claude-flow 3.41.4 → 3.42.0

package/v3/@claude-flow/cli/dist/src/mcp-tools/hive-mind-tools.js

@@ -5,6 +5,7 @@
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { join } from 'node:path';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
 import { getProjectCwd } from './types.js';
 import { validateIdentifier, validateText } from './validate-input.js';
 // Storage paths
@@ -83,6 +84,36 @@ function tryResolveProposal(proposal, totalNodes) {
     }
     return null;
 }
+/**
+ * Verify a caller-supplied hiveToken against the one minted by hive-mind_init,
+ * using a constant-time comparison (bearer-token capability check -- callers
+ * that never joined, and callers that guess/omit the token, get identical
+ * rejection). Returns an error string on failure, or null on success.
+ */
+function requireHiveToken(state, suppliedToken) {
+    if (!state.hiveToken) {
+        return 'Hive-mind has no capability token minted (re-run hive-mind_init)';
+    }
+    if (typeof suppliedToken !== 'string' || !suppliedToken) {
+        return 'hiveToken is required';
+    }
+    const expected = Buffer.from(state.hiveToken, 'utf-8');
+    const actual = Buffer.from(suppliedToken, 'utf-8');
+    if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
+        return 'Invalid hiveToken';
+    }
+    return null;
+}
+/**
+ * Read the current hiveToken directly off disk, for same-machine callers
+ * that already have filesystem access to hive state (the CLI's own
+ * `hive-mind join/leave/consensus` subcommands) -- NOT exposed over any MCP
+ * tool response (in particular, not hive-mind_status), since that's a
+ * remote-reachable surface a capability token must not leak through.
+ */
+export function getHiveTokenForCli() {
+    return loadHiveState().hiveToken;
+}
 function getHiveDir() {
     return join(getProjectCwd(), STORAGE_DIR, HIVE_DIR);
 }
@@ -248,6 +279,14 @@ export const hiveMindTools = [
                 electedAt: new Date().toISOString(),
                 term: 1,
             };
+            // Mint a capability token on first init; a re-init (topology/consensus
+            // change on an already-initialized hive) keeps the existing token and
+            // roster rather than silently invalidating workers who already hold
+            // it -- only re-generated if somehow absent (e.g. state predates this
+            // field).
+            if (!state.hiveToken) {
+                state.hiveToken = randomBytes(32).toString('hex');
+            }
             saveHiveState(state);
             return {
                 success: true,
@@ -256,6 +295,7 @@ export const hiveMindTools = [
                 consensus: state.consensusStrategy,
                 queenId,
                 status: 'initialized',
+                hiveToken: state.hiveToken,
                 config: {
                     topology: state.topology,
                     consensus: state.consensusStrategy,
@@ -375,8 +415,9 @@ export const hiveMindTools = [
             properties: {
                 agentId: { type: 'string', description: 'Agent ID to join' },
                 role: { type: 'string', enum: ['worker', 'specialist', 'scout'], description: 'Agent role in hive' },
+                hiveToken: { type: 'string', description: 'Capability token minted by hive-mind_init' },
             },
-            required: ['agentId'],
+            required: ['agentId', 'hiveToken'],
         },
         handler: async (input) => {
             const state = loadHiveState();
@@ -389,6 +430,13 @@ export const hiveMindTools = [
             if (!state.initialized) {
                 return { success: false, error: 'Hive-mind not initialized' };
             }
+            // Fail-closed: an unrecognized/missing token makes no membership
+            // change at all -- state.workers is untouched, not just left
+            // unsaved (the write below never happens on this path).
+            const tokenError = requireHiveToken(state, input.hiveToken);
+            if (tokenError) {
+                return { success: false, agentId, error: tokenError };
+            }
             if (!state.workers.includes(agentId)) {
                 state.workers.push(agentId);
                 saveHiveState(state);
@@ -410,8 +458,9 @@ export const hiveMindTools = [
             type: 'object',
             properties: {
                 agentId: { type: 'string', description: 'Agent ID to remove' },
+                hiveToken: { type: 'string', description: 'Capability token minted by hive-mind_init' },
             },
-            required: ['agentId'],
+            required: ['agentId', 'hiveToken'],
         },
         handler: async (input) => {
             const state = loadHiveState();
@@ -421,6 +470,12 @@ export const hiveMindTools = [
                 if (!v.valid)
                     return { success: false, agentId, error: v.error };
             }
+            // Fail-closed: a denied caller makes no membership change -- the
+            // splice/save below is unreachable on this path.
+            const tokenError = requireHiveToken(state, input.hiveToken);
+            if (tokenError) {
+                return { success: false, agentId, error: tokenError };
+            }
             const index = state.workers.indexOf(agentId);
             if (index > -1) {
                 state.workers.splice(index, 1);
@@ -448,6 +503,7 @@ export const hiveMindTools = [
                 value: { description: 'Proposal value (for propose)' },
                 vote: { type: 'boolean', description: 'Vote (true=for, false=against)' },
                 voterId: { type: 'string', description: 'Voter agent ID' },
+                hiveToken: { type: 'string', description: 'Capability token minted by hive-mind_init (required to vote)' },
                 strategy: { type: 'string', enum: ['bft', 'raft', 'quorum'], description: 'Consensus strategy (default: raft)' },
                 quorumPreset: { type: 'string', enum: ['unanimous', 'majority', 'supermajority'], description: 'Quorum threshold preset (for quorum strategy, default: majority)' },
                 term: { type: 'number', description: 'Term number (for raft strategy)' },
@@ -531,6 +587,28 @@ export const hiveMindTools = [
                 if (!voterId) {
                     return { action, error: 'voterId is required for voting' };
                 }
+                // Fail-closed: a denied caller records no vote at all -- the
+                // votes[voterId] write below is unreachable on this path, and
+                // nothing about the proposal (vote tallies, status) changes.
+                const tokenError = requireHiveToken(state, input.hiveToken);
+                if (tokenError) {
+                    return { action, error: tokenError, proposalId: proposal.proposalId };
+                }
+                // voterId was previously trusted as-is: any caller-supplied string
+                // was recorded into proposal.votes and counted toward
+                // calculateRequiredVotes()'s threshold (derived from
+                // state.workers.length), with no check that it named a worker who
+                // actually joined this hive-mind. That let a single caller cross
+                // any strategy's quorum (raft/bft/quorum alike) by voting under
+                // fabricated ids — a Sybil attack on consensus, not merely a
+                // double-vote. Require the voter to be a registered worker.
+                if (!state.workers.includes(voterId)) {
+                    return {
+                        action,
+                        error: `Voter ${voterId} is not a registered hive-mind worker`,
+                        proposalId: proposal.proposalId,
+                    };
+                }
                 const voteValue = input.vote;
                 const proposalStrategy = proposal.strategy || 'raft';
                 const required = calculateRequiredVotes(proposalStrategy, totalNodes, proposal.quorumPreset);

package/v3/@claude-flow/cli/dist/src/mcp-tools/policy-enforcer.d.ts

@@ -0,0 +1,126 @@
+/**
+ * MCP Governance Policy Enforcer (opt-in).
+ *
+ * `.harness/mcp-policy.json` declares governance intent (defaultDeny,
+ * auditLog, maxToolCallsPerTurn, dangerousPatterns, ...) for the claude-flow
+ * MCP server, but until now nothing in the running server (mcp-server.ts)
+ * ever read it: `harness mcp-scan` grades the file's *posture* offline, the
+ * live `tools/call` dispatch never consulted it. Any connected MCP client
+ * could call every registered tool with no audit trail and no call budget.
+ *
+ * This module wires the two policy fields that are actually in this
+ * server's jurisdiction, per the policy file's own rationale comment
+ * (`dangerousPatterns` / `allowShell` / `allowNetwork` / `allowFileWrite`
+ * describe the native-Claude-Code-tool layer — Bash/Write/Edit/WebFetch —
+ * not this MCP server's memory_-, hooks_-, agentdb_-prefixed tool surface,
+ * so they are intentionally left unenforced here):
+ *   - `auditLog`: append a JSONL record for every `tools/call`.
+ *   - `maxToolCallsPerTurn`: bound calls per MCP *session* (one stdio
+ *     process lifetime), deny once exceeded.
+ *
+ * Fully opt-in via `RUFLO_MCP_ENFORCE_POLICY=1` (or `true`). Unset/false
+ * means every function below is a no-op on the hot path — the pre-existing
+ * `tools/call` behavior is unchanged.
+ *
+ * FAIL-CLOSED once enforcement is enabled (PR #3139 review round 1):
+ * a missing/malformed policy file, or a failed mandatory audit-log write,
+ * denies the call rather than silently degrading to unrestricted execution.
+ * The whole point of opting in is a restriction that actually holds; an
+ * enforcement flag that quietly falls back to "no restriction" on its own
+ * misconfiguration defeats the feature. See `evaluateToolCall()`.
+ *
+ * Known scope limits (disclosed, not fixed here):
+ *   - Only wired into the stdio `tools/call` dispatch
+ *     (`MCPServerManager.handleMCPMessage`). The separate HTTP/websocket
+ *     path (`startHttpServer()`, via `@claude-flow/mcp`) does not call
+ *     this module and is unaffected even when this flag is set.
+ *
+ * `maxToolCallsPerTurn` reset semantics (dream-cycle 2026-09-01, follow-up
+ * to 2026-08-31 review round 1): despite the field's name, the original
+ * implementation enforced a *session-lifetime cumulative* cap that never
+ * reset — a long-lived stdio session could exhaust the budget under
+ * entirely legitimate use and stay locked out until the MCP server process
+ * restarted. Research that night (see the dream-cycle gist) found: (1) the
+ * MCP spec only mandates "rate limit tool invocations" with zero mechanism
+ * guidance, and its 2026-07-28 revision (SEP-2567) is actively removing the
+ * session concept from the protocol entirely; (2) every framework/product
+ * that gets this right (FastMCP's rate-limiting middleware, the PolicyLayer
+ * MCP firewall, Cloudflare's public rate limiter) anchors the reset to
+ * wall-clock time, not to a turn or session counter that never decays —
+ * a turn-count reset is gameable by a chatty loop re-arming its own budget,
+ * which wall-clock time is not. This module now enforces a *sliding
+ * wall-clock window*: `maxToolCallsPerTurn` calls are allowed per rolling
+ * `turnWindowMs` (default 60000) per session, keyed by call timestamp so
+ * calls fall out of the window as time passes rather than accumulating
+ * forever. `now` is an injectable parameter (defaults to `Date.now`) so
+ * production callers need no change and tests stay fully deterministic via
+ * `vi.useFakeTimers()`.
+ */
+export interface McpPolicy {
+    schema?: number;
+    policyVersion?: number;
+    harnessId?: string;
+    defaultDeny?: boolean;
+    auditLog?: boolean;
+    requireApprovalForDangerous?: boolean;
+    toolTimeoutMs?: number;
+    /**
+     * Despite the name, this is a WALL-CLOCK rate limit, not a literal
+     * conversational-turn counter — MCP has no protocol-level concept of a
+     * "turn" to count against (confirmed: the spec is silent on it, and its
+     * 2026-07-28 revision removes the session concept entirely). Enforced as
+     * "at most this many calls in any rolling `turnWindowMs` window" per
+     * session. Treat it, and document it to callers, as rate limiting.
+     */
+    maxToolCallsPerTurn?: number;
+    /** Rolling window (ms) over which `maxToolCallsPerTurn` is counted. Default 60000. */
+    turnWindowMs?: number;
+    dangerousPatterns?: string[];
+    approvedServers?: string[];
+    [key: string]: unknown;
+}
+export declare function isPolicyEnforcementEnabled(env?: NodeJS.ProcessEnv): boolean;
+export declare function loadMcpPolicy(policyPath?: string): McpPolicy | null;
+/** Test-only: clear per-session call state between test cases. */
+export declare function resetPolicyEnforcerState(): void;
+export interface PolicyCheckResult {
+    allowed: boolean;
+    reason?: string;
+}
+/**
+ * Checks (and, if allowed, records) a tool call against
+ * `policy.maxToolCallsPerTurn`, counted over a sliding window of
+ * `policy.turnWindowMs` (default 60000ms) rather than the session's whole
+ * lifetime. Calls older than the window are pruned before comparing count
+ * to limit, so a session that pauses gets its budget back rather than
+ * staying denied until the process restarts. `now` defaults to `Date.now`
+ * for production callers; tests inject a controlled clock instead.
+ */
+export declare function checkAndRecordCall(policy: McpPolicy, sessionId: string, now?: number): PolicyCheckResult;
+export interface AuditLogEntry {
+    timestamp: string;
+    sessionId: string;
+    toolName: string;
+    allowed: boolean;
+    reason?: string;
+}
+/** Test-only: redirect the audit log to a temp file instead of the default path. */
+export declare function setAuditLogPathForTesting(p: string | null): void;
+export declare function getAuditLogPath(): string;
+/**
+ * Appends one JSONL audit record. Returns `true` if `policy.auditLog` is not
+ * set (nothing was required) or the write succeeded; `false` only when
+ * `auditLog` is required and the write itself failed (disk full, unwritable
+ * path, etc). Never throws — the caller (`evaluateToolCall`) decides what a
+ * failed *mandatory* write means for the call (fail-closed: deny it).
+ */
+export declare function appendAuditLog(policy: McpPolicy, entry: AuditLogEntry): boolean;
+/**
+ * Single enforcement entry point for a `tools/call` dispatch. Combines, in
+ * order: fail-closed on a missing/malformed policy, the per-session call
+ * budget, and fail-closed on a failed mandatory audit-log write. `policy`
+ * is the result of `loadMcpPolicy()` — pass `null` straight through when it
+ * failed to load, rather than re-deciding that here.
+ */
+export declare function evaluateToolCall(policy: McpPolicy | null, sessionId: string, toolName: string, now?: number): PolicyCheckResult;
+//# sourceMappingURL=policy-enforcer.d.ts.map

package/v3/@claude-flow/cli/dist/src/mcp-tools/policy-enforcer.js

@@ -0,0 +1,177 @@
+/**
+ * MCP Governance Policy Enforcer (opt-in).
+ *
+ * `.harness/mcp-policy.json` declares governance intent (defaultDeny,
+ * auditLog, maxToolCallsPerTurn, dangerousPatterns, ...) for the claude-flow
+ * MCP server, but until now nothing in the running server (mcp-server.ts)
+ * ever read it: `harness mcp-scan` grades the file's *posture* offline, the
+ * live `tools/call` dispatch never consulted it. Any connected MCP client
+ * could call every registered tool with no audit trail and no call budget.
+ *
+ * This module wires the two policy fields that are actually in this
+ * server's jurisdiction, per the policy file's own rationale comment
+ * (`dangerousPatterns` / `allowShell` / `allowNetwork` / `allowFileWrite`
+ * describe the native-Claude-Code-tool layer — Bash/Write/Edit/WebFetch —
+ * not this MCP server's memory_-, hooks_-, agentdb_-prefixed tool surface,
+ * so they are intentionally left unenforced here):
+ *   - `auditLog`: append a JSONL record for every `tools/call`.
+ *   - `maxToolCallsPerTurn`: bound calls per MCP *session* (one stdio
+ *     process lifetime), deny once exceeded.
+ *
+ * Fully opt-in via `RUFLO_MCP_ENFORCE_POLICY=1` (or `true`). Unset/false
+ * means every function below is a no-op on the hot path — the pre-existing
+ * `tools/call` behavior is unchanged.
+ *
+ * FAIL-CLOSED once enforcement is enabled (PR #3139 review round 1):
+ * a missing/malformed policy file, or a failed mandatory audit-log write,
+ * denies the call rather than silently degrading to unrestricted execution.
+ * The whole point of opting in is a restriction that actually holds; an
+ * enforcement flag that quietly falls back to "no restriction" on its own
+ * misconfiguration defeats the feature. See `evaluateToolCall()`.
+ *
+ * Known scope limits (disclosed, not fixed here):
+ *   - Only wired into the stdio `tools/call` dispatch
+ *     (`MCPServerManager.handleMCPMessage`). The separate HTTP/websocket
+ *     path (`startHttpServer()`, via `@claude-flow/mcp`) does not call
+ *     this module and is unaffected even when this flag is set.
+ *
+ * `maxToolCallsPerTurn` reset semantics (dream-cycle 2026-09-01, follow-up
+ * to 2026-08-31 review round 1): despite the field's name, the original
+ * implementation enforced a *session-lifetime cumulative* cap that never
+ * reset — a long-lived stdio session could exhaust the budget under
+ * entirely legitimate use and stay locked out until the MCP server process
+ * restarted. Research that night (see the dream-cycle gist) found: (1) the
+ * MCP spec only mandates "rate limit tool invocations" with zero mechanism
+ * guidance, and its 2026-07-28 revision (SEP-2567) is actively removing the
+ * session concept from the protocol entirely; (2) every framework/product
+ * that gets this right (FastMCP's rate-limiting middleware, the PolicyLayer
+ * MCP firewall, Cloudflare's public rate limiter) anchors the reset to
+ * wall-clock time, not to a turn or session counter that never decays —
+ * a turn-count reset is gameable by a chatty loop re-arming its own budget,
+ * which wall-clock time is not. This module now enforces a *sliding
+ * wall-clock window*: `maxToolCallsPerTurn` calls are allowed per rolling
+ * `turnWindowMs` (default 60000) per session, keyed by call timestamp so
+ * calls fall out of the window as time passes rather than accumulating
+ * forever. `now` is an injectable parameter (defaults to `Date.now`) so
+ * production callers need no change and tests stay fully deterministic via
+ * `vi.useFakeTimers()`.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+export function isPolicyEnforcementEnabled(env = process.env) {
+    const v = env.RUFLO_MCP_ENFORCE_POLICY;
+    return v === '1' || (v ?? '').toLowerCase() === 'true';
+}
+export function loadMcpPolicy(policyPath = path.join(process.cwd(), '.harness', 'mcp-policy.json')) {
+    try {
+        const raw = fs.readFileSync(policyPath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== 'object' || parsed === null)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+const DEFAULT_TURN_WINDOW_MS = 60_000;
+const sessionState = new Map();
+/** Test-only: clear per-session call state between test cases. */
+export function resetPolicyEnforcerState() {
+    sessionState.clear();
+}
+/**
+ * Checks (and, if allowed, records) a tool call against
+ * `policy.maxToolCallsPerTurn`, counted over a sliding window of
+ * `policy.turnWindowMs` (default 60000ms) rather than the session's whole
+ * lifetime. Calls older than the window are pruned before comparing count
+ * to limit, so a session that pauses gets its budget back rather than
+ * staying denied until the process restarts. `now` defaults to `Date.now`
+ * for production callers; tests inject a controlled clock instead.
+ */
+export function checkAndRecordCall(policy, sessionId, now = Date.now()) {
+    const limit = policy.maxToolCallsPerTurn;
+    if (typeof limit !== 'number' || !Number.isFinite(limit) || limit <= 0) {
+        return { allowed: true };
+    }
+    const configuredWindow = policy.turnWindowMs;
+    const windowMs = typeof configuredWindow === 'number' && Number.isFinite(configuredWindow) && configuredWindow > 0
+        ? configuredWindow
+        : DEFAULT_TURN_WINDOW_MS;
+    const state = sessionState.get(sessionId) ?? { callTimes: [] };
+    const cutoff = now - windowMs;
+    state.callTimes = state.callTimes.filter((t) => t > cutoff);
+    if (state.callTimes.length >= limit) {
+        sessionState.set(sessionId, state);
+        return {
+            allowed: false,
+            reason: `maxToolCallsPerTurn (${limit}) exceeded within the last ${windowMs}ms for this session`,
+        };
+    }
+    state.callTimes.push(now);
+    sessionState.set(sessionId, state);
+    return { allowed: true };
+}
+let auditLogPathOverride = null;
+/** Test-only: redirect the audit log to a temp file instead of the default path. */
+export function setAuditLogPathForTesting(p) {
+    auditLogPathOverride = p;
+}
+function defaultAuditLogPath() {
+    return path.join(os.tmpdir(), 'ruflo-mcp-audit.jsonl');
+}
+export function getAuditLogPath() {
+    return auditLogPathOverride ?? defaultAuditLogPath();
+}
+/**
+ * Appends one JSONL audit record. Returns `true` if `policy.auditLog` is not
+ * set (nothing was required) or the write succeeded; `false` only when
+ * `auditLog` is required and the write itself failed (disk full, unwritable
+ * path, etc). Never throws — the caller (`evaluateToolCall`) decides what a
+ * failed *mandatory* write means for the call (fail-closed: deny it).
+ */
+export function appendAuditLog(policy, entry) {
+    if (!policy.auditLog)
+        return true;
+    try {
+        fs.appendFileSync(getAuditLogPath(), `${JSON.stringify(entry)}\n`, 'utf-8');
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Single enforcement entry point for a `tools/call` dispatch. Combines, in
+ * order: fail-closed on a missing/malformed policy, the per-session call
+ * budget, and fail-closed on a failed mandatory audit-log write. `policy`
+ * is the result of `loadMcpPolicy()` — pass `null` straight through when it
+ * failed to load, rather than re-deciding that here.
+ */
+export function evaluateToolCall(policy, sessionId, toolName, now = Date.now()) {
+    if (policy === null) {
+        return {
+            allowed: false,
+            reason: 'RUFLO_MCP_ENFORCE_POLICY is set but .harness/mcp-policy.json is missing or invalid — failing closed',
+        };
+    }
+    const budget = checkAndRecordCall(policy, sessionId, now);
+    const auditOk = appendAuditLog(policy, {
+        timestamp: new Date(now).toISOString(),
+        sessionId,
+        toolName,
+        allowed: budget.allowed,
+        reason: budget.reason,
+    });
+    if (!budget.allowed)
+        return budget;
+    if (!auditOk) {
+        return {
+            allowed: false,
+            reason: 'audit log write failed and policy.auditLog is required — failing closed',
+        };
+    }
+    return { allowed: true };
+}
+//# sourceMappingURL=policy-enforcer.js.map

package/v3/@claude-flow/cli/dist/src/memory/intelligence.d.ts

@@ -178,13 +178,25 @@ declare class LocalReasoningBank {
      */
     store(pattern: Omit<StoredPattern, 'usageCount' | 'createdAt' | 'lastUsedAt'> & Partial<StoredPattern>): void;
     /**
-     * Find similar patterns by embedding
+     * Find similar patterns by embedding.
+     *
+     * `confidence` on each result is the pattern's own learned reliability
+     * (unchanged from storage) — NOT how well it matches this query. The
+     * per-query cosine score is returned separately as `similarity`. Callers
+     * that want "how good a semantic match is this" must read `.similarity`;
+     * callers that want "how reliable has this pattern proven to be" read
+     * `.confidence`. Prior to this fix both were conflated (confidence was
+     * overwritten with the cosine score), which silently broke any consumer
+     * that needed to tell them apart (found during the 2026-09-12 dream-cycle
+     * intelligence-surface review).
      */
     findSimilar(queryEmbedding: number[], options: {
         k?: number;
         threshold?: number;
         type?: string;
-    }): StoredPattern[];
+    }): (StoredPattern & {
+        similarity: number;
+    })[];
     /**
      * Optimized cosine similarity
      */

package/v3/@claude-flow/cli/dist/src/memory/intelligence.js

@@ -250,10 +250,20 @@ class LocalSonaCoordinator {
                     const oldConfidence = pattern.confidence;
                     // Check EWC penalty before applying update
                     if (ewcConsolidator) {
-                        const oldWeights = [oldConfidence];
                         const proposedConfidence = Math.min(1.0, oldConfidence + this.config.loraLearningRate * reward);
-                        const newWeights = [proposedConfidence];
-                        const penalty = ewcConsolidator.getPenalty(oldWeights, newWeights);
+                        // Use computeConfidencePenalty (averages the full Fisher diagonal),
+                        // not getPenalty([oldConf],[newConf]) — that call shape collapses
+                        // to fisherDiag[0] only (Math.min(1,1,384) === 1), an arbitrary
+                        // single dimension instead of the full accumulated Fisher signal.
+                        // computeConfidencePenalty exists precisely for this
+                        // scalar-confidence case (see its docstring) but was unwired.
+                        // Note: neither call shape differentiates between patterns — both
+                        // take only a confidence delta, not a per-pattern embedding, so
+                        // two patterns with the same delta under the same consolidator
+                        // state get the same penalty either way. This fix corrects which
+                        // shared Fisher signal informs that penalty; it does not add
+                        // per-pattern discrimination (see ewc-distill-confidence-gate.test.ts).
+                        const penalty = ewcConsolidator.computeConfidencePenalty(oldConfidence, proposedConfidence);
                         totalEwcPenalty += penalty;
                         // If penalty is too high, reduce the update magnitude
                         if (penalty > this.config.ewcLambda) {
@@ -279,13 +289,14 @@ class LocalSonaCoordinator {
                 }
             }
         }
-        // Update EWC Fisher matrix with confidence changes
+        // Update EWC Fisher matrix with confidence changes. updateFisherFromConfidences
+        // takes the full per-pattern embedding + confidence-delta batch directly (it
+        // computes the same squared confidence-delta-scaled-embedding gradient proxy
+        // internally) — replaces the previous per-change recordGradient loop, which
+        // updated the full 384-dim globalFisher but fed a signal that getPenalty's
+        // 1-element call shape then read back only at index 0.
         if (ewcConsolidator && confidenceChanges.length > 0) {
-            for (const change of confidenceChanges) {
-                // Use confidence delta as gradient proxy
-                const gradient = change.embedding.map(e => e * Math.abs(change.newConf - change.oldConf));
-                ewcConsolidator.recordGradient(change.id, gradient, true);
-            }
+            ewcConsolidator.updateFisherFromConfidences(confidenceChanges);
         }
         // Persist updated patterns
         bank.flushToDisk();
@@ -467,7 +478,17 @@ class LocalReasoningBank {
         this.saveToDisk();
     }
     /**
-     * Find similar patterns by embedding
+     * Find similar patterns by embedding.
+     *
+     * `confidence` on each result is the pattern's own learned reliability
+     * (unchanged from storage) — NOT how well it matches this query. The
+     * per-query cosine score is returned separately as `similarity`. Callers
+     * that want "how good a semantic match is this" must read `.similarity`;
+     * callers that want "how reliable has this pattern proven to be" read
+     * `.confidence`. Prior to this fix both were conflated (confidence was
+     * overwritten with the cosine score), which silently broke any consumer
+     * that needed to tell them apart (found during the 2026-09-12 dream-cycle
+     * intelligence-surface review).
      */
     findSimilar(queryEmbedding, options) {
         const { k = 5, threshold = 0.5, type } = options;
@@ -489,7 +510,7 @@ class LocalReasoningBank {
             // Update usage
             s.pattern.usageCount++;
             s.pattern.lastUsedAt = Date.now();
-            return { ...s.pattern, confidence: s.score };
+            return { ...s.pattern, similarity: s.score };
         });
     }
     /**
@@ -985,7 +1006,7 @@ export async function findSimilarPatterns(query, options) {
             usageCount: r.usageCount,
             createdAt: r.createdAt,
             lastUsedAt: r.lastUsedAt,
-            similarity: r.similarity ?? r.confidence ?? 0.5
+            similarity: r.similarity
         }));
     }
     catch {

package/v3/@claude-flow/cli/dist/src/memory/memory-bridge.js

@@ -1866,7 +1866,12 @@ export async function bridgeStorePattern(options) {
             }
             catch { /* HNSW is best-effort */ }
         }
-        return { success: true, patternId: result.id, controller: 'bridge-fallback' };
+        // #3324: bridgeStoreEntry's `result.id` is its OWN internally generated
+        // row id (generateId('entry')), a different value from the `key` the row
+        // was actually stored under. getEntry/memory_retrieve look up by `key`,
+        // so returning result.id here handed the caller a handle that can never
+        // be read back — return `patternId` (the real key) instead.
+        return { success: true, patternId, controller: 'bridge-fallback' };
     }
     catch {
         return null;
@@ -1915,10 +1920,13 @@ export async function bridgeSearchPatterns(options) {
                 const qEmb = await generateEmbedding(options.query);
                 if (qEmb && Array.isArray(qEmb.embedding) && qEmb.embedding.length > 0) {
                     const hits = reasoningBank.findSimilar(qEmb.embedding, { k, threshold });
+                    // findSimilar() no longer overwrites confidence with the query-match
+                    // score — prefer similarity (the actual match strength) for search ranking,
+                    // falling back to confidence/score only for older/foreign result shapes.
                     mapped = (Array.isArray(hits) ? hits : []).map((r) => ({
                         id: r.id ?? '',
                         content: r.content ?? '',
-                        score: r.confidence ?? r.score ?? 0,
+                        score: r.similarity ?? r.confidence ?? r.score ?? 0,
                     }));
                 }
             }