[Dream Cycle 2026-08-01] security: MemPoisonGuard for AgentDB + DockerDefault parity (ADR-381)

[ruvnet]

Rotation

Field	Value
Date	2026-08-01
Deep surface	security
Scan surfaces	intelligence, swarm
Session commit	4ac1ab9ff3ee8f0406cfa97fe463944d9b110e9a
Issue	#2892
ADR	ADR-381 (MemPoisonGuard)

Changes

• docs/dream-cycles/2026-08-01-security-sota.md — SOTA report with witness stamp (1088 words)
• v3/docs/adr/ADR-381-dream-cycle-security-mem-poison-guard.md — Proposed: two-stage memory poisoning interceptor for AgentDB

ADR-381 Summary

MemPoisonGuard — closes the Write-Execute-Forget (WEF) memory poisoning attack vector identified by MemSecBench (arXiv:2607.27080, 310 cases, Grade A). Proposes a two-stage interceptor on all AgentDB store() calls:

• Layer 1: regex heuristics (<1ms, $0) for credential/backdoor patterns
• Layer 2: Haiku LLM-judge (~$0.0002) on L1 hits
• Feature gate: CLAUDE_FLOW_FEATURE_MEM_POISON_GUARD=1
• OWASP coverage: LLM02 (Insecure Output Handling) + LLM08 (Excessive Agency)

Key Research Findings

Finding	Grade	Action
MemSecBench: 310-case WEF memory poisoning benchmark — AgentDB unguarded	A	ADR-381
AutoGen v0.7.5 Docker-defaults code execution — Ruflo lags competitor baseline	A	--sandbox docker flag (implementation-level)
ThreatForest: MITRE ATT&CK/CAPEC mapping from agent security scans	B	--output mitre-attack extension (implementation-level)
OwlPath (intelligence scan): 28.8% token reduction via OWL2 ontology encoding	A	Future ADR (intelligence surface)
Distributed Containment (swarm scan): peer-driven repulsive cage isolation for compromised agents	B	Future ADR (swarm surface)

Witness

Report SHA-256: d5c3ef510b1effdb931e18753e88d6fa1a3c03e4b7519677fc012532b1bc5bbf
Witness stamp: 16eb7e75bf3ef21b599d9329ca29681c5c7203a9a048ddbd263985556688c608

Merge Policy

Leave for human review. Do not self-merge. ADR-381 is Proposed; implementation requires separate PR. See issue #2892 for full research context and competitor analysis.

---

Generated by Claude Code