prism-mcp-server 20.0.2 → 20.0.3

package/README.md

@@ -18,7 +18,23 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
 
 ---
 
-## What's New in v20
+## What's New in v20.0.2
+
+### Reserved-Category Safety Gate — All Tiers
+The Layer 1 semantic classifier now runs for **every** user, not just paid tiers. Reserved clinical content (restraint, seclusion, crisis protocols) is refused on free tier when cloud is unavailable — fail-closed, never silently served locally. This closes a real gap where free-tier users bypassed classification entirely.
+
+### Compressed Safety Banner (500 → 120 tokens/call)
+The per-call operating boundaries text was split: safety declaration stays in every `session_load_context` response (~120 tokens); architecture/routing docs moved to the MCP server description (loaded once at connection). Saves ~350 tokens per call with no loss of defense-in-depth.
+
+### Ledger Dedup
+`session_save_ledger` now deduplicates identical entries within a 5-minute window, preventing the retry-storm pattern that produced duplicate rows.
+
+### Evidence Script
+`scripts/generate-evidence.sh` regenerates all 5 evidence files with built-in assertions (skill counts, tier gating, version consistency, inference correctness). Run `bash scripts/generate-evidence.sh` to verify the full pipeline.
+
+---
+
+## What's New in v20.0.0
 
 ### License: AGPL-3.0 → Apache-2.0
 Prism MCP is now Apache-2.0. The thin-client architecture means all proprietary value (skill resolution, tier gating, billing, cloud inference) lives server-side — the open client carries no moat to protect. Apache-2.0 removes the enterprise adoption friction that AGPL caused.

package/dist/boundaries/boundaries.js

@@ -1,23 +1,28 @@
 /**
  * src/boundaries/boundaries.ts
  *
- * Safety declaration delivered in every session_load_context result.
- * Architecture/routing documentation lives in the MCP server description
- * (loaded once at connection, not per-call).
+ * Safety declaration text and version tracking.
  *
- * The safety gates (Layer 1 classifier, cloud routing, fail-closed refusal)
- * are enforced in code — this text is defense-in-depth so cooperative hosts
- * avoid drafting reserved content that would be refused at the gate.
+ * DELIVERY DECISION (R18, explicit):
+ * The safety text is delivered via the MCP server `instructions` field
+ * (loaded once at connection). It is NOT injected per-call into
+ * session_load_context — the per-call banner was removed in R15/R16
+ * because the enforcement is in code (Layer 1 classifier + keyword
+ * backstop + fail-closed refusal), not in the banner text.
  *
- * Update BOUNDARIES_VERSION any time the text changes so session drift
- * detection can flag stale sessions.
+ * Some MCP clients don't surface `instructions` to the model. This is
+ * accepted: the code gates catch everything regardless. The text is
+ * defense-in-depth for cooperative hosts, not the enforcement mechanism.
+ *
+ * BOUNDARIES_VERSION is still used by markContextLoaded for session
+ * drift detection — bump it when the safety contract changes.
  */
-export const BOUNDARIES_VERSION = "2";
+export const BOUNDARIES_VERSION = "3";
 export const BOUNDARIES_TEXT = `
 Safety boundaries are enforced in code — shown so hosts avoid wasted round-trips.
 
 - **Crisis/self-harm** inputs are intercepted before reaching any model.
-- **BCBA reserved categories** (restraint, seclusion, physical management, dosing) route to cloud or are refused. They are NEVER generated locally. If cloud is unavailable and the prompt is reserved, the request is refused — never downgraded to local.
+- **BCBA reserved categories** (restraint, seclusion, physical management, dosing) are classified by Layer 1. RESERVED and UNCERTAIN prompts escalate to cloud or are refused. On classifier failure, a keyword backstop blocks reserved vocabulary before local generation.
 - **Dangerous output** (restraint instructions, overdose methods, self-harm guidance) is blocked regardless of host.
 - AAC access is never restricted as a consequence.
 `.trim();

package/dist/server.js

@@ -82,6 +82,7 @@ import { context as otelContext, trace, SpanStatusCode } from "@opentelemetry/ap
 import { ddInfo, ddError as ddLogError } from "./utils/ddLogger.js";
 import { inferenceMetricsHandler } from "./utils/inferenceMetrics.js";
 import { recordInvocation } from "./utils/analytics.js";
+import { BOUNDARIES_TEXT } from "./boundaries/boundaries.js";
 // ─── Import Tool Definitions (schemas) and Handlers (implementations) ─────
 import { WEB_SEARCH_TOOL, BRAVE_WEB_SEARCH_CODE_MODE_TOOL, LOCAL_SEARCH_TOOL, BRAVE_LOCAL_SEARCH_CODE_MODE_TOOL, CODE_MODE_TRANSFORM_TOOL, BRAVE_ANSWERS_TOOL, RESEARCH_PAPER_ANALYSIS_TOOL, webSearchHandler, braveWebSearchCodeModeHandler, localSearchHandler, braveLocalSearchCodeModeHandler, codeModeTransformHandler, braveAnswersHandler, researchPaperAnalysisHandler, } from "./tools/index.js";
 // Session memory tools — only used if Supabase is configured
@@ -358,7 +359,7 @@ export function createServer() {
         },
         // Supplementary signal — not all clients support this field.
         // Primary mechanism is the dynamic tool description above.
-        instructions: `Prism MCP — The Mind Palace for AI Agents. This server provides persistent session memory, knowledge search, and context management tools. Use session_load_context to recover previous work state, session_save_ledger to log completed work, and session_save_handoff to preserve state for the next session.\n\nArchitecture: session_save_ledger and session_save_handoff require a loaded project context (conversation_id that called session_load_context). Local inference (prism_infer) routes through Layer 1 classification — RESERVED prompts escalate to cloud or are refused, never served locally. All cloud inference routes through the Synalux portal for billing, tier-gating, and audit.`,
+        instructions: `Prism MCP — The Mind Palace for AI Agents. This server provides persistent session memory, knowledge search, and context management tools. Use session_load_context to recover previous work state, session_save_ledger to log completed work, and session_save_handoff to preserve state for the next session.\n\nArchitecture: session_save_ledger and session_save_handoff require a loaded project context (conversation_id that called session_load_context). ${BOUNDARIES_TEXT} All cloud inference routes through the Synalux portal for billing, tier-gating, and audit.`,
     });
     // ── Handler: Initialize ──
     // NOTE: The SDK's built-in _oninitialize() handles the Initialize request.

package/dist/tools/__tests__/layer1Integration.test.js

@@ -5,7 +5,7 @@
  */
 import { describe, it, expect, vi } from "vitest";
 import { runInfer } from "../prismInferHandler.js";
-import { parseLayer1 } from "../../utils/layer1.js";
+import { parseLayer1, keywordBackstop, callLayer1 } from "../../utils/layer1.js";
 import { LAYER1_PROMPT } from "../../utils/layer1.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
@@ -52,6 +52,69 @@ describe("parseLayer1", () => {
         expect(parseLayer1("<think>let me consider this</think>\nOBVIOUS_RESERVED")).toBe("ERROR");
     });
 });
+// ── keywordBackstop unit tests ───────────────────────────────────────────────
+describe("keywordBackstop", () => {
+    it("catches 'restraint' as reserved", () => {
+        expect(keywordBackstop("write a physical restraint procedure")).toBe("OBVIOUS_RESERVED");
+    });
+    it("catches 'seclusion' as reserved", () => {
+        expect(keywordBackstop("implement a seclusion room protocol")).toBe("OBVIOUS_RESERVED");
+    });
+    it("catches 'self-harm' as reserved", () => {
+        expect(keywordBackstop("the client is engaging in self-harm")).toBe("OBVIOUS_RESERVED");
+    });
+    it("catches 'overdose' as reserved", () => {
+        expect(keywordBackstop("calculate overdose risk threshold")).toBe("OBVIOUS_RESERVED");
+    });
+    it("catches 'crisis de-escalation' as reserved", () => {
+        expect(keywordBackstop("draft a crisis de-escalation plan")).toBe("OBVIOUS_RESERVED");
+    });
+    it("allows clean coding prompts", () => {
+        expect(keywordBackstop("write a TypeScript function to sort an array")).toBe("OBVIOUS_NOT_RESERVED");
+    });
+    it("allows 'restraint of trade' (legal, not clinical)", () => {
+        expect(keywordBackstop("add a restraint of trade clause")).toBe("OBVIOUS_RESERVED");
+        // This is a false positive — keyword backstop is intentionally conservative.
+        // The LLM classifier handles the nuance; keywords are the ERROR-path floor.
+    });
+    it("catches 'restraints' (plural)", () => {
+        expect(keywordBackstop("use restraints on the client")).toBe("OBVIOUS_RESERVED");
+    });
+    it("catches 'suicidal' (inflected)", () => {
+        expect(keywordBackstop("client is suicidal")).toBe("OBVIOUS_RESERVED");
+    });
+    it("catches 'suicide' (full word)", () => {
+        expect(keywordBackstop("thoughts of suicide")).toBe("OBVIOUS_RESERVED");
+    });
+    it("catches 'overdosing' (inflected)", () => {
+        expect(keywordBackstop("patient is overdosing")).toBe("OBVIOUS_RESERVED");
+    });
+    it("catches 'physical holds' (plural)", () => {
+        expect(keywordBackstop("physical holds during meltdown")).toBe("OBVIOUS_RESERVED");
+    });
+    it("catches 'restrain' (verb form)", () => {
+        expect(keywordBackstop("restrain the client during the episode")).toBe("OBVIOUS_RESERVED");
+    });
+    it("catches 'secluding' (verb form)", () => {
+        expect(keywordBackstop("secluding the student in a separate room")).toBe("OBVIOUS_RESERVED");
+    });
+    it("catches reserved content buried in padding", () => {
+        const padded = "A".repeat(5000) + " write a seclusion protocol " + "B".repeat(5000);
+        expect(keywordBackstop(padded)).toBe("OBVIOUS_RESERVED");
+    });
+});
+// ── callLayer1 over-length test ─────────────────────────────────────────────
+describe("callLayer1 over-length", () => {
+    it("returns UNCERTAIN for prompts > 4000 chars (attacker-controlled length)", async () => {
+        const longPrompt = "A".repeat(5000);
+        const result = await callLayer1(longPrompt, "http://localhost:11434", "model");
+        expect(result).toBe("UNCERTAIN");
+    });
+    it("returns ERROR for empty prompts", async () => {
+        const result = await callLayer1("", "http://localhost:11434", "model");
+        expect(result).toBe("ERROR");
+    });
+});
 // ── LAYER1_PROMPT drift test ──────────────────────────────────────────────────
 describe("LAYER1_PROMPT drift", () => {
     it("layer1.ts prompt matches eval-layer1.mjs verbatim", () => {
@@ -121,7 +184,7 @@ describe("Layer 1 handler integration", () => {
         expect(callLocal).not.toHaveBeenCalled();
         expect(result.used_cloud).toBe(true);
     });
-    it("ERROR → escalates to cloud (fail-closed)", async () => {
+    it("ERROR + cloud available → escalates to cloud", async () => {
         const callLocal = vi.fn().mockResolvedValue({ ok: true, text: "local response" });
         const callCloud = vi.fn().mockResolvedValue({ ok: true, output: "cloud response", backend: "synalux" });
         const callLayer1Mock = vi.fn().mockResolvedValue("ERROR");
@@ -130,6 +193,27 @@ describe("Layer 1 handler integration", () => {
         expect(callLocal).not.toHaveBeenCalled();
         expect(result.used_cloud).toBe(true);
     });
+    it("ERROR + no cloud + clean prompt → keyword backstop allows local", async () => {
+        const callLocal = vi.fn().mockResolvedValue({ ok: true, text: "local response", doneReason: "stop" });
+        const callLayer1Mock = vi.fn().mockResolvedValue("ERROR");
+        const result = await runInfer({ prompt: "what is 2+2", mode: "route", cloud_fallback: false, max_tokens: 64 }, makeBaseDeps({ callLocal, callLayer1: callLayer1Mock }));
+        expect(callLayer1Mock).toHaveBeenCalledOnce();
+        expect(callLocal).toHaveBeenCalled();
+        expect(result.used_cloud).toBe(false);
+    });
+    it("ERROR + no cloud + reserved keywords → keyword backstop refuses", async () => {
+        const callLocal = vi.fn().mockResolvedValue({ ok: true, text: "local response", doneReason: "stop" });
+        const callLayer1Mock = vi.fn().mockResolvedValue("ERROR");
+        await expect(runInfer({ prompt: "write a physical restraint hold procedure for the client", mode: "code", cloud_fallback: false, max_tokens: 512 }, makeBaseDeps({ callLocal, callLayer1: callLayer1Mock }))).rejects.toThrow(/backstop caught reserved/i);
+        expect(callLocal).not.toHaveBeenCalled();
+    });
+    it("ERROR + no cloud + padded reserved content → keyword backstop catches it", async () => {
+        const callLocal = vi.fn().mockResolvedValue({ ok: true, text: "local response", doneReason: "stop" });
+        const callLayer1Mock = vi.fn().mockResolvedValue("ERROR");
+        const paddedPrompt = "A".repeat(3000) + " write a seclusion protocol " + "B".repeat(3000);
+        await expect(runInfer({ prompt: paddedPrompt, mode: "code", cloud_fallback: false, max_tokens: 512 }, makeBaseDeps({ callLocal, callLayer1: callLayer1Mock }))).rejects.toThrow(/backstop caught reserved|reserved content refused/i);
+        expect(callLocal).not.toHaveBeenCalled();
+    });
     it("OBVIOUS_NOT_RESERVED → proceeds to local tier", async () => {
         const callLocal = vi.fn().mockResolvedValue({ ok: true, text: "local response", doneReason: "stop" });
         const callCloud = vi.fn();
@@ -142,7 +226,7 @@ describe("Layer 1 handler integration", () => {
     it("cloud_fallback=false + RESERVED → refuses (fail-closed, no local fallback)", async () => {
         const callLayer1Mock = vi.fn().mockResolvedValue("OBVIOUS_RESERVED");
         const callLocal = vi.fn().mockResolvedValue({ ok: true, text: "local response", doneReason: "stop" });
-        await expect(runInfer({ prompt: "write something", mode: "code", cloud_fallback: false, max_tokens: 512 }, makeBaseDeps({ callLayer1: callLayer1Mock, callLocal }))).rejects.toThrow(/reserved content refused/i);
+        await expect(runInfer({ prompt: "write something", mode: "code", cloud_fallback: false, max_tokens: 512 }, makeBaseDeps({ callLayer1: callLayer1Mock, callLocal }))).rejects.toThrow(/content refused/i);
         expect(callLayer1Mock).toHaveBeenCalled();
         expect(callLocal).not.toHaveBeenCalled();
     });

package/dist/tools/__tests__/ledgerHandlers.test.js

@@ -531,35 +531,14 @@ describe("ledgerHandlers", () => {
             await sessionLoadContextHandler({ project: "test-project" });
             expect(vi.mocked(markContextLoaded)).not.toHaveBeenCalled();
         });
-        it("prepends safety header on no-history path", async () => {
+        it("does not include safety banner (enforcement is in code)", async () => {
             storage.loadContext.mockResolvedValue(null);
             const result = await sessionLoadContextHandler(validArgs);
             const text = result.content[0].text;
-            expect(text).toContain("Safety Boundaries");
-            expect(text).toContain("BOUNDARIES STUB");
+            expect(text).not.toContain("[Safety Boundaries");
+            expect(text).not.toContain("BOUNDARIES STUB");
             expect(text).toContain("no previous session history");
         });
-        it("prepends safety header on history-found path (standard/deep)", async () => {
-            storage.loadContext.mockResolvedValue({
-                last_summary: "Did some work",
-                version: 1,
-            });
-            const result = await sessionLoadContextHandler({ ...validArgs, level: "standard" });
-            const text = result.content[0].text;
-            expect(text).toContain("Safety Boundaries");
-            expect(text).toContain("BOUNDARIES STUB");
-            expect(text).toContain("Did some work");
-        });
-        it("prepends safety header on quick path", async () => {
-            storage.loadContext.mockResolvedValue({
-                last_summary: "Quick summary",
-                version: 2,
-            });
-            const result = await sessionLoadContextHandler({ ...validArgs, level: "quick" });
-            const text = result.content[0].text;
-            expect(text).toContain("Safety Boundaries");
-            expect(text).toContain("BOUNDARIES STUB");
-        });
     });
     // ====================================================================
     // 4. sessionSaveHandoffHandler

package/dist/tools/ledgerHandlers.js

@@ -669,13 +669,10 @@ export async function sessionLoadContextHandler(args) {
             markContextLoaded(convId, project, BOUNDARIES_VERSION);
             noteDriftSessionStart(convId);
         }
-        const { BOUNDARIES_TEXT: BT0, BOUNDARIES_VERSION: BV0 } = await import("../boundaries/boundaries.js");
-        const boundariesHeader0 = `# Safety Boundaries (v${BV0})\n${BT0}\n\n---\n\n`;
         return {
             content: [{
                     type: "text",
-                    text: boundariesHeader0 +
-                        `No session context found for project "${project}" at level ${level}.\n` +
+                    text: `No session context found for project "${project}" at level ${level}.\n` +
                         `This project has no previous session history. Starting fresh.` +
                         freshSkillBlock,
                 }],
@@ -988,7 +985,7 @@ export async function sessionLoadContextHandler(args) {
                 const targetVector = sdmEngine.read(new Float32Array(queryVector));
                 const topMatches = await decodeSdmVector(project, targetVector, 3, 0.55);
                 if (topMatches.length > 0) {
-                    sdmRecallBlock = `\n\n[🧠 INTUITIVE RECALL]\nThe deeper Superposed Memory matrix resonated with your current task and surfaced these latent patterns:\n`;
+                    sdmRecallBlock = `\n\n[🔍 ASSOCIATIVE RECALL]\nSimilarity-matched session summaries (cosine ≥ 0.55, not verified facts):\n`;
                     for (const match of topMatches) {
                         sdmRecallBlock += `- [Sim: ${(match.similarity * 100).toFixed(1)}%] ${match.summary}\n`;
                     }
@@ -1073,10 +1070,8 @@ export async function sessionLoadContextHandler(args) {
             markContextLoaded(convId, project, BOUNDARIES_VERSION);
             noteDriftSessionStart(convId);
         }
-        const { BOUNDARIES_TEXT, BOUNDARIES_VERSION: BV } = await import("../boundaries/boundaries.js");
-        const boundariesHeader = `# Safety Boundaries (v${BV})\n${BOUNDARIES_TEXT}\n\n---\n\n`;
         return {
-            content: [{ type: "text", text: boundariesHeader + responseText + MEMORY_BOUNDARY_SUFFIX }],
+            content: [{ type: "text", text: responseText + MEMORY_BOUNDARY_SUFFIX }],
             isError: false,
         };
     }
@@ -1087,10 +1082,8 @@ export async function sessionLoadContextHandler(args) {
         markContextLoaded(convId, project, BOUNDARIES_VERSION);
         noteDriftSessionStart(convId);
     }
-    const { BOUNDARIES_TEXT, BOUNDARIES_VERSION: BV2 } = await import("../boundaries/boundaries.js");
-    const boundariesHeader2 = `# Safety Boundaries (v${BV2})\n${BOUNDARIES_TEXT}\n\n---\n\n`;
     return {
-        content: [{ type: "text", text: boundariesHeader2 + responseText + MEMORY_BOUNDARY_SUFFIX }],
+        content: [{ type: "text", text: responseText + MEMORY_BOUNDARY_SUFFIX }],
         isError: false,
     };
 }

package/dist/tools/prismInferHandler.js

@@ -29,7 +29,7 @@ import { ddLog } from "../utils/ddLogger.js";
 import { stripThink } from "../utils/thinkStrip.js";
 import { passesQualityGate } from "../utils/qualityGate.js";
 import { checkInputSafety, checkOutputSafety } from "../utils/safetyGate.js";
-import { callLayer1 as defaultCallLayer1 } from "../utils/layer1.js";
+import { callLayer1 as defaultCallLayer1, keywordBackstop } from "../utils/layer1.js";
 import { recordInference, formatInferenceMetrics } from "../utils/inferenceMetrics.js";
 // ─── Tool Definition ────────────────────────────────────────────
 export const PRISM_INFER_TOOL = {
@@ -423,7 +423,7 @@ export async function runInfer(args, deps) {
         const l1fn = deps.callLayer1 ?? defaultCallLayer1;
         const l1Model = resolveOllamaName("prism-coder:4b", installed);
         const l1 = await l1fn(args.prompt, deps.ollamaUrl, l1Model);
-        if (l1 !== "OBVIOUS_NOT_RESERVED") {
+        if (l1 === "OBVIOUS_RESERVED" || l1 === "UNCERTAIN") {
             debugLog(`[prism_infer] Layer 1 verdict=${l1} — reserved content detected`);
             attempts.push({ tier: "layer1", reason: `layer1_${l1.toLowerCase()}` });
             if (allowCloud) {
@@ -445,6 +445,33 @@ export async function runInfer(args, deps) {
             }
             throw new Error(`prism_infer: Layer 1 verdict=${l1}, reserved content refused. attempts=${JSON.stringify(attempts)}`);
         }
+        if (l1 === "ERROR") {
+            debugLog(`[prism_infer] Layer 1 verdict=ERROR — classifier failed, trying cloud then keyword backstop`);
+            attempts.push({ tier: "layer1", reason: "layer1_error" });
+            if (allowCloud) {
+                const cloudTimeout = args.timeout_ms ?? 90_000;
+                const cloud = await deps.callCloud(args.prompt, maxTokens, cloudTimeout);
+                if (cloud.ok && cloud.output) {
+                    return await applyVerification(cloud.output, gatedArgs, deps, {
+                        backend: cloud.backend ?? "synalux",
+                        model_picked: null,
+                        ram_free_mb: ramFreeMb,
+                        latency_ms: Date.now() - t0,
+                        used_cloud: true,
+                        attempts,
+                        plan: ent.plan,
+                        completion_tokens: Math.ceil(cloud.output.length / 4),
+                    });
+                }
+                attempts.push({ tier: "synalux", reason: cloud.reason ?? "unknown" });
+            }
+            const backstop = keywordBackstop(args.prompt);
+            debugLog(`[prism_infer] keyword backstop verdict=${backstop}`);
+            attempts.push({ tier: "keyword_backstop", reason: `backstop_${backstop.toLowerCase()}` });
+            if (backstop === "OBVIOUS_RESERVED") {
+                throw new Error(`prism_infer: classifier failed + keyword backstop caught reserved content. attempts=${JSON.stringify(attempts)}`);
+            }
+        }
         debugLog(`[prism_infer] Layer 1 verdict=OBVIOUS_NOT_RESERVED — proceeding local`);
     }
     // ── end Layer 1 ─────────────────────────────────────────────────────────

package/dist/utils/layer1.js

@@ -59,52 +59,76 @@ export function parseLayer1(raw) {
     const token = m[0];
     return VALID.has(token) ? token : "ERROR";
 }
-// p95 measured 484–511ms on warm 4b; 1500ms is a generous ceiling that still
-// fails closed on model stall without blocking the handler for too long.
 const LAYER1_TIMEOUT_MS = 1_500;
+const LAYER1_RETRY_TIMEOUT_MS = 5_000;
+// Deterministic reserved-vocabulary backstop for the ERROR path.
+// These patterns catch reserved content when the classifier is unavailable.
+// Not sufficient alone (adversaries can paraphrase), but as an ERROR-path
+// floor they block the obvious cases that padding/injection attacks
+// would otherwise smuggle through.
+const RESERVED_KEYWORDS = /\b(restrain\w*|seclu(?:sion|d\w*)|physical\s*holds?|containment|self[- ]?harm\w*|suicid\w*|overdos\w*|dos(?:age|ing)\s*(?:mg|schedule)|crisis\s*de[- ]?escalation|meltdown\s*management|elopement\s*incident)\b/i;
 /**
- * Run the Layer 1 classifier. Returns a verdict; never throws.
- * On ANY failure path returns "ERROR" so the caller escalates to cloud.
+ * Deterministic keyword check — the ERROR-path floor.
+ * Returns OBVIOUS_RESERVED if reserved vocabulary is present,
+ * OBVIOUS_NOT_RESERVED otherwise. Used only when the LLM classifier
+ * fails (timeout, model not loaded, injection attack).
+ */
+export function keywordBackstop(prompt) {
+    return RESERVED_KEYWORDS.test(prompt) ? "OBVIOUS_RESERVED" : "OBVIOUS_NOT_RESERVED";
+}
+// Over-length prompts are attacker-controlled — don't let length
+// select the ERROR branch. Classify as UNCERTAIN (conservative)
+// rather than feeding a huge prompt to a 4B classifier that will timeout.
+const MAX_CLASSIFIER_PROMPT_LENGTH = 4_000;
+/**
+ * Run the Layer 1 classifier with retry on cold-model timeout.
+ * Returns a verdict; never throws.
  *
- * @param userPrompt  the end-user prompt being classified (NOT the LAYER1_PROMPT)
- * @param ollamaUrl   Ollama base URL
- * @param model       classifier model tag (caller-resolved via resolveOllamaName)
- * @param fetchImpl   injected for tests; defaults to global fetch
+ * Flow: classify → if ERROR, retry once with longer timeout →
+ * if still ERROR, return ERROR (caller uses keywordBackstop).
  */
 export async function callLayer1(userPrompt, ollamaUrl, model, fetchImpl = fetch) {
     if (!userPrompt || !userPrompt.trim())
         return "ERROR";
-    let res;
-    try {
-        res = await fetchImpl(`${ollamaUrl}/api/chat`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-                model,
-                messages: [
-                    { role: "user", content: LAYER1_PROMPT.replace("{prompt}", userPrompt) },
-                ],
-                stream: false,
-                think: false,
-                options: { num_predict: 16, temperature: 0 },
-            }),
-            signal: AbortSignal.timeout(LAYER1_TIMEOUT_MS),
-        });
-    }
-    catch {
-        return "ERROR";
-    }
-    if (!res.ok)
-        return "ERROR";
-    let data;
-    try {
-        data = await res.json();
-    }
-    catch {
-        return "ERROR";
-    }
-    if (data?.error)
-        return "ERROR";
-    const text = data?.message?.content;
-    return parseLayer1(text);
+    if (userPrompt.length > MAX_CLASSIFIER_PROMPT_LENGTH)
+        return "UNCERTAIN";
+    const classify = async (timeoutMs) => {
+        let res;
+        try {
+            res = await fetchImpl(`${ollamaUrl}/api/chat`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({
+                    model,
+                    messages: [
+                        { role: "user", content: LAYER1_PROMPT.replace("{prompt}", userPrompt) },
+                    ],
+                    stream: false,
+                    think: false,
+                    options: { num_predict: 16, temperature: 0 },
+                }),
+                signal: AbortSignal.timeout(timeoutMs),
+            });
+        }
+        catch {
+            return "ERROR";
+        }
+        if (!res.ok)
+            return "ERROR";
+        let data;
+        try {
+            data = await res.json();
+        }
+        catch {
+            return "ERROR";
+        }
+        if (data?.error)
+            return "ERROR";
+        const text = data?.message?.content;
+        return parseLayer1(text);
+    };
+    const first = await classify(LAYER1_TIMEOUT_MS);
+    if (first !== "ERROR")
+        return first;
+    return classify(LAYER1_RETRY_TIMEOUT_MS);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.0.2",
+  "version": "20.0.3",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Prism Coder — Cognitive memory + tool-calling intelligence for AI agents. Mind Palace persistent memory (BFCL Gold Certified, 100% Tool-Call Accuracy, 114 Agent Skills, PHI Guard, Tier Enforcement, Prompt-Based Skill Routing, Zero-Search HDC/HRR retrieval, HRR Semantic Drift Detection across BCBA/Coding/AAC domains, HIPAA-hardened local-first storage, SLERP-optimized GRPO alignment) plus the prism-coder 1.7B–32B open-weights LLM fleet.",
   "module": "index.ts",