prism-mcp-server 20.0.3 → 20.0.4

package/README.md

@@ -18,19 +18,35 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
 
 ---
 
-## What's New in v20.0.2
+## What's New in v20.0.4
 
-### Reserved-Category Safety Gate — All Tiers
-The Layer 1 semantic classifier now runs for **every** user, not just paid tiers. Reserved clinical content (restraint, seclusion, crisis protocols) is refused on free tier when cloud is unavailable — fail-closed, never silently served locally. This closes a real gap where free-tier users bypassed classification entirely.
+### Think-Only Retry
+Qwen 3.5 models (9B/27B) with thinking enabled could burn all tokens on `<think>` blocks and return empty content, causing a cascade to 4B. Now detects think-only responses and retries the same tier with thinking disabled — preserving model quality instead of falling to a smaller model.
 
-### Compressed Safety Banner (500 → 120 tokens/call)
-The per-call operating boundaries text was split: safety declaration stays in every `session_load_context` response (~120 tokens); architecture/routing docs moved to the MCP server description (loaded once at connection). Saves ~350 tokens per call with no loss of defense-in-depth.
+### Local-First Skill Rewrite
+The `local-inference-first` skill now uses a hard falsifiable trigger list (format conversion, regex, i18n, boilerplate CRUD, deterministic tests) with no self-assessment escape. Clinical content removed from delegation — it conflicts with the Layer 1 reserved-category safety floor. Honest target: 15-25% of prompts delegated at equal quality.
 
-### Ledger Dedup
-`session_save_ledger` now deduplicates identical entries within a 5-minute window, preventing the retry-storm pattern that produced duplicate rows.
+---
+
+## What's New in v20.0.3
+
+### Layer 1 Cold-Model Resilience
+The reserved-category classifier now retries once with a longer timeout on cold-model failure, then falls back to a deterministic keyword backstop before refusing. Over-length prompts (>4K chars) are classified as UNCERTAIN before reaching the classifier — prompt padding can no longer force the ERROR branch. This eliminates the cold-start refusal problem without weakening the safety gate.
+
+### Keyword Backstop for Reserved Content
+When the LLM classifier fails (timeout, injection, resource pressure), a deterministic regex floor catches reserved vocabulary (restraint, seclusion, self-harm, suicide, overdose, crisis de-escalation, etc.) including inflected and verb forms. Blocks prompt-padding and classifier-injection attacks on the ERROR path.
+
+### Single-Source Safety Text
+The safety statement in the MCP server `instructions` field now imports from `boundaries.ts` — one source of truth instead of two hand-maintained copies. Boundaries version bumped to v3 with an explicit delivery decision documented in code.
+
+### Reserved-Category Safety Gate — All Tiers (v20.0.2)
+The Layer 1 semantic classifier now runs for **every** user, not just paid tiers. Reserved clinical content is refused on free tier when cloud is unavailable — fail-closed.
+
+### Ledger Dedup (v20.0.2)
+`session_save_ledger` deduplicates identical entries within a 5-minute window.
 
-### Evidence Script
-`scripts/generate-evidence.sh` regenerates all 5 evidence files with built-in assertions (skill counts, tier gating, version consistency, inference correctness). Run `bash scripts/generate-evidence.sh` to verify the full pipeline.
+### Evidence Script (v20.0.2)
+`scripts/generate-evidence.sh` regenerates all 5 evidence files with built-in assertions. Run `bash scripts/generate-evidence.sh` to verify the full pipeline.
 
 ---
 

package/dist/tools/__tests__/layer1Integration.test.js

@@ -250,6 +250,21 @@ describe("Layer 1 handler integration", () => {
         await expect(runInfer({ prompt: "de-escalation plan for violent behavior", mode: "code", cloud_fallback: true, max_tokens: 512 }, makeBaseDeps({ callLocal, callCloud, callLayer1: callLayer1Mock }))).rejects.toThrow("Layer 1 verdict=OBVIOUS_RESERVED");
         expect(callLocal).not.toHaveBeenCalled();
     });
+    it("think_only → retries same tier with think=false, succeeds", async () => {
+        let callCount = 0;
+        const callLocal = vi.fn().mockImplementation(async (_url, _model, _prompt, _sys, _max, _temp, _timeout, think) => {
+            callCount++;
+            if (think)
+                return { ok: false, reason: "think_only" };
+            return { ok: true, text: "answer without thinking", doneReason: "stop" };
+        });
+        const result = await runInfer({ prompt: "write a regex for emails", mode: "code", cloud_fallback: false, max_tokens: 256 }, makeBaseDeps({ callLocal }));
+        expect(callCount).toBe(2);
+        expect(callLocal).toHaveBeenNthCalledWith(1, expect.anything(), expect.anything(), expect.anything(), undefined, expect.anything(), expect.anything(), expect.anything(), true);
+        expect(callLocal).toHaveBeenNthCalledWith(2, expect.anything(), expect.anything(), expect.anything(), undefined, expect.anything(), expect.anything(), expect.anything(), false);
+        expect(result.output).toBe("answer without thinking");
+        expect(result.used_cloud).toBe(false);
+    });
 });
 // ── Auto-evict unit tests ─────────────────────────────────────────────────────
 describe("Auto-evict warm smaller models (F1/F2/F3/F4 regression suite)", () => {

package/dist/tools/__tests__/ledgerHandlers.test.js

@@ -449,15 +449,14 @@ describe("ledgerHandlers", () => {
             expect(text).toContain('<prism_memory context="historical">');
             expect(text).toContain("</prism_memory>");
         });
-        it("includes ABA Precision Protocol in every response", async () => {
+        it("does not contain inline ABA protocol (delivered via skill routing)", async () => {
             storage.loadContext.mockResolvedValue({
                 last_summary: "Summary",
                 version: 1,
             });
             const result = await sessionLoadContextHandler(validArgs);
             const text = result.content[0].text;
-            expect(text).toContain("ABA PRECISION PROTOCOL");
-            expect(text).toContain("Observable Goals");
+            expect(text).not.toContain("ABA PRECISION PROTOCOL");
         });
         it("passes role to loadContext when provided", async () => {
             storage.loadContext.mockResolvedValue(null);

package/dist/tools/ledgerHandlers.js

@@ -1010,21 +1010,13 @@ export async function sessionLoadContextHandler(args) {
             behavWarnings.map(w => `- ${w.summary} (importance: ${w.importance})`).join("\n");
         behavBlock = [...rawBlock].slice(0, 2000).join('');
     }
-    // ─── v9.4.7: ABA Precision Protocol (foundational) ────────
-    const abaProtocol = `\n\n[🧠 ABA PRECISION PROTOCOL]\n` +
-        `Rule 1 — Observable Goals: Every task must have a measurable, verifiable outcome. State the specific result.\n` +
-        `Rule 2 — Precise Execution: One step at a time. Verify each step. If it fails → STOP → fix → verify → then continue.\n` +
-        `Rule 3 — No Reinforcement of Errors: Never repeat the same mistake twice. When the user says something is wrong, read the actual code/data FIRST before forming an opinion.\n` +
-        `Rule 4 — No Negation/Filler/Hedging Lead: NEVER start with "I can't", "I'm unable to", "Unfortunately", "I cannot", "I apologize", "While I cannot", "Sorry", "Regrettably", "I'm afraid", "As an AI", "Sure,", "Certainly,", "I can certainly", "Let me be transparent", "I should note", "Just to clarify", "It's worth noting". You may use "Yes" or "Absolutely" ONLY as a 1-word direct answer to a binary Yes/No question. UNCERTAINTY ESCAPE: Use ONLY for required database fields/API params (e.g., "Missing: patient_id"). Do NOT use as generic refusal.\n` +
-        `Rule 5 — Fix Without Asking: When you see a bug, fix it immediately. Do NOT ask "would you like me to fix that?" — just fix it.\n` +
-        `Rule 6 — Action Intent: When user says "fix/run/open/deploy", they want ACTION not a tutorial. Ask for specific info needed in 1-2 sentences, or act directly.\n` +
-        `Rule 7 — Tool Redirect: When user asks to "open browser"/"run terminal"/"git push" — output ONLY the URL or command. No follow-up. No explanations. Example: "open browser" → "https://synalux.ai/dashboard"`;
+    // ABA Precision Protocol is now delivered via skill routing
+    // (aba-precision-protocol, protected universal at priority -1).
+    // The inline literal was deleted in R25 to eliminate the mirror pair.
     // T5 structural truncation: assemble sections in priority order so budget truncation
     // drops the LEAST critical sections first (session history), never skills.
-    // Priority high→low: ABA | skills | behavioral warnings | version | drift | briefing | SDM | history
-    // The header + critical rules are always at the top; history is appended last.
+    // Priority high→low: skills | behavioral warnings | version | drift | briefing | SDM | history
     const criticalPrefix = `${MEMORY_BOUNDARY_PREFIX}📋 Session context for "${project}" (${level}):\n\n` +
-        abaProtocol +
         behavBlock +
         skillBlock +
         versionNote +

package/dist/tools/prismInferHandler.js

@@ -245,8 +245,13 @@ async function callOllamaGenerate(url, model, prompt, system, maxTokens, tempera
         if (data.error)
             return { ok: false, reason: `ollama_err:${data.error}` };
         const text = (data.message?.content ?? "").trim();
-        if (!text)
-            return { ok: false, reason: "empty_response" };
+        if (!text) {
+            // When think=true, the model may burn all tokens on <think> and
+            // produce empty content. Report this distinctly so the tier loop
+            // can retry the same model with think=false rather than skipping.
+            const hadThinking = !!(data.message?.thinking);
+            return { ok: false, reason: hadThinking ? "think_only" : "empty_response" };
+        }
         return { ok: true, text, doneReason: data.done_reason, promptTokens: data.prompt_eval_count, completionTokens: data.eval_count };
     }
     catch (err) {
@@ -561,7 +566,14 @@ export async function runInfer(args, deps) {
             anyViable = true;
             const timeout = args.timeout_ms ?? DEFAULT_TIMEOUTS[tier.tag] ?? 60_000;
             const enableThink = args.think ?? (mode !== "route");
-            const result = await deps.callLocal(deps.ollamaUrl, ollamaName, args.prompt, args.system, maxTokens, temperature, timeout, enableThink);
+            let result = await deps.callLocal(deps.ollamaUrl, ollamaName, args.prompt, args.system, maxTokens, temperature, timeout, enableThink);
+            // Think-only retry: model burned all tokens on <think>, empty content.
+            // Retry same model with think=false rather than falling to a smaller tier.
+            // One-shot: think=false cannot re-trigger think_only (no thinking to burn).
+            if (!result.ok && result.reason === "think_only" && enableThink) {
+                debugLog(`[prism_infer] ${tier.tag} returned think-only — retrying with think=false`);
+                result = await deps.callLocal(deps.ollamaUrl, ollamaName, args.prompt, args.system, maxTokens, temperature, timeout, false);
+            }
             if (result.ok) {
                 const { stripped, thinkOnly } = stripThink(result.text);
                 const output = stripped;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.0.3",
+  "version": "20.0.4",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Prism Coder — Cognitive memory + tool-calling intelligence for AI agents. Mind Palace persistent memory (BFCL Gold Certified, 100% Tool-Call Accuracy, 114 Agent Skills, PHI Guard, Tier Enforcement, Prompt-Based Skill Routing, Zero-Search HDC/HRR retrieval, HRR Semantic Drift Detection across BCBA/Coding/AAC domains, HIPAA-hardened local-first storage, SLERP-optimized GRPO alignment) plus the prism-coder 1.7B–32B open-weights LLM fleet.",
   "module": "index.ts",