From 1991962da9dd101d92252be43f47d68b93e2060b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 13 Aug 2026 21:53:10 +0000
Subject: [PATCH 1/3] security-adversarial: classify evaluator entrypoint
 liveness (redblue silent no-op)

Reproduced a real, 100%-reliable silent failure in this repo's own SCAN=redblue
evaluator entrypoint (dream.config.json): `npx @metaharness/redblue <anything>`
exits 0 with zero bytes on both stdout and stderr, for every subcommand tried.
Root cause: the package's CLI guards its dispatch with the classic
`import.meta.url === file://${process.argv[1]}` idiom, which fails once the
executable is reached through the symlink npm/npx create for a package's bin
entry, so the dispatch body never runs. Exit 0 + silence is indistinguishable
from "ran clean, zero findings" to anything that only checks the exit code.

Adds classifyEntrypointResult (packages/cli/src/entrypoint.ts) and a
`dream-machine verify-entrypoint` CLI command so this pipeline can separate
live / blocked / suspicious-silent before ever recording EVALUATED=yes.

Includes two fixes from an independent adversarial critique of this diff:
unquoted multi-word --cmd used to silently truncate and produce a false
"live" verdict (fixed with a hard usage-error guard); child_process.exec's
error.code can be a non-number on maxBuffer overflow (fixed with explicit
buffer size + defensive coercion).

npm test: 85 -> 96 (all new, 0 removed/modified). ADR-0002 documents the
entrypoint-trust convention. Full evidence in
docs/dream-cycle/2026-08-13-security-adversarial-report.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UAJ2FdMooTevrJ34FW3mpr
---
 ...ecurity-adversarial-entrypoint-liveness.md | 107 +++++++
 docs/adrs/INDEX.md                            |   1 +
 .../2026-08-13-security-adversarial-report.md | 273 ++++++++++++++++++
 packages/cli/src/bin.ts                       |  20 ++
 packages/cli/src/entrypoint.test.ts           |  39 +++
 packages/cli/src/entrypoint.ts                |  51 ++++
 packages/cli/src/index.test.ts                |  58 ++++
 packages/cli/src/index.ts                     |  35 +++
 8 files changed, 584 insertions(+)
 create mode 100644 docs/adrs/ADR-0002-dream-cycle-security-adversarial-entrypoint-liveness.md
 create mode 100644 docs/dream-cycle/2026-08-13-security-adversarial-report.md
 create mode 100644 packages/cli/src/entrypoint.test.ts
 create mode 100644 packages/cli/src/entrypoint.ts

diff --git a/docs/adrs/ADR-0002-dream-cycle-security-adversarial-entrypoint-liveness.md b/docs/adrs/ADR-0002-dream-cycle-security-adversarial-entrypoint-liveness.md
new file mode 100644
index 0000000..3af08c6
--- /dev/null
+++ b/docs/adrs/ADR-0002-dream-cycle-security-adversarial-entrypoint-liveness.md
@@ -0,0 +1,107 @@
+# ADR-0002: Evaluator entrypoints must be classified live/blocked/suspicious-silent before an EVALUATED verdict is recorded
+
+- **Status**: Proposed
+- **Date**: 2026-08-13
+- **Related**: ADR-0001 §2.3 ("Evaluation is delegated, never reimplemented"), §2.4 ("the engine must never hard-depend on [evaluation backends]"), §5 Test Contract item 4 (optional-backend degradation)
+- **Deciders**: dream-cycle nightly session (security-adversarial, SCAN=redblue/supply-chain), 2026-08-13
+- **Tags**: dream-cycle, security-adversarial, supply-chain, evaluator-trust, witness-every-quantitative-claim
+
+## 1. Context
+
+Tonight's SCAN=redblue probe reproduced a real, 100%-reliable failure in
+`npx @metaharness/redblue` (the SCAN=redblue evaluator entrypoint this repo's
+own `dream.config.json` declares): the command exits `0` with **zero bytes**
+on both stdout and stderr, for every subcommand tried. Root cause: the
+package's CLI guards its dispatch with `import.meta.url ===
+\`file://${process.argv[1]}\``, a comparison that fails once the executable
+is reached through the symlink `npm`/`npx` always create for a package's
+`bin` entry — so the dispatch body silently never runs.
+
+ADR-0001 §2.3 composes `@metaharness/{flywheel,darwin,redblue}` as the
+pipeline's evaluation backends and explicitly says the engine must treat them
+as optional (§2.4) — but "optional" was only specified for the *absent*
+case (package not installed, no credentials → `LLM_EVAL=blocked`). Nothing in
+ADR-0001 addresses the case discovered tonight: a backend that *is* installed,
+*is* invoked correctly, and *exits 0* — while having silently done nothing.
+An exit code alone cannot distinguish this from a genuine clean pass, and
+STEP 5-9 of the compiled nightly prompt ("Do not infer results from logs.
+Preserve the real receipt") assumes a human/agent will catch this by hand
+every time. Tonight's session did, by accident of manual probing — that is
+not a mechanism, it's luck.
+
+## 2. Decision
+
+Ship `@dream-machine/cli`'s `classifyEntrypointResult` (`packages/cli/src/entrypoint.ts`)
+as the canonical, deterministic classifier for any evaluator-entrypoint
+result in this engine, with three outcomes:
+
+- **live** — exit 0 with non-empty stdout or stderr.
+- **blocked** — nonzero exit (the tool ran and told us something is wrong;
+  the reason is in stderr).
+- **suspicious-silent** — exit 0 with empty stdout *and* empty stderr. Never
+  equated with a clean pass; never sufficient on its own to record
+  `EVALUATED=yes`.
+
+Exposed tonight as `dream-machine verify-entrypoint <label> --cmd "<command>"`
+(exit 0/1/2 respectively, so the classification is scriptable). Any future
+wiring that runs `dream.config.json`'s `evaluatorEntrypoints` automatically
+(not built tonight — see Consequences) must route the raw exec result through
+this classifier before it is allowed to influence a night's `EVALUATED`/
+`VERDICT` fields.
+
+## 3. Consequences
+
+- **Extends, not replaces, ADR-0001's optionality principle.** "The engine
+  must never hard-depend on [backends]" (ADR-0001 §2.4) now also means: never
+  trust a backend's bare exit code as sufficient evidence it did real work.
+- **No behavior changed for the `bench: npm test` entrypoint** — it always
+  produces real output and classifies `live`, confirmed tonight.
+- **This is a detection primitive, not a fix.** It does not patch
+  `@metaharness/redblue` (out of this repo's scope — a different repo,
+  `ruvnet/agent-harness-generator`) and does not yet auto-wire
+  `evaluatorEntrypoints` through the classifier inside the compiled prompt
+  itself — that wiring is next-step work, explicitly deferred rather than
+  rushed into tonight's already-scoped candidate.
+- **New CLI surface** (`verify-entrypoint`) is additive and optional
+  (`IO.exec` is `exec?`, so every existing IO/test fake is unaffected).
+
+## 4. Alternatives Considered
+
+- **Patch `@metaharness/redblue` directly.** Rejected for tonight: wrong
+  repo/scope (`ruvnet/agent-harness-generator`, not `ruvnet/dream-machine`);
+  filed as a follow-up recommendation instead (Node now ships
+  `import.meta.main`, stable-track ≥22.18/24.2, as the correct native fix).
+- **Silently swallow the redblue failure and move on.** Rejected: violates
+  `witness-every-quantitative-claim` — a "the scan passed" claim built on an
+  unexamined exit code is exactly the overclaim this repo's own disciplines
+  forbid.
+- **Hard-fail the whole night when any evaluator entrypoint is
+  suspicious-silent.** Rejected: too strong — `suspicious-silent` is a signal
+  requiring investigation, not automatically a `REJECT`; a legitimate
+  zero-output tool exists in principle, so the classifier flags for review
+  (`INCONCLUSIVE`-shaped) rather than asserting failure.
+
+## 5. Test Contract
+
+1. `classifyEntrypointResult` is pure (no I/O, no clock, no randomness) and
+   unit-tested for all three verdicts plus the whitespace-only-output edge
+   case (`packages/cli/src/entrypoint.test.ts`).
+2. `dream-machine verify-entrypoint` round-trips a real exec result through
+   the classifier and exits 0/1/2 for live/blocked/suspicious-silent
+   respectively (`packages/cli/src/index.test.ts`).
+3. Live receipt against this repo's real `dream.config.json`
+   `evaluatorEntrypoints` tonight: `bench` → live, `flywheel` → blocked,
+   `redblue` → suspicious-silent, `darwin --version` → blocked (wrong flag,
+   visible reason) — all four match ground truth verified by hand.
+4. No pre-existing test weakened, removed, or modified; `npm test` baseline
+   85/85 → candidate 95/95, 0 regressions.
+
+## 6. References
+
+- ADR-0001 §2.3, §2.4, §5(4).
+- `nodejs/node#57616` — "Provide an equivalent of require.main for ESM"
+  (documents the symlink footgun; Grade B, fetched directly).
+- Node.js `import.meta.main` docs (`nodejs.org/api/esm.html`) — the native
+  replacement fix (Grade A, fetched directly).
+- `pytest` exit code 5 ("no tests were collected") — closest prior art for a
+  dedicated "ran clean but did zero real work" signal (Grade B).
diff --git a/docs/adrs/INDEX.md b/docs/adrs/INDEX.md
index 957e723..148fee9 100644
--- a/docs/adrs/INDEX.md
+++ b/docs/adrs/INDEX.md
@@ -8,6 +8,7 @@ Alternatives Considered → Test Contract → References.
 | ADR | Title | Status |
 |-----|-------|--------|
 | [ADR-0001](./ADR-0001-dream-machine-engine.md) | The Dream Machine engine — a config-driven, evidence-gated nightly evolution loop composed from the ruvnet stack | Accepted (v0.1.0 shipped) |
+| [ADR-0002](./ADR-0002-dream-cycle-security-adversarial-entrypoint-liveness.md) | Evaluator entrypoints must be classified live/blocked/suspicious-silent before an EVALUATED verdict is recorded | Proposed |
 
 ## How to amend
 
diff --git a/docs/dream-cycle/2026-08-13-security-adversarial-report.md b/docs/dream-cycle/2026-08-13-security-adversarial-report.md
new file mode 100644
index 0000000..d9e2438
--- /dev/null
+++ b/docs/dream-cycle/2026-08-13-security-adversarial-report.md
@@ -0,0 +1,273 @@
+# Security-Adversarial / Supply-Chain SOTA Report — 2026
+
+## TL;DR
+
+Tonight's SCAN=redblue probe of this repo's own declared evaluator entrypoint
+(`npx @metaharness/redblue`, per `dream.config.json`) reproduced a real,
+100%-reliable silent failure: the command exits 0 with **zero bytes** on both
+stdout and stderr, for every subcommand tried. Root cause: `@metaharness/redblue`'s
+CLI guards its dispatch with the classic-but-broken ESM idiom
+`import.meta.url === \`file://${process.argv[1]}\``, which fails once the binary
+is reached through the symlink `npm`/`npx` always create for a package's `bin`
+entry — so the dispatch body never runs. Exit 0 + silence is indistinguishable
+from "ran clean, zero findings" to anything that trusts the exit code alone —
+which is exactly what this repo's own compiled nightly prompt (STEP 5-9) would
+otherwise do for the SCAN=redblue evaluator. Candidate: a small, tested,
+deterministic entrypoint-liveness classifier (`classifyEntrypointResult`) and a
+`dream-machine verify-entrypoint` CLI command so this pipeline (and any future
+one composing @metaharness packages) can distinguish LIVE / BLOCKED /
+SUSPICIOUS-SILENT before ever recording `EVALUATED=yes`.
+
+## What's new
+
+- First-hand reproduction (grade A — not sourced, directly executed tonight)
+  that `npx -y @metaharness/redblue <init|run|attack|help|bare|--version>` all
+  produce 0-byte stdout, 0-byte stderr, exit 0.
+- Root-caused to `dist/cli/index.js`'s `isMain` guard via direct inspection of
+  the installed package source (`~/.npm/_npx/*/node_modules/@metaharness/redblue/dist/cli/index.js`
+  line ~489): `const isMain = import.meta.url === \`file://${process.argv[1]}\`;`
+  — the well-known npm-bin-symlink footgun.
+- Confirmed this repo's own `dream.config.json:17` documents exactly this
+  broken invocation (`"redblue": "npx @metaharness/redblue"`) as the
+  SCAN=redblue evaluator entrypoint that every future security-adversarial
+  night is instructed to trust.
+- Also found (same probe) `"flywheel": "npx @metaharness/flywheel"` is broken
+  for a different, *loud* reason: the package ships no `bin` field at all, so
+  npx fails immediately with a visible error — safe (fails loud), unlike
+  redblue's silent failure, but still a stale/incorrect entrypoint doc.
+- Confirmed `@metaharness/darwin` is genuinely invocable (`npx -y
+  @metaharness/darwin evolve|bench|security`), but the intuitive `--version`
+  flag is *not* recognized and exits 1 with usage text — correctly classified
+  tonight as `blocked` (visible reason), not `live` and not `suspicious-silent`.
+
+## Hypothesis (frozen before implementation)
+
+> Given a nightly pipeline that shells out to third-party evaluator
+> entrypoints and trusts their exit code as a pass/fail signal, when a
+> deterministic `classifyEntrypointResult` function is interposed between the
+> raw exec result and the pipeline's `EVALUATED=yes/no/blocked` decision, then
+> it should correctly separate LIVE (real output, exit 0) from BLOCKED
+> (nonzero exit, has a reason) from SUSPICIOUS-SILENT (exit 0, zero output on
+> both streams) — a distinction the raw exit code alone cannot make — subject
+> to: no change to any existing test, no change to the `bench: npm test`
+> evaluator's own behavior, and the classifier must be pure/deterministic
+> (no I/O, no clock, no randomness).
+
+## Benchmarks / Evaluation
+
+Real evaluator: `npm test` (vitest), this repo's own `bench` entrypoint —
+the only evaluator entrypoint confirmed genuinely live tonight.
+
+| | Baseline (parent, commit 3de0107) | Candidate (working tree) |
+|---|---|---|
+| Test files | 6 | 7 (+`entrypoint.test.ts`) |
+| Tests | 85 | 96 (+11, 0 removed, 0 modified) |
+| Result | 85 passed | 96 passed |
+| Duration | 930ms | 1.21s |
+
+No pre-existing test was touched, weakened, or removed. Diff: 2 new files
+(`entrypoint.ts` 51 lines, `entrypoint.test.ts` 39 lines) + 3 modified files
+(113 changed lines) = 203 changed lines total, one conceptual change
+(includes a post-critique fix — see Reward-Hack Check).
+
+Live receipt — `dream-machine verify-entrypoint` run against this repo's real
+`dream.config.json` evaluatorEntrypoints tonight:
+
+```
+$ node packages/cli/dist/bin.js verify-entrypoint redblue --cmd "npx -y @metaharness/redblue"
+redblue: suspicious-silent (exit 0) — exit 0 with empty stdout and stderr —
+  indistinguishable from "ran clean, zero findings"; do not record
+  EVALUATED=yes from this result alone
+$ echo $?
+2
+
+$ node packages/cli/dist/bin.js verify-entrypoint flywheel --cmd "npx -y @metaharness/flywheel"
+flywheel: blocked (exit 1) — npm error could not determine executable to run
+$ echo $?
+1
+
+$ node packages/cli/dist/bin.js verify-entrypoint darwin --cmd "npx -y @metaharness/darwin --version"
+darwin: blocked (exit 1) — usage: metaharness-darwin <evolve|bench|security> ...
+$ echo $?
+1
+
+$ node packages/cli/dist/bin.js verify-entrypoint bench --cmd "npm test --silent"
+bench: live (exit 0) — produced output
+$ echo $?
+0
+
+$ node packages/cli/dist/bin.js verify-entrypoint redblue --cmd npx @metaharness/redblue
+verify-entrypoint: unexpected extra argument(s) ["@metaharness/redblue"] — did you
+  forget to quote --cmd? usage: dream-machine verify-entrypoint <label> --cmd "<command>"
+$ echo $?
+1
+```
+
+All classifications match ground truth verified by hand tonight, including
+the post-critique fix (last block: an unquoted `--cmd` is now a hard usage
+error instead of silently truncating to a false "live" verdict).
+
+## Darwin (bounded evolution)
+
+Not run. There is no evolvable population for a single, already-minimal, pure
+classification function with three closed-form output branches — bounded
+Darwin's generations×children search space requires a mutable candidate
+population, which a one-function utility with an exhaustive branch structure
+doesn't meaningfully have. Recorded as `DARWIN=not-applicable`, not a stop
+condition.
+
+## Evidence
+
+- OBSERVATION: `npx -y @metaharness/redblue <any arg>` → 0-byte stdout, 0-byte
+  stderr, exit 0. Reproduced 7 times across different subcommands tonight.
+- OBSERVATION: installed package source at
+  `dist/cli/index.js` line ~489 uses `import.meta.url === \`file://${process.argv[1]}\`}`
+  as its `isMain` guard.
+- MEASUREMENT: `npm test` — 85/85 (baseline) → 95/95 (candidate), 0 regressions.
+- INFERENCE: the `isMain` comparison fails specifically because `npx`/`npm`
+  install the package's `bin` entry as a symlink, and `process.argv[1]`
+  (argv path) vs `import.meta.url` (URL, resolved through the symlink)
+  diverge in exactly the scenario documented in nodejs/node#57616 (Grade B,
+  fetched directly).
+- DECISION: ship the classifier + CLI command as a small, tested, orthogonal
+  addition; do not attempt to patch `@metaharness/redblue` itself (out of
+  repo scope — that's `ruvnet/agent-harness-generator`, not
+  `ruvnet/dream-machine`).
+
+## Reward-Hack Check
+
+Independent critic (separate agent, not this candidate's author) reviewed the
+diff for weakened tests, cherry-picked test cases, threshold tampering, gold
+data changes, and command-injection exposure in the new `io.exec` surface.
+
+**Verdict: CLEAR of reward-hacking** — no pre-existing test weakened, no
+threshold/gold data touched, only the 5 intended files changed, all
+additive. The classifier is general-purpose, not hard-coded to the redblue
+string.
+
+**Two real defects were found and fixed before this report was finalized**
+(not silently dropped, not shipped as known-broken):
+
+1. **False-positive footgun (fixed)**: an unquoted multi-word `--cmd` (e.g.
+   `verify-entrypoint redblue --cmd npx @metaharness/redblue`, no quotes/`=`)
+   let `--cmd` silently absorb only `npx` and drop `@metaharness/redblue` as
+   an unexamined stray positional — running bare `npx` (prints its own usage,
+   exits 0) then produced a false **`live`** verdict for the exact
+   silent-failure class this tool exists to catch. Fixed by rejecting any
+   extra positional as a hard usage error (`packages/cli/src/index.ts`);
+   regression test added (`index.test.ts`, "rejects an unquoted multi-word
+   --cmd..."); reverified live against the real `npx` binary tonight.
+2. **Type-contract violation + unbounded buffer (fixed)**: `child_process.exec`'s
+   maxBuffer-exceeded error sets `error.code` to a string
+   (`ERR_CHILD_PROCESS_STDOUT_MAXBUFFER`), not a number, silently violating
+   `ExecResult.code: number`; combined with no `maxBuffer` override, a
+   verbose `bench: npm test` run could plausibly overflow Node's 1 MiB
+   default and get misclassified `blocked` despite being genuinely live.
+   Fixed: explicit 10 MiB `maxBuffer` + defensive `typeof err.code ===
+   'number'` coercion (`packages/cli/src/bin.ts`).
+
+**One real risk flagged, correctly left unfixed (out of scope tonight, not
+silently dropped)**: `io.exec`/`child_process.exec` shells out an
+unsanitized string with no allowlist. Not exploitable by tonight's diff
+(`cmd` only ever comes from a human-typed CLI flag), but the critic
+correctly identified that `dream.config.json#evaluatorEntrypoints` values
+flow into the compiled nightly prompt (`packages/compile/src/index.ts`) and
+`dream.config.json` itself sets `"autoMerge": true` — so the *natural* next
+automation (auto-feeding `evaluatorEntrypoints` into `verify-entrypoint`)
+would be piping a value from a file this same pipeline can modify into an
+unsanitized shell exec. Recorded as a MUST-ADDRESS-BEFORE-AUTOMATING item in
+the filed issue, not built or fixed tonight — building that automation was
+never in scope for this candidate.
+
+## Security Review
+
+- **Tool/command-authority scope**: `io.exec` in `bin.ts` shells out via
+  `child_process.exec` (uses `/bin/sh -c`). The `cmd` string is only ever
+  supplied by a human/agent invoking `dream-machine verify-entrypoint
+  <label> --cmd "<command>"` from a trusted local CLI session, or (in future
+  wiring, not implemented tonight) read from `dream.config.json`'s
+  `evaluatorEntrypoints`, which is a repo-committed, PR-reviewed file — never
+  attacker-controllable input at runtime. No new remote/network attack
+  surface is introduced tonight; this module does not read `evaluatorEntrypoints`
+  automatically yet (candidate is CLI-invoked only, one conceptual change).
+- **Credential exposure**: none — the module handles no secrets.
+- **Prompt injection / cross-agent poisoning**: N/A — no LLM calls in this
+  candidate.
+- **Least privilege**: `io.exec` is optional on the `IO` interface (`exec?`),
+  so every existing call site (tests, `compile`, `ledger`, `witness`, `tui`)
+  is unaffected and requires no new capability.
+
+## Scan Findings
+
+**redblue** — `@metaharness/redblue`'s CLI is a complete silent no-op under
+standard `npm`/`npx` bin-symlink invocation (see above). This is upstream,
+out of this repo's scope to patch directly, but this repo's own
+`dream.config.json` blindly documents the broken invocation as its
+SCAN=redblue evaluator entrypoint — that documentation is now stale/misleading
+until Notes tonight's finding is acted on (tracked in the filed issue, not
+fixed tonight — fixing the config string doesn't fix the underlying tool).
+
+**supply-chain** — `@metaharness/{flywheel,darwin,redblue}` are legitimate,
+correctly-scoped, single-maintainer (`ruvnet`) npm packages (verified via
+`npm view` + registry HTTP 200 on all three); no typosquat/dependency-confusion
+risk found. The real supply-chain risk found tonight is *trust*, not
+*identity*: this repo's evaluator wiring has no mechanism to detect that a
+correctly-resolved, legitimately-published dependency's CLI silently does
+nothing — exactly the gap the candidate closes.
+
+## Competitors
+
+| System | Evaluator/tool-liveness handling | Grade |
+|---|---|---|
+| Sakana AI "The AI Scientist" | Documents sandboxing unsafe self-modifying code (timeout extension incident); no documented subprocess-liveness check | B |
+| OpenHands (OpenDevin) | Docker-sandboxed execution; third-party paper notes "anti-hacking measures disable network access" for outcome verification, not liveness detection specifically | C |
+| SWE-agent / SWE-bench | Exit-code-based fail2pass validation; independent study (arXiv:2503.15223) reports ~0.90-0.93 precision, i.e. imperfect — exit code alone is known-lossy | C (secondhand, PDF unread) |
+| DSPy/GEPA | Metric-based scoring with feedback; no documented tool-liveness/silent-failure detection | B (absence confirmed via official docs) |
+| AutoGPT-lineage | Community failure catalog documents agents self-reporting false success with no independent liveness check | C |
+| pytest (prior art, not a competitor) | Ships a dedicated exit code (5) specifically for "ran clean but did zero real work" — the closest existing prior art to tonight's `suspicious-silent` verdict | B |
+
+## Gist
+
+This report. Published as a local artifact (`/tmp/dream-gist-2026-08-13.md`,
+committed into the PR as evidence) — no `gh gist create` tonight: this
+session has GitHub API access via MCP tools for issues/PRs/branches, but no
+gist-creation tool was available. `GIST=LOCAL`.
+
+## Witness
+
+`dream-machine witness stamp` hashes this exact file's raw bytes, so the
+stamp cannot be written *inside* the file it stamps (editing the file after
+hashing would invalidate the hash against the committed bytes — a
+self-reference bug, caught while drafting this report). The stamp is
+therefore computed over this file frozen exactly as it reads at this point,
+and published instead in the PR description and the LEDGER.md row, both of
+which point back at this file (committed at
+`docs/dream-cycle/2026-08-13-security-adversarial-report.md`) by path and
+session commit. Anyone can independently reproduce it:
+
+```bash
+sha256sum docs/dream-cycle/2026-08-13-security-adversarial-report.md   # REPORT_HASH
+printf '%s%s' "$REPORT_HASH" "3de01079abe64e4a1f2d3fe3b758523705b3bf47" | sha256sum
+# must equal the WITNESS value published in the PR body and LEDGER.md
+```
+
+## Recommendation
+
+Human review of the draft PR. Two follow-ups explicitly NOT done tonight
+(next-steps, not silently dropped):
+1. Wire `evaluatorEntrypoints` from `dream.config.json` through
+   `classifyEntrypointResult` automatically inside the compiled nightly
+   prompt's STEP 5-9 guidance, so future nights get this check without
+   remembering to invoke it by hand.
+2. File an upstream issue against `@metaharness/redblue` (out of this repo's
+   scope — different repo, `ruvnet/agent-harness-generator`) recommending
+   the fix Node.js now ships natively: `import.meta.main` (stable-track,
+   Node ≥22.18/24.2), replacing the broken `import.meta.url === file://argv[1]`
+   comparison.
+3. `docs/dream-cycle/LEDGER.md` rows 3-8 reference issues/PRs (#3, #4, #6, #9,
+   #10, #12, #13, #15, #16, #18) and dates (2026-08-14 through 2026-08-19)
+   that do not exist on GitHub and postdate tonight (2026-08-13) — confirmed
+   via `mcp__github__list_issues`/`list_pull_requests` (0 real issues, only 5
+   open dependabot PRs #1-5). These are seed/example rows, not real history.
+   Not corrected tonight (out of scope for this candidate) but flagged so a
+   future night doesn't try to "re-check the fate" of fictional issues.
diff --git a/packages/cli/src/bin.ts b/packages/cli/src/bin.ts
index 6e815cb..bda53bd 100755
--- a/packages/cli/src/bin.ts
+++ b/packages/cli/src/bin.ts
@@ -1,13 +1,33 @@
 #!/usr/bin/env node
 /** The real executable: wires `run` to the process + node fs. */
 import { readFile, writeFile } from 'node:fs/promises';
+import { exec as execCb } from 'node:child_process';
+import { promisify } from 'node:util';
 import { run, type IO } from './index.js';
 
+const exec = promisify(execCb);
+
 const io: IO = {
   readFile: (p) => readFile(p, 'utf8'),
   writeFile: (p, c) => writeFile(p, c, 'utf8'),
   now: () => new Date().toISOString().slice(0, 10),
   env: process.env,
+  exec: async (cmd) => {
+    try {
+      // 10x Node's 1 MiB default maxBuffer: a verbose `bench: npm test` run in a larger
+      // monorepo can plausibly exceed the default, which would otherwise reject and get
+      // misclassified as `blocked` even though the entrypoint is genuinely live.
+      const { stdout, stderr } = await exec(cmd, { maxBuffer: 10 * 1024 * 1024 });
+      return { code: 0, stdout, stderr };
+    } catch (e) {
+      const err = e as { code?: unknown; stdout?: string; stderr?: string };
+      // Some exec failures (e.g. ERR_CHILD_PROCESS_STDOUT_MAXBUFFER) set `code` to a
+      // string, not a number — coerce defensively so ExecResult's `code: number` contract
+      // actually holds at runtime.
+      const code = typeof err.code === 'number' ? err.code : 1;
+      return { code, stdout: err.stdout ?? '', stderr: err.stderr ?? '' };
+    }
+  },
 };
 
 run(process.argv.slice(2), io).then((r) => {
diff --git a/packages/cli/src/entrypoint.test.ts b/packages/cli/src/entrypoint.test.ts
new file mode 100644
index 0000000..d055c50
--- /dev/null
+++ b/packages/cli/src/entrypoint.test.ts
@@ -0,0 +1,39 @@
+import { describe, it, expect } from 'vitest';
+import { classifyEntrypointResult } from './entrypoint.js';
+
+describe('classifyEntrypointResult', () => {
+  it('flags a nonzero exit as blocked (reproduces npx @metaharness/flywheel: no bin field)', () => {
+    const r = classifyEntrypointResult({
+      code: 1,
+      stdout: '',
+      stderr: 'npm error could not determine executable to run',
+    });
+    expect(r.verdict).toBe('blocked');
+    expect(r.reason).toContain('could not determine executable to run');
+  });
+
+  it('flags exit 0 + empty stdout/stderr as suspicious-silent (reproduces npx @metaharness/redblue)', () => {
+    const r = classifyEntrypointResult({ code: 0, stdout: '', stderr: '' });
+    expect(r.verdict).toBe('suspicious-silent');
+    expect(r.reason).toContain('indistinguishable from');
+  });
+
+  it('flags exit 0 + whitespace-only output as suspicious-silent, not live', () => {
+    const r = classifyEntrypointResult({ code: 0, stdout: '  \n\t', stderr: '' });
+    expect(r.verdict).toBe('suspicious-silent');
+  });
+
+  it('treats exit 0 + real stdout as live (reproduces npx @metaharness/darwin --version usage text)', () => {
+    const r = classifyEntrypointResult({
+      code: 0,
+      stdout: 'usage: metaharness-darwin <evolve|bench|security> …',
+      stderr: '',
+    });
+    expect(r.verdict).toBe('live');
+  });
+
+  it('treats exit 0 + stderr-only output as live (bench entrypoint may log to stderr)', () => {
+    const r = classifyEntrypointResult({ code: 0, stdout: '', stderr: 'warning: slow test detected' });
+    expect(r.verdict).toBe('live');
+  });
+});
diff --git a/packages/cli/src/entrypoint.ts b/packages/cli/src/entrypoint.ts
new file mode 100644
index 0000000..6f952bd
--- /dev/null
+++ b/packages/cli/src/entrypoint.ts
@@ -0,0 +1,51 @@
+/**
+ * Entrypoint-liveness classification.
+ *
+ * Reproduced 2026-08-13 (security-adversarial night, SCAN=redblue): running
+ * `npx @metaharness/redblue <any subcommand>` — the exact command this repo's
+ * own `dream.config.json` documents as the SCAN=redblue evaluator entrypoint —
+ * exits 0 with zero bytes on both stdout and stderr, for every subcommand
+ * tried. The package's CLI guards its dispatch with the classic ESM idiom
+ * `import.meta.url === \`file://${process.argv[1]}\``, which fails once the
+ * executable is reached through the symlink npm/npx always create for a
+ * package's `bin` entry, so the dispatch body silently never runs. Exit 0 +
+ * silence is indistinguishable from "ran clean, zero findings" to anything
+ * that only checks the exit code — exactly what STEP 5-9 of the compiled
+ * nightly prompt would otherwise do. Any evaluator entrypoint result should
+ * route through here before the pipeline is allowed to record EVALUATED=yes.
+ */
+
+export interface ExecResult {
+  code: number;
+  stdout: string;
+  stderr: string;
+}
+
+export type EntrypointVerdict = 'live' | 'suspicious-silent' | 'blocked';
+
+export interface EntrypointCheck {
+  verdict: EntrypointVerdict;
+  code: number;
+  reason: string;
+}
+
+/** Classify a completed entrypoint invocation. Pure — no I/O. */
+export function classifyEntrypointResult(r: ExecResult): EntrypointCheck {
+  if (r.code !== 0) {
+    return {
+      verdict: 'blocked',
+      code: r.code,
+      reason: r.stderr.trim() || `exited ${r.code} with no stderr`,
+    };
+  }
+  if (r.stdout.trim() === '' && r.stderr.trim() === '') {
+    return {
+      verdict: 'suspicious-silent',
+      code: r.code,
+      reason:
+        'exit 0 with empty stdout and stderr — indistinguishable from "ran clean, zero findings"; ' +
+        'do not record EVALUATED=yes from this result alone',
+    };
+  }
+  return { verdict: 'live', code: r.code, reason: 'produced output' };
+}
diff --git a/packages/cli/src/index.test.ts b/packages/cli/src/index.test.ts
index 2047de4..4670709 100644
--- a/packages/cli/src/index.test.ts
+++ b/packages/cli/src/index.test.ts
@@ -164,6 +164,64 @@ describe('witness', () => {
   });
 });
 
+describe('verify-entrypoint', () => {
+  function mockIOWithExec(exec: IO['exec']): IO {
+    return { ...mockIO(), exec };
+  }
+
+  it('reports live for a command that produces output and exits 0', async () => {
+    const io = mockIOWithExec(async () => ({ code: 0, stdout: 'ok', stderr: '' }));
+    const r = await run(['verify-entrypoint', 'bench', '--cmd', 'npm test'], io);
+    expect(r.code).toBe(0);
+    expect(r.out).toContain('bench: live');
+  });
+
+  it('reports blocked for a nonzero exit', async () => {
+    const io = mockIOWithExec(async () => ({
+      code: 1,
+      stdout: '',
+      stderr: 'npm error could not determine executable to run',
+    }));
+    const r = await run(['verify-entrypoint', 'flywheel', '--cmd', 'npx @metaharness/flywheel'], io);
+    expect(r.code).toBe(1);
+    expect(r.out).toContain('flywheel: blocked');
+  });
+
+  it('reports suspicious-silent (not live) for exit 0 with no output', async () => {
+    const io = mockIOWithExec(async () => ({ code: 0, stdout: '', stderr: '' }));
+    const r = await run(['verify-entrypoint', 'redblue', '--cmd', 'npx @metaharness/redblue'], io);
+    expect(r.code).toBe(2);
+    expect(r.out).toContain('redblue: suspicious-silent');
+    expect(r.out).toContain('do not record EVALUATED=yes');
+  });
+
+  it('errors without --cmd', async () => {
+    const io = mockIOWithExec(async () => ({ code: 0, stdout: '', stderr: '' }));
+    const r = await run(['verify-entrypoint', 'redblue'], io);
+    expect(r.code).toBe(1);
+    expect(r.err).toContain('usage:');
+  });
+
+  it('rejects an unquoted multi-word --cmd instead of silently truncating it', async () => {
+    // Regression test: `verify-entrypoint redblue --cmd npx @metaharness/redblue` (no
+    // quotes/`=`) used to let --cmd absorb only "npx" and silently drop
+    // "@metaharness/redblue" as a stray positional — running bare `npx` (which prints its
+    // own usage text and exits 0) then misreported a false "live" verdict for the exact
+    // silent-failure this tool exists to catch.
+    const io = mockIOWithExec(async () => ({ code: 0, stdout: 'npx usage text', stderr: '' }));
+    const r = await run(['verify-entrypoint', 'redblue', '--cmd', 'npx', '@metaharness/redblue'], io);
+    expect(r.code).toBe(1);
+    expect(r.err).toContain('unexpected extra argument');
+    expect(r.out).not.toContain('live');
+  });
+
+  it('errors when the IO has no exec()', async () => {
+    const r = await run(['verify-entrypoint', 'redblue', '--cmd', 'echo hi'], mockIO());
+    expect(r.code).toBe(1);
+    expect(r.err).toContain('no exec()');
+  });
+});
+
 describe('tui', () => {
   it('renders a dashboard from a ledger', async () => {
     const md = appendRow(emptyLedger(), sampleRow());
diff --git a/packages/cli/src/index.ts b/packages/cli/src/index.ts
index 9a60da1..0350457 100644
--- a/packages/cli/src/index.ts
+++ b/packages/cli/src/index.ts
@@ -18,6 +18,7 @@ import {
 import { stamp, verify, verifySteps } from '@dream-machine/witness';
 import { serializeRoutine, scheduleInstructions } from '@dream-machine/schedule';
 import { renderDashboard } from './tui.js';
+import { classifyEntrypointResult, type ExecResult } from './entrypoint.js';
 
 export const VERSION = '0.1.0';
 
@@ -26,6 +27,8 @@ export interface IO {
   writeFile(path: string, content: string): Promise<void>;
   now(): string; // YYYY-MM-DD
   env: Record<string, string | undefined>;
+  /** Run a shell command and capture its result. Optional: not every IO needs it. */
+  exec?(cmd: string): Promise<ExecResult>;
 }
 
 export interface RunResult {
@@ -93,6 +96,7 @@ Commands:
   ledger append   --path L --date .. --deep .. ...     Append one row
   witness stamp   <report-file> <commit>               Compute the witness triple
   witness verify  <report-file> <commit> <witness>     Verify a claimed witness
+  verify-entrypoint <label> --cmd "<command>"           Classify an evaluator entrypoint's liveness
   tui             [--path LEDGER.md] [--no-color]      Render the dashboard
   version | --version                                  Print version
   help    | --help                                     This help
@@ -261,6 +265,37 @@ export async function run(argv: string[], io: IO): Promise<RunResult> {
         return { code: 1, out: sink.out, err: sink.err };
       }
 
+      case 'verify-entrypoint': {
+        const label = _[1];
+        const cmd = flags.cmd as string | undefined;
+        if (!label || !cmd) {
+          sink.error('usage: dream-machine verify-entrypoint <label> --cmd "<command>"');
+          return { code: 1, out: sink.out, err: sink.err };
+        }
+        if (_.length > 2) {
+          // An unquoted multi-word --cmd (e.g. `--cmd npx @metaharness/redblue` with no
+          // quotes/`=`) gets word-split by the shell before argv reaches us: `--cmd` only
+          // absorbs the next single token, and the rest land here as stray positionals.
+          // Silently proceeding on a truncated command (e.g. running bare `npx`) can itself
+          // produce a false "live" verdict — exactly the failure mode this tool exists to
+          // catch — so treat extra positionals as a hard usage error instead.
+          sink.error(
+            `verify-entrypoint: unexpected extra argument(s) ${JSON.stringify(_.slice(2))} — ` +
+              `did you forget to quote --cmd? usage: dream-machine verify-entrypoint <label> --cmd "<command>"`,
+          );
+          return { code: 1, out: sink.out, err: sink.err };
+        }
+        if (!io.exec) {
+          sink.error('verify-entrypoint: this IO has no exec() — cannot run commands');
+          return { code: 1, out: sink.out, err: sink.err };
+        }
+        const result = await io.exec(cmd);
+        const check = classifyEntrypointResult(result);
+        sink.log(`${label}: ${check.verdict} (exit ${check.code}) — ${check.reason}`);
+        const code = check.verdict === 'live' ? 0 : check.verdict === 'blocked' ? 1 : 2;
+        return { code, out: sink.out, err: sink.err };
+      }
+
       case 'tui': {
         const path = (flags.path as string) || 'docs/dream-cycle/LEDGER.md';
         let md = '';

From d3f1e56ee3168da7d9f5460a4bf33dd707fa0a71 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 13 Aug 2026 21:53:58 +0000
Subject: [PATCH 2/3] docs(dream-cycle): append 2026-08-13 security-adversarial
 ledger row
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ACCEPT — redblue evaluator entrypoint liveness classifier. Issue #6, PR #7.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UAJ2FdMooTevrJ34FW3mpr
---
 docs/dream-cycle/LEDGER.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/dream-cycle/LEDGER.md b/docs/dream-cycle/LEDGER.md
index 35e0b52..a368855 100644
--- a/docs/dream-cycle/LEDGER.md
+++ b/docs/dream-cycle/LEDGER.md
@@ -6,3 +6,4 @@
 | 2026-08-17 | security-adversarial | redblue indirect-injection family | #12 | #13 | yes | ACCEPT | n=6 | d4e5f607 | PR#10 CLOSED |
 | 2026-08-18 | developer-experience | tui verdict distribution panel | #15 | #16 | yes | ACCEPT | +ux | e5f60718 | PR#13 MERGED |
 | 2026-08-19 | compiler-parity | config schema validation gaps | #18 | NONE | no | INCONCLUSIVE | - | f6071829 | PR#16 MERGED |
+| 2026-08-13 | security-adversarial | redblue evaluator entrypoint silently no-ops (npx bin-symlink isMain footgun); added classifyEntrypointResult + verify-entrypoint | #6 | #7 | yes | ACCEPT | npm test 85->96, 0 regressions | ec2052aa | rows dated 2026-08-14..2026-08-19 are unverifiable seed data (see #6); real repo had 0 dream-cycle issues/PRs before tonight |

From 3f577392910b86cd3bc9495c360a6142e3d02a0f Mon Sep 17 00:00:00 2001
From: ruv <ruv@ruv.net>
Date: Thu, 13 Aug 2026 18:04:34 -0400
Subject: [PATCH 3/3] fix(dream-cycle): resolve the two issues the nightly
 surfaced
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- LEDGER.md: remove the fake future-dated demo seed rows (#3-#18, 2026-08-14..19)
  that were never real GitHub state; keep only the real 2026-08-13 night. The
  nightly correctly flagged these as unverifiable (issue #6).
- dream.config.json: drop the broken evaluator entrypoints the nightly proved
  don't work — 'npx @metaharness/redblue' (silent no-op via the bin-symlink
  isMain footgun) and 'npx @metaharness/flywheel' (no bin field); keep the
  working 'npm test' and correct darwin to 'npx @metaharness/darwin evolve'.

Merges main (v0.1.x packaging, 4D site, GHA dream) into the PR branch. 96 tests green.

Co-Authored-By: claude-flow <ruv@ruv.net>
---
 docs/dream-cycle/LEDGER.md |  8 +----
 dream.config.json          | 73 ++++++++++++++++++++++++++++++++------
 2 files changed, 63 insertions(+), 18 deletions(-)

diff --git a/docs/dream-cycle/LEDGER.md b/docs/dream-cycle/LEDGER.md
index a368855..a2e605a 100644
--- a/docs/dream-cycle/LEDGER.md
+++ b/docs/dream-cycle/LEDGER.md
@@ -1,9 +1,3 @@
 | Date | Deep | Finding | Issue | PR | Evaluated? | Verdict | Effect | Witness | Prior-night fates |
 | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| 2026-08-14 | compiler-parity | golden snapshot drift guard | #3 | #4 | yes | ACCEPT | 0 drift | a1b2c3d4 | first night |
-| 2026-08-15 | ledger-signals | zero-merge bias tuning | #6 | NONE | blocked | INCONCLUSIVE | - | b2c3d4e5 | PR#4 MERGED |
-| 2026-08-16 | evaluation-adapters | flywheel receipt replay wiring | #9 | #10 | yes | REJECT | no lift | c3d4e5f6 | PR#4 MERGED |
-| 2026-08-17 | security-adversarial | redblue indirect-injection family | #12 | #13 | yes | ACCEPT | n=6 | d4e5f607 | PR#10 CLOSED |
-| 2026-08-18 | developer-experience | tui verdict distribution panel | #15 | #16 | yes | ACCEPT | +ux | e5f60718 | PR#13 MERGED |
-| 2026-08-19 | compiler-parity | config schema validation gaps | #18 | NONE | no | INCONCLUSIVE | - | f6071829 | PR#16 MERGED |
-| 2026-08-13 | security-adversarial | redblue evaluator entrypoint silently no-ops (npx bin-symlink isMain footgun); added classifyEntrypointResult + verify-entrypoint | #6 | #7 | yes | ACCEPT | npm test 85->96, 0 regressions | ec2052aa | rows dated 2026-08-14..2026-08-19 are unverifiable seed data (see #6); real repo had 0 dream-cycle issues/PRs before tonight |
+| 2026-08-13 | security-adversarial | redblue evaluator entrypoint silently no-ops (npx bin-symlink isMain footgun); added classifyEntrypointResult + verify-entrypoint | #6 | #7 | yes | ACCEPT | npm test 85->96, 0 regressions | ec2052aa | first real night (demo seed rows removed 2026-08-13; see #6) |
diff --git a/dream.config.json b/dream.config.json
index 3305ebc..750e9eb 100644
--- a/dream.config.json
+++ b/dream.config.json
@@ -2,24 +2,75 @@
   "repo": "ruvnet/dream-machine",
   "cron": "0 9 * * *",
   "slots": [
-    { "deep": "compiler-parity", "scan": ["config-schema", "golden-snapshots"] },
-    { "deep": "ledger-signals", "scan": ["witness", "verify"] },
-    { "deep": "evaluation-adapters", "scan": ["flywheel", "darwin"] },
-    { "deep": "security-adversarial", "scan": ["redblue", "supply-chain"] },
-    { "deep": "developer-experience", "scan": ["cli", "tui"] }
+    {
+      "deep": "compiler-parity",
+      "scan": [
+        "config-schema",
+        "golden-snapshots"
+      ]
+    },
+    {
+      "deep": "ledger-signals",
+      "scan": [
+        "witness",
+        "verify"
+      ]
+    },
+    {
+      "deep": "evaluation-adapters",
+      "scan": [
+        "flywheel",
+        "darwin"
+      ]
+    },
+    {
+      "deep": "security-adversarial",
+      "scan": [
+        "redblue",
+        "supply-chain"
+      ]
+    },
+    {
+      "deep": "developer-experience",
+      "scan": [
+        "cli",
+        "tui"
+      ]
+    }
   ],
-  "bonusModuli": { "25": "ui-management-console", "75": "self-hosting-review" },
+  "bonusModuli": {
+    "25": "ui-management-console",
+    "75": "self-hosting-review"
+  },
   "controlPlaneProbes": [
     "node packages/cli/dist/bin.js version || true",
     "npm test --silent 2>&1 | tail -5 || true"
   ],
-  "buildStep": { "cmd": "npm ci && npm run build", "degradeOnWasmFailure": true },
-  "evaluatorEntrypoints": { "bench": "npm test", "flywheel": "npx @metaharness/flywheel", "darwin": "npx @metaharness/darwin", "redblue": "npx @metaharness/redblue" },
+  "buildStep": {
+    "cmd": "npm ci && npm run build",
+    "degradeOnWasmFailure": true
+  },
+  "evaluatorEntrypoints": {
+    "bench": "npm test",
+    "darwin": "npx @metaharness/darwin evolve"
+  },
   "adrConvention": "4-digit",
-  "competitors": ["Sakana AI Scientist", "OpenHands", "DSPy/GEPA", "SWE-agent", "AutoGPT lineage"],
-  "extraDisciplines": ["evaluation-is-not-promotion", "witness-every-quantitative-claim"],
+  "competitors": [
+    "Sakana AI Scientist",
+    "OpenHands",
+    "DSPy/GEPA",
+    "SWE-agent",
+    "AutoGPT lineage"
+  ],
+  "extraDisciplines": [
+    "evaluation-is-not-promotion",
+    "witness-every-quantitative-claim"
+  ],
   "ledgerPath": "docs/dream-cycle/LEDGER.md",
   "branchPrefix": "dream/",
-  "labels": ["dream-cycle", "research"],
+  "labels": [
+    "dream-cycle",
+    "research"
+  ],
   "autoMerge": true
 }