[Dream Cycle 2026-09-05] generator-genome: score.ts credited a nonexistent manifest.host field (npx-runnable bonus unreachable) + router,turn-credit scan

[ruvnet]

Tonight's Rotation

SLOT=0 → DEEP=generator-genome (scaffolding quality, genome scorers, score/diag/doctor), SCAN=router,turn-credit. No bonus deep dive (day%25=5, day%75=30). Build: full (JS/TS, no wasm/native step failed). LLM_EVAL=available (OPENROUTER_API_KEY present) but unneeded — tonight's candidate is deterministic. gh CLI unavailable in this session; GitHub MCP tools used instead for issue/PR (not FALLBACK — this issue and the PR are real, not local-only). No gist-creation tool available (matches every prior night) — gist is docs/dream-cycle/2026-09-05-gist.md, GIST=LOCAL.

Process note (found before research began): the scheduler's stored authoritative prompt text still reads "ADR-251 traceability" in its Authority Note, but ADR-251 was renumbered to ADR-273 (nightly-dream-machine.md) after a numbering collision with PR #260 on 2026-09-01 — the repo's docs/dream-cycle/PROMPT.md mirror was already corrected to ADR-273, but the scheduler copy wasn't. Attempted to fix it via update_trigger; the tool refused because this session did not create that trigger (created via "http_api"). Human action needed: update the "MetaHarness Nightly Dream Cycle" routine's stored prompt, replacing "ADR-251 traceability" with "ADR-273 traceability" (one word), to keep the mirror rule intact.

Ledger Check

Inspected LEDGER.md (last 14+ rows) plus direct GitHub state (STEP 1's caution against inferring from ledger sparseness alone):

• Backlog is healthy: of the last 7 dream-cycle nights, 5 merged (08-29 dream(host-adapters): fix host-openclaw YAML/shell injection via spec.name (evaluated) #246, 08-30 dream(generator-genome): #248 close zero-test-coverage gap in genome-scorers.ts (evaluated) #249, 09-01 dream(flywheel-promotion): consolidate #205/#231/#255 + close a 4th replay-trust gap (evaluated) #258 — consolidating dream(flywheel-promotion): verifyReplayBundle didn't verify the full diagnostic ledger (evaluated) #205/dream(flywheel-promotion): gateReExecutes never checked the anti-Goodhart anchor clause (evaluated) #231/dream(flywheel-promotion): bind sealed scores + receipt id to the commit they decorate (evaluated) #255), only dream(darwin-evolution): #271 close Tier-2 sandbox's missing ADR-071 gate (evaluated) #272 (09-02, darwin-evolution) and dream(security-adversarial): threat-model/mcp-scan MCP-detection consistency (evaluated) #276 (09-03, security-adversarial) remain open, both <4 days old, not stale. The 08-27 review-backlog crisis (issue [Dream Cycle 2026-09-01] flywheel-promotion: consolidate 3 unmerged replay-trust fixes (#205/#231/#255) + close a 4th (parents/generation binding) + evals-verticals,bench scan #257, 0/8 merged) is resolved.
• Verified gap, 2026-09-04: no dream/* branch and no [Dream Cycle 2026-09-04]-labeled issue exist (checked git ls-remote-equivalent via list_branches + list_issues). PR research: freeze September 4 security and privacy reproduction program #282 (research/2026-09-04-reproduction-program) exists for that date but is a human-authored (ruvnet), differently-scoped research protocol (HookPry/PatchBench/UMPeek reproduction tracks, tracks issue Reproduce HookPry, PatchBench, and UMPeek under frozen independent RuV baselines #281) — not this routine's output, no dream-cycle label, different branch prefix. Reported as a real, directly-verified gap, not inferred from ledger sparseness.
• No duplicate-direction issue on generator-genome: 3 prior nights (08-15 dream(generator-genome): scorePublishReadiness locked python/go out of 'ready' (evaluated) #200, 08-25 dream(generator-genome): scoreTestConfidence trusted manifest, not real tests (evaluated) #229, 08-30 dream(generator-genome): #248 close zero-test-coverage gap in genome-scorers.ts (evaluated) #249) each closed a distinct finding, all merged.

STEP 1.2 — prior gist score (2026-09-03, PR #276): 9/10 — grade-A/B benchmark evidence (2), 6 competitor rows (2), 4 concrete recommendations (2), valid witness (2), genuinely novel finding (1), but over the 1500-word limit (0/1 — estimated ~2050 words). Tonight's gist was trimmed to 1497 words to hit that bar.

Deep Dive Findings (generator-genome)

packages/create-agent-harness/src/score.ts's scorePublishReadiness() gated its 20-point "npx-runnable" bonus on manifest?.host && pkg?.bin — HarnessManifest has never had a host field, only hosts: string[], so the bonus was unreachable for every real scaffold; sibling scoreRepoUnderstanding() credited "host(s) declared" even for hosts: [] (empty array is truthy in JS). Fixed both to require Array.isArray(manifest.hosts) && manifest.hosts.length > 0. Full detail in the gist.

Hypothesis

Given a scaffolded harness with a bin entry and a non-empty manifest.hosts, harness score's Publish-readiness dimension should award the full 20-point bonus (not the 10-point fallback), subject to: bin-with-zero-hosts still scores 10; no-bin still scores 0; 0 regressions; new tests fail non-vacuously pre-patch. Frozen before implementation, not modified after.

Evaluation Receipt

• New tests (score-host-detection.test.ts, 7): non-tautological, hand-derived expected totals. 4/7 fail pre-patch with exactly the bug-predicted values; 7/7 pass post-patch.
• Full create-agent-harness suite: 554→561 passed / 2 skipped (43→44 files), 0 regressions, tsc --noEmit clean.
• Live CLI smoke test (real npx metaharness-scaffolded harness, built harness-bin.js): Publish-readiness 30→40, overall 65→66.

evaluated: accepted

Darwin Results

Not run — scoring-logic correctness fix, not a genome/routing/tier parameter; no ADR-071 mutation surface applies.

Flywheel Evidence

Not a flywheel-domain candidate; durable OBSERVATION/MEASUREMENT/INFERENCE/DECISION/REJECTION record in docs/dream-cycle/2026-09-05-evidence.md.

Reward Hack Check

No unresolved signal. No test weakened, no gold data touched, no cost hidden, no output hardcoded — confirmed independently by the critic, who isolated the diff and reproduced red/green from scratch.

Security Review

Not security-sensitive: scores downstream generated harnesses' scaffolding, not this repo's own credentials/tool authority/CI gates. published-smoke.yml's own harness score invocation runs against a no-manifest fixture, unaffected either way.

Scan Findings

router (packages/router): no correctness bugs found in KRR solver, calibration, or native paths; minor dead-code smell in train.ts's looFor (unused reassigned locals) and an untested zero-example-candidate edge case in route()/predict() — low severity, not fixed tonight.

turn-credit (packages/turn-credit): real gap in cli.ts:51-63 — processCmd's mode label is chosen independently of which evidence path (usesPairs) the code actually ran, so a caller declaring mode: "logprob-gap" while supplying scoreWith pairs gets a receipt mislabeled proxy: false despite running the experimental proxy heuristic. Signed receipts flow from this. Not covered by existing tests. Frozen experiments/turn-credit-acceptance and experiments/router-calibration-loop both re-ran clean with no drift vs. committed verdict.json/README tables. Good candidate for a near-future flywheel-promotion/darwin-evolution night (turn-credit is that slot's scan surface).

Competitors Reviewed

LangGraph, AutoGen/AG2, CrewAI, OpenAI Codex CLI/Agents SDK, Claude Agent SDK ecosystem (community skill-linters), DSPy/GEPA — full table + grades in the gist. Also reviewed: Harness-Bench (arXiv:2605.27922) and related 2026 harness-ablation/leaderboard-methodology papers. Net: MetaHarness's static scaffold-scoring niche remains differentiated in 2026, but only if the scorers are themselves correct — which tonight's finding shows they were not.

Gist

docs/dream-cycle/2026-09-05-gist.md (this PR). GIST=LOCAL (no gist-creation tool available this session).

Witness

session_commit : 42f568b7297c59065ea562247937bb25cd353a6a
report_sha256  : 1c36dd58f3bc876bd3d07fc3e7c88ea375b1dd09d02a91df9db605bd4e38450b
witness        : b247d7645557ef46288663f03d0c1b09814b564966da94ba3c08b19644973797

Self-verified end-to-end before commit (see gist for the verifier procedure).

Recommendation

ACCEPT for human review (not autonomous promotion). See gist Recommended Next Steps for the 3 deferred follow-ups (empty-test-dir sibling bug, 3-formula readiness cross-consistency gap, turn-credit CLI mislabeling).