## 1. Tonight's Rotation | Key | Value | |---|---| | Date | 2026-08-30 | | DEEP | performance | | SCAN | security, hive-mind | | SLOT | 0 | | Session commit | `d33ef4bf8ab27a8f9ef08352c9c293b53312a861` | | Branch | `dream/2026-08-30-performance` | | ADR | None — dead-code removal + doc-accuracy fix, matches repo convention (every recent scoped-fix night skipped an ADR) | ## 2. Ledger Check Last 14+ rows inspected (`docs/dream-cycle/LEDGER.md`). The ledger on `main` is still frozen at the 2026-08-19 row (a merge-cadence backlog, not a pipeline failure — confirmed identically by 2026-08-29's own night). Pulled forward the 2026-08-20..29 backfill from `dream/2026-08-29-swarm` (not yet merged) rather than re-deriving it. Last 7 nights' fates, verified via GitHub MCP directly (not inferred): | Date | Deep | Issue | PR | Fate | |---|---|---|---|---| | 2026-08-20..23 | — | — | — | **Confirmed no-run gap** — no branch/PR/issue for any of these 4 dates. Re-verified tonight via `git ls-remote --heads origin "dream/*"` and `search_pull_requests head:dream/2026-08-2`. 8th consecutive night this gap has been re-confirmed, root cause still undiagnosed. | | 2026-08-24 | swarm | #3085 | #3086 | OPEN draft, ACCEPT evidence, not yet merged | | 2026-08-25 | performance | #3093 | #3094 | OPEN draft, ACCEPT evidence, not yet merged | | 2026-08-26 | security | #3102 | #3103 | OPEN draft, ACCEPT-with-caveats evidence, not yet merged | | 2026-08-27 | intelligence | #3109 | #3110 | OPEN draft, ACCEPT-scoped evidence (post-review corrected), not yet merged | | 2026-08-28 | memory | #3118 | #3119 | OPEN draft, ACCEPT evidence, not yet merged | | 2026-08-29 | swarm | #3122 | #3123 | OPEN draft, ACCEPT evidence, not yet merged | By contrast, 2026-08-16 through 2026-08-19's candidate PRs (#3044, #3049, #3057, #3062) **did** merge, on 2026-08-21 — so the pattern is a review backlog on recent nights, not an abandoned-and-rejected one. 08-14/08-15 (the two nights before the current run of successes) were genuinely REJECTED evidence (density-invariant breach, recall-floor breach) and remain unmerged by design. **Performance-surface duplicate-direction check**: prior performance nights — 06-05/06-10/06-15/06-20/06-25/06-30/07-05/07-10/07-20/07-25/08-05/08-10 (SOTA-research-only nights, pre-v3-evidence-pipeline), 08-15 (efSearch/efConstruction REJECTED), 08-25 (productQuantizeDistance ACCEPTED). No finding phrase repeats ≥3 times. Surface not exhausted, but the "find one more implemented-but-unwired function" *mechanism* has now been used on 6 of the last 7 nights across surfaces (08-24 swarm, 08-25 performance, 08-26 security, 08-27 intelligence, 08-28 memory, 08-29 swarm) — tonight's finding is the same mechanism again (diskann-backend.ts unwired), but the *subject* (a stale, already-corrected public performance claim propagating into user-facing generated docs) is a different class of bug than the prior six's silent-runtime-behavior bugs, and the research section this time is substantially deeper per the operator's v3.1 guidance (see §3, §12). **Prior gist self-score (2026-08-29, swarm)**: 9/10 — benchmark evidence grade A (2), 5 competitor rows (2), 5 specific executable recommendations (2), valid witness (2), genuinely novel Ruflo-specific finding (1), word count over the 1500 soft cap (0, ~1850 words). No narrowing action required — flagged for future nights to trim. ## 3. Deep Dive Findings Full 5-role parallel research fan-out (Deep Researcher, Competitor Analyst, Ruflo Architecture Reviewer, plus 2 scan researchers below) — see gist for the full literature table (arXiv:2607.04630 CHAT constraint-aware HNSW tuning; SIGMOD/PACMMOD RaBitQ; VLDB 2025 SegPQ; arXiv:2605.25521 CS-PQ; arXiv:2607.09015 correlation-aware bandit routing; multi-agent KV-cache-sharing literature explicitly ruled out as inapplicable to Ruflo's hosted-API architecture). Independently, the Architecture Reviewer found `v3/@claude-flow/cli/src/ruvector/diskann-backend.ts` (375 lines — a complete `diskann → hnsw → cosine-js` fallback chain with its own benchmark utility) has **zero call sites anywhere in the monorepo**: not re-exported from `ruvector/index.ts`, not imported by any command/tool/test. `@ruvector/diskann` is not a listed dependency anywhere (confirmed via `npm ls`), so even `isDiskAnnAvailable()` would always resolve `false` at runtime. Tracing forward from there: `v3/@claude-flow/cli/src/init/claudemd-generator.ts` — the generator behind every `ruflo init` — told new projects to "Use HNSW/DiskANN for vector search" and claimed "HNSW/DiskANN: 150x-12,500x faster search". That exact "150x-12,500x" figure was already measured to be unreproducible and corrected to "~1.9x-4.7x vs brute force, recall@10 ~0.99" in this repo's own `docs/reviews/intelligence-system-audit-2026-05-29.md` and root `CLAUDE.md`/`v3/CLAUDE.md` — five months before tonight — but the correction never propagated into the generator that ships to every new user's own project. ## 4. Hypothesis > Given a new project created via `ruflo init` (default or `--wizard`), when the generated CLAUDE.md's performance/intelligence sections are corrected to drop the DiskANN claim (its only integration, `diskann-backend.ts`, has zero call sites in the monorepo and `@ruvector/diskann` is not a dependency) and replace "150x-12,500x faster search" with this repo's own measured figure ("~1.9x-4.7x vs brute force, recall@10 ~0.99"), then generated project documentation states only claims Ruflo can substantiate, subject to: (1) no other generated-doc section changes; (2) zero import/build errors anywhere in the monorepo from removing `diskann-backend.ts`; (3) existing test suite green; (4) $0 cost. Frozen before evaluation; not modified after. ## 5. Evaluation Receipt **evaluated: accepted.** Real evaluator: `vitest run` + `tsc --noEmit`, deterministic, $0, zero LLM calls. Baseline reproduced via `git stash` (source diff, keeping the new test): fails exactly as predicted (both stale strings present in the 'performance'/'full' template output). Candidate (restored): 17/17 passing in the touched `describe('generateClaudeMd')` block. Full `@claude-flow/cli` package suite: candidate and a controlled baseline re-run produced **byte-identical** 106-failure lists (pre-existing, environmental — missing native `@ruvector/*-wasm` modules in this sandbox, same documented class as multiple prior nights); disclosed, not hidden: an initial pair of ad hoc full-suite runs showed differing raw counts (104 vs 85 failed) before this controlled comparison, attributable to suite-level flakiness unrelated to the diff. `tsc --noEmit`: all pre-existing errors are unbuilt-sibling-package (`@claude-flow/memory`, `@claude-flow/neural`, `@claude-flow/swarm`) resolution failures, none referencing either touched file. ## 6. Darwin Results Skipped — scope mismatch. This is a documentation-accuracy/dead-code-removal fix with no continuous/categorical parameter; `darwin --execute`'s real interface (confirmed via `npx ruvector harness darwin --help`) evolves routing/topology/prompt/memory/tool/tier/context/coordination genome parameters against an LLM-scored bench corpus. Same skip class as 7 of the last 8 dream-cycle nights. ## 7. Flywheel Evidence No `.claude-flow/flywheel/` state exists in this repo. No signed `@metaharness/flywheel` bundle — deterministic Vitest evidence, not an LLM-task corpus the replay/verify tooling targets, same as every algorithmic/doc-accuracy candidate since 08-14. Classified: OBSERVATION (zero call sites, confirmed by direct grep across the full monorepo, independently re-verified by the critic) / MEASUREMENT (baseline-fails/candidate-passes property, byte-identical full-suite failure lists) / INFERENCE (the audit's correction never propagated into the generator, root-caused to no test previously pinning generated-doc content against the audit doc) / DECISION (ship the narrow fix; explicitly do not attempt the ~40-location full sweep tonight) / REJECTION (none — evidence supports ACCEPT). ## 8. Reward Hack Check No generic reward-hack CLI reachable this session (checked `npx ruvector harness --help`). Manual checklist, independently re-verified by the adversarial critic (fresh session, no authoring context): no test weakened (purely additive test, existing 16 assertions untouched); no gold/threshold tuned post-hoc (the corrected figure is pinned to the pre-existing, independently-dated audit doc, not chosen to make a test pass); no cherry-picking; zero cost; the critic independently confirmed the pre-fix source actually contained both stale strings (so the new test would genuinely have failed before the fix, not vacuously). ## 9. Security Review Not security-sensitive — pure dead-code deletion (no reachable code path, confirmed) and doc-string content edits in a markdown generator; no behavior change to any live code path, no new network/filesystem/credential/MCP-authority surface. Confirmed explicitly by the adversarial critic. ## 10. Adversarial Critique Independent critic (fresh session, no authoring context): re-verified zero call sites for every `diskann-backend.ts` export across the *whole* repo (not just `cli/src`), ruling out a false-positive `'diskann'` string in an unrelated backend-type enum in `@claude-flow/plugins`; independently re-read the audit doc and confirmed "~1.9x-4.7x, recall@10 ~0.99" is correct (noting a pre-existing, not-introduced-by-this-diff wrinkle: the audit doc itself says "recall ~0.9" in one older passage vs. "~0.99" elsewhere); reran `tsc --noEmit | grep diskann` (empty) and the new test in isolation (genuinely fails pre-fix, passes post-fix). **Verdict: CONFIRMED**, with one disclosure gap: the single most user-visible instance of this exact bug — `commands/memory.ts:1153`'s live `output.printInfo('V3 Performance: 150x-12,500x faster search...')`, printed at runtime, not just in generated docs, in the *same package* this candidate touched — was not fixed here. Correct call to keep out of scope (bundling would mean an open-ended ~40-location cross-package sweep in one night), but disclosed rather than silently left out — see §15. ## 11. Scan Findings: security Repo delta since 2026-08-26 (ADR-377 caller-identity binding): only one unrelated commit landed in the window (`d33ef4bf8`, a plugin addition touching zero security-relevant code). **Finding (Grade B, matches Ruflo's own known gap):** ADR-377's `authorizeMcpTool()` caller-identity check exists but remains **off by default** — `CLAUDE_FLOW_MCP_CALLER_AUTH` is unset in a stock deployment. The 2026 OWASP MCP Top 10 (owasp.org/www-project-mcp-top-10) ranks "Unauthenticated Access" and "Confused Deputy" as the top two MCP-specific risks; CSA/arXiv writeups (MCP-38 Threat Taxonomy) reiterate ambient-authority servers as the dominant real-world failure mode. **Action**: flip `CLAUDE_FLOW_MCP_CALLER_AUTH` to default-on in the next minor release with a documented escape hatch, and add a CI check asserting `authorizeMcpTool()` fails closed when unset. No ADR needed — this finishes the existing ADR-377 rollout. ## 12. Scan Findings: hive-mind **Finding (Grade B — repo verified directly, external claims from arXiv preprints):** Raft (`raft.ts`), Byzantine/PBFT (`byzantine.ts`), and Gossip (`gossip.ts`) in `v3/@claude-flow/swarm/src/consensus/` are real, tested implementations (561/514/599 lines respectively, dedicated transport, failure-injection tests). Quorum is real but lightweight (MCP-tool-level threshold vote-counting, separate from `ConsensusEngine`). **`crdt` is purely aspirational** — it appears only as a type-union member and a CLI menu label (`hive-mind.ts:44`); grep across the full `v3/@claude-flow/` tree finds zero `CrdtConsensus` class or CRDT merge/replication logic anywhere. Selecting it in the CLI wizard has no backing engine. Externally, 2025-2026 work (arXiv:2605.09076 Byzantine-fault multi-agent LLMs; arXiv:2511.10400) shows confidence-probe-weighted voting (CP-WBFT) beating Ruflo's current fixed-quorum voting on fault tolerance. **Action**: either implement a minimal `CrdtConsensus` class (even last-write-wins/G-Counter) and wire it into `createConsensusEngine`, or remove `'crdt'` from its three enum/type sites and the CLI menu label — the current state silently offers a non-functional option. ## 13. Competitors Reviewed | Framework | 2025-2026 performance work | Grade | |---|---|---| | Qdrant | GPU-accelerated HNSW build; 1.5/2-bit + asymmetric quantization; inline-storage quantized-in-graph layout | B | | Weaviate | Native BM25+vector hybrid; "Search Mode" test-time-compute scaling across 12 benchmarks | B | | Milvus | GPU CAGRA (NVIDIA cuVS): ~50x search throughput, 12.5x better time-to-cost at top100@98% recall | A | | LanceDB | RaBitQ GA (1-bit + centroid-only routing) targeting 10B-vector scale | B | | Vespa | 8.5-12.9x throughput/core vs Elasticsearch | B (Jan 2025, aging) | | LangGraph / AutoGen / CrewAI / OpenAI Agents SDK | None ship a built-in cost/latency model router or cross-agent KV-cache sharing (deliberately, in 2 cases) | B | Every major vector DB now ships GPU-accelerated indexing Ruflo lacks — a genuine, open gap. Ruflo's 3-tier cost/latency routing + SONA is unclaimed territory across all 4 agent-framework competitors surveyed. ## 14. Gist `docs/dream-cycle/dream-gist-2026-08-30.md` (committed on this branch; no gist-creation MCP tool available in this session, consistent with every dream-cycle night since 2026-08-14). ## 15. Recommendation 1. **Merge this candidate** (human review required) — removes 375 lines of unreachable, misleading code and closes a real gap between this repo's own corrected audit and what it tells every new user. 2. **Highest-priority follow-up**: `commands/memory.ts:1153`'s live `output.printInfo('V3 Performance: 150x-12,500x faster search...')` — more user-visible than tonight's fix (runtime CLI output, not generated docs), same package, not fixed here (see §10). Plus ~14 more CLI source locations, a structurally identical "2.49x-7.47x" Flash Attention figure in ~9 locations, and ~15 `.claude/skills`/`.claude/agents` SKILL.md files — worth a dedicated, ideally scripted, `automation`/`meta` sweep night rather than hand-editing each one. 3. Re-open the `@claude-flow/memory` `efSearch`/`efConstruction` decoupling question **only** with a scale-adaptive default (per CHAT, arXiv:2607.04630) — not a flat low default, which is exactly what 2026-08-15's PR #3034 tested and got rejected for (recall breach at N=8000). 4. `Quantizer.productQuantizeDistance()` is still unwired into `HNSWIndex.distance()` five research-nights after 2026-08-25 first reported it — cheap, high-confidence, still open. 5. Consider ADR-377's `CLAUDE_FLOW_MCP_CALLER_AUTH` default-on flip (§11) and either a real `CrdtConsensus` implementation or removing the dead `'crdt'` option (§12). 6. Human review/merge recommended for the growing backlog of ACCEPT-evidence draft PRs (08-24 through 08-29, plus tonight) — six consecutive accepted candidates now awaiting review. 7. The 2026-08-20..23 no-run gap remains undiagnosed after 8 consecutive nights of re-confirmation — worth a dedicated `automation`/`meta` night rather than another passive re-check.