[Dream Cycle 2026-09-07] darwin-evolution: reward-hack monitor never scans tool-response content + weight-eft,learn scan

[ruvnet]

MetaHarness Dream Cycle, 2026-09-07. Deep surface: darwin-evolution (slot 2). Scan: weight-eft, learn.

Tonight's Rotation

DATE=2026-09-07
DEEP=darwin-evolution
SCAN=weight-eft,learn
SLOT=2
COMMIT=d5833dc6512ac1adeeef91a331c29055cd8a4dbb
BRANCH=dream/2026-09-07-darwin-evolution
LLM_EVAL=available (OPENROUTER_API_KEY present; not needed — tonight's candidate is $0/deterministic)
BUILD=full (npm run build clean, no wasm/NAPI failures this run)

Ledger Check

Inspected the last 14+ rows of docs/dream-cycle/LEDGER.md plus live GitHub state (list_pull_requests,
search_pull_requests) for the last 7 nights. Every dream-cycle PR back through 2026-08-13 is now MERGED
except #288 (2026-09-06, flywheel-promotion, still open/draft, <24h old at session start — not stale). No
≥3 repeated-duplicate-finding pattern, no zero-merge bias, no 3-consecutive-low-gist-score streak, no
LLM_EVAL=blocked streak — none of STEP 1.1's learning-signal triggers fire tonight; proceeded normally.

Prior-gist score (2026-09-06, flywheel-promotion, PR #288): 10/10 — benchmark evidence grade A (core
finding), ≥4 competitor rows (6), specific executable recommendations (3), valid witness, ~1300 words
(under 1500), genuinely novel finding (unreachable production call site for withSequentialEvidence).

Last darwin-evolution night (2026-09-02, PR #272, ADR-278 Tier-2 gate closure) disclosed-but-did-not-fix
3 items directly in tonight's scan surface: (1) weight-eft's reward-hack filter content-blind on
tool-response payloads, (2) learn's --dry-run never validates --slice/--manifest, (3) learn's
code/tests cite ADR-235 instead of the correct ADR-228. Tonight closes (1); (2) and (3) remain disclosed,
not fixed (see Recommended Next Steps in the gist).

Deep Dive Findings

packages/weight-eft/src/reward-hack.ts's deterministic reward-hack monitor (ADR-198) scans only the
outgoing arguments of an agent's tool CALLS (role:'assistant' tool_calls[].function.arguments) — it
never inspects role:'tool' messages' content (what a tool actually returned). A trajectory that leaks
gold-patch/FAIL_TO_PASS/PASS_TO_PASS content through an innocuous-looking call (clean arguments, leaking
response) sails through undetected into SFT/DPO training data for the cheap-tier LoRA distillation.

Also found fresh tonight (Architecture Reviewer role, not part of tonight's candidate): two live files
both claim ADR number 273 (docs/adrs/ADR-273-darwin-llm-agent-sandbox.md and
docs/adrs/ADR-273-nightly-dream-machine.md), both currently listed in docs/adrs/INDEX.md — a real,
unresolved numbering collision on main. Disclosed, not fixed tonight (candidate #3 below, score 4.25);
flagged for a near-future night or standalone cleanup PR.

Hypothesis

Given a resolved Darwin trajectory whose tool-CALL arguments carry no reward-hack signal but whose
tool-RESPONSE content (role:'tool') contains a gold-read pattern, when detectRewardHack() runs over it,
then it should be flagged kind: 'gold-read' exactly as a call-argument leak already is today, subject to:
(a) zero verdict change for the 4 existing fixture trajectories; (b) purely additive — no existing pattern,
classification, or finding kind removed/narrowed; (c) 0 regressions in the full weight-eft suite; (d) the
new path proven non-vacuous (crafted fixture fails pre-fix, passes post-fix). Frozen before implementation.

Evaluation Receipt

evaluated: accepted. Full receipt in the gist/PR — summary:

• New fixture (reward-hack-response-content.json): clean call args (verified against all 3 pattern
  lists), leaking tool-response content (FAIL_TO_PASS: ...).
• Pre-fix (confirmed live via git stash): monitor misses it — 2/4 new tests fail exactly as
  predicted.
• Post-fix: flagged correctly; exporter drops it, keeps the honest trajectory; 4/4 new tests pass.
• Control: original 4-fixture archive byte-identical in verdict (independently re-checked by the
  critic).
• weight-eft 37→41/41 (+4, 0 regressions), tsc --noEmit clean. Downstream create-agent-harness
  (only in-repo consumer): 572/574 (2 pre-existing skips, unchanged). Full monorepo build clean.

Darwin Results

Not applicable — a correctness fix to weight-eft's own monitor, not a Darwin-scoped tunable
genome/routing/tier/prompt parameter. Confirmed directly: packages/darwin-mode/src/safety.ts's mutation
allowlist governs only Darwin's own 7 generated genome surface files, not weight-eft's source.

Flywheel Evidence

Not a flywheel-domain candidate. Durable OBSERVATION/MEASUREMENT/INFERENCE/DECISION record:
docs/dream-cycle/2026-09-07-evidence.md.

Reward Hack Check

No unresolved signal. The fix is purely additive (no test weakened, no pattern/threshold narrowed, no gold
data touched). Independent adversarial critic (fresh sub-agent, no authorship context, re-ran the suite and
tsc itself) verdict: ACCEPT — confirmed additive-only, confirmed the new fixture is non-vacuous by
independently checking its call arguments against all three pattern lists, confirmed no false positives
introduced on the original 4-fixture archive, found no gaming/hardcoding/scope-creep. One disclosed,
non-blocking follow-up: the response-content scan applies only GOLD_READ_PATTERNS, not the other two
pattern lists (see gist Recommended Next Steps #1).

Security Review

This candidate closes a training-data-integrity gap (a reward-hacked "success" that goes undetected teaches
the distilled cheap-tier model to reward-hack). No credential/shell/network surface touched, no new
dependency, no ReDoS risk (reuses the existing bounded regex patterns against a new input surface). Not a
containment/sandbox-escape fix like 2026-09-02's ADR-278 — this is detection-scope hardening of an existing,
already-ADR'd mechanism (ADR-198).

Scan Findings — weight-eft

Confirmed and closed tonight (see Deep Dive Findings): the tool-response content-blindness gap disclosed
2026-09-02. Disclosed, not fixed: the fix covers GOLD_READ_PATTERNS only; VERIFICATION_WRITE_PATTERNS/
OUT_OF_SANDBOX_PATTERNS against response content is a legitimate follow-up (flagged by both the
Architecture Reviewer and the independent critic).

Scan Findings — learn

Two items disclosed 2026-09-02, re-confirmed tonight, not fixed (kept tonight's candidate to one
conceptual change): (1) learn.ts/index.ts/learn.test.ts cite ADR-235 (wrong topic — flywheel replay
verifiers) instead of ADR-228 (the correct GEPA-executor-genome ADR that learn.mjs itself already cites
correctly); (2) learn.mjs --dry-run never validates --slice/--manifest exists before printing its
plan, so a typo only surfaces deep into a real (costed) --run. Both are small, low-risk, well-scoped for
a near-future darwin-evolution night.

Competitors Reviewed

LangGraph, AutoGen, CrewAI, OpenAI Agents SDK/Codex, DSPy/GEPA (default list), plus Sakana AI's Darwin
Gödel Machine (nearest architectural peer to Darwin Mode, not in the default list). None ships a monitor
that scans tool-response content (vs. call arguments) for RL/self-improvement training-data filtering.
OpenAI's own "Action Monitor" baseline definition (grade A primary source) already covers tool outputs —
so this fix brings weight-eft in line with the field's own baseline convention, not ahead of it. Full
citations and grades in the gist's "What's New in 2026" table.

Gist

docs/dream-cycle/2026-09-07-gist.md (this PR/branch). GIST=LOCAL — no gist-creation tool available in
this session's toolset, matching every prior Dream Cycle night.

Witness

session_commit : d5833dc6512ac1adeeef91a331c29055cd8a4dbb
report_sha256   : 4a6e49dd59527e22924cd57cd571998cc04126d0ee2654a598936fdcc912e189
witness         : 2986185670f7f8ae3b5c9b9b569073b3e7910c9f24beedab7b30553242265f1e

Self-verified end-to-end (hash → concatenate with session commit → hash again) before this issue was filed.

Recommendation

ACCEPT — real, reproducible, non-vacuous, independently-critiqued closure of a previously-disclosed
training-data-integrity gap, directly in tonight's scan surface, corroborated by 2026 field evidence from
5 independent research passes. Human review required; this session does not merge or promote.