[Dream Cycle 2026-09-05] performance: CLI cold-start benchmark measured setTimeout(), not the real CLI (evaluated, ACCEPT-scoped) + security,hive-mind scan

## 1. Tonight's Rotation

| Key | Value |
|---|---|
| Date | 2026-09-05 |
| DEEP | performance |
| SCAN | security, hive-mind |
| SLOT | 0 |
| Session commit | `db4991967c45c6f72133dff0bb80b0a492960fc1` |
| Branch | `dream/2026-09-05-performance` |
| Bonus deep-dives | none (DAYINT%25=5, %75=30 — neither trigger) |
| ADR | None — scoped wiring/correctness fix + one doc-table correction, matches repo convention (same class as 08-24 weightedConsensus, 08-25 PQ dispatch, 08-30 diskann removal). |

## 2. Ledger Check

Last 14+ rows inspected. **Found and fixed a real gap**: rows for 2026-08-24 through 2026-09-03 (10 nights) were never appended to `docs/dream-cycle/LEDGER.md` despite the pipeline running to completion every one of those nights. Verified via direct evidence before concluding this (per STEP 1's anti-inference rule), not inferred from a sparse table:
- `git ls-remote --heads origin "dream/*"` shows real branches for every date 2026-08-24..2026-09-03.
- `search_issues label:dream-cycle` / `search_pull_requests` confirm a real issue + draft PR pair for each of those 10 nights.
- `2026-08-20` through `2026-08-23` is a **separate, genuine 4-night gap** (no branches, no issues, no PRs at all) — independently reconfirmed by three prior nights (08-24, 08-25, 08-27) and reconfirmed again here.
- Via `issue_read` on #3109: PRs #3043/#3044, #3048/#3049, #3056/#3057, #3061/#3062 (08-16 through 08-19) were **merged 2026-08-21** — updates this ledger's last-recorded "OPEN" status for them.

Backfilled all 10 missing rows into `LEDGER.md` (titles + verdicts; full effect-size detail lives in each linked issue, not re-extracted tonight to protect research budget per STEP 0.6). **This is the 3rd occurrence of this exact ledger-append failure mode** — no longer a one-off; elevated from a background note to an explicit recommendation (see §15).

Prior-night fates (last 8 with an ACCEPT/REJECT verdict, all still open drafts as of tonight, consistent with "never self-merge"):
| Date | Deep | Issue | PR | Fate |
|---|---|---|---|---|
| 2026-08-24 | swarm | #3085 | #3086 | OPEN draft (ACCEPT) |
| 2026-08-25 | performance | #3093 | #3094 | OPEN draft (ACCEPT) |
| 2026-08-26 | security | #3102 | #3103 | OPEN draft (ACCEPT-with-caveats) |
| 2026-08-27 | intelligence | #3109 | #3110 | OPEN draft (ACCEPT-scoped) |
| 2026-08-28 | memory | #3118 | #3119 | OPEN draft (ACCEPT) |
| 2026-08-29 | swarm | #3122 | #3123 | OPEN draft (ACCEPT) |
| 2026-08-30 | performance | #3129 | #3130 | OPEN draft (ACCEPT) |
| 2026-08-31 | security | #3138 | #3139 | OPEN draft (ACCEPT) |

**Performance-surface duplicate-direction check**: HNSW efSearch tuning (REJECTED 08-15), HNSW PQ dispatch (fixed 08-25), diskann-backend dead code (fixed 08-30), KV-cache-sharing research (08-10) all confirmed exhausted/already-addressed and not revisited. Tonight's finding (fabricated benchmark harness) is a distinct mechanism in a different subsystem (`@claude-flow/performance`, not `@claude-flow/memory`'s HNSW code).

**Prior gist self-score (2026-09-03, memory)**: estimated 9/10 — Grade A/B benchmark evidence (2), 10 competitor rows (2), specific executable recommendations (2), valid witness (2), genuinely novel finding (1); likely exceeds the 1500-word cap (0) — not re-counted exactly tonight to protect budget, but all other criteria clearly met from a direct read.

## 3. Deep Dive Findings

Five parallel research roles fanned out (Deep Researcher, 2 Scan Researchers for security/hive-mind, Competitor Analyst, Ruflo Architecture Reviewer). Full findings, grading, and citations in the committed gist (`docs/dream-cycle/dream-gist-2026-09-05.md`).

Headline, independently converged on by both the Deep Researcher and the Architecture Reviewer: `v3/@claude-flow/performance/benchmarks/startup/cli-cold-start.bench.ts` defines a real, `child_process.spawn()`-based `measureColdStart()` — and never calls it. Every benchmark instead used `setTimeout()` delay chains with invented constants. The worst instance, a "V2 vs V3 Comparison Simulation," paired `setTimeout(resolve, 100)` ("V2") against `setTimeout(resolve, 20)` ("V3") with zero code in between — a "5.00x speedup" guaranteed by construction on every single run, regardless of any real code. Sibling files `agent-spawn.bench.ts`, `mcp-server-init.bench.ts`, `cli-warm-start.bench.ts` share the identical anti-pattern (not fixed tonight — see §15).

Why now: UC Berkeley RDI (Apr 2026) and a follow-up industry report found 8 standard agent benchmarks gameable to near-100% without solving the task — the same class of failure (self-reported framework performance numbers with no reproducible harness) this finding reproduces in Ruflo's own repo.

## 4. Hypothesis

> Given the CLI cold-start benchmark suite, which currently reports a "V2 vs V3" speedup and other headline numbers purely from hardcoded `setTimeout()` delays without exercising any real code path, when the suite is rewired to call its own pre-existing (but dead) `measureColdStart()` function — spawning a real `node bin/cli.js` child process — and the fabricated V2-vs-V3 comparison is removed rather than "fixed" (no V2 binary remains to compare against), then the suite should report a genuine measured wall-clock number reflecting actual current CLI behavior for at least one real subcommand, subject to: (1) existing tests remain green; (2) the fix touches only the benchmark/test harness and one documentation table, not production CLI code; (3) $0 evaluation cost, zero LLM calls; (4) the honest scope limitation (measures `--version` only, because this worktree's `dist/` isn't built) is disclosed rather than hidden.

Frozen before evaluation; not modified after seeing results.

## 5. Evaluation Receipt

**evaluated: accepted, with disclosed caveats (ACCEPT-scoped).** Real evaluator: Vitest 4.1.8, deterministic, zero LLM calls, $0 cost. Candidate: `cli-cold-start.bench.ts` (exported `measureColdStart`, added `runRealColdStartMeasurement`/`CLI_BIN_PATH`, removed the fabricated block), new test `__tests__/cli-cold-start.test.ts` (4 tests), 2-row correction in `ADR-STATUS-SUMMARY.md`.

Baseline vs. candidate isolated via `git stash` of just the `.bench.ts` file: all 4 new tests **fail against baseline** (functions not exported pre-fix; fabricated-pattern guard also fails) and **pass against candidate**. Full `@claude-flow/performance` suite: **99/99 passing** (95 pre-existing + 4 new, identical pre-existing pass count both ways). `tsc --noEmit`: zero errors.

Real measured number: `node bin/cli.js --version`, 5 runs — mean **54.65ms**, min 51.94ms, max 57.92ms — well under the 500ms target. Caveat: `--version` is the one subcommand that runs without a built `dist/` in this worktree; other subcommands currently fail with `ERR_MODULE_NOT_FOUND` (confirmed independently by two research roles tonight), so this measures one real subcommand's cold start, not the full CLI's.

## 6. Darwin Results

Skipped — scope mismatch, confirmed via `npx ruvector harness darwin --help`: real interface takes a JSON genome config with `--execute` over continuous/categorical parameters. This is a dead-code-wiring fix with a binary "called or not" evaluation, not a tunable parameter with a search space.

## 7. Flywheel Evidence

No signed `@metaharness/flywheel` bundle — deterministic Vitest evidence retained instead (consistent with every accepted night since 08-18). Classified: OBSERVATION (dead `measureColdStart()` call, grep+read confirmed) / MEASUREMENT (baseline-fails/candidate-passes, 99/99 green, tsc clean, real 54.65ms±3ms number) / INFERENCE (the fabricated number never reflected real behavior; this fix doesn't itself prove current CLI startup is fast/slow beyond the one subcommand measured) / DECISION (ship as small, additive fix) / REJECTION (none this round).

## 8. Reward Hack Check

No standalone generic reward-hack CLI reachable this session. Manual checklist: no test weakened (purely additive); no gold-label leakage (none exists in this code); no cherry-picking (full 99-test suite both ways); no seed manipulation (real subprocess timing, variance disclosed via min/max); zero cost; no undocumented caching. The one real limitation (covers `--version` only) is disclosed in-code and here, not hidden.

## 9. Security Review

Not primary tonight. `runRealColdStartMeasurement()` spawns a fixed, hardcoded command with `shell: false` (unchanged from the pre-existing helper) — no user-controlled input reaches the spawned args. No new network/filesystem/credential surface; dev/benchmark tooling only.

## 10. Scan Findings: security

**New, code-verified, Medium severity.** Plugin supply-chain controls are documented but never enforced at install time. `v3/@claude-flow/cli/src/plugins/store/discovery.ts:96-102` defines real `PluginStoreConfig` fields (`requireVerification`, `minTrustLevel`, `blockedPlugins`, `allowedPermissions`, `requirePermissionPrompt: true`) and `SECURITY.md` documents checksum/trust/permission gating — but `commands/plugins.ts:217,228`'s `--verify` flag is read into a local variable and never used again; the registry entry's `checksum`/`trustLevel`/`permissions` (lines 271-309) are fetched only for cosmetic display while the real install (`manager.installFromNpm`) runs a plain `npm install ` fully decoupled from that metadata; repo-wide grep for `config.blockedPlugins|minTrustLevel|allowedPermissions|requirePermissionPrompt` returns zero matches. `manager.ts`'s `enable()` logs a warning and flips the plugin on regardless of trust level. Net effect: an `unverified`/`privileged`-permission entry installs and enables identically to an `official` one. Distinct from `discovery.ts:186`'s real, fail-closed registry-JSON signature check. Testable cheaply via a stubbed-npm unit test. Not implemented tonight (out of scope for the performance DEEP surface) — see §15.

## 11. Scan Findings: hive-mind

**New, code-verified.** Raft leader-election safety gap in `v3/@claude-flow/swarm/src/consensus/raft.ts`. `startElection()` (303-333) counts `votesReceived` across a peer loop; `requestVote()` (335-368) correctly steps a node down to follower internally if a peer reveals a higher term (347-352) — but the outer loop keeps counting votes granted by *earlier* peers under the original (now-stale) term. If a later peer grants a vote after the internal term-bump, `votesReceived` can cross `votesNeeded` and `becomeLeader()` fires (370) with no guard that all counted votes share the current term or that the node is still `candidate`. This can produce a leader elected via a majority mixing stale- and current-term votes — violating Raft's core safety property, potentially yielding two simultaneous leaders for one term. `raft-transport.test.ts` only exercises the receiver side; nothing drives a multi-peer election with a mid-loop term bump. Testable cheaply via a mock transport returning mixed terms. Not implemented tonight — a consensus-safety correctness bug deserves its own focused night; see §15.

## 12. Competitors Reviewed

| System | Mechanism | Performance characteristic | Grade |
|---|---|---|---|
| Qdrant | Rust HNSW + TurboQuant | ~8x compression, minimal recall loss | B |
| Milvus | Multi-index incl. DiskANN | Exceeds-RAM indexing, neither Qdrant nor Weaviate match | B |
| LangGraph | Graph state-delta passing | Fastest of 4 frameworks on 5 latency tasks (2026 independent run) | B |
| AutoGen/AG2 | Async, sequential-default GroupChat | Matched LangGraph latency; sequential default caps concurrency | C |
| CrewAI | Role-based, role re-injected per turn | ~18% token overhead vs. LangGraph | C |
| OpenAI (prompt caching) | Automatic exact-prefix caching | 50-90% cost cut, 13-31% TTFT improvement (arXiv-verified) | A |
| Ruflo (before tonight) | Real spawn-based measurement fn, never called | 0% real coverage of its own claimed numbers | — |

Full "why the cross-framework spawn-overhead cell is empty everywhere" analysis (arXiv:2606.20695 — 7/10 recent coordination-gain claims fall inside noise-floor variance) in the gist.

## 13. Gist

`docs/dream-cycle/dream-gist-2026-09-05.md` (committed on this branch; no gist-creation MCP tool available in this session, consistent with every dream-cycle night since 2026-08-14).

## 14. Witness

| Field | Value |
|---|---|
| Session commit | `db4991967c45c6f72133dff0bb80b0a492960fc1` |
| Gist SHA-256 (pre-witness content) | `0aae2712a54567521f308721205cbcbded0dadada2ab052810476b8e94d60fce` |
| Witness stamp | `04f903bab9006e79cf201c498058d028d66a0de7d6ef17e97325638336d1e98c` |

Verifier procedure: fetch `docs/dream-cycle/dream-gist-2026-09-05.md` from this branch, strip the witness table's filled values back to `PENDING`, SHA-256 it, concatenate with the session commit above, SHA-256 again — result must equal the witness stamp.

## 15. Recommendation

1. **Merge the linked draft PR** (human review required) — small (~120 net lines across 3 files), fully reversible, additive, with a discriminating regression test and disclosed scope limitations.
2. **Prioritize the hive-mind Raft election-safety finding** (§11) for a near-term `swarm`/`hive-mind` night — a consensus-safety correctness bug, not a performance/research question.
3. **Fix the plugin supply-chain enforcement gap** (§10) — either a small standalone PR wiring the existing config fields into `commands/plugins.ts`/`manager.ts`, or a future `security` DEEP night if it needs more design work.
4. Apply the same "wire the real measurement, delete the fabricated one" fix to `agent-spawn.bench.ts`, `mcp-server-init.bench.ts`, `cli-warm-start.bench.ts` — not done tonight to keep this patch to one conceptual change.
5. **Ledger-append reliability** is now a 3rd-occurrence recurring failure (10 nights backfilled tonight). Recommend a future `automation`/`meta` DEEP night treat "harden STEP 25 against silent failure" as a first-class candidate, not a footnote.
6. Continued human review needed for the 8 still-open ACCEPT-evidence PRs from 08-24 through 08-31 (table in §2).

Start with v3/@claude-flow/performance/benchmarks/startup/cli-cold-start.bench.ts and inspect the existing measureColdStart() path and benchmark cases. Run the mentioned __tests__/cli-cold-start.test.ts, the @claude-flow/performance suite, and tsc --noEmit. Done means the benchmark measures a real CLI subcommand, removes fabricated timing claims, and records the documented limitation.

Written by the indexing model from the issue text.