dream

Dream 0002 - 2026-08-05

About this note

Field	Value
Scope	whole brain
Read	11 topic notes, claims 1-177, 20 ADRs, `INDEX.md`, `glossary.md`, `log.md` tail, `brain/dreams/0001-260802.md`
Findings	8 applied, 3 proposed, 7 classes clean
Validator	OK (13 checks) before and after

The first pass after a large single-session ingest. Between dream 0001 and this one the brain went from 11 sources and 100 claims to 22 sources and 177 claims - seven sources landed in one session (S16-S22), agent-security advanced to established, and two ADRs were written. That is the largest compounding burst this repo has had, and it is exactly the condition the stage exists for.

The headline: belief drift is still zero, and bookkeeping drift is up sharply and concentrated. Nothing contradicts anything. No claim needed its confidence moved, no topic needed splitting or merging, and every conflict the brain holds is still kept-both-sides and labelled. Seven of the eight findings are the same two bugs dream 0001 already named, which is the real result: the defects did not diversify, they multiplied. Three are stale source counts (dream 0001's P1, never implemented). Three are absolute statements - "nothing here yet on X" - that a later source in the same session falsified and nobody went back to.

On this pageFindings appliedFinding 4 is the one worth reading twiceProposed, not applied (needs a human call)Checked and cleanNotes for the next pass

Findings applied#

#	Class	Where	What was wrong	What changed
1	Stale status	`topics/agents.md:3`	Header read `11 sources / 10 independent` while listing 14, and `INDEX.md` said 14 (13 independent). Three sources were appended to the list today without touching the count	Corrected to `14 sources / 13 independent`
2	Stale status	`INDEX.md`, context-engineering row	Note said 10 sources, INDEX row said 9. S21 was added to the note and not to the row	INDEX row corrected to 10
3	Stale status	`topics/memory.md:3` + its INDEX row	Header said 4 sources while listing six (S6, S7, S8, S16, S17, S19); INDEX said 5. Both were wrong and they disagreed with each other	Both corrected to 6
4	Superseded framing	`topics/agents.md:535`	"Gap: nothing here yet on agent security. Both sources treat tool calls as trusted" - and it pointed at `agent-security.md` as "`emerging`, and still with no source that studies agent threats". Triply false: this note now carries S17, S18 and S20 with claims 147/149/168; "both sources" was written at 2 sources and there are 14; and `agent-security` is `established` with four threat sources	Rewritten as what is actually still missing, with the cross-note status removed rather than restated
5	Superseded framing	`topics/agent-security.md:469`	"fraud and manipulated content are explicit non-goals (claim 155), and nothing in this brain addresses them". Written during S18's compound; S21 landed four hours later and its behavioural defences act before an instruction is followed, so they are the one class that can touch a manipulated-content payload	Corrected to name S21 as partial, unmeasured coverage - which also sharpens the three-class framing rather than merely fixing a fact
6	Closed open question	`topics/skills.md`, Open questions	"Nothing yet on skills as an attack surface." The same note gained a section today titled "The topic's first security material: a skill is a write channel" (S19, claims 158/162). A note contradicting itself between two of its own sections	Struck through and dated, naming S19 and what genuinely remains open
7	Stale self-reference	`topics/rag.md:~318`	"this brain ... at 11 sources", testing S8's ~100-source ceiling against this repo. Dream 0001 fixed this exact line (8 to 11); it is now 22	Updated to 22, and the number replaced with a pointer so it cannot go stale a third time
8	Superseded framing	`topics/agent-security.md`, Note for the architect	"This note now carries three distinguishable bodies of material ... agent-specific threats (still thin)". The threat material is now the bulk of the note across four sources and two corroborating groups, and a fourth body exists that is not listed - defences (S18, S20, S21)	Rewritten to four bodies with the threat material no longer described as thin

Finding 4 is the one worth reading twice#

It is dream 0001's Finding 3 recurring in the same file, and it now carries a factual claim about a neighbour note that four sources have falsified. The sentence was correct when written at two sources. Nothing in an ingest pass ever revisits a "gap" statement in a note it is not editing, and validate.py cannot see it because every link resolves and every claim number exists.

This is the class the stage exists for, and it has now produced findings in both passes.

Proposed, not applied (needs a human call)#

#	Proposal	Reasoning	Why it is a judgement call
P1	Implement dream 0001's P1: a `validate.py` check that a topic note's `Status:` source count agrees with its `INDEX.md` row, and with the number of sources the status line itself lists	Dream 0001 proposed this after three occurrences and it was never built. It has now fired three more times (findings 1-3), and finding 3 is the worst form - note, INDEX and the note's own list all disagreeing. I caught all three with a throwaway script in under a minute. Six occurrences across two passes is no longer a pattern, it is a missing check	It hardens a convention `AGENTS.md` states only in prose, and touches a frozen script - so `AGENTS.md` must gain the rule before the checker enforces it. Also needs care: some notes legitimately carry two counts (raw and independent)
P2	Record a rule for a seed that never attracts a source, and apply it to `inferencing`	Dream 0001 flagged this as having no rule. Since then the call has been tested twice and deliberately declined - S14 and S15 were both examined against it and routed elsewhere, with the reasoning recorded in ADR-0018. So the note is not neglected; it is actively defended. The proposal is to say so in the note itself, converting an apparent gap into a recorded decision	Whether an empty seed should ever be retired is a taxonomy question, and the honest argument for keeping this one is that it has twice stopped a source being misfiled - which is work, even though the note is empty
P3	Add a security cross-reference to `mcp.md`	Four sources landed today whose subject is untrusted content arriving through the channel MCP defines, and `mcp.md` contains no pointer to any of them. Its own `additional_search_text` observation is the seed of exactly the retrieval-poisoning shape S16 measures	This is an addition, not drift, and dreaming reconciles rather than ingests. Recorded here so it is not lost, and left for a compound pass or a deliberate edit

Checked and clean#

Contradiction. No unflagged contradictions. The conflicts the brain holds are all still kept-both-sides and labelled, and today's ingests added two more handled correctly: claim 159 does not refute claim 149 (S19 tested detectors, not structural defences - recorded as a scope correction in S19 d3 rather than as a win for either side), and S21's authors and S18's authors agree that heuristic defence cannot carry a guarantee, reached by different routes and recorded as agreement rather than collapsed into one claim.
Stale confidence. No claim sitting below a confidence a later source earned. Checked hardest on the three new corroborating groups - claims 145, 165 and 177 each name their sources and their independence basis in the claim text itself, and claim 177 correctly labels S13's as the only observed instance with the other two as predictions. No claim was raised on "it feels established now".
Orphans. All claims 135-177 are referenced by number in at least one topic note. Dream 0001 recorded that the by-number method is weak for older claims because notes restate rather than cite; that remains true and this check is only meaningful for the newer range, where the convention changed. Recorded so the next pass knows the limit.
Closed open questions. All strikethroughs carry a closing source and a date. One was missing entirely and became finding 6.
Cross-note status claims (dream 0001's P2 class). Clean - grep for "still a seed", "still emerging" and similar found nothing. Finding 4 is adjacent but is a gap claim rather than a status word, which is why P2's pattern would not have caught it.
ADR Context sections. Dream 0001 instructed that these are dated historical records and must not be updated. Verified against the diff: today's commits added ADR-0019 and ADR-0020 and modified no existing ADR. The instruction held without anyone re-deriving it, which is the mechanism working.
Topic status words. All 11 notes agree with their INDEX row on the status word. Only the counts drifted, which is why P1 targets counts specifically.

Notes for the next pass#

The identity split trigger was tested against S18 and did not fire. agent-security.md carries a standing instruction to split identity-and-authorization on the next source teaching identity mechanics. CaMeL uses "capabilities", which is an authorization mechanism, so the trigger deserved a real test - and it fails the same way S12 did under ADR-0015: CaMeL's capabilities are intra-process data-flow labels, with no principal, no token, no flow, no lifetime and no delegation model. Object-capability, not identity. Recorded so the next pass does not re-derive it, and the trigger stands.
/verify is owed on seven sources. S16-S22 were all written in one session by the agent that also gated them, which is claim 34's exact prohibition. The contract forbids running /verify in the same session as the ingest, so this is the first thing a different session should do. It is the largest un-taken quality check in the repo.
rag.md's self-reference has now gone stale twice. Finding 7 replaces the count with a pointer, which should end it. If any other note is found carrying a hard-coded brain-wide total, do the same.
mcp is still the thinnest note relative to stated intent. Two secondary sources, no primary, no spec version, and the owner's stated goal runs through it. Unchanged from dream 0001 except that the gap now matters more.
Watch agent-security.md for a split on a different axis than the planned one. It now holds four bodies (threats, auth substrate, containment, defences) across 10 sources and is the longest note in the brain. The planned split is identity-and-authorization; the natural split on current weight is threats and defences apart from substrate and containment. Not actionable yet - the material is still one argument - but it is the note most likely to need an architect call next.