[Dream Cycle 2026-08-11] security: ColluSkill 96% compositional evasion gap (ADR-382) + intelligence,swarm scan

## Tonight's Rotation

| Field | Value |
|-------|-------|
| Deep surface | **security** (SLOT 1) |
| Scan surfaces | intelligence, swarm |
| Session commit | `f35c545fbe927aeb4ab8433bab8d827f69436572` |
| Date | 2026-08-11 |

---

## Drift Check

**Prior dream-cycle issues (last 7):**
| # | Title | Date | State |
|---|-------|------|-------|
| #2953 | performance: cross-agent KV cache sharing 7.8× prefill gap | 2026-08-10 | open |
| #2949 | swarm: SwarmAgentic PSO topology auto-generation +261.8% gap | 2026-08-09 | open |
| #2943 | memory: ScrubJay temporal decay collapses GenGap 5.7× | 2026-08-08 | open |
| #2938 | intelligence: EnvACE World Rehearsal gap — SONA lacks pre-execution self-simulation | 2026-08-07 | open |
| #2932 | security: AgentDB memory poisoning 84.2% persistence gap | 2026-08-06 | open |
| #2923 | performance: 8.08× inference gap | 2026-08-05 | open |
| #2918 | swarm: Stigmergic pheromone bus closes 50%-agent-reduction gap | 2026-08-04 | open |

**Phrase drift:** No finding phrase repeats ≥3 times — CLEAR. Last security night (#2932, 2026-08-06) was "AgentDB memory poisoning / Adaptive Trust Scoring". Tonight's finding is orthogonal: compositional skill evasion of the MCP scanner layer.

⚠️ **needs-merge:** 76 total dream-cycle issues open, 0 merged. No dream-cycle PR has been merged in 15+ nights. Human review and merge of at least one draft PR is strongly recommended.

**Self-score of last night's gist (#2953, performance/KV-cache):**
| Criterion | Score |
|-----------|-------|
| Benchmark grade A or B claim | 2/2 (KVCOMM 7.8× Grade A, MemOPD 1.63× Grade A) |
| ≥4 competitor rows | 2/2 (LangGraph, AutoGen, CrewAI, OpenAI Agents SDK) |
| Specific actions | 2/2 (3 concrete implementation entry points) |
| Witness present | 2/2 (SHA-256 + witness stamp in issue body) |
| <1500 words | 1/1 |
| Novel finding | 1/1 (cross-agent KV cache sharing, no prior dream-cycle coverage) |
| **Total** | **10/10** |

---

## Deep Dive Findings — security

### SOTA Summary (2026)

**ColluSkill** (arXiv:2608.09732, Aug 9, 2026, Grade A): Adversarial cross-skill composition achieves **96.0% ASR** against per-component MCP scanners, including phrase-catalog and Shamir-split fragment detection patterns equivalent to Ruflo's `McpCompositionInspector`. The attacker distributes injection payload fragments across sequential tool calls; each call scores below the per-tool threshold while the target model assembles the combined payload. ChainGuard — a chain-level cross-skill correlation defense maintaining a rolling injection-risk sum — reduces ASR to **22.5%**.

**SkillsMetric** (arXiv:2608.08468, Aug 8, 2026, Grade A): Static analysis of 138K skills achieves AUC 0.93 for benign/malicious classification but **0% detection of host-destruction attacks** and only 42% for prompt injection. Ruflo's `injection-catalog.ts` has no host-destruction patterns.

**StepJack** (arXiv:2608.06477, Grade A): Multi-step indirect prompt injection ASR rises monotonically from **31.3% at hop 1 to 36.9% at hop 3**. Ruflo's `ChannelGuard` is stateless per-hop — no accumulated risk across swarm pipeline hops.

**Persistent Semantic Entities** (arXiv:2608.07952, Aug 7, 2026, Grade A): Preference injection compounds **1.9× across a 4-stage pipeline**; **100% contamination at t=10**. Contamination survives stateless per-hop scanning.

### Gap vs Current Ruflo

| Gap | Current State | SOTA |
|-----|--------------|------|
| Cross-tool composition scanning | `McpCompositionInspector` per-tool only | ColluSkill 96% ASR vs per-tool; ChainGuard 22.5% post-defense |
| Multi-hop injection accumulation | `ChannelGuard` stateless per-hop | StepJack: 31.3% → 36.9% ASR as hop count rises |
| Host-destruction detection | No patterns in `injection-catalog.ts` | SkillsMetric: 0% detection baseline |
| Sequential contamination compounding | No session-level risk ledger | 1.9× compounding across 4 hops |

### Recommended Action

→ **ADR-382**: `ChainRiskAccumulator` in `McpCompositionInspector` (cross-tool session-scoped rolling risk sum); `SessionRiskLedger` in `ChannelGuard` (stateful multi-hop accumulation); `HOST_DESTRUCTION_PATTERNS` in `injection-catalog.ts`. Entry points: `v3/@claude-flow/cli/src/security/mcp-composition-inspector.ts`, `v3/@claude-flow/cli/src/security/channel-guard.ts`, `v3/@claude-flow/cli/src/security/injection-catalog.ts`.

---

## Scan Findings — intelligence

**Source:** arXiv:2608.09643 "Activation Probes Surface Code-Security Signals that the Model's Output Misses" (Grade A)

**Finding:** Probing internal model activations achieves **61–67% accuracy** detecting vulnerable vs. fixed code without any output-level signal. Ruflo's SONA neural system records trajectory rewards but does not tap internal activation signals for security classification. Adding a lightweight activation probe at the reasoning boundary could surface security-critical patterns SONA misses entirely.

**Competitive signal:** No competitor (LangGraph, AutoGen, CrewAI, OpenAI Agents SDK) has published an activation-level security probe for agent systems in 2026.

**One-sentence finding (Grade A):** Activation probes reach 61–67% accuracy on vulnerable-vs-fixed code without output-level signals; SONA has no equivalent activation-level security classifier.

---

## Scan Findings — swarm

**Source:** arXiv:2608.06477 "StepJack" (Grade A)

**Finding:** Multi-step indirect prompt injection ASR rises monotonically — **31.3% at 1-hop, 36.9% at 3-hop**. Ruflo's swarm passes tool-output context across `ChannelGuard` boundaries, but `ChannelGuard` is stateless: content cleared at hop 1 can arrive at a successor agent as part of a multi-hop injection sequence with no accumulated-risk signal.

**Competitive signal:** No competitor tracks cumulative per-session injection risk across multi-agent hops.

**One-sentence finding (Grade A):** StepJack proves multi-hop prompt injection compounds monotonically; Ruflo's stateless `ChannelGuard` has no per-session accumulation to detect this.

---

## Competitors Reviewed

| Competitor | Cross-tool composition defense | Multi-hop injection tracking | Code execution safety | 2026 notes |
|---|---|---|---|---|
| LangGraph | None | None | None | No security hardening in 2026 changelog |
| AutoGen / AG2 | None | None | Docker executor default (v0.7.5) + `approval_func` | Most security-active competitor in 2026 |
| CrewAI | None | None | None | No security features in 2026 releases |
| OpenAI Agents SDK | ToolGuardrail (per-call only) | None | Sandboxed tools | No cross-tool composition defense |

No competitor has shipped a cross-tool composition security layer. First-mover advantage available.

---

## Gist

⚠️ gh CLI unavailable in this environment (FALLBACK=true). Research content captured in this issue and branch file `v3/research/dream-gist-2026-08-11.md`.

**GIST_HASH (canonical file sha256):** `a49ec6f669ffda52ab20f84b6ee9bf0054d7746154cb51d03bb8d2f653acaaf9`

---

## Witness

| Field | Value |
|-------|-------|
| Session commit | `f35c545fbe927aeb4ab8433bab8d827f69436572` |
| Report SHA-256 | `a49ec6f669ffda52ab20f84b6ee9bf0054d7746154cb51d03bb8d2f653acaaf9` |
| Witness stamp | `c76a4e325430373793d470aab112b7e0a723c3ebd3b9564dfb03871b21ad32f8` |

Verifier: `sha256sum v3/research/dream-gist-2026-08-11.md` → concat session commit → `sha256sum` → must equal Witness stamp.

---

## ADR

**ADR-382:** `v3/docs/adr/ADR-382-dream-cycle-security-chain-risk-accumulator.md` — ChainRiskAccumulator: Cross-Tool Sequential Injection Correlation. Adds `ChainRiskAccumulator` to `McpCompositionInspector` (session-scoped rolling risk sum), `SessionRiskLedger` to `ChannelGuard` (stateful multi-hop accumulation), and `HOST_DESTRUCTION_PATTERNS` to `injection-catalog.ts`. Targets ColluSkill compositional evasion (96.0% ASR → ~22.5% post-defense), StepJack multi-hop gap, and SkillsMetric 0% host-destruction detection.

Start with v3/docs/adr/ADR-382-dream-cycle-security-chain-risk-accumulator.md, then read v3/@claude-flow/cli/src/security/mcp-composition-inspector.ts, channel-guard.ts, and injection-catalog.ts. Trace the existing per-tool and per-hop checks before implementing the session risk accumulator, multi-hop ledger, and host-destruction patterns described in the ADR. Done means all three security gaps are addressed across those entry points.

Written by the indexing model from the issue text.