docs(audit): frontier architecture red-team of SPARK (2026-08-25) - #288
Open
adrianwedd wants to merge 3 commits into
Open
docs(audit): frontier architecture red-team of SPARK (2026-08-25)#288adrianwedd wants to merge 3 commits into
adrianwedd wants to merge 3 commits into
Conversation
Adversarial review answering five questions: does the architecture deserve to exist; where SPARK cosplays agency; what failures are still hard to see; where authority boundaries are still fake; what SPARK should become next. Four read-only spark-investigator tracks + direct live-state reading + open-issue review; top-ten findings independently re-verified at file:line. Key verified findings: the brain reply channel is unauthenticated (collect_reply reads a world-writable outbox with no writer check, brain.py:775-798 / _DIR_MODE 1777); reflection routing is contradicted across three files with two dead functions (mind.py call_claude has zero callers; call_llm goes straight to ask_m5); consolidated memory is plumbed only into the reflection nobody hears (retrieve_memories sole caller is mind.py:2570); confirm_motion_allowed is a bare bool on the pre-#209 footing. No robot state changed; this document is the only write. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ThqC6Gq4mZyXWnnvGC2a57
…ed-team Independent frontier-model review commissioned to attack the red-team report, not polish it. Re-traces every top-ten finding to file:line (crown jewels read first-hand) and against live production state. Core disagreement: the report's ranking is one-directionally biased. It dresses same-uid trust assumptions as security bypasses (B1 demoted to a P1 nonce) and test-pinned/documented dead code as latent chaos (B2), while under-stating the memory/learning findings and getting its flagship agency line wrong on its own cited line (B9: memory.py:299-307 reads outcomes back into the prompt). Adds findings the report missed, incl. a real privacy bug: the message_obi redaction is bypassed through session history into the jailbroken personas' prompts and the public thoughts feed (P0), consolidation failing live since Aug-23, evolve advertised-but-dead with a falsified audit trail, single-flight voice starvation up to 15 min, and night-silence/announce bounds sitting in the evolve-whitelisted file. Re-ranks P0s and gives a 3-month preserve/delete/build verdict. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ThqC6Gq4mZyXWnnvGC2a57
Deploying spark with
|
| Latest commit: |
e752e5a
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://17658ec7.spark-e11.pages.dev |
| Branch Preview URL: | https://audit-architecture-redteam-2.spark-e11.pages.dev |
Grounds §4 of the peer review in real symbols. The minimal change is three
pieces of plumbing over primitives SPARK already has, not a memory platform:
1. deterministic report-kind extraction of explicit first-person assertions
from existing conversation events (obi_chat.jsonl, voice user turns) — no
LLM, so no model-guessed facts by construction;
2. a physically separate state/people-{persona}.jsonl store that reflection
never reads — the contamination firewall that keeps person facts out of the
public thoughts/blog/social path;
3. relevance-mode retrieval injected into the two SPARK-identity channels
(voice-as-spark, obi-chat) with "Obi told me" provenance framing.
Reuses pxh.provenance (report ceiling, supersession), pxh.memory (scorer,
non-padding retrieval), pxh.health. Gated behind fixing the message_obi
redaction leak first (display_text is a local at mind.py:2897, re-read raw at
mind.py:3173). Couples to a new px-mind-consolidation health component so the
currently-dead nightly consolidation stops failing silently. Includes a
Day1/Day3 lived acceptance test, falsification tests, and an explicit
what-NOT-to-build list (no embeddings/episodic/platform until keyword
retrieval is measured insufficient).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ThqC6Gq4mZyXWnnvGC2a57
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adversarial architectural review of SPARK as a deployed persistent embodied agent, answering five commissioned questions (does the architecture deserve to exist; where SPARK cosplays agency; what failures are hard to see; where authority boundaries are fake; what SPARK should become next).
Method: four independent read-only
spark-investigatortracks (architecture/SPOFs, agency-vs-theatre, observability, authority boundaries) + direct live-state reading + open-issue review. All top-ten findings independently re-verified at file:line before inclusion. Read-only — this document is the only write; no robot state changed.Top verified findings
collect_reply(brain.py:775-798) reads a world-writable1777outbox with no writer check; anypiprocess can forge a reply into speech/memory/public-blog. The multi-uid rationale for1777is obsolete post-Stage 2: remove spark-io, collapse to one resident Claude session #242.mind.call_claude/call_brain_reflectionare dead code (zero callers;call_llmgoes straight toask_m5).retrieve_memoriessole caller is mind.py:2570); every channel Obi uses is amnesiac past 10 turns.notes.jsonl) is stranded from spark-persona reads (notes-spark.jsonl).confirm_motion_allowedis a bare bool with no provenance — motion authority on the exact pre-state(quiet): make quiet mode attributable, bounded and explainable #209 footing quiet-mode was fixed off.Full report:
docs/audits/2026-08-25-spark-architecture-redteam.md(verdict, ten findings, complexity to delete/defend, five falsification experiments, next-capability roadmap, an "if I inherited this robot" plan, and a one-page adversarial review for another frontier model to critique).🤖 Generated with Claude Code