prism-mcp-server 19.2.8 → 19.2.9

package/dist/tools/sessionDriftHandler.js

@@ -5,7 +5,7 @@
  * (POST /api/v1/prism/memory action=detect_drift) which owns the embedding
  * + detection logic, and returns the structured result.
  *
- * Prism-mcp never does NLP or embedding here — that lives in synalux-private.
+ * Prism-mcp never does NLP or embedding here — that is portal-side.
  */
 import { isSessionDetectDriftArgs } from "./sessionMemoryDefinitions.js";
 import { getStorage } from "../storage/index.js";

package/dist/tools/skillRouting.js

@@ -9,9 +9,8 @@
  *      free-tier / disconnected installations still get the BCBA universal
  *      skill loaded.
  *
- * To change the routing for production, edit
- *   synalux-private/portal/src/app/api/v1/skills/routing/route.ts
- * and deploy synalux. prism-mcp picks up the new config within 5 minutes.
+ * To change the routing for production, edit the portal routing endpoint
+ * and deploy. prism-mcp picks up the new config within 5 minutes.
  *
  * Do NOT add hardcoded skill names here outside the OFFLINE_FALLBACK block
  * — that defeats the single-source-of-truth design.
@@ -28,7 +27,10 @@ const OFFLINE_FALLBACK = {
     user_local: { enabled: false, key_prefix: 'user_skill:' },
 };
 const SYNALUX_BASE = process.env.SYNALUX_BASE_URL || 'https://synalux.ai';
-const CACHE_TTL_MS = 5 * 60 * 1000;
+const LIVE_CACHE_TTL_MS = 5 * 60 * 1000; // 5min for successful fetches
+const FAILURE_BACKOFF_MS = 30_000; // F5 fix: 30s retry after failure (not 5min)
+// F5 fix: track live vs fallback separately so a transient failure doesn't
+// negative-cache the full routing table for 5 minutes, dropping 19 skills.
 let cached = null;
 let inflight = null;
 async function fetchOnce() {
@@ -51,7 +53,9 @@ async function fetchOnce() {
         return body;
     }
     catch {
-        return OFFLINE_FALLBACK;
+        // On failure: return the last live table (stale-while-revalidate) or OFFLINE_FALLBACK.
+        // The caller marks this as isLive=false so it retries after FAILURE_BACKOFF_MS, not 5min.
+        return cached?.table ?? OFFLINE_FALLBACK;
     }
 }
 /**
@@ -68,15 +72,21 @@ function normalizeEntry(entry, defaultPriority) {
 }
 export async function resolveSkillsForProject(project) {
     const now = Date.now();
-    if (!cached || now - cached.fetchedAt > CACHE_TTL_MS) {
+    // F5 fix: use shorter backoff TTL after failures so a 30s synalux hiccup doesn't
+    // lock the session into OFFLINE_FALLBACK for 5 minutes.
+    const ttl = (cached?.isLive ?? true) ? LIVE_CACHE_TTL_MS : FAILURE_BACKOFF_MS;
+    if (!cached || now - cached.fetchedAt > ttl) {
         if (!inflight) {
             inflight = fetchOnce().then((table) => {
-                cached = { table, fetchedAt: Date.now() };
+                // isLive = true only when we got a live response (not stale cache / OFFLINE_FALLBACK)
+                const isLive = table !== OFFLINE_FALLBACK && table !== cached?.table;
+                cached = { table, fetchedAt: Date.now(), isLive };
                 return table;
             }).finally(() => { inflight = null; });
         }
         await inflight;
     }
+    const isOffline = !(cached?.isLive ?? false);
     const table = cached.table;
     const seen = new Set();
     const skills = [];
@@ -104,6 +114,7 @@ export async function resolveSkillsForProject(project) {
         names: skills.map(s => s.name),
         skills,
         user_local: table.user_local ?? OFFLINE_FALLBACK.user_local,
+        isOffline,
     };
 }
 /**
@@ -113,10 +124,12 @@ export async function resolveSkillsForProject(project) {
  */
 export async function resolveSkillsForPrompt(prompt, baseSkills = []) {
     const now = Date.now();
-    if (!cached || now - cached.fetchedAt > CACHE_TTL_MS) {
+    const ttl = (cached?.isLive ?? true) ? LIVE_CACHE_TTL_MS : FAILURE_BACKOFF_MS;
+    if (!cached || now - cached.fetchedAt > ttl) {
         if (!inflight) {
             inflight = fetchOnce().then((table) => {
-                cached = { table, fetchedAt: Date.now() };
+                const isLive = table !== OFFLINE_FALLBACK && table !== cached?.table;
+                cached = { table, fetchedAt: Date.now(), isLive };
                 return table;
             }).finally(() => { inflight = null; });
         }

package/dist/utils/entitlements.js

@@ -93,6 +93,15 @@ async function fetchEntitlements() {
                 return cache.entitlements;
             return FREE_ENTITLEMENTS;
         }
+        // Normalize legacy ceiling values to the current fleet.
+        if (data.model_ceiling === "14b") {
+            debugLog("[entitlements] grandfathered 14b ceiling → 9b");
+            data.model_ceiling = "9b";
+        }
+        if (data.model_ceiling === "32b") {
+            debugLog("[entitlements] grandfathered 32b ceiling → 27b");
+            data.model_ceiling = "27b";
+        }
         debugLog(`[entitlements] plan=${data.plan} ceiling=${data.model_ceiling} ` +
             `daily=${data.daily_infer_limit} max_tokens=${data.max_tokens}`);
         return data;

package/dist/utils/inferenceMetrics.js

@@ -1,20 +1,40 @@
 /**
  * Inference metrics — local accumulator for user-facing display.
  *
- * The local accumulator is the SOLE source for the session metrics block
- * shown in session_save_ledger/handoff. It tracks what THIS prism process
- * did THIS session — prism is the natural and only complete source for
- * this data (the portal only sees what prism forwards).
+ * Tracks what THIS prism process did THIS session. Portal forwarding
+ * (ddLog) is a separate best-effort stream — display never depends on it.
  *
- * Portal forwarding (ddLog → /api/v1/telemetry) is a separate, best-effort
- * analytics stream that the display path never depends on. If the portal
- * is down, unconfigured, or the token is missing, users still see metrics.
+ * T1 fix: content-aware chars/token estimator (was flat /4, biased for
+ *   emoji-dense/code/CJK payloads by 15–40%).
+ * T2 fix: dual-column prompt tokens — `evaluated` (Ollama actual) vs
+ *   `submittedEst` (estimated submitted, including KV-cached prefixes).
+ *   Ollama returns prompt_eval_count=0 for cached prompts, so "evaluated"
+ *   undercounts on repeated system-prompt calls; submittedEst shows actual load.
  */
 import { debugLog } from "./logger.js";
+// T1 fix: content-aware token estimator. Replaces flat text.length / 4 which
+// underestimates emoji (~2 UTF-16 units but 1.5-2.5 BPE tokens) and CJK
+// (~1 char ≈ 1 token) by 15-40%, and overestimates dense code (~3.3 chars/token).
+export function estimateTokens(text) {
+    if (!text)
+        return 0;
+    const cjkCount = (text.match(/[　-鿿豈-﫿]/g) ?? []).length;
+    const emojiCount = (text.match(/[\u{1F000}-\u{1FFFF}]/gu) ?? []).length;
+    // Code density check: >2% of chars are code punctuation → use code divisor
+    const codePunct = (text.match(/[`{};\[\]=>|#@$%^&*\\]/g) ?? []).length;
+    const isCode = text.length > 0 && codePunct / text.length > 0.02;
+    // UTF-16 length minus CJK and emoji codepoints (emoji are 2 units each)
+    const latinLen = text.length - cjkCount - emojiCount * 2;
+    const latinTokens = latinLen / (isCode ? 3.3 : 4.0);
+    const cjkTokens = cjkCount; // ~1 token per CJK char
+    const emojiTokens = emojiCount * 1.5; // ~1.5 BPE tokens per emoji
+    return Math.ceil(Math.max(0, latinTokens) + cjkTokens + emojiTokens);
+}
 const byModel = {};
 let localCalls = 0;
 let cloudCalls = 0;
-let totalPromptTokens = 0;
+let promptTokensEvaluated = 0;
+let promptTokensSubmittedEst = 0;
 let totalCompletionTokens = 0;
 let totalLatencyMs = 0;
 export function recordInference(result) {
@@ -27,16 +47,35 @@ export function recordInference(result) {
     else {
         localCalls++;
     }
-    const pt = result.prompt_tokens ?? 0;
+    const evaluated = result.prompt_tokens ?? 0;
     const ct = result.completion_tokens ?? 0;
-    totalPromptTokens += pt;
+    // T2: when Ollama returns 0 evaluated (KV-cache hit), estimate submitted tokens
+    // from the prompt text/length so submittedEst reflects actual context load.
+    let submittedEst = evaluated; // default: evaluated is the best estimate
+    if (evaluated === 0 && !result.used_cloud) {
+        if (result.prompt_text) {
+            submittedEst = estimateTokens(result.prompt_text);
+        }
+        else if (result.prompt_length && result.prompt_length > 0) {
+            submittedEst = Math.ceil(result.prompt_length / 4); // flat fallback without text
+        }
+    }
+    promptTokensEvaluated += evaluated;
+    promptTokensSubmittedEst += submittedEst;
     totalCompletionTokens += ct;
     totalLatencyMs += result.latency_ms;
     if (!byModel[key]) {
-        byModel[key] = { calls: 0, promptTokens: 0, completionTokens: 0, totalLatencyMs: 0 };
+        byModel[key] = {
+            calls: 0,
+            promptTokensEvaluated: 0,
+            promptTokensSubmittedEst: 0,
+            completionTokens: 0,
+            totalLatencyMs: 0,
+        };
     }
     byModel[key].calls++;
-    byModel[key].promptTokens += pt;
+    byModel[key].promptTokensEvaluated += evaluated;
+    byModel[key].promptTokensSubmittedEst += submittedEst;
     byModel[key].completionTokens += ct;
     byModel[key].totalLatencyMs += result.latency_ms;
 }
@@ -52,9 +91,10 @@ export function getInferenceSnapshot() {
         totalCalls: total,
         localPct: total > 0 ? Math.round((localCalls / total) * 100) : 0,
         cloudPct: total > 0 ? 100 - Math.round((localCalls / total) * 100) : 0,
-        totalPromptTokens,
+        promptTokensEvaluated,
+        promptTokensSubmittedEst,
         totalCompletionTokens,
-        totalTokens: totalPromptTokens + totalCompletionTokens,
+        totalTokens: promptTokensSubmittedEst + totalCompletionTokens,
         avgLatencyMs: total > 0 ? Math.round(totalLatencyMs / total) : 0,
         byModel: modelCopy,
     };
@@ -62,7 +102,8 @@ export function getInferenceSnapshot() {
 export function resetInferenceMetrics() {
     localCalls = 0;
     cloudCalls = 0;
-    totalPromptTokens = 0;
+    promptTokensEvaluated = 0;
+    promptTokensSubmittedEst = 0;
     totalCompletionTokens = 0;
     totalLatencyMs = 0;
     for (const key of Object.keys(byModel)) {
@@ -75,27 +116,54 @@ export async function inferenceMetricsHandler() {
     return {
         content: [{
                 type: "text",
-                text: block || "No prism_infer calls this session. Metrics track local-model delegation only — not the host model's (Claude's) token spend.",
+                text: block || "No prism_infer calls this session.\n" +
+                    "📊 Delegation Metrics track local-model delegation — not the host model's (Claude's) spend.",
             }],
     };
 }
-export function formatInferenceMetrics() {
+/**
+ * Format inference metrics.
+ *
+ * @param compact - When true, returns a single-line footer for appending to
+ *   prism_infer responses. Output is threshold-gated: only emits every
+ *   PRISM_METRICS_EVERY calls (default 5) so it doesn't drown per-response output.
+ *   When false (default), returns the full multi-line block used by the explicit
+ *   inference_metrics tool.
+ */
+export function formatInferenceMetrics(compact = false) {
     const snap = getInferenceSnapshot();
     if (snap.totalCalls === 0)
         return "";
+    if (compact) {
+        // Threshold gate: only emit every N calls so the footer is periodic, not per-call noise.
+        // The per-call header already shows backend/model/latency; this is the session rollup.
+        const every = parseInt(process.env["PRISM_METRICS_EVERY"] ?? "5", 10);
+        // Always emit on the first call (totalCalls===1) so short sessions (1–4 calls)
+        // see at least one rollup. Otherwise emit every N calls as the rolling summary.
+        if (snap.totalCalls !== 1 && snap.totalCalls % every !== 0)
+            return "";
+        return `📊 local ${snap.localCalls} (${snap.localPct}%) · cloud ${snap.cloudCalls} (${snap.cloudPct}%) · ~${snap.totalTokens.toLocaleString()} tok · avg ${snap.avgLatencyMs}ms`;
+    }
+    // Full multi-line block (explicit inference_metrics tool call).
+    // T2: show both evaluated (Ollama actual) and submitted estimate.
+    // When they differ, the gap is KV-cached prompt tokens (real load, not counted by Ollama).
+    const promptLine = snap.promptTokensEvaluated !== snap.promptTokensSubmittedEst
+        ? `  Prompt tokens: ${snap.promptTokensEvaluated.toLocaleString()} evaluated / ${snap.promptTokensSubmittedEst.toLocaleString()} submitted est.`
+        : `  Prompt tokens: ${snap.promptTokensEvaluated.toLocaleString()}`;
     const lines = [
-        `\n📊 Inference Metrics — local-model delegation (this session):`,
+        `\n📊 Delegation Metrics — local-model calls this session (not host model spend):`,
         `  Total calls: ${snap.totalCalls} — Local: ${snap.localCalls} (${snap.localPct}%) | Cloud: ${snap.cloudCalls} (${snap.cloudPct}%)`,
-        `  Tokens: ${snap.totalPromptTokens.toLocaleString()} in + ${snap.totalCompletionTokens.toLocaleString()} out = ${snap.totalTokens.toLocaleString()} total`,
+        promptLine,
+        `  Completion tokens: ${snap.totalCompletionTokens.toLocaleString()}`,
         `  Avg latency: ${snap.avgLatencyMs}ms`,
     ];
     const models = Object.entries(snap.byModel).sort((a, b) => b[1].calls - a[1].calls);
     if (models.length > 1) {
         lines.push(`  By model:`);
         for (const [name, stats] of models) {
-            const tokens = stats.promptTokens + stats.completionTokens;
+            const tokens = stats.promptTokensSubmittedEst + stats.completionTokens;
             const avgMs = stats.calls > 0 ? Math.round(stats.totalLatencyMs / stats.calls) : 0;
-            lines.push(`    ${name}: ${stats.calls} calls, ${tokens.toLocaleString()} tokens, avg ${avgMs}ms`);
+            lines.push(`    ${name}: ${stats.calls} calls, ${tokens.toLocaleString()} tokens est., avg ${avgMs}ms`);
         }
     }
     return lines.join("\n");

package/dist/utils/layer1.js

@@ -0,0 +1,110 @@
+/**
+ * Layer 1 semantic pre-classifier for prism_infer.
+ * ─────────────────────────────────────────────────────────────
+ * Calls dcostenco/prism-coder:4b via Ollama to classify whether
+ * a prompt is OBVIOUS_RESERVED, OBVIOUS_NOT_RESERVED, or UNCERTAIN.
+ *
+ * Fail-closed contract:
+ *   OBVIOUS_NOT_RESERVED → the ONLY verdict that permits local routing
+ *   OBVIOUS_RESERVED     → escalate to cloud
+ *   UNCERTAIN            → escalate to cloud (conservative)
+ *   ERROR                → escalate to cloud (never fail-open)
+ *
+ * The prompt below is VERBATIM from §E of prism-infer-boundaries/SKILL.md.
+ * It is duplicated here (not imported) because prism is a thin client with no
+ * access to the skills tree at runtime. A drift test asserts byte-for-byte match.
+ *
+ * Must not run when mode="route" and max_tokens<=16 — that IS a Layer 1 call.
+ */
+// VERBATIM — §E prism-infer-boundaries/SKILL.md. Do not edit without re-running eval-layer1.mjs.
+export const LAYER1_PROMPT = `Classify this request with exactly one word: OBVIOUS_RESERVED, OBVIOUS_NOT_RESERVED, or UNCERTAIN.
+
+OBVIOUS_RESERVED — clearly involves:
+- Behavioral crisis: de-escalation, meltdown management, rage episode, violent behavior response
+- Physical restraint, holds, containment, physical management of clients
+- Self-harm: client bites/hits/scratches/bangs self, draws blood, injures self
+- Suicide, homicide, harm to self or others, safety planning
+- Client physical elopement incidents — client ran away, bolted, or escaped (with prior documented incidents)
+- Writing auth/login/JWT/token/session validation code
+- Determining if code bypasses auth or allows unauthenticated access
+- Assessing whether code actually exposes PHI or constitutes a HIPAA violation
+- Whether to push, ship, deploy, or block a production release
+- Diagnosis code assignment
+
+OBVIOUS_NOT_RESERVED — general coding, code review, analysis, documentation, test generation, data processing.
+
+UNCERTAIN — if the request touches reserved vocabulary but the task is non-security, non-clinical operational work (e.g., deleting or renaming a file, adding a non-auth data field to a form, reviewing existing code for dead exports or hook order) rather than writing clinical safety protocols, implementing auth or security code, making push or deploy decisions, or determining compliance.
+
+Request: "{prompt}"
+
+Answer (one word):`;
+const VALID = new Set([
+    "OBVIOUS_RESERVED",
+    "OBVIOUS_NOT_RESERVED",
+    "UNCERTAIN",
+]);
+/**
+ * Parse the model's raw text into a verdict. Extracts the first token of
+ * letters/underscores (ignoring leading punctuation, quotes, whitespace).
+ * Anything not in the valid set → ERROR, which the caller escalates.
+ * Note: OBVIOUS_NOT_RESERVED contains "RESERVED" as a substring — whole-token
+ * matching via Set prevents the substring trap from inverting the gate.
+ */
+export function parseLayer1(raw) {
+    if (!raw)
+        return "ERROR";
+    const m = raw.trim().toUpperCase().match(/[A-Z_]+/);
+    if (!m)
+        return "ERROR";
+    const token = m[0];
+    return VALID.has(token) ? token : "ERROR";
+}
+// p95 measured 484–511ms on warm 4b; 1500ms is a generous ceiling that still
+// fails closed on model stall without blocking the handler for too long.
+const LAYER1_TIMEOUT_MS = 1_500;
+/**
+ * Run the Layer 1 classifier. Returns a verdict; never throws.
+ * On ANY failure path returns "ERROR" so the caller escalates to cloud.
+ *
+ * @param userPrompt  the end-user prompt being classified (NOT the LAYER1_PROMPT)
+ * @param ollamaUrl   Ollama base URL
+ * @param model       classifier model tag (caller-resolved via resolveOllamaName)
+ * @param fetchImpl   injected for tests; defaults to global fetch
+ */
+export async function callLayer1(userPrompt, ollamaUrl, model, fetchImpl = fetch) {
+    if (!userPrompt || !userPrompt.trim())
+        return "ERROR";
+    let res;
+    try {
+        res = await fetchImpl(`${ollamaUrl}/api/chat`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                model,
+                messages: [
+                    { role: "user", content: LAYER1_PROMPT.replace("{prompt}", userPrompt) },
+                ],
+                stream: false,
+                think: false,
+                options: { num_predict: 16, temperature: 0 },
+            }),
+            signal: AbortSignal.timeout(LAYER1_TIMEOUT_MS),
+        });
+    }
+    catch {
+        return "ERROR";
+    }
+    if (!res.ok)
+        return "ERROR";
+    let data;
+    try {
+        data = await res.json();
+    }
+    catch {
+        return "ERROR";
+    }
+    if (data?.error)
+        return "ERROR";
+    const text = data?.message?.content;
+    return parseLayer1(text);
+}

package/dist/utils/projectResolver.js

@@ -2,8 +2,7 @@
  * Prism Project Resolver — Local Storage Variant
  * ================================================
  *
- * Same contract as the synalux portal resolver
- * (synalux-private/portal/src/lib/prism-project-resolver.ts) but
+ * Same contract as the Synalux portal resolver but
  * sources the project registry from local prism-config.db settings
  * (`repo_path:<project>` keys) instead of the `prism_projects`
  * Supabase table.
@@ -13,8 +12,7 @@
  * portal resolver becomes authoritative and this one becomes a noop
  * for the same write.
  *
- * Background: see synalux-private project ledger entry
- * 2026-04-30-thin-client-architecture-directive — the prism-aac
+ * Background: thin-client architecture directive 2026-04-30 — the prism-aac
  * Azure-leak memory-loss bug was caused by the absence of this
  * validation.
  */

package/dist/utils/qualityGate.js

@@ -7,19 +7,29 @@
  *
  * Returns: { pass: boolean, reason?: string }
  */
+/**
+ * Signal 5 — Tool-call bleed: pipe-delimited format leaking into non-tool turns.
+ * Matches <|tool_call|> and <|tool_call_end|> only — NOT angle-bracket <tool_call> variants
+ * (those are normalized by normalizeToolCallFormat, not gated as failures).
+ */
+export const TOOL_CALL_BLEED_RE = /<\|tool_call\|>|<\|tool_call_end\|>/;
 /**
  * Check if a model response passes the quality gate.
  * @param stripped  Response AFTER think-stripping (use stripThink first)
  * @param thinkOnly  True if the response was only <think> blocks with no answer
  * @param finishReason  Ollama's finish_reason if available (e.g. "length" = truncated)
+ * @param mode  Inference mode — "route" uses length===0 floor; "code"/"chat" keep <5
  */
-export function passesQualityGate(stripped, thinkOnly, finishReason) {
+export function passesQualityGate(stripped, thinkOnly, finishReason, mode) {
     // Signal 1: Think-only — model reasoned but produced no answer (check before empty)
     if (thinkOnly) {
         return { pass: false, reason: "think_only" };
     }
-    // Signal 2: Empty or near-empty after stripping
-    if (stripped.trim().length < 5) {
+    // Signal 2: Mode-aware empty floor.
+    // Route legitimately returns 1–4 char labels ("P1", "YES", "CO4", "FIXED").
+    // Use length===0 for route; keep <5 for code/chat where single-word answers are invalid.
+    const emptyFloor = mode === "route" ? 0 : 4;
+    if (stripped.trim().length <= emptyFloor) {
         return { pass: false, reason: "empty_response" };
     }
     // Signal 3: Hard truncation — Ollama reports finish_reason="length"
@@ -27,6 +37,12 @@ export function passesQualityGate(stripped, thinkOnly, finishReason) {
     if (finishReason === "length") {
         return { pass: false, reason: "hard_truncation" };
     }
+    // Signal 5: Tool-call bleed — fine-tuned 4b emits <|tool_call|> format in non-tool turns.
+    // Pipe-delimited format only; angle-bracket variants are handled by normalizeToolCallFormat.
+    // False-positive guard: requires the literal pipe tokens, not the words "tool call".
+    if (TOOL_CALL_BLEED_RE.test(stripped)) {
+        return { pass: false, reason: "tool_call_bleed" };
+    }
     // Signal 4: Exact-loop detection (two passes).
     //
     // Pass A (prose-only, threshold ≥3): strip structural markdown that

package/dist/utils/safetyGate.js

@@ -56,6 +56,26 @@ const MEDICAL_INPUT_RE = [
     /(?:how\s+much|what\s+dose)\s+.*(?:should\s+I|do\s+I|can\s+I)\s+(?:inject|take|give)/i,
     /(?:dose|dosage)\s+(?:should\s+I|do\s+I|can\s+I)\s+(?:inject|take|give)/i,
 ];
+// ── Output: BCBA reserved category — physical management / restraint / seclusion ─
+//
+// These patterns are a BACKSTOP (Option 1) — high-precision/low-recall.
+// The structural safety mechanism is Option 4: consequence/crisis sections of BIPs
+// never generate locally. These regexes catch the obvious cases if section-routing fails.
+// They do NOT substitute for the structural gate; euphemistic phrasings ("guide the client
+// firmly to the floor") pass through, so the structural gate is the primary control.
+const BCBA_OUTPUT_RE = [
+    // Explicit restraint technique names
+    /\b(?:prone|supine|basket|therapeutic|manual)\s+(?:hold|restraint)\b/i,
+    /\btwo[-\s]?person\s+(?:hold|restraint)\b/i,
+    /\bphysical\s+(?:intervention|management|restraint)\b/i,
+    // Seclusion
+    /\bseclusion\s+(?:room|protocol|procedure|space)\b/i,
+    /\bplace\s+(?:the\s+)?client\s+in\s+(?:a\s+)?(?:seclusion|hold|timeout\s+room)\b/i,
+    // Staff-instruction framing (high-precision: requires staff + restraint verb + client)
+    /\bstaff\s+(?:should|must|will)\s+(?:physically\s+)?(?:hold|restrain|manage)\s+(?:the\s+)?client\b/i,
+    /\bcaregiver\s+(?:should|must|will)\s+(?:physically\s+)?(?:hold|restrain|manage)\s+(?:the\s+)?client\b/i,
+];
+export const BCBA_RESPONSE = "This output contains physical management content (restraint, hold, or seclusion procedure). Consequence strategy and crisis/safety sections require cloud review — they cannot generate locally per BCBA clinical standards. Escalating to cloud.";
 // ── Output: model providing dangerous instructions ───────────────────────────
 const CRISIS_OUTPUT_RE = [
     /\bhow many pills\s+to\b/i,
@@ -96,6 +116,8 @@ export function checkInputSafety(text) {
 }
 export function checkOutputSafety(response) {
     const r = normalize(response);
+    if (BCBA_OUTPUT_RE.some(re => re.test(r)))
+        return BCBA_RESPONSE;
     if (CRISIS_OUTPUT_RE.some(re => re.test(r)))
         return CRISIS_RESPONSE;
     if (MEDICAL_OUTPUT_RE.some(re => re.test(r)))

package/dist/vm/competitorImport.js

@@ -13,7 +13,7 @@
  *   - Eclipse
  *   - Flutter/Dart
  *
- * BOUNDARY: Interfaces only — implementations in synalux-private.
+ * BOUNDARY: Interfaces only — implementations are portal-side.
  */
 export const COMPETITOR_PLATFORMS = [
     {

package/dist/vm/componentMarketplace.js

@@ -9,7 +9,7 @@
  *   - License enforcement and revenue sharing
  *   - Category-based discovery and search
  *
- * BOUNDARY: Interfaces only — implementations in synalux-private.
+ * BOUNDARY: Interfaces only — implementations are portal-side.
  */
 export const MARKETPLACE_TIERS = {
     free: {

package/dist/vm/creativeStudio.js

@@ -8,7 +8,7 @@
  *   - Audio generation and production
  *   - All tier-gated through Synalux subscription
  *
- * BOUNDARY: Interfaces only — implementations in synalux-private.
+ * BOUNDARY: Interfaces only — implementations are portal-side.
  */
 export const CREATIVE_STUDIO_TIERS = {
     free: {

package/dist/vm/ethicsEnforcement.js

@@ -14,7 +14,7 @@
  *   5. KILL SWITCH         — instant account suspension (remote, irreversible)
  *   6. AUDIT TRAIL         — tamper-proof logging for compliance investigations
  *
- * BOUNDARY: Interfaces only — implementations in synalux-private.
+ * BOUNDARY: Interfaces only — implementations are portal-side.
  */
 /** Default prohibited use policy — hardcoded, cannot be overridden per-tenant */
 export const PROHIBITED_USE_POLICY = {
@@ -122,7 +122,7 @@ export const DEFAULT_USE_CASE_SCREENING = {
     human_review_queue: true,
     re_screening_interval_days: 30,
     prohibited_dependencies: [
-        // Placeholder patterns — real list maintained in synalux-private
+        // Placeholder patterns — see portal-side ethics enforcement config
         '@military/*', 'defense-*', 'weapon-*', 'surveillance-*',
     ],
     government_domain_patterns: [

package/dist/vm/gameEngine.js

@@ -15,7 +15,7 @@
  *   - Cross-platform build matrix
  *   - Plugin/SDK sandbox
  *
- * BOUNDARY: Interfaces only — implementations in synalux-private.
+ * BOUNDARY: Interfaces only — implementations are portal-side.
  */
 /** Preset memory budgets for common platforms */
 export const MEMORY_BUDGETS = {

package/dist/vm/projectTemplates.js

@@ -8,7 +8,7 @@
  *   - Creative projects (3D visualization, VR experience, etc.)
  *   - Enterprise (dashboards, APIs, microservices)
  *
- * BOUNDARY: Interfaces only — implementations in synalux-private.
+ * BOUNDARY: Interfaces only — implementations are portal-side.
  */
 // ══════════════════════════════════════════════════════════════════
 // 2. GAME TEMPLATES

package/dist/vm/types.js

@@ -7,8 +7,7 @@
  *
  * Only interfaces live in Prism — implementations stay in Synalux.
  *
- * @see synalux-private/portal/src/lib/vm-manager.ts
- * @see synalux-private/portal/src/lib/device-registry.ts
+ * @see Synalux portal — vm-manager, device-registry
  */
 /** Preset network conditions for load testing */
 export const NETWORK_PRESETS = {

package/dist/vm/vmManager.js

@@ -2,7 +2,7 @@
  * VM Manager — Prism IDE Hypervisor Abstraction
  * ==============================================
  * Interface layer for VM lifecycle management.
- * Implementations live in Synalux (synalux-private/portal/src/lib/vm-manager.ts).
+ * Implementations are portal-side (Synalux VM manager).
  *
  * Supports:
  * - VM creation from built-in templates or custom specs

package/dist/vm/workspaceLicensing.js

@@ -9,7 +9,7 @@
  * Required because the marketplace allows building, distributing, and selling apps.
  * License compliance is enforced at build, deploy, and publish time.
  *
- * BOUNDARY: Interfaces only — implementations in synalux-private.
+ * BOUNDARY: Interfaces only — implementations are portal-side.
  */
 /** Workspace license presets */
 export const WORKSPACE_LICENSE_PRESETS = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "19.2.8",
+  "version": "19.2.9",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Prism Coder — Cognitive memory + tool-calling intelligence for AI agents. Mind Palace persistent memory (BFCL Gold Certified, 100% Tool-Call Accuracy, 114 Agent Skills, PHI Guard, Tier Enforcement, Prompt-Based Skill Routing, Zero-Search HDC/HRR retrieval, HRR Semantic Drift Detection across BCBA/Coding/AAC domains, HIPAA-hardened local-first storage, SLERP-optimized GRPO alignment) plus the prism-coder 1.7B–32B open-weights LLM fleet.",
   "module": "index.ts",