28 spec support in our own server #2648 ("Follow-ups... Publish @claude-flow/mcp@3.0.0-alpha.10 so external CLI installs pick up the new code") and fix(mcp): restore spec-valid HTTP transport and CLI tools #3015 ("The PR remains Draft until a maintainer publishes @claude-flow/mcp@3.0.0-alpha.10").

No code fix exists to port — the fix is an npm publish of @claude-flow/mcp@3.0.0-alpha.10, a maintainer/release action outside this PR's scope (and outside a nightly research candidate's authority to trigger). Not re-running — this is a deterministic registry-availability failure, not a flake. Every other check in this run (28/34 jobs, including the CLI/security/codex packages this PR actually touches) passed. Keeping this PR watched; will re-check once the upstream publish lands.

---

Generated by Claude Code

[ruvnet]

Test Suite (ubuntu-latest) update, on the current head (18d444fdd, after the CI build-step fix): the 2 regressions this PR introduced (dual-mode.test.ts, dual-mode-stdin-2947.test.ts, both previously new-failing due to @claude-flow/security's unbuilt dist) are now fixed — confirmed directly in the latest run's log: the ratchet is down to exactly 3 unexpected failing files, not 5.

The remaining 3 (plugins/ruflo-chatgpt-federation/test/oauth.test.mjs, plugins/ruflo-chatgpt-federation/test/publisher.test.mjs, plugins/ruflo-x-gateway/test/oauth.test.mjs) are pre-existing and not this PR's — confirmed by running the identical ratchet against main's own tip (fde5b3b88, run 34893342871): same 3 files, same failure, before any commit on this branch existed. Unrelated to caller-identity/MCP/OAuth-for-MCP-servers — these are the ChatGPT-federation and X-gateway plugins' own OAuth test suites. No existing issue or fix PR found (searched). Not something to fix here — standing down on these 3, not silently: this comment names them and confirms they're base-branch-red, not introduced or worsened by this diff. Not re-running — this job already ran on both this exact head and this exact base independently, so a flake re-run wouldn't add information.

Test Suite job conclusion will stay red until that pre-existing gap is fixed separately; every other job/check on this PR reflects only this candidate's own diff.

---

Generated by Claude Code