[Dream Cycle 2026-06-26] security: MCP tool permission boundaries unguarded — ShareLock >90% ASR + intelligence,swarm scan

## Tonight's Rotation

| Field | Value |
|-------|-------|
| Date | 2026-06-26 |
| Slot | 1 |
| Deep Surface | security |
| Scan 1 | intelligence |
| Scan 2 | swarm |
| Session Commit | `8ae87524553569dcd6ba6a7e7e96fbea6b0e0b74` |
| Branch | `dream/2026-06-26-security` |
| ADR | ADR-155 (MCP Tool Permission Attestation) |

---

## Drift Check

**Prior dream-cycle issues (7 most recent):**

| # | Surface | Title | Date |
|---|---------|-------|------|
| #2462 | performance | 5× Grade A evidence for stateful KV-cache + execution graph scheduler | 2026-06-25 |
| #2456 | swarm | SGTO-MAS trust-weighted consensus closes 5.3% adversarial gap | 2026-06-24 |
| #2452 | memory | semantic drift from repeated summarization cycles | 2026-06-23 |
| #2435 | intelligence | FLARE myopic commitment gap — SONA has no lookahead simulation | 2026-06-22 |
| #2429 | **security** | 83.9% of sandbox harms pass semantic checks — execution-phase enforcement gap | 2026-06-21 |
| #2427 | performance | Ruflo missing task-completion benchmark vs LangGraph 62% | 2026-06-20 |
| #2419 | swarm | AdaptOrch +22.9% SWE-bench via adaptive topology | 2026-06-19 |

**Drift flags:**
- ⚠️ **needs-merge**: 0 dream-cycle PRs merged in the last 14 nights. Human review + merge needed.
- ✅ No phrase repeated ≥3 times in recent titles.
- ✅ Security last ran 5 days ago (#2429) — not exhausted. Different angle tonight (MCP tool boundaries vs. sandbox execution-phase from #2429).

**Self-score of #2462 (performance, last night's gist):**
Gist content not directly accessible in this environment; scoring deferred. If available, apply: benchmark grade A/B=2, ≥4 competitor rows=2, specific actions=2, witness present=2, <1500 words=1, novel finding=1 (max 10).

---

## Deep Dive Findings — Security

### SOTA Summary (2026-06-26)

Seven Grade-A papers converge on MCP tool-call boundaries as the primary unguarded attack vector in LLM agent systems:

| Finding | Metric | Grade | Source |
|---------|--------|-------|--------|
| ShareLock threshold poisoning on MCP tools | >90% ASR via Shamir's scheme | A | arXiv 2026 |
| ToolPrivBench: over-privilege usage rate (Qwen3-8B) | 64.9% OPUR baseline | A | arXiv 2026 |
| ToolPrivBench: post-training over-privilege reduction | 64.9% → 27.02% | A | arXiv 2026 |
| ControlPlane paper: agents declaring permission boundaries | <1% | A | arXiv 2026 |
| Progent out-of-band prompt injection defense | 25.8% → 4.2% ASR (6×) | A | arXiv 2026 |
| Entropy-dynamics jailbreak detection (training-free) | AUROC 0.941 | A | arXiv 2026 |
| Intent+harm unified verifier | F1 0.90 → 0.95, ASR 4.1% | A | arXiv 2026 |
| TerraProbe deceptive LLM fix rate | 71.4% of suggestions | A | arXiv 2026 |
| ToolPrivBench: tool failure amplifies privilege escalation | Cross-model confirmed | A | arXiv 2026 |
| LangSmith: gateway guard + sandbox auth proxy (GCP/AWS) | Production June 2026 | B | LangChain changelog |
| PrivacyAlign: GPT-5.5 23.3%, Claude Opus 4.7 34.1%, Gemini 3.1 Pro 41.4% leakage | Baseline | B | HuggingFace 2026 |

### Gap vs Current Ruflo

Ruflo `@claude-flow/security` provides `SafeExecutor` (command injection), `InputValidator` (Zod), `PathValidator` (traversal). **None operate at the MCP tool registration or dispatch layer.**

- ❌ No `ToolPermissionContract` on tool registration — tools run at whatever privilege they claim
- ❌ No OPUR measurement — 64.9% base rate is assumed to apply
- ❌ No prompt-injection out-of-band verifier (Progent-style)
- ❌ No jailbreak detection on SONA input boundary (entropy-dynamics)
- ❌ No deceptive-fix detection for tool-generated code patches (TerraProbe finding)

### Recommended Action

**Primary (ADR-155, this PR):** Implement MCP Tool Permission Attestation — each tool declares `minPrivilege` contract at registration; `SafeExecutor` extended with `McpPermissionGuard` that rejects escalations before dispatch. Target: OPUR ≤ 30% (matching ToolPrivBench post-training baseline).

**Secondary:** Add Progent-style secondary-model verifier at tool-call intercept point (Tier-2 Haiku, ~15% token overhead, targets 4.2% residual ASR).

**Tertiary:** Entropy-dynamics jailbreak guard on MoE gate using Kendall τ trajectory (training-free, composable with RuVector).

---

## Scan Findings — Intelligence

**Source**: "Plans Don't Persist: Why Context Management Is Load Bearing for LLM Agents" (Snowflake, HuggingFace 2026)

**Finding**: Plan representations decay 4.1×–12.4× after a single execution step. Context eviction reduces task success from 56.7% → 22.0% (−34.7 pp). An early-warning probe detects plan decay 4.45 steps ahead at 74.2% accuracy.

**Gap vs Ruflo**: SONA's adaptation loop stores plans in short-context memory with no plan-persistence guard. Silent eviction under load is the expected behaviour — same failure mode as the paper's baseline.

**Competitive signal**: DeepSeek-R1 partially mitigates via internal re-derivation; still underestimated by 4.5× in standard detection. No agent frameworks have shipped a production plan-persistence guard as of 2026-06-26.

**Action**: no ADR tonight (implementation-level) — add plan-persistence probe to SONA adaptation loop backlog.

---

## Scan Findings — Swarm

**Source**: SPIN framework, arXiv 2606.07557 (Fan 2026)

**Finding**: Multi-agent policy coordination complexity reduced from O(n^m) to O(m·n·χ²) — exponential to polynomial — enabling stable decentralised subgroup formation without a central coordinator.

**Gap vs Ruflo**: Ruflo defaults to `hierarchical` topology. This is suboptimal for large fleets (>16 agents) where decentralised subgroup formation yields lower latency. SPIN's complexity bound suggests the switch-over point is computable from agent count and task dependency graph.

**Competitive signal**: Hardware-embodied swarms (SIES hexapod, arXiv 2606.24958) achieving fault-recovery via generalizable coupling operators — real-time swarm resilience is moving to physical validation.

**Action**: no ADR tonight (implementation-level) — evaluate SPIN complexity threshold for Ruflo topology auto-selection (ADR-019 candidate extension).

---

## Competitors Reviewed

| Competitor | MCP Security Posture | Prompt-Injection Defense | Sandbox / Isolation | Over-Privilege Guard |
|-----------|---------------------|--------------------------|---------------------|----------------------|
| **LangChain / LangSmith** | Custom tool registry; no MCP layer | Gateway guard PII filter (B) | Sandbox auth proxy GCP/AWS June 2026 | Not published |
| **AutoGen** | No public MCP security posture | Research-stage only | Docker isolation (configurable) | No published benchmark |
| **CrewAI** | No public MCP security posture | Not documented | Environment sandboxing | Not published |
| **OpenAI Swarm** | N/A (API-native, no MCP) | System-prompt hardening only | Operator-level isolation | No over-privilege API |
| **Ruflo** | SafeExecutor (no MCP-layer contract) | None implemented | Agent process isolation | None (ADR-155 proposes fix) |

---

## Gist Link

SOTA report committed to branch as `v3/docs/dream-cycle/2026-06-26-security-sota.md` (no gist CLI available in this environment).

Direct file: https://github.com/ruvnet/ruflo/blob/dream/2026-06-26-security/v3/docs/dream-cycle/2026-06-26-security-sota.md

---

## Witness

| Field | Value |
|-------|-------|
| Session commit | `8ae87524553569dcd6ba6a7e7e96fbea6b0e0b74` |
| Report SHA-256 | `90fdca347b95cb2331628df553ffc9e620e877f4c2c7d14f4c790af1f4c4756b` |
| Witness stamp | `94640412feecef6ccef028cece6fb8af1abb8d577c12c850fd9f0a979a969cfc` |

**Verifier**: `sha256sum v3/docs/dream-cycle/2026-06-26-security-sota.md` (pre-witness content hash) → concat `8ae87524553569dcd6ba6a7e7e96fbea6b0e0b74` → `sha256sum` → must equal witness stamp.

Start with ADR-155 and the current @claude-flow/security implementation, especially SafeExecutor, then inspect how MCP tools are registered and dispatched. The issue's report is documented in v3/docs/dream-cycle/2026-06-26-security-sota.md. Done means the proposed permission-attestation and pre-dispatch escalation checks are implemented with validation evidence, while the secondary and tertiary ideas remain separate follow-up work.

Written by the indexing model from the issue text.