[梦循环2026-09-16]安全:蜂窝-mind spound/propose/广播/shutdown/memory仍然绕行#3291的Sybil-vote sordic gate + 智能,swarm扫描

1. Tonight's Rotation DATE=2026-09-16, SLOT=1, DEEP=security, SCAN=intelligence,swarm. No bonus deep dive (day%25=16, day%75=41). Session commit a65bdf683a73dcc1f20d455658daab1cca07306b, branch dream/2026-09-16-security. ## 2. Ledger Check Read docs/dream-cycle/LEDGER.md (194 lines, last 14+ rows inspected). Verified via GitHub MCP tools (no gh CLI in this environment) the fate of the last 7 nights and the entire 08-24..09-02 backlog the ledger's own notes had flagged as "unmerged draft since 09-14": all 13 backlog PRs (#3086, #3094, #3103, #3110, #3119, #3123, #3130, #3139, #3152, #3160) plus the last 7 nights (#3184, #3221, #3232, #3243, #3266, #3291, #3302) are now MERGED, all landed 2026-09-14/15 in a single review batch. The ledger's own inline fate notes are stale as of this reading; this issue's ledger row reflects the verified-current state. #3291 (2026-09-11, hive-mind Sybil-vote fix) merged 2026-09-15 — one day before tonight, making it the freshest prior-night finding to build on. ## 3. Deep Dive Findings Five research roles (deep researcher, 2 scan roles, competitor analyst, architecture reviewer) ran in parallel. Three independently converged on the same core finding before any code was written: hive-mind_spawn, hive-mind_consensus's propose action, hive-mind_broadcast, and hive-mind_shutdown in v3/@Claude-flow/cli/src/mcp-tools/hive-mind-tools.ts mutate the same hive state #3291 just finished securing, with no requireHiveToken gate — most severely, hive-mind_spawn pushes attacker-chosen agent ids straight into state.workers, the exact roster vote treats as legitimate voters, so an unauthenticated caller can spawn its own "workers" and vote as them, bypassing #3291 entirely via a sibling tool. A fifth gap (hive-mind_memory's set/delete actions, same saveHiveState pattern) was found only during the post-implementation adversarial critique (see §7) and closed the same night. A second, independently-found candidate (terminal_execute shelling out via raw execSync with zero policy enforcement, contradicting .harness/mcp-policy.json's stated tool-surface boundary) scored comparably but was not selected — see §15. ## 4. Hypothesis Given the hive-mind MCP tools, where hive-mind_join/leave/vote already require a hiveToken minted by hive-mind_init (#3291) to prevent Sybil-vote manipulation, when hive-mind_spawn, hive-mind_consensus's propose action, hive-mind_broadcast, hive-mind_shutdown, and hive-mind_memory's set/delete actions are given the same requireHiveToken gate, then an unauthenticated caller should no longer be able to mint voting workers via spawn, inject unauthenticated consensus proposals, inject spoofed broadcast messages, terminate a running hive, or tamper with/erase shared-memory entries — relative to today's baseline where all six accept any caller with no proof of hive membership — subject to: (1) the CLI's own hive-mind