mcp-nervous-system 1.5.1 → 1.6.0

package/README.md

@@ -4,7 +4,7 @@
 
 7 mechanically enforced rules that prevent the most common failure modes when LLMs have access to real infrastructure: context loss, silent failures, file damage, goal drift, and overreach.
 
-Built by [Arthur Palyan](https://www.levelsofself.com) at Palyan Family AI System. 15 tools including configuration drift detection and emergency kill switch. Battle-tested on an 11-member AI family running 28 processes 24/7 on a single VPS. 58+ violations logged, 0 bypassed.
+Built by [Arthur Palyan](https://www.levelsofself.com) at Palyan Family AI System. 16 tools including configuration drift detection and emergency kill switch. Battle-tested on an 11-member AI family running 30 processes 24/7 on a single VPS. 58+ violations logged, 0 bypassed.
 
 ## The Problem
 
@@ -60,7 +60,7 @@ Protocol: MCP 2024-11-05 (Streamable HTTP + SSE)
 Authentication: None required
 ```
 
-## NEW in v1.5.0
+## NEW in v1.5.1
 
 **drift_audit** (free tier)
 Configuration drift detection across 5 scopes: roles, versions, files, processes, and website. Scans source-of-truth files (family-roles.json, package.json, UNTOUCHABLE_FILES.txt) against all downstream references - HTML pages, JSON configs, markdown docs, and running PM2 processes. Change one file, drift_audit tells you everywhere else that needs updating. The closed loop that keeps your entire system consistent.

package/README.md.bak.1772792496

@@ -0,0 +1,172 @@
+# The Nervous System
+
+**LLM Behavioral Enforcement Framework**
+
+7 mechanically enforced rules that prevent the most common failure modes when LLMs have access to real infrastructure: context loss, silent failures, file damage, goal drift, and overreach.
+
+Built by [Arthur Palyan](https://www.levelsofself.com) at Palyan Family AI System. 15 tools including configuration drift detection and emergency kill switch. Battle-tested on an 11-member AI family running 28 processes 24/7 on a single VPS. 58+ violations logged, 0 bypassed.
+
+## The Problem
+
+When you give an LLM access to your file system, bash, and production infrastructure, it will eventually:
+
+- Edit a file it shouldn't touch
+- Lose context between sessions and start over
+- Drift from the original objective during long tasks
+- Fail silently when a session times out
+- Make logic changes without asking
+- Disappear into debug loops
+
+The Nervous System solves all of these with rules enforced by external mechanisms the LLM cannot override.
+
+## Install
+
+### Claude Desktop
+
+Add to your `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "nervous-system": {
+      "command": "npx",
+      "args": ["-y", "mcp-nervous-system"]
+    }
+  }
+}
+```
+
+### Claude Code
+
+```bash
+claude mcp add nervous-system npx mcp-nervous-system
+```
+
+### Direct
+
+```bash
+npx mcp-nervous-system
+```
+
+Server starts on port 3475 with SSE, HTTP, and health endpoints.
+
+### Hosted (No Install)
+
+The server is live and ready to use:
+
+```
+URL: https://api.100levelup.com/mcp-ns/
+Protocol: MCP 2024-11-05 (Streamable HTTP + SSE)
+Authentication: None required
+```
+
+## NEW in v1.5.0
+
+**drift_audit** (free tier)
+Configuration drift detection across 5 scopes: roles, versions, files, processes, and website. Scans source-of-truth files (family-roles.json, package.json, UNTOUCHABLE_FILES.txt) against all downstream references - HTML pages, JSON configs, markdown docs, and running PM2 processes. Change one file, drift_audit tells you everywhere else that needs updating. The closed loop that keeps your entire system consistent.
+
+**Positioning: Auto mode decides what Claude CAN do. The Nervous System governs HOW it behaves while doing it.**
+
+## The 7 Rules
+
+| # | Rule | What It Prevents |
+|---|------|-----------------|
+| 1 | **Dispatch Don't Do** | Debug loops, rabbit holes. Tasks > 2 messages get dispatched. |
+| 2 | **Untouchable** | File damage. Protected files mechanically blocked from editing. |
+| 3 | **Write Progress** | Silent failures. Progress noted before each action. |
+| 4 | **Step Back Every 4** | Goal drift. Forced reflection every 4 messages. |
+| 5 | **Delegate and Return** | Invisible work. Background tasks reported immediately. |
+| 6 | **Ask Before Touching** | Unauthorized changes. Logic changes need human approval. |
+| 7 | **Hand Off** | Context loss. Written handoffs every 3-4 exchanges. |
+
+## MCP Tools (12)
+
+| Tool | Description |
+|------|------------|
+| `get_framework` | Complete framework: all rules, permission protocol, enforcement patterns |
+| `guardrail_rules` | The 7 core rules with triggers, enforcement, and failure modes |
+| `preflight_check` | File protection system: shell script blocks edits to protected files |
+| `session_handoff` | Context preservation: templates for handoff documents |
+| `worklog` | Progress documentation pattern |
+| `violation_logging` | Audit trail: timestamp, type, context for every violation |
+| `step_back_check` | Forced reflection system |
+| `get_nervous_system_info` | System overview and operational stats |
+| `emergency_kill_switch` | Emergency shutdown of all PM2 processes. Requires kill switch secret. Logs to tamper-evident audit trail |
+| `verify_audit_chain` | Walks the SHA-256 hash-chained audit log and verifies every entry. Returns chain integrity status |
+| `dispatch_to_llm` | Spawns a background LLM agent to handle a task. Checks RAM, enforces max 2 concurrent dispatches |
+| `drift_audit` | Configuration drift detection across roles, versions, files, processes, and website. Finds stale values everywhere. |
+
+## Kill Switch
+
+The `emergency_kill_switch` tool provides an emergency shutdown capability. Send a POST request to `/kill` with the kill switch secret to immediately stop all PM2 processes. Every activation is logged to the tamper-evident audit trail with SHA-256 hash chaining, so kill switch events cannot be hidden or altered after the fact.
+
+- Requires authentication (kill switch secret)
+- Logs to hash-chained audit trail
+- Returns confirmation with affected process count
+
+## Tamper-Evident Audit Trail
+
+Every guardrail violation, kill switch activation, and dispatch event is recorded in a SHA-256 hash-chained audit log. Each entry includes the hash of the previous entry, making it cryptographically impossible to alter or delete past records without breaking the chain.
+
+- Use `verify_audit_chain` to walk the entire chain and verify integrity
+- Returns: valid/invalid status, entry count, and break point if tampered
+- 58+ violations logged, 0 bypassed, 0 chain breaks
+
+## Dispatch to LLM
+
+The `dispatch_to_llm` tool enables a brain + agents architecture. Instead of one LLM session doing everything, complex tasks get dispatched to background agents that run independently under the same 7 rules.
+
+- Checks available RAM (requires 500MB+)
+- Enforces max 2 concurrent dispatches
+- Returns PID and log file path for monitoring
+- Every dispatched agent runs under the same nervous system guardrails
+
+## EU AI Act Compliance
+
+The Nervous System provides practical compliance tools for the EU AI Act. See the full compliance page at:
+
+https://api.100levelup.com/family/eu-ai-act.html
+
+## Resources (5)
+
+- `nervous-system://framework` - The complete framework
+- `nervous-system://quick-start` - Quick start guide
+- `nervous-system://rules` - The 7 core rules
+- `nervous-system://templates` - Templates for handoffs, worklogs, preflight
+- `nervous-system://drift-audit` - Configuration drift detection
+
+## Production Stats
+
+From the live Palyan Family AI System deployment (Feb 28 - Mar 5, 2026):
+
+- **58+** violations caught
+- **29** edits blocked by preflight
+- **13** unique files protected
+- **0** rules bypassed
+- **28** processes monitored
+- **7** days continuous operation
+
+## Live Demo
+
+Try it yourself (no login required):
+
+- **[Interactive Demo](https://api.100levelup.com/family/arthur.html?guest=1)** - Talk to a governed LLM and try to break the rules
+- **[Audit Dashboard](https://api.100levelup.com/family/audit.html)** - See real violation history with timeline
+- **[System Status](https://api.100levelup.com/family/status.html)** - Live health checks
+- **[API Documentation](https://api.100levelup.com/family/api-docs.html)** - Full tool and resource reference
+- **[Case Study](https://api.100levelup.com/family/case-study.html)** - Production deployment data
+- **[Plain English Rules](https://api.100levelup.com/family/rules-plain.html)** - For non-technical stakeholders
+- **[Incident Response](https://api.100levelup.com/family/incident-response.html)** - Detection, containment, resolution
+- **[EU AI Act Compliance](https://api.100levelup.com/family/eu-ai-act.html)** - Practical EU AI Act compliance tools
+
+## Philosophy
+
+> "LLMs can't reliably self-enforce promises. Guardrails work via preflight.sh, violation logs, and catching drift. Build enforcement systems, don't make promises."
+
+If a guardrail can be violated by the thing it guards, it is not a guardrail. It is a suggestion.
+
+Every rule in the Nervous System is enforced by an external mechanism: a shell script, a timer, a separate monitoring process. The LLM cannot override, circumvent, or ignore them.
+
+## License
+
+MIT

package/README.md.bak.1772792812

@@ -0,0 +1,172 @@
+# The Nervous System
+
+**LLM Behavioral Enforcement Framework**
+
+7 mechanically enforced rules that prevent the most common failure modes when LLMs have access to real infrastructure: context loss, silent failures, file damage, goal drift, and overreach.
+
+Built by [Arthur Palyan](https://www.levelsofself.com) at Palyan Family AI System. 15 tools including configuration drift detection and emergency kill switch. Battle-tested on an 11-member AI family running 30 processes 24/7 on a single VPS. 58+ violations logged, 0 bypassed.
+
+## The Problem
+
+When you give an LLM access to your file system, bash, and production infrastructure, it will eventually:
+
+- Edit a file it shouldn't touch
+- Lose context between sessions and start over
+- Drift from the original objective during long tasks
+- Fail silently when a session times out
+- Make logic changes without asking
+- Disappear into debug loops
+
+The Nervous System solves all of these with rules enforced by external mechanisms the LLM cannot override.
+
+## Install
+
+### Claude Desktop
+
+Add to your `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "nervous-system": {
+      "command": "npx",
+      "args": ["-y", "mcp-nervous-system"]
+    }
+  }
+}
+```
+
+### Claude Code
+
+```bash
+claude mcp add nervous-system npx mcp-nervous-system
+```
+
+### Direct
+
+```bash
+npx mcp-nervous-system
+```
+
+Server starts on port 3475 with SSE, HTTP, and health endpoints.
+
+### Hosted (No Install)
+
+The server is live and ready to use:
+
+```
+URL: https://api.100levelup.com/mcp-ns/
+Protocol: MCP 2024-11-05 (Streamable HTTP + SSE)
+Authentication: None required
+```
+
+## NEW in v1.5.0
+
+**drift_audit** (free tier)
+Configuration drift detection across 5 scopes: roles, versions, files, processes, and website. Scans source-of-truth files (family-roles.json, package.json, UNTOUCHABLE_FILES.txt) against all downstream references - HTML pages, JSON configs, markdown docs, and running PM2 processes. Change one file, drift_audit tells you everywhere else that needs updating. The closed loop that keeps your entire system consistent.
+
+**Positioning: Auto mode decides what Claude CAN do. The Nervous System governs HOW it behaves while doing it.**
+
+## The 7 Rules
+
+| # | Rule | What It Prevents |
+|---|------|-----------------|
+| 1 | **Dispatch Don't Do** | Debug loops, rabbit holes. Tasks > 2 messages get dispatched. |
+| 2 | **Untouchable** | File damage. Protected files mechanically blocked from editing. |
+| 3 | **Write Progress** | Silent failures. Progress noted before each action. |
+| 4 | **Step Back Every 4** | Goal drift. Forced reflection every 4 messages. |
+| 5 | **Delegate and Return** | Invisible work. Background tasks reported immediately. |
+| 6 | **Ask Before Touching** | Unauthorized changes. Logic changes need human approval. |
+| 7 | **Hand Off** | Context loss. Written handoffs every 3-4 exchanges. |
+
+## MCP Tools (12)
+
+| Tool | Description |
+|------|------------|
+| `get_framework` | Complete framework: all rules, permission protocol, enforcement patterns |
+| `guardrail_rules` | The 7 core rules with triggers, enforcement, and failure modes |
+| `preflight_check` | File protection system: shell script blocks edits to protected files |
+| `session_handoff` | Context preservation: templates for handoff documents |
+| `worklog` | Progress documentation pattern |
+| `violation_logging` | Audit trail: timestamp, type, context for every violation |
+| `step_back_check` | Forced reflection system |
+| `get_nervous_system_info` | System overview and operational stats |
+| `emergency_kill_switch` | Emergency shutdown of all PM2 processes. Requires kill switch secret. Logs to tamper-evident audit trail |
+| `verify_audit_chain` | Walks the SHA-256 hash-chained audit log and verifies every entry. Returns chain integrity status |
+| `dispatch_to_llm` | Spawns a background LLM agent to handle a task. Checks RAM, enforces max 2 concurrent dispatches |
+| `drift_audit` | Configuration drift detection across roles, versions, files, processes, and website. Finds stale values everywhere. |
+
+## Kill Switch
+
+The `emergency_kill_switch` tool provides an emergency shutdown capability. Send a POST request to `/kill` with the kill switch secret to immediately stop all PM2 processes. Every activation is logged to the tamper-evident audit trail with SHA-256 hash chaining, so kill switch events cannot be hidden or altered after the fact.
+
+- Requires authentication (kill switch secret)
+- Logs to hash-chained audit trail
+- Returns confirmation with affected process count
+
+## Tamper-Evident Audit Trail
+
+Every guardrail violation, kill switch activation, and dispatch event is recorded in a SHA-256 hash-chained audit log. Each entry includes the hash of the previous entry, making it cryptographically impossible to alter or delete past records without breaking the chain.
+
+- Use `verify_audit_chain` to walk the entire chain and verify integrity
+- Returns: valid/invalid status, entry count, and break point if tampered
+- 58+ violations logged, 0 bypassed, 0 chain breaks
+
+## Dispatch to LLM
+
+The `dispatch_to_llm` tool enables a brain + agents architecture. Instead of one LLM session doing everything, complex tasks get dispatched to background agents that run independently under the same 7 rules.
+
+- Checks available RAM (requires 500MB+)
+- Enforces max 2 concurrent dispatches
+- Returns PID and log file path for monitoring
+- Every dispatched agent runs under the same nervous system guardrails
+
+## EU AI Act Compliance
+
+The Nervous System provides practical compliance tools for the EU AI Act. See the full compliance page at:
+
+https://api.100levelup.com/family/eu-ai-act.html
+
+## Resources (5)
+
+- `nervous-system://framework` - The complete framework
+- `nervous-system://quick-start` - Quick start guide
+- `nervous-system://rules` - The 7 core rules
+- `nervous-system://templates` - Templates for handoffs, worklogs, preflight
+- `nervous-system://drift-audit` - Configuration drift detection
+
+## Production Stats
+
+From the live Palyan Family AI System deployment (Feb 28 - Mar 5, 2026):
+
+- **58+** violations caught
+- **29** edits blocked by preflight
+- **13** unique files protected
+- **0** rules bypassed
+- **28** processes monitored
+- **7** days continuous operation
+
+## Live Demo
+
+Try it yourself (no login required):
+
+- **[Interactive Demo](https://api.100levelup.com/family/arthur.html?guest=1)** - Talk to a governed LLM and try to break the rules
+- **[Audit Dashboard](https://api.100levelup.com/family/audit.html)** - See real violation history with timeline
+- **[System Status](https://api.100levelup.com/family/status.html)** - Live health checks
+- **[API Documentation](https://api.100levelup.com/family/api-docs.html)** - Full tool and resource reference
+- **[Case Study](https://api.100levelup.com/family/case-study.html)** - Production deployment data
+- **[Plain English Rules](https://api.100levelup.com/family/rules-plain.html)** - For non-technical stakeholders
+- **[Incident Response](https://api.100levelup.com/family/incident-response.html)** - Detection, containment, resolution
+- **[EU AI Act Compliance](https://api.100levelup.com/family/eu-ai-act.html)** - Practical EU AI Act compliance tools
+
+## Philosophy
+
+> "LLMs can't reliably self-enforce promises. Guardrails work via preflight.sh, violation logs, and catching drift. Build enforcement systems, don't make promises."
+
+If a guardrail can be violated by the thing it guards, it is not a guardrail. It is a suggestion.
+
+Every rule in the Nervous System is enforced by an external mechanism: a shell script, a timer, a separate monitoring process. The LLM cannot override, circumvent, or ignore them.
+
+## License
+
+MIT

package/index.js

@@ -5,11 +5,62 @@ const crypto = require('crypto');
 const { spawn } = require('child_process');
 const fs = require('fs');
 
+const path = require('path');
+const os = require('os');
+
+// ============================================================
+// PROJECT CONFIGURATION - Auto-discover or use config file
+// ============================================================
+
+function loadProjectConfig() {
+  const configPaths = [
+    process.env.NS_CONFIG_PATH,
+    path.join(process.cwd(), 'nervous-system.config.json'),
+    path.join(os.homedir(), '.nervous-system', 'config.json'),
+    path.join(__dirname, 'nervous-system.config.json'),
+  ].filter(Boolean);
+
+  for (const cp of configPaths) {
+    try {
+      const raw = fs.readFileSync(cp, 'utf8');
+      const cfg = JSON.parse(raw);
+      cfg._source = cp;
+      return cfg;
+    } catch (e) { continue; }
+  }
+
+  // Return defaults that work for any project
+  return {
+    _source: 'defaults',
+    project_root: process.cwd(),
+    data_dir: null,
+    logs_dir: null,
+    html_dir: null,
+    protected_files_list: null,
+    config_file: null,
+    roles_file: null,
+    docs_to_audit: [],
+    pm2_managed: false,
+    html_pages: [],
+    package_json: null,
+    github_repo: null,
+  };
+}
+
+const PROJECT = loadProjectConfig();
+
+function projectPath(key) {
+  const val = PROJECT[key];
+  if (!val) return null;
+  if (path.isAbsolute(val)) return val;
+  return path.join(PROJECT.project_root || process.cwd(), val);
+}
+
 const PORT = 3475;
 
 const KILL_SECRET = process.env.KILL_SECRET || 'ns-kill-2026';
-const AUDIT_CHAIN_FILE = '/root/family-data/audit-chain.json';
-const VIOLATIONS_LOG = '/root/family-logs/guardrail-violations.log';
+const AUDIT_CHAIN_FILE = projectPath('data_dir') ? path.join(projectPath('data_dir'), 'audit-chain.json') : path.join(os.homedir(), '.nervous-system', 'audit-chain.json');
+const VIOLATIONS_LOG = projectPath('logs_dir') ? path.join(projectPath('logs_dir'), 'guardrail-violations.log') : path.join(os.homedir(), '.nervous-system', 'guardrail-violations.log');
 const GENESIS_HASH = '0000000000000000000000000000000000000000000000000000000000000000';
 const activeDispatches = [];
 const MAX_CONCURRENT_DISPATCHES = 2;
@@ -108,7 +159,7 @@ function dispatchToLLM(task, maxTurns) {
   const freeMB = getFreeMB();
   if (freeMB < 500) return { dispatched: false, error: `Insufficient RAM: ${freeMB}MB free (need 500MB+)` };
   const ts = Date.now();
-  const logFile = `/root/family-logs/dispatch-${ts}.log`;
+  const logFile = projectPath('logs_dir') ? `${projectPath('logs_dir')}/dispatch-${ts}.log` : path.join(os.homedir(), '.nervous-system', `dispatch-${ts}.log`);
   const turns = maxTurns || 15;
   try {
     const escaped = task.replace(/"/g, '\\"');
@@ -129,7 +180,7 @@ const MCP_VERSION = '2024-11-05';
 // Server info
 const SERVER_INFO = {
   name: 'nervous-system',
-  version: '1.5.1'
+  version: '1.6.0'
 };
 
 // ============================================================
@@ -138,7 +189,7 @@ const SERVER_INFO = {
 
 const FRAMEWORK = {
   name: 'The Nervous System',
-  version: '1.5.1',
+  version: '1.6.0',
   author: 'Arthur Palyan',
   tagline: 'Anthropic built the brain. Arthur built the nervous system that keeps it from hurting itself.',
   problem: 'LLMs lose context between sessions, loop on problems instead of dispatching, silently fail without progress notes, edit protected files, drift from the real problem, and solve instead of asking.',
@@ -475,7 +526,7 @@ const NERVOUS_SYSTEM_INFO = {
     ]
   },
   origin_story: {
-    context: 'Arthur Palyan runs a startup with 12 AI family members, each with distinct roles. The entire operation runs on a $12/month VPS with a $300/month LLM subscription.',
+    context: 'Arthur Palyan runs a startup with 12 AI family members, each with distinct roles. The entire operation runs on a $24/month VPS with a $200/month LLM subscription.',
     problem_discovered: 'After months of building, patterns emerged: LLMs would break working systems while trying to improve them. They would loop on debugging instead of dispatching. They would silently fail when sessions timed out. They would lose all context between sessions.',
     solution_built: 'Arthur built the nervous system - not by changing the LLM model, but by wrapping it in behavioral rules enforced through scripts, file checks, and prompt engineering. The LLM itself became the enforcement mechanism, trained to check before acting.',
     philosophy: 'The brain (LLM) is powerful but needs a nervous system to keep it from hurting itself. Just like a human nervous system sends pain signals before you touch a hot stove, this system sends BLOCKED/PROTECTED signals before the LLM edits a critical file.',
@@ -507,7 +558,7 @@ const NERVOUS_SYSTEM_INFO = {
     reflection_trigger: 'Every 4 messages',
     processes_managed: '22+ autonomous PM2 processes',
     family_members: 12,
-    monthly_cost: '$352/month total infrastructure',
+    monthly_cost: 'Under $300/month total infrastructure',
     uptime: '24/7 autonomous operation',
     deployment: 'Single VPS, single LLM subscription'
   }
@@ -649,6 +700,21 @@ const TOOLS = [
         page: { type: 'string', description: "Specific page to check (e.g. 'gateway.html'), or 'all' for everything" }
       }
     }
+  },
+  // NEW: Pre-Publish Audit
+  {
+    name: 'pre_publish_audit',
+    annotations: { title: 'Pre-Publish Audit', readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    description: 'Scans the Nervous System source code itself before publishing. Catches hardcoded secrets, personal data, non-portable paths, and internal naming that should not ship to clients. RUN THIS BEFORE EVERY npm publish.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        source_file: {
+          type: 'string',
+          description: 'Path to the NS source file to audit. Defaults to own index.js'
+        }
+      }
+    }
   }
 ];
 
@@ -686,7 +752,10 @@ function safeReadFile(filePath) {
 function auditRoles() {
   const drifts = [];
   let cleanChecks = 0;
-  const rolesFile = '/root/family-data/family-roles.json';
+  const rolesFile = projectPath('roles_file');
+  if (!rolesFile) {
+    return { drifts: [], cleanChecks: 0, skipped: 'roles_file not configured' };
+  }
   const roles = safeReadJSON(rolesFile);
   if (!roles || !roles.members) {
     drifts.push({ type: 'missing_source', source: rolesFile, target: '', field: '', expected: 'valid JSON with members array', found: 'missing or invalid' });
@@ -699,7 +768,8 @@ function auditRoles() {
   }
 
   // Check family-status.json
-  const statusFile = '/root/family-data/family-status.json';
+  const statusFile = projectPath('data_dir') ? path.join(projectPath('data_dir'), 'family-status.json') : null;
+  if (!statusFile) { return { drifts, cleanChecks }; }
   const status = safeReadJSON(statusFile);
   if (status && status.members) {
     for (const m of status.members) {
@@ -715,8 +785,8 @@ function auditRoles() {
   }
 
   // Check system-config.json
-  const configFile = '/root/family-data/system-config.json';
-  const config = safeReadJSON(configFile);
+  const configFile = projectPath('config_file');
+  const config = configFile ? safeReadJSON(configFile) : null;
   if (config && config.family_members) {
     for (const m of config.family_members) {
       const src = sourceRoles[m.id];
@@ -731,8 +801,8 @@ function auditRoles() {
   }
 
   // Check family-guide.json
-  const guideFile = '/root/family-data/family-guide.json';
-  const guide = safeReadJSON(guideFile);
+  const guideFile = projectPath('data_dir') ? path.join(projectPath('data_dir'), 'family-guide.json') : null;
+  const guide = guideFile ? safeReadJSON(guideFile) : null;
   if (guide && guide.members) {
     for (const m of guide.members) {
       const src = sourceRoles[m.id];
@@ -747,11 +817,12 @@ function auditRoles() {
   }
 
   // Check HTML files for role references
-  const htmlFiles = [
-    { path: '/root/family-home/index.html', name: 'index.html' },
-    { path: '/root/family-home/explorer.html', name: 'explorer.html' },
-    { path: '/root/family-home/meet.html', name: 'meet.html' }
-  ];
+  const htmlDir = projectPath('html_dir');
+  const htmlFiles = htmlDir ? [
+    { path: path.join(htmlDir, 'index.html'), name: 'index.html' },
+    { path: path.join(htmlDir, 'explorer.html'), name: 'explorer.html' },
+    { path: path.join(htmlDir, 'meet.html'), name: 'meet.html' }
+  ] : [];
   for (const hf of htmlFiles) {
     const content = safeReadFile(hf.path);
     if (!content) continue;
@@ -761,7 +832,7 @@ function auditRoles() {
   }
 
   // Check mcp-ops-server.js
-  const opsContent = safeReadFile('/root/mcp-ops-server.js');
+  const opsContent = projectPath('project_root') ? safeReadFile(path.join(projectPath('project_root') || process.cwd(), 'mcp-ops-server.js')) : null;
   if (opsContent) {
     for (const [id, src] of Object.entries(sourceRoles)) {
       if (opsContent.includes(`"${src.aka}"`) || opsContent.includes(`'${src.aka}'`)) {
@@ -776,7 +847,10 @@ function auditRoles() {
 function auditVersions() {
   const drifts = [];
   let cleanChecks = 0;
-  const pkgFile = '/root/github-repos/mcp-nervous-system/package.json';
+  const pkgFile = projectPath('package_json');
+  if (!pkgFile) {
+    return { drifts: [], cleanChecks: 0, skipped: 'package_json not configured' };
+  }
   const pkg = safeReadJSON(pkgFile);
   const expectedVersion = pkg ? pkg.version : null;
   if (!expectedVersion) {
@@ -785,7 +859,8 @@ function auditVersions() {
   }
 
   // Check SERVER_INFO.version and FRAMEWORK.version in index.js
-  const indexContent = safeReadFile('/root/github-repos/mcp-nervous-system/index.js');
+  const ghRepo = projectPath('github_repo');
+  const indexContent = ghRepo ? safeReadFile(path.join(ghRepo, 'index.js')) : null;
   if (indexContent) {
     const siMatch = indexContent.match(/SERVER_INFO\s*=\s*\{[^}]*version:\s*'([^']+)'/);
     if (siMatch) {
@@ -826,7 +901,7 @@ function auditVersions() {
   }
 
   // Check BUSINESS_BUILDER.md
-  const bbContent = safeReadFile('/root/family-data/BUSINESS_BUILDER.md');
+  const bbContent = projectPath('data_dir') ? safeReadFile(path.join(projectPath('data_dir'), 'BUSINESS_BUILDER.md')) : null;
   if (bbContent) {
     const bbMatch = bbContent.match(/[Nn]ervous [Ss]ystem.*?v?(\d+\.\d+\.\d+)/);
     if (bbMatch && bbMatch[1] !== expectedVersion) {
@@ -835,7 +910,7 @@ function auditVersions() {
   }
 
   // Check gateway.html
-  const gwContent = safeReadFile('/root/family-home/gateway.html');
+  const gwContent = projectPath('html_dir') ? safeReadFile(path.join(projectPath('html_dir'), 'gateway.html')) : null;
   if (gwContent) {
     const gwMatch = gwContent.match(/[Vv]ersion[:\s]*v?(\d+\.\d+\.\d+)/);
     if (gwMatch && gwMatch[1] !== expectedVersion) {
@@ -844,7 +919,7 @@ function auditVersions() {
   }
 
   // Check README.md
-  const readmeContent = safeReadFile('/root/github-repos/mcp-nervous-system/README.md');
+  const readmeContent = ghRepo ? safeReadFile(path.join(ghRepo, 'README.md')) : null;
   if (readmeContent) {
     const rmMatch = readmeContent.match(/[Vv]ersion[:\s]*v?(\d+\.\d+\.\d+)/);
     if (rmMatch && rmMatch[1] !== expectedVersion) {
@@ -853,7 +928,7 @@ function auditVersions() {
   }
 
   // Check family-roles.json stats
-  const roles = safeReadJSON('/root/family-data/family-roles.json');
+  const roles = projectPath('roles_file') ? safeReadJSON(projectPath('roles_file')) : null;
   if (roles && roles.stats) {
     if (roles.stats.ns_version && roles.stats.ns_version !== expectedVersion) {
       drifts.push({ type: 'version_mismatch', source: 'package.json', target: 'family-roles.json', field: 'stats.ns_version', expected: expectedVersion, found: roles.stats.ns_version });
@@ -874,10 +949,13 @@ function auditFiles() {
   let cleanChecks = 0;
 
   // Check UNTOUCHABLE_FILES.txt - verify each file exists
-  const untouchableContent = safeReadFile('/root/family-data/UNTOUCHABLE_FILES.txt');
+  const untouchableFile = projectPath('protected_files_list');
+  const untouchableContent = untouchableFile ? safeReadFile(untouchableFile) : null;
   if (untouchableContent) {
     const lines = untouchableContent.split('\n').map(l => l.trim()).filter(l => l && !l.startsWith('#'));
-    for (const filePath of lines) {
+    for (const rawLine of lines) {
+      const filePath = rawLine.split(/\s*[\(\#]/)[0].trim();
+      if (!filePath || !filePath.startsWith('/')) continue;
       if (fs.existsSync(filePath)) {
         cleanChecks++;
       } else {
@@ -887,10 +965,8 @@ function auditFiles() {
   }
 
   // Check LLM_STARTUP.md and BUSINESS_BUILDER.md for file references
-  const docsToCheck = [
-    { path: '/root/family-data/LLM_STARTUP.md', name: 'LLM_STARTUP.md' },
-    { path: '/root/family-data/BUSINESS_BUILDER.md', name: 'BUSINESS_BUILDER.md' }
-  ];
+  const docsToAudit = PROJECT.docs_to_audit || [];
+  const docsToCheck = docsToAudit.map(p => ({ path: p, name: path.basename(p) }));
 
   // Get PM2 running scripts
   let pm2Scripts = {};
@@ -906,7 +982,8 @@ function auditFiles() {
     const content = safeReadFile(doc.path);
     if (!content) continue;
     // Look for .js file references
-    const jsRefs = content.match(/\/root\/[^\s)]+\.js/g) || [];
+    // Match .js files but exclude .json, .jsonl, .jsx
+    const jsRefs = (content.match(/\/[^\s)]+\.js\b/g) || []).filter(r => !r.match(/\.json[l]?$/));
     for (const ref of jsRefs) {
       if (fs.existsSync(ref)) {
         cleanChecks++;
@@ -928,7 +1005,8 @@ function auditFiles() {
   }
 
   // Check system-config.json syntax_check_scripts
-  const config = safeReadJSON('/root/family-data/system-config.json');
+  const sysConfigFile = projectPath('config_file');
+  const config = sysConfigFile ? safeReadJSON(sysConfigFile) : null;
   if (config && config.syntax_check_scripts) {
     for (const script of config.syntax_check_scripts) {
       if (fs.existsSync(script)) {
@@ -955,10 +1033,10 @@ function auditProcesses() {
     return { drifts, cleanChecks };
   }
 
-  const config = safeReadJSON('/root/family-data/system-config.json');
+  const procConfigFile = projectPath('config_file');
+  const config = procConfigFile ? safeReadJSON(procConfigFile) : null;
   if (!config || !config.processes) {
-    // Try to compare against family-roles.json procs
-    const roles = safeReadJSON('/root/family-data/family-roles.json');
+    const roles = projectPath('roles_file') ? safeReadJSON(projectPath('roles_file')) : null;
     if (roles && roles.members) {
       const expectedProcs = [];
       for (const m of roles.members) {
@@ -1007,18 +1085,19 @@ function auditWebsite() {
   let cleanChecks = 0;
 
   // Source of truth values
-  const pkgFile = '/root/github-repos/mcp-nervous-system/package.json';
-  const pkg = safeReadJSON(pkgFile);
-  const expectedVersion = pkg ? pkg.version : '1.5.0';
+  const pkgFile = projectPath('package_json');
+  const pkg = pkgFile ? safeReadJSON(pkgFile) : null;
+  const expectedVersion = pkg ? pkg.version : SERVER_INFO.version;
   const actualToolCount = TOOLS.length;
   const actualResourceCount = RESOURCES.length;
 
-  const roles = safeReadJSON('/root/family-data/family-roles.json');
+  const roles = projectPath('roles_file') ? safeReadJSON(projectPath('roles_file')) : null;
   const expectedMemberCount = roles && roles.stats ? roles.stats.member_count : 11;
   const expectedProcessCount = roles && roles.stats ? roles.stats.process_count : 28;
 
   // Count protected files (non-comment, non-blank lines starting with /)
-  const untouchableContent = safeReadFile('/root/family-data/UNTOUCHABLE_FILES.txt');
+  const protListFile = projectPath('protected_files_list');
+  const untouchableContent = protListFile ? safeReadFile(protListFile) : null;
   let protectedFileCount = 0;
   if (untouchableContent) {
     protectedFileCount = untouchableContent.split('\n').filter(l => l.trim() && !l.trim().startsWith('#') && l.trim().startsWith('/')).length;
@@ -1028,7 +1107,10 @@ function auditWebsite() {
   const roleNames = roles && roles.members ? roles.members.map(m => m.name) : [];
 
   // 1. Check all .html files in /root/family-home/
-  const familyHomeDir = '/root/family-home/';
+  const familyHomeDir = projectPath('html_dir');
+  if (!familyHomeDir) {
+    return { drifts: [], cleanChecks: 0, skipped: 'html_dir not configured' };
+  }
   let htmlFiles = [];
   try {
     htmlFiles = fs.readdirSync(familyHomeDir).filter(f => f.endsWith('.html')).map(f => familyHomeDir + f);
@@ -1091,7 +1173,8 @@ function auditWebsite() {
   }
 
   // 2. Check family-guide.json
-  const guide = safeReadJSON('/root/family-data/family-guide.json');
+  const guideFile2 = projectPath('data_dir') ? path.join(projectPath('data_dir'), 'family-guide.json') : null;
+  const guide = guideFile2 ? safeReadJSON(guideFile2) : null;
   if (guide) {
     const guideStr = JSON.stringify(guide);
     // Check version refs
@@ -1117,7 +1200,7 @@ function auditWebsite() {
   } else { cleanChecks++; }
 
   // 3. Check mcp-stripe-checkout.js for version refs
-  const checkoutContent = safeReadFile('/root/mcp-stripe-checkout.js');
+  const checkoutContent = projectPath('project_root') ? safeReadFile(path.join(projectPath('project_root') || process.cwd(), 'mcp-stripe-checkout.js')) : null;
   if (checkoutContent) {
     const checkoutVersions = checkoutContent.match(/v(\d+\.\d+\.\d+)/g) || [];
     for (const cv of checkoutVersions) {
@@ -1130,7 +1213,8 @@ function auditWebsite() {
   }
 
   // 4. Check system-config.json for version/tool counts
-  const sysConfig = safeReadJSON('/root/family-data/system-config.json');
+  const sysConfigFile2 = projectPath('config_file');
+  const sysConfig = sysConfigFile2 ? safeReadJSON(sysConfigFile2) : null;
   if (sysConfig) {
     const scStr = JSON.stringify(sysConfig);
     const scVersions = scStr.match(/v(\d+\.\d+\.\d+)/g) || [];
@@ -1144,7 +1228,7 @@ function auditWebsite() {
   }
 
   // 5. Check FREE_TOOLS in mcp-api-middleware.js match actual tool names
-  const middlewareContent = safeReadFile('/root/mcp-api-middleware.js');
+  const middlewareContent = projectPath('project_root') ? safeReadFile(path.join(projectPath('project_root') || process.cwd(), 'mcp-api-middleware.js')) : null;
   if (middlewareContent) {
     const freeToolsMatch = middlewareContent.match(/'nervous-system':\s*\[([^\]]+)\]/);
     if (freeToolsMatch) {
@@ -1164,7 +1248,7 @@ function auditWebsite() {
   }
 
   // 6. Check sitemap.xml has all public pages
-  const sitemapContent = safeReadFile('/root/family-home/sitemap.xml');
+  const sitemapContent = familyHomeDir ? safeReadFile(path.join(familyHomeDir, 'sitemap.xml')) : null;
   if (sitemapContent && htmlFiles.length > 0) {
     const publicPages = htmlFiles.filter(f => {
       const name = f.split('/').pop();
@@ -1226,17 +1310,21 @@ function runSecurityAudit() {
   let checksPassed = 0;
 
   // 1. Scan HTML files for hardcoded passwords/secrets
-  const htmlDir = '/root/family-home/';
+  const htmlDir = projectPath('html_dir');
+  if (!htmlDir) {
+    return { status: 'skipped', vulnerability_count: 0, checks_passed: 0, vulnerabilities: [], skipped: 'html_dir not configured' };
+  }
   const secretPatterns = [
-    /Liarzhek1\$/g,
-    /Levelsofself1\$/g,
-    /\d{10}:AA[A-Za-z0-9_-]{30,}/g,
-    /sk-ant-[a-zA-Z0-9_-]+/g,
-    /npm_[A-Za-z0-9]{20,}/g,
-    /ghp_[A-Za-z0-9]{20,}/g,
-    /BOT_TOKEN\s*[:=]\s*['"][^'"]+['"]/gi,
-    /PAPA_FULL\s*[:=]\s*['"][^'"]+['"]/gi,
-    /PAPA_READ\s*[:=]\s*['"][^'"]+['"]/gi
+    /\d{10}:AA[A-Za-z0-9_-]{30,}/g,        // Telegram bot tokens
+    /sk-ant-[a-zA-Z0-9_-]+/g,               // Anthropic API keys
+    /sk_live_[a-zA-Z0-9]+/g,                // Stripe live keys
+    /sk_test_[a-zA-Z0-9]+/g,                // Stripe test keys
+    /npm_[A-Za-z0-9]{20,}/g,                // npm tokens
+    /ghp_[A-Za-z0-9]{20,}/g,                // GitHub PATs
+    /BOT_TOKEN\s*[:=]\s*['"][^'"]+['"]/gi,   // Generic bot tokens
+    /password\s*[:=]\s*['"][^'"]{8,}['"]/gi, // Hardcoded passwords
+    /api[_-]?key\s*[:=]\s*['"][A-Za-z0-9_\-]{20,}['"]/gi, // API keys
+    /secret\s*[:=]\s*['"][A-Za-z0-9_\-]{16,}['"]/gi,       // Secrets
   ];
   try {
     const htmlFiles = fs.readdirSync(htmlDir).filter(f => f.endsWith('.html'));
@@ -1244,11 +1332,24 @@ function runSecurityAudit() {
       const content = safeReadFile(htmlDir + hf);
       if (!content) continue;
       let fileClean = true;
+      const contentLines = content.split('\n');
       for (const pat of secretPatterns) {
         pat.lastIndex = 0;
-        const matches = content.match(pat);
-        if (matches && matches.length > 0) {
-          vulnerabilities.push({ type: 'hardcoded_secret', file: hf, pattern: pat.source, count: matches.length });
+        let realMatches = 0;
+        for (const line of contentLines) {
+          // Skip lines that are defining detection patterns (not actual secrets)
+          if (line.trim().match(/^\s*\/.*\/[gim]*,?\s*$/) ||
+              line.includes('SENS_PAT') ||
+              line.includes('secretPatterns') ||
+              line.includes('leakPatterns') ||
+              line.includes('dangerPatterns') ||
+              line.includes('redact')) continue;
+          pat.lastIndex = 0;
+          const m = line.match(pat);
+          if (m) realMatches += m.length;
+        }
+        if (realMatches > 0) {
+          vulnerabilities.push({ type: 'hardcoded_secret', file: hf, pattern: pat.source, count: realMatches });
           fileClean = false;
         }
       }
@@ -1259,7 +1360,7 @@ function runSecurityAudit() {
   }
 
   // 2. Check auth endpoints use server-side validation
-  const serverContent = safeReadFile('/root/family-home/server.js');
+  const serverContent = htmlDir ? safeReadFile(path.join(htmlDir, 'server.js')) : null;
   if (serverContent) {
     if (serverContent.includes('getSessionFromReq') || serverContent.includes('getAccessLevel')) {
       checksPassed++;
@@ -1291,7 +1392,8 @@ function runSecurityAudit() {
   }
 
   // 5. Check bridge rate limiting
-  if (serverContent && serverContent.includes('rate') || fs.existsSync('/root/rate-limit.js') || fs.existsSync('/root/bridge-ratelimit.js')) {
+  const projRoot = projectPath('project_root') || process.cwd();
+  if (serverContent && serverContent.includes('rate') || fs.existsSync(path.join(projRoot, 'rate-limit.js')) || fs.existsSync(path.join(projRoot, 'bridge-ratelimit.js'))) {
     checksPassed++;
   } else {
     vulnerabilities.push({ type: 'missing_rate_limit', file: 'bridge', detail: 'No rate limiting found for bridge' });
@@ -1315,7 +1417,8 @@ function runSecurityAudit() {
 
   // 7. Check api-credentials.json permissions
   try {
-    const credFile = '/root/family-data/api-credentials.json';
+    const credFile = projectPath('data_dir') ? path.join(projectPath('data_dir'), 'api-credentials.json') : null;
+    if (!credFile) { checksPassed++; }
     if (fs.existsSync(credFile)) {
       const stats = fs.statSync(credFile);
       const mode = (stats.mode & 0o777).toString(8);
@@ -1367,10 +1470,14 @@ function runSecurityAudit() {
 
 function runAutoPropagators() {
   const results = [];
+  const workersDir = projectPath('project_root') ? path.join(projectPath('project_root') || process.cwd(), 'family-workers') : null;
+  if (!workersDir || !fs.existsSync(workersDir)) {
+    return { timestamp: new Date().toISOString(), propagators_run: 0, results: [], skipped: 'family-workers directory not found' };
+  }
   const scripts = [
-    { name: 'role', path: '/root/family-workers/role-propagator.js' },
-    { name: 'version', path: '/root/family-workers/version-propagator.js' },
-    { name: 'content', path: '/root/family-workers/content-propagator.js' }
+    { name: 'role', path: path.join(workersDir, 'role-propagator.js') },
+    { name: 'version', path: path.join(workersDir, 'version-propagator.js') },
+    { name: 'content', path: path.join(workersDir, 'content-propagator.js') }
   ];
   for (const script of scripts) {
     try {
@@ -1393,7 +1500,10 @@ function runAutoPropagators() {
 // ============================================================
 
 function runPageHealth(page) {
-  const FAMILY_HOME = '/root/family-home';
+  const FAMILY_HOME = projectPath('html_dir');
+  if (!FAMILY_HOME) {
+    return { status: 'skipped', pages_checked: 0, issue_count: 0, issues: [], skipped: 'html_dir not configured' };
+  }
   const issues = [];
 
   let htmlFiles;
@@ -1547,6 +1657,111 @@ function runPageHealth(page) {
   };
 }
 
+
+// ============================================================
+// PRE-PUBLISH AUDIT ENGINE
+// ============================================================
+
+function runPrePublishAudit(sourceFile) {
+  const findings = [];
+  const file = sourceFile || __filename;
+  let content;
+  try {
+    content = fs.readFileSync(file, 'utf8');
+  } catch (e) {
+    return { status: 'error', error: 'Cannot read file: ' + e.message };
+  }
+  const lines = content.split('\n');
+
+  // 1. Check for hardcoded absolute paths (non-portable)
+  lines.forEach((line, idx) => {
+    if (line.trim().startsWith('//')) return;
+    if (line.includes('description:') || line.includes('context:')) return;
+    if (line.includes('description,') || line.includes("description'")) return;
+
+    if (line.match(/['"\`]\/root\//)) {
+      findings.push({
+        type: 'hardcoded_path',
+        line: idx + 1,
+        preview: line.trim().substring(0, 100),
+        fix: 'Use projectPath() or configurable path'
+      });
+    }
+    if (line.match(/['"\`]\/home\//)) {
+      findings.push({
+        type: 'hardcoded_path',
+        line: idx + 1,
+        preview: line.trim().substring(0, 100),
+        fix: 'Use projectPath() or os.homedir()'
+      });
+    }
+  });
+
+  // 2. Check for personal data that should not ship
+  const personalPatterns = [
+    { name: 'email_address', pat: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g },
+    { name: 'phone_number', pat: /\b\d{3}[-.]?\d{3}[-.]?\d{4}\b/g },
+    { name: 'ip_address', pat: /\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g },
+  ];
+  lines.forEach((line, idx) => {
+    if (line.trim().startsWith('//') || line.includes('description')) return;
+    if (line.includes('regex') || line.includes('pattern') || line.includes('pat:')) return;
+    for (const pp of personalPatterns) {
+      pp.pat.lastIndex = 0;
+      if (pp.pat.test(line)) {
+        findings.push({
+          type: 'personal_data',
+          subtype: pp.name,
+          line: idx + 1,
+          preview: line.trim().substring(0, 100),
+        });
+      }
+    }
+  });
+
+  // 3. Check for internal naming that should be generic
+  const internalTerms = [
+    'family-data', 'family-home', 'family-logs', 'family-roles',
+    'family-guide', 'family-status', 'family-workers',
+    'PAPA_FULL', 'PAPA_READ', 'ARTHUR_CHAT_ID',
+  ];
+  lines.forEach((line, idx) => {
+    if (line.trim().startsWith('//')) return;
+    if (line.includes('description:') || line.includes('context:') || line.includes('tagline:')) return;
+    if (line.includes('origin_story')) return;
+    for (const term of internalTerms) {
+      if (line.toLowerCase().includes(term.toLowerCase()) &&
+          !line.includes('// ')) {
+        findings.push({
+          type: 'internal_naming',
+          term: term,
+          line: idx + 1,
+          preview: line.trim().substring(0, 100),
+        });
+      }
+    }
+  });
+
+  // 4. GATE: Block publish if critical findings
+  const critical = findings.filter(f =>
+    f.type === 'personal_data' ||
+    (f.type === 'hardcoded_path' && !f.preview.includes('description'))
+  );
+
+  return {
+    status: findings.length === 0 ? 'ready_to_publish' :
+            critical.length > 0 ? 'BLOCKED_critical_findings' : 'warnings_only',
+    total_findings: findings.length,
+    critical_count: critical.length,
+    findings: findings,
+    recommendation: critical.length > 0 ?
+      'DO NOT PUBLISH. Fix critical findings first.' :
+      findings.length > 0 ?
+      'Review warnings before publishing. None are blockers.' :
+      'Clean. Safe to publish.'
+  };
+}
+
 // ============================================================
 // Handle tool calls
 // ============================================================
@@ -1672,6 +1887,10 @@ function handleToolCall(name, args) {
       return runPageHealth(args.page || 'all');
     }
 
+    case 'pre_publish_audit': {
+      return runPrePublishAudit(args.source_file);
+    }
+
     default:
       return { error: 'Unknown tool' };
   }
@@ -1793,7 +2012,7 @@ const server = http.createServer((req, res) => {
   // Health check
   if (req.method === 'GET' && url.pathname === '/health') {
     res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ status: 'ok', service: 'nervous-system-mcp', version: '1.5.0', protocol: MCP_VERSION }));
+    res.end(JSON.stringify({ status: 'ok', service: 'nervous-system-mcp', version: '1.6.0', protocol: MCP_VERSION }));
     return;
   }
 
@@ -1910,7 +2129,7 @@ const server = http.createServer((req, res) => {
     res.writeHead(200, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({
       name: 'The Nervous System MCP Server',
-      version: '1.5.1',
+      version: '1.6.0',
       protocol: MCP_VERSION,
       description: 'LLM behavioral enforcement framework. 7 core rules, preflight checks, session handoffs, worklogs, violation logging, kill switch, hash-chained audit, and forced reflection cycles. Built by Arthur Palyan.',
       endpoints: {
@@ -1932,8 +2151,8 @@ const server = http.createServer((req, res) => {
 migrateExistingViolations();
 
 server.listen(PORT, '127.0.0.1', () => {
-  console.error(`[MCP Server] Nervous System v1.5.1 running on port ${PORT}`);
+  console.error(`[MCP Server] Nervous System v1.6.0 running on port ${PORT}`);
   console.error(`[MCP Server] SSE: /sse | HTTP: /mcp | Health: /health | Kill: POST /kill | Audit: GET /audit/verify | Dispatches: GET /dispatches`);
   console.error(`[MCP Server] Protocol: ${MCP_VERSION}`);
-  console.error(`[MCP Server] Tools: ${TOOLS.length} (including kill switch, audit chain, dispatch, drift audit, page health)`);
+  console.error(`[MCP Server] Tools: ${TOOLS.length} (including kill switch, audit chain, dispatch, drift audit, page health, pre-publish audit)`);
 });

package/nervous-system.config.example.json

@@ -0,0 +1,10 @@
+{
+  "project_root": ".",
+  "data_dir": "./data",
+  "logs_dir": "./logs",
+  "html_dir": "./public",
+  "protected_files_list": "./PROTECTED_FILES.txt",
+  "config_file": "./system-config.json",
+  "pm2_managed": false,
+  "docs_to_audit": []
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mcp-nervous-system",
-  "version": "1.5.1",
-  "description": "The Nervous System - LLM Behavioral Enforcement Framework. 7 mechanically enforced rules, 16 tools including kill switch, audit chain, dispatch, drift audit, security audit, page health, and session close. MCP server for Claude Desktop, Claude Code, and any MCP-compatible client.",
+  "version": "1.6.0",
+  "description": "The Nervous System - LLM Behavioral Enforcement Framework. 7 mechanically enforced rules, 17 tools including kill switch, audit chain, dispatch, drift audit, security audit, page health, pre-publish audit, and session close. MCP server for Claude Desktop, Claude Code, and any MCP-compatible client.",
   "main": "server.js",
   "bin": {
     "mcp-nervous-system": "./stdio.js"
@@ -39,4 +39,4 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0"
   }
-}
+}

package/package.json.bak.1772792496

@@ -0,0 +1,42 @@
+{
+  "name": "mcp-nervous-system",
+  "version": "1.5.1",
+  "description": "The Nervous System - LLM Behavioral Enforcement Framework. 7 mechanically enforced rules, 16 tools including kill switch, audit chain, dispatch, drift audit, security audit, page health, and session close. MCP server for Claude Desktop, Claude Code, and any MCP-compatible client.",
+  "main": "server.js",
+  "bin": {
+    "mcp-nervous-system": "./stdio.js"
+  },
+  "scripts": {
+    "start": "node server.js"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "llm",
+    "ai-safety",
+    "ai-governance",
+    "behavioral-enforcement",
+    "guardrails",
+    "claude",
+    "anthropic",
+    "nervous-system",
+    "kill-switch",
+    "audit-trail"
+  ],
+  "author": "Arthur Palyan <palyanai@gmail.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/levelsofself/mcp-nervous-system"
+  },
+  "homepage": "https://api.100levelup.com/family/gateway.html",
+  "bugs": {
+    "url": "https://github.com/levelsofself/mcp-nervous-system/issues"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0"
+  }
+}

package/package.json.bak.1772792812

@@ -0,0 +1,42 @@
+{
+  "name": "mcp-nervous-system",
+  "version": "1.5.0",
+  "description": "The Nervous System - LLM Behavioral Enforcement Framework. 7 mechanically enforced rules, 16 tools including kill switch, audit chain, dispatch, drift audit, security audit, page health, and session close. MCP server for Claude Desktop, Claude Code, and any MCP-compatible client.",
+  "main": "server.js",
+  "bin": {
+    "mcp-nervous-system": "./stdio.js"
+  },
+  "scripts": {
+    "start": "node server.js"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "llm",
+    "ai-safety",
+    "ai-governance",
+    "behavioral-enforcement",
+    "guardrails",
+    "claude",
+    "anthropic",
+    "nervous-system",
+    "kill-switch",
+    "audit-trail"
+  ],
+  "author": "Arthur Palyan <palyanai@gmail.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/levelsofself/mcp-nervous-system"
+  },
+  "homepage": "https://api.100levelup.com/family/gateway.html",
+  "bugs": {
+    "url": "https://github.com/levelsofself/mcp-nervous-system/issues"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0"
+  }
+}