Closes #380.

Hypothesis

Given main's existing .github/workflows/security.yml npm-audit + audit-deps-aggregate gate (already fail-on-high+, already wired, already running on every push), when @modelcontextprotocol/sdk's exact pin in packages/arc-agi-3-chatgpt/package.json is widened to a caret range at the already-available non-major patched version, and @grpc/grpc-js/proxy-addr are allowed to resolve within their existing parent ranges, then npm audit --omit=dev --audit-level=high should report 0 advisories and both previously-failing CI jobs should pass on this commit — subject to: zero behavioral change to any passing test, zero new direct dependency, zero other importer of the touched packages regressed, and a regression test that fails pre-fix/passes post-fix for each of the two directly-reachable advisories.

Candidate

Two-line functional change, one conceptual fix:

• packages/arc-agi-3-chatgpt/package.json: "@modelcontextprotocol/sdk": "1.26.0" (exact pin) → "^1.32.1" (caret, non-major per npm audit fix's own fixAvailable metadata).
• package-lock.json regenerated via npm install + npm audit fix (no --force), which also moved @grpc/grpc-js 1.14.4→1.14.5 (via packages/agntcy's agntcy-dir/spiffe) and proxy-addr 2.0.7→2.0.8 (via the sdk's own express dependency) within their already-permissive parent ranges — no other package.json touched for those two.
• packages/arc-agi-3-chatgpt/__tests__/security.test.ts: new dependency advisory floors describe block (2 tests) asserting the resolved sdk/proxy-addr versions stay at/above each GHSA's patched floor.

Evaluation Receipt

evaluated: accepted.

• Baseline (reproduced via git checkout of the pre-fix files + npm install): npm audit --omit=dev --audit-level=high → FAIL, exactly 3 advisories (@grpc/grpc-js high, @modelcontextprotocol/sdk high, proxy-addr critical); the 2 new tests fail non-vacuously with the exact predicted expected true, got false.
• Candidate: same command → PASS, 0 advisories. harness audit agrees (0 at high+; 6 remaining devDependency-only advisories, all behind a vitest@5.0.3 major bump, disclosed and correctly left alone).
• packages/arc-agi-3-chatgpt full suite: 67→69/69 (+2, 0 regressions), tsc --noEmit clean.
• packages/agntcy full suite: 82 passed / 2 pre-existing skips (0 regressions) after the transitive grpc-js bump.
• packages/create-agent-harness audit-cmd.test.ts: 6/6 unaffected (file untouched).
• Full monorepo npm run build: clean (JS-only — wasm/NAPI unavailable in this sandbox, wasm-pack not installed; recorded degradation, not a stop condition).

Baseline Comparison

Darwin Lineage

DARWIN=not_applicable — a dependency-version pin is not one of the seven ADR-071-approved mutation surfaces (routing weight, topology, prompt/memory policy, tool selection, tier policy, context policy, genome parameter). Same reasoning as #243/#373's precedent for this bug class.

Flywheel Evidence

FLYWHEEL=not_applicable — a repo-dependency-hygiene fix, not a harness-runtime promotion candidate. Durable evidence is this PR + issue #380 + docs/dream-cycle/2026-10-08-gist.md + the ledger row.

Reward Hack Check

No benchmark/evaluator exists for this candidate class to game; no test weakened (both new tests are net-new, nothing pre-existing touched); no gold data to leak. The new regression-test helper (resolvedVersion/atLeast in security.test.ts) was independently pressure-tested by the adversarial critic below for a silent-pass-on-exception failure mode — none found (it throws loudly on resolution failure, and atLeast fails safe on a malformed version).

Security Review

This PR is tonight's security review (DEEP=security-adversarial, SCAN=sbom,policy). Concretely: an MCP OAuth confused-deputy credential-exfiltration bug (GHSA-6qxp-vccf-f47h) and a critical IP-spoofing bug via trust-proxy mishandling (GHSA-jqcg-44mw-7w3h) were live in main's production dependency tree, with a CI gate the repo already built for exactly this purpose sitting red and unactioned. Full 2025-2026 sourced research (OWASP Agentic Top 10 ASI04, the MCP-OAuth bug class recurring 3x industry-wide in 2026, the Nx supply-chain compromise, Cursor MCPoison/CurXecute, CrewAI's fail-open Docker fallback) in the gist. Scan (sbom): confirmed no dependabot.yml/renovate.json exists — disclosed as a follow-up, not fixed tonight. Scan (policy): no new ADR-022-relevant finding; its default-deny model is unaffected by this change.

Regression Analysis

0 regressions: arc-agi-3-chatgpt 69/69, agntcy 82/84 (2 pre-existing skips), tsc clean, full monorepo build clean. Blast radius: packages/arc-agi-3-chatgpt is the only package.json in the repo depending on @modelcontextprotocol/sdk; zero other importers of either touched package (confirmed by direct grep, independently re-confirmed by the critic).

ADR

None filed — a dependency-version correctness fix, not an architectural decision (matches #243's precedent: no ADR for a CLI/dependency-hygiene bug fix). No existing ADR covers dependency/supply-chain vulnerability remediation policy (checked docs/adrs/INDEX.md); that gap itself is disclosed as a recommended follow-up in the gist, not filed as its own ADR tonight.

Adversarial Critique

Independent fresh-subagent critic, cold-read, own reproduction: ran npm audit --omit=dev --audit-level=high --json on the patched tree (clean), then git stash -u + npm install to independently revert to the pre-fix dependency tree and confirmed the exact same 3 advisories reappear, then git stash pop to restore the patched state. Verified ^1.32.1 is consistent with this repo's own convention (caret ranges are the norm for third-party deps; exact pins are reserved for internal @metaharness/* siblings — the prior exact pin was the outlier). Read the new test block in full and tried to break it (an exception path, a false-positive match) — found none; it fails safe and loudly. Confirmed blast radius independently (zero other importers). Ran both packages' full suites independently and got matching pass counts. Verdict: ACCEPT, no caveats.

Research Gist

docs/dream-cycle/2026-10-08-gist.md — GIST=LOCAL (no gist-creation tool in this session's toolset, same as every Dream Cycle night since 2026-09-09's #299).

Issue

#380

Witness

session_commit : ea287d6ef7548b0b32fa3e20956fa548cfe51edb
report_sha256  : bf3de6111d3ace824959f26c5fbb06bb7083b4e195a6543dd86b08f14a8d6ce6
witness        : 1e8cc07d83d14c0ebce974692d32acd4b3995237110502958267c7382a30f3d0

Merge Policy

Human review required. Do not self-merge. Do not autonomously promote Flywheel state.

Recommendation: ACCEPT — small (2 functional lines + a lockfile regen + 2 new tests), independently critiqued with zero caveats, non-vacuously proven both ways, zero regressions, zero downstream blast radius, and it closes a real red CI gate on main behind which sat a real, currently-unpatched CVE class (MCP OAuth confused-deputy). Separately: a 10-PR Dream Cycle backlog has formed since 2026-09-27 (#360 through #379), oldest 11 days old, not yet past the 14-day STALE threshold — noted once per STEP 1.1's duplicate-rejection precedent rather than escalated.

Mid-session housekeeping, disclosed for transparency: this container's local main ref had gone stale (8 commits behind origin/main, all docs-only README/visual-walkthrough commits, zero file overlap with this candidate) from state left over by a prior session. Corrected via git stash + fast-forward merge + git stash pop before branching, so this PR is built on and targets the true current main — verified by re-running the full evaluation after the correction.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Puqy2g9eQuTWpeHrhan75M

Generated by Claude Code