[Dream Cycle 2026-09-11] ledger-signals: zeroMergeStreak can't tell "nothing proposed" from "N unreviewed" + witness,verify scan

[ruvnet]

Rotation

Slot 1 (20260911 % 5): DEEP=ledger-signals, SCAN=witness,verify. No bonus deep dive (% 25 != 0, % 75 != 0). Session commit 3edd426f6c9c4b1e80235f7447dc863e749345cc.

Ledger Check

docs/dream-cycle/LEDGER.md: last row 2026-09-07, daysSinceLastRow=4 (ledgerStale=true). node packages/cli/dist/bin.js ledger signals on the committed ledger: zeroMergeStreak=true, duplicateDirections=["harden anchored replay json evidence reject"] (a portfolio-cycle row, unrelated to this repo's own code surfaces — not actionable here), lowScoreStreak=false, blockedEvalStreak=false.

Live GitHub check (gh binary absent this session; used the GitHub MCP tools instead — this is not FALLBACK, mcp__github__get_me confirms authenticated as ruvnet): 5 open, unmerged dream/* candidate PRs — #105 (compiler-parity, draft), #103 (developer-experience, draft), #101 (portfolio docs, non-draft), #100 (security-adversarial, draft), #98 (portfolio docs, draft) — plus 3 dependabot PRs (#106, #107, #94) unrelated to the dream cycle. Zero dream-cycle PRs merged since #24 (2026-08-26), matching zeroMergeStreak=true across every night since.

No open issue currently targets ledger-signals or the witness/verify scan surfaces, so tonight's direction is not a duplicate of in-flight work on those surfaces specifically. (Incidentally, PR #103 is still open for a real, already-found developer-experience bug — verdictColor() leaking raw ANSI through --no-color in packages/cli/src/tui.ts — confirmed still present on main by reading the code tonight. Not re-filed; #102/#103 already own it.)

Deep Dive: ledger-signals

learningSignals() (packages/ledger/src/index.ts) computes zeroMergeStreak as a single boolean over the trailing window: "did any PR in the last N ledger rows merge?" It answers whether merging has stopped, not how much is backed up behind that stop. With 16+ consecutive zero-merge nights and a real, growing set of open draft PRs, that distinction matters: a night (or a human skimming tui) reading zeroMergeStreak=true has no way to tell "nothing has been proposed in a while" from "5+ candidates are open and simply not being reviewed" — both produce the same boolean.

Hypothesis (frozen before implementation)

Given the Dream Machine's self-hosting nightly cycle, when a reviewBacklogSize field (nullable, caller-supplied open-candidate-PR count) is added to learningSignals()'s output, then a night or human reading ledger signals/tui output gains direct visibility into review-queue depth, subject to: (a) zero change to any existing signal's value when the new option is omitted, (b) no change to learningSignals()'s purity (still no I/O), and (c) full test coverage at both the library and CLI layer.

Evaluation Receipt

Real evaluator (npm test = vitest + governance node --test), same corpus, parent then candidate:

Baseline (3edd426):  616/616 vitest + 81/81 governance
Candidate:            627/627 vitest (+11 net new, 0 regressions) + 81/81 governance
typecheck: clean · lint: clean

Live end-to-end (not just unit tests) against the real ledger:

$ node packages/cli/dist/bin.js ledger signals --path docs/dream-cycle/LEDGER.md --open-count 5
...
"reviewBacklogSize": 5

Every other field matches the --open-count-less run exactly (asserted both live and by a dedicated unit test).

Darwin Results

Not run. evaluatorEntrypoints.darwin (npx @metaharness/darwin, unpinned) is unrelated to this candidate's surface and already independently flagged as live-but-buggy (2026-09-07 ledger row, PRs #17/#40/#65/#91). Re-running an unpinned npx package for an unrelated candidate would add supply-chain exposure with no evidentiary value here — deliberately skipped, not silently omitted.

Evidence

• OBSERVATION: 5 open dream/* PRs at session start, 0 merged since fix(compile): enforce documented hourly cron floor #24 (2026-08-26).
• MEASUREMENT: baseline/candidate test deltas above; reviewBacklogSize echoes the supplied count exactly; omitting --open-count reproduces every other field byte-for-byte.
• INFERENCE (not causal): the review-backlog-depth gap in learningSignals() plausibly contributed to 16+ nights each independently re-deriving "bias small" from a boolean alone — merge decisions happen outside this session's visibility, so no causal claim is made.

Reward-Hack Check

No test/threshold/gold-data change. 11 new tests added, zero existing tests modified. New field is informational only (> 0 display condition in the TUI, no gating). No hidden cost, no cache reliance, no ledger-schema change.

Security Review

No new I/O, filesystem, network, or credential surface. --open-count parses a bounded non-negative integer, fail-closed on anything else (same pattern as the existing --merged flag). No prompt-injection or MCP-authority surface touched.

Scan Findings: witness

Read packages/witness/src/index.ts, evidence-freshness.ts, claim-receipt.ts, trace-replay.ts, termination.ts, security-patch.ts, reconstruction.ts, and the CLI's witness stamp/verify and freshness stamp/verify wiring end to end. Found no defect: commit/digest validation is strict (COMMIT_RE, HEX64), freshness verify anchors the policy digest before touching the filesystem (preventing a crafted policy from probing paths outside the repo), and the self-referential-hash problem (hashing a report that embeds its own hash) is already handled by convention (external hash recorded in the PR/ledger, not inlined in the report file) since the 2026-08-13/2026-09-07 reports. ADR-0010's evidence-freshness re-verification (PR #97) is live on main and matches its own description. No candidate produced from this scan tonight.

Scan Findings: verify

Read ledger verify, witness verify, freshness verify, and verify-entrypoint (packages/cli/src/index.ts, entrypoint.ts). verify-entrypoint's stale-state vs. blocked vs. suspicious-silent classification (documented against real @metaharness/redblue and @metaharness/darwin repros from 2026-08-13/2026-09-02) is sound. Ran ledger verify against the live ledger: 40 pre-existing structural errors, all from portfolio-cycle rows using a combined verdict/evaluated partial shape incompatible with this repo's own ACCEPT|REJECT|INCONCLUSIVE / yes|no|blocked schema — already tracked (issues #48/#58, PRs #49/#59, still open/unmerged). Not re-filed; would be a duplicate direction.

Competitors (grade: B/C — industry analysis, not peer-reviewed benchmarks; see report for full table + sources)

Sakana AI Scientist, OpenHands, SWE-agent, DSPy/GEPA, and the AutoGPT lineage: none expose a review-backlog-depth signal as part of their own architecture (OpenHands/SWE-agent are benchmark/CI-focused, not fleet-review-ops-focused). Kanban practice literature (Yeret 2026; cross-checked against Signadot/Milestone.ai 2026) treats explicit review-queue-depth signals as the standard mitigation once agent-generated PR volume outpaces human review capacity — this candidate is an internally-motivated port of that idea, not a literature-graded technique itself.

Gist

GIST=LOCAL — no gh binary and no gist-creation MCP tool available this session (not FALLBACK: GitHub issue/PR/API access via MCP tools worked fine). Full report committed as the durable artifact: docs/dream-cycle/2026-09-11-ledger-signals-report.md.

Witness

Computed via dream-machine witness stamp against the final committed report bytes and SESSION_COMMIT=3edd426f6c9c4b1e80235f7447dc863e749345cc. Value recorded in the PR body and the LEDGER.md row for this night (see report's Witness section for the reproduction recipe).

Recommendation

evaluated: accepted. Draft PR only — this session never merges. A human still has to decide whether to review and merge any of the 5+ open candidate PRs; reviewBacklogSize only makes that queue depth visible, it does not clear it.