prism-mcp-server 20.0.8 → 20.2.0

package/dist/utils/layer1.js

@@ -5,9 +5,14 @@
  * a prompt is OBVIOUS_RESERVED, OBVIOUS_NOT_RESERVED, or UNCERTAIN.
  *
  * Fail-closed contract:
- *   OBVIOUS_NOT_RESERVED → the ONLY verdict that permits local routing
+ *   OBVIOUS_NOT_RESERVED → permits local routing
  *   OBVIOUS_RESERVED     → escalate to cloud
  *   UNCERTAIN            → escalate to cloud (conservative)
+ *   UNCERTAIN_LENGTH     → §5.3: prompt too long to classify in full, but the
+ *                          full-text keyword floor is clean AND a head+tail
+ *                          excerpt classified clean — permits local routing
+ *                          with a distinct audit marker ("too long to classify"
+ *                          ≠ "semantically uncertain")
  *   ERROR                → escalate to cloud (never fail-open)
  *
  * The prompt below is VERBATIM from §E of prism-infer-boundaries/SKILL.md.
@@ -66,7 +71,7 @@ const LAYER1_RETRY_TIMEOUT_MS = 5_000;
 // Not sufficient alone (adversaries can paraphrase), but as an ERROR-path
 // floor they block the obvious cases that padding/injection attacks
 // would otherwise smuggle through.
-const RESERVED_KEYWORDS = /\b(restrain\w*|seclu(?:sion|d\w*)|physical\s*holds?|containment|self[- ]?harm\w*|suicid\w*|overdos\w*|dos(?:age|ing)\s*(?:mg|schedule)|crisis\s*de[- ]?escalation|meltdown\s*management|elopement\s*incident)\b/i;
+const RESERVED_KEYWORDS = /\b(restrain\w*|seclu(?:sion|d\w*)|physical\s*holds?|(?:prone|supine|basket|therapeutic|manual|two[- ]?person)\s+holds?|hold(?:ing)?\s+(?:the\s+)?(?:client|child|student|patient)\s+down|containment|self[- ]?harm\w*|suicid\w*|overdos\w*|dos(?:age|ing)\s*(?:mg|schedule)|crisis\s*de[- ]?escalation|meltdown\s*management|rage\s+episode|elopement\s*incident)\b/i;
 /**
  * Deterministic keyword check — the ERROR-path floor.
  * Returns OBVIOUS_RESERVED if reserved vocabulary is present,
@@ -77,21 +82,54 @@ export function keywordBackstop(prompt) {
     return RESERVED_KEYWORDS.test(prompt) ? "OBVIOUS_RESERVED" : "OBVIOUS_NOT_RESERVED";
 }
 // Over-length prompts are attacker-controlled — don't let length
-// select the ERROR branch. Classify as UNCERTAIN (conservative)
-// rather than feeding a huge prompt to a 4B classifier that will timeout.
+// select the ERROR branch. §5.3: instead of a blanket UNCERTAIN (which
+// routed every big benign prompt to cloud-or-refuse — v1 FATAL #3), run
+// the deterministic keyword floor over the FULL text, then classify a
+// bounded head+tail excerpt. A clean floor + clean excerpt yields the
+// distinct UNCERTAIN_LENGTH verdict so callers can tell "too long to
+// classify" from "semantically uncertain".
 const MAX_CLASSIFIER_PROMPT_LENGTH = 4_000;
+// Excerpt budget: head + middle + tail must stay under the classifier cap
+// with room for the LAYER1_PROMPT template. The sampled middle window
+// narrows the region an attacker can hide paraphrased reserved content in
+// (adversarial-review finding: keyword-free paraphrases in the unseen
+// middle are the residual gap — the window makes padding placement
+// harder; the full-text keyword floor remains the deterministic net).
+const EXCERPT_HEAD_CHARS = 2_000;
+const EXCERPT_MID_CHARS = 400;
+const EXCERPT_TAIL_CHARS = 1_400;
+/** Bounded head+middle+tail excerpt of an oversize prompt (§5.3). Exported for tests. */
+export function buildOversizeExcerpt(prompt) {
+    const midStart = Math.max(EXCERPT_HEAD_CHARS, Math.floor(prompt.length / 2) - EXCERPT_MID_CHARS / 2);
+    const middle = prompt.slice(midStart, midStart + EXCERPT_MID_CHARS);
+    return (prompt.slice(0, EXCERPT_HEAD_CHARS) +
+        "\n[…]\n" +
+        middle +
+        "\n[…]\n" +
+        prompt.slice(-EXCERPT_TAIL_CHARS));
+}
 /**
  * Run the Layer 1 classifier with retry on cold-model timeout.
  * Returns a verdict; never throws.
  *
  * Flow: classify → if ERROR, retry once with longer timeout →
  * if still ERROR, return ERROR (caller uses keywordBackstop).
+ *
+ * Oversize flow (§5.3): full-text keyword floor → excerpt classification →
+ * reserved/uncertain excerpt verdicts keep full reserved handling;
+ * a clean excerpt returns UNCERTAIN_LENGTH.
  */
 export async function callLayer1(userPrompt, ollamaUrl, model, fetchImpl = fetch) {
     if (!userPrompt || !userPrompt.trim())
         return "ERROR";
-    if (userPrompt.length > MAX_CLASSIFIER_PROMPT_LENGTH)
-        return "UNCERTAIN";
+    const oversize = userPrompt.length > MAX_CLASSIFIER_PROMPT_LENGTH;
+    if (oversize && keywordBackstop(userPrompt) === "OBVIOUS_RESERVED") {
+        // The regex floor has no length limit — reserved vocabulary anywhere
+        // in the full text (including the middle the excerpt can't see)
+        // short-circuits to reserved handling.
+        return "OBVIOUS_RESERVED";
+    }
+    const classifierInput = oversize ? buildOversizeExcerpt(userPrompt) : userPrompt;
     const classify = async (timeoutMs) => {
         let res;
         try {
@@ -101,7 +139,7 @@ export async function callLayer1(userPrompt, ollamaUrl, model, fetchImpl = fetch
                 body: JSON.stringify({
                     model,
                     messages: [
-                        { role: "user", content: LAYER1_PROMPT.replace("{prompt}", userPrompt) },
+                        { role: "user", content: LAYER1_PROMPT.replace("{prompt}", classifierInput) },
                     ],
                     stream: false,
                     think: false,
@@ -128,7 +166,16 @@ export async function callLayer1(userPrompt, ollamaUrl, model, fetchImpl = fetch
         return parseLayer1(text);
     };
     const first = await classify(LAYER1_TIMEOUT_MS);
-    if (first !== "ERROR")
-        return first;
-    return classify(LAYER1_RETRY_TIMEOUT_MS);
+    const verdict = first !== "ERROR" ? first : await classify(LAYER1_RETRY_TIMEOUT_MS);
+    if (!oversize)
+        return verdict;
+    // §5.3 oversize mapping:
+    //   excerpt OBVIOUS_RESERVED / UNCERTAIN → keep full reserved handling
+    //   excerpt OBVIOUS_NOT_RESERVED        → UNCERTAIN_LENGTH (distinct verdict)
+    //   excerpt ERROR                       → UNCERTAIN_LENGTH — the deterministic
+    //     keyword floor already cleared the FULL text above, which is the same
+    //     floor the normal-size ERROR path falls back to via the caller.
+    if (verdict === "OBVIOUS_RESERVED" || verdict === "UNCERTAIN")
+        return verdict;
+    return "UNCERTAIN_LENGTH";
 }

package/dist/utils/modelPicker.js

@@ -24,12 +24,21 @@ const GB = 1024 ** 3;
 /**
  * Tier table, ordered LARGEST → SMALLEST. Picker walks this and returns
  * the first row whose minFreeGb fits within freeBytes.
+ *
+ * ctxTokens (§5.4): aligned with the LIVE Modelfile `num_ctx` values
+ * (verified via `ollama show <tag> --modelfile` on 2026-07-20). The values
+ * are inverted from intuition — the 27b/9b Modelfiles bake num_ctx 4096
+ * while 4b/2b bake 32768. The tier walk skips tiers whose ctx cannot hold
+ * prompt + output (reason: ctx_insufficient) — Ollama otherwise silently
+ * truncates the prompt and answers from the fragment. If a Modelfile's
+ * num_ctx is ever raised, update the row here (a raise is a measured
+ * decision with KV-cache RAM costed — plan v2 §5.4).
  */
 export const MODEL_TIERS = [
-    { tag: 'prism-coder:27b', weightsGb: 16, minFreeGb: 20, ctxTokens: 32_768 },
-    { tag: 'prism-coder:9b', weightsGb: 5.8, minFreeGb: 8, ctxTokens: 32_768 },
+    { tag: 'prism-coder:27b', weightsGb: 16, minFreeGb: 20, ctxTokens: 4_096 },
+    { tag: 'prism-coder:9b', weightsGb: 5.8, minFreeGb: 8, ctxTokens: 4_096 },
     { tag: 'prism-coder:4b', weightsGb: 3.4, minFreeGb: 5, ctxTokens: 32_768 },
-    { tag: 'prism-coder:2b', weightsGb: 2.3, minFreeGb: 3, ctxTokens: 8_192 },
+    { tag: 'prism-coder:2b', weightsGb: 2.3, minFreeGb: 3, ctxTokens: 32_768 },
 ];
 /**
  * True when `installed` matches `tierTag` either as a bare tag

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.0.8",
+  "version": "20.2.0",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Prism Coder — Cognitive memory + tool-calling intelligence for AI agents. Mind Palace persistent memory (BFCL Gold Certified, 100% Tool-Call Accuracy, 114 Agent Skills, PHI Guard, Tier Enforcement, Prompt-Based Skill Routing, Zero-Search HDC/HRR retrieval, HRR Semantic Drift Detection across BCBA/Coding/AAC domains, HIPAA-hardened local-first storage, SLERP-optimized GRPO alignment) plus the prism-coder 1.7B–32B open-weights LLM fleet.",
   "module": "index.ts",
@@ -65,6 +65,7 @@
     "rag",
     "embeddings",
     "cursor",
+    "codex",
     "windsurf",
     "cline",
     "persistent-memory",
@@ -144,6 +145,7 @@
     "p-limit": "^7.3.0",
     "postcss": "8.5.12",
     "quickjs-emscripten": "^0.32.0",
+    "smol-toml": "^1.7.0",
     "stream-json": "^2.0.0",
     "turndown": "^7.2.2",
     "zod": "^4.3.6"

package/dist/utils/groundingVerifier.js

@@ -1,203 +0,0 @@
-/**
- * groundingVerifier — runtime accountability for prism_infer
- * ============================================================
- *
- * When a caller passes `evidence` + `verify: true` to prism_infer, this
- * module checks that every factual claim in the model's draft is
- * entailed by one of the evidence snippets. Sibling of synalux-portal's
- * chat-verifier — same architecture, lighter footprint (no DB audit,
- * stateless MCP), pointed at free-form generation instead of tool-call
- * responses.
- *
- * Cascade role: qwen3.5:4b is the default verifier (fast, 2.5GB).
- * 14b drafts; 4b verifies. Different model = Patronus rule satisfied.
- * Falls back to 2b on devices with <4GB free RAM.
- *
- * Failure modes:
- *   - Verifier model unreachable / timeout → fail-closed refusal
- *   - Verifier returns malformed JSON → fail-closed refusal
- *   - NEUTRAL or CONTRADICTED claim → fail-closed refusal that names
- *     the failed claim
- *
- * The refusal text always names which claim couldn't be grounded so
- * the calling agent can decide whether to retry with more evidence or
- * fall back to cloud.
- */
-import { PRISM_LOCAL_LLM_URL } from "../config.js";
-// ─── Pre-checks ─────────────────────────────────────────────────────────
-const ASSERTIVE_RX = /\b(?:\d{1,5}|[A-Z]\d{2}\.\d|ICD-?10|CPT|\$\d|\d{4}-\d{2}-\d{2}|[A-Z][a-z]{2,}\s+[A-Z][a-z]{2,})\b/;
-/**
- * Returns true when the draft makes at least one assertion that could be
- * fabricated — numbers, dates, ICD/CPT codes, two-word names, dollar
- * amounts. Conversational replies skip the verifier entirely.
- */
-export function draftHasAssertiveClaims(draft) {
-    if (!draft)
-        return false;
-    return ASSERTIVE_RX.test(draft);
-}
-// ─── Verifier prompt (grammar-constrained JSON) ─────────────────────────
-const VERIFIER_SYSTEM_PROMPT = `You are a strict factual-grounding verifier. Your job is to REJECT ungrounded claims.
-Given EVIDENCE (one or more text snippets) and DRAFT_ANSWER, find every
-factual claim (counts, names, dates, codes, dollar amounts) and assign:
-
-  ENTAILED     — the EXACT value appears verbatim in EVIDENCE text, or is an
-                 arithmetic identity (e.g. "3" and "three"). STRICT: if you
-                 must infer, estimate, or extrapolate, it is NOT ENTAILED.
-  CONTRADICTED — the claim states a DIFFERENT value than what EVIDENCE says
-                 for the same fact.
-  NEUTRAL      — the claim is not addressed in EVIDENCE at all.
-
-CRITICAL DEFAULT RULE: when in doubt, use NEUTRAL — never guess ENTAILED.
-Prefer false negatives over false positives. If the evidence does not
-explicitly state the value, it is NEUTRAL.
-
-Do NOT report opinions, refusals, or hedges as claims. Conversational
-phrasing ("Hello", "I can help") is not a claim.
-
-Output JSON only — no prose, no apology.`;
-const VERIFIER_JSON_SCHEMA = {
-    type: "object",
-    properties: {
-        claims: {
-            type: "array",
-            items: {
-                type: "object",
-                properties: {
-                    text: { type: "string" },
-                    verdict: { type: "string", enum: ["ENTAILED", "NEUTRAL", "CONTRADICTED"] },
-                    evidence_span: { type: ["string", "null"] },
-                },
-                required: ["text", "verdict", "evidence_span"],
-                additionalProperties: false,
-            },
-        },
-    },
-    required: ["claims"],
-    additionalProperties: false,
-};
-// ─── Refusal text ───────────────────────────────────────────────────────
-function refusalText(action, failedClaim) {
-    switch (action) {
-        case "refused_fabricated":
-            return `I can't ground "${failedClaim}" in the evidence provided. ` +
-                "If this claim is correct, supply the supporting source as evidence and retry.";
-        case "refused_no_evidence":
-            return `I can't ground "${failedClaim}" — no evidence was provided this turn. ` +
-                "Provide evidence snippets via the `evidence` argument and retry.";
-        case "refused_timeout":
-            return `I couldn't verify "${failedClaim}" within the allowed time. ` +
-                "The verifier model may be cold-loading; try again in a moment.";
-        case "served":
-            return ""; // unreachable
-    }
-}
-export async function verifyGrounding(opts) {
-    const verifierModel = opts.verifierModel ?? "qwen3.5:4b";
-    const timeoutMs = opts.timeoutMs ?? 2000;
-    const ollamaUrl = opts.ollamaUrl ?? PRISM_LOCAL_LLM_URL;
-    const fetchImpl = opts.fetchImpl ?? fetch;
-    const verifierChain = [];
-    // Tier 0 — conversational drafts skip the verifier entirely.
-    if (!draftHasAssertiveClaims(opts.draft)) {
-        return {
-            action: "served",
-            finalText: opts.draft,
-            claims: [],
-            verifierChain,
-        };
-    }
-    // Tier 0a — assertive draft with NO evidence is fail-closed:
-    // the model is making claims it cannot back up.
-    if (opts.evidence.length === 0) {
-        const claim = firstAssertiveSpan(opts.draft);
-        return {
-            action: "refused_no_evidence",
-            finalText: refusalText("refused_no_evidence", claim),
-            claims: [{ claim, verdict: "NEUTRAL", evidence_span: null }],
-            verifierChain,
-            refusalClaim: claim,
-        };
-    }
-    // Tier 2 — NLI verifier call.
-    const t0 = Date.now();
-    const evidenceText = opts.evidence
-        .map((e, i) => `[${i}] ${e.source}\n${e.content}`)
-        .join("\n\n");
-    const payload = {
-        model: verifierModel,
-        messages: [
-            { role: "system", content: VERIFIER_SYSTEM_PROMPT },
-            { role: "user", content: `EVIDENCE:\n${evidenceText}\n\nDRAFT_ANSWER:\n${opts.draft}` },
-        ],
-        stream: false,
-        response_format: {
-            type: "json_schema",
-            json_schema: { name: "verifier", schema: VERIFIER_JSON_SCHEMA, strict: true },
-        },
-        temperature: 0,
-    };
-    let parsedClaims = null;
-    try {
-        const res = await fetchImpl(`${ollamaUrl}/v1/chat/completions`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify(payload),
-            signal: AbortSignal.timeout(timeoutMs),
-        });
-        if (!res.ok)
-            throw new Error(`HTTP ${res.status}`);
-        const data = (await res.json());
-        const content = data?.choices?.[0]?.message?.content;
-        if (typeof content !== "string")
-            throw new Error("no content");
-        const parsed = JSON.parse(content);
-        if (!parsed || !Array.isArray(parsed.claims))
-            throw new Error("malformed");
-        parsedClaims = parsed.claims.map((c) => ({
-            claim: String(c.text ?? ""),
-            verdict: ["ENTAILED", "NEUTRAL", "CONTRADICTED"].includes(c.verdict)
-                ? c.verdict
-                : "NEUTRAL",
-            evidence_span: typeof c.evidence_span === "string" ? c.evidence_span : null,
-        }));
-    }
-    catch {
-        const latencyMs = Date.now() - t0;
-        verifierChain.push({ model: verifierModel, verdict: "NEUTRAL", latencyMs });
-        const claim = firstAssertiveSpan(opts.draft);
-        return {
-            action: "refused_timeout",
-            finalText: refusalText("refused_timeout", claim),
-            claims: [{ claim, verdict: "NEUTRAL", evidence_span: null }],
-            verifierChain,
-            refusalClaim: claim,
-        };
-    }
-    const latencyMs = Date.now() - t0;
-    const failing = parsedClaims.find(c => c.verdict !== "ENTAILED");
-    const rollup = failing ? failing.verdict : "ENTAILED";
-    verifierChain.push({ model: verifierModel, verdict: rollup, latencyMs });
-    if (failing) {
-        return {
-            action: "refused_fabricated",
-            finalText: refusalText("refused_fabricated", failing.claim),
-            claims: parsedClaims,
-            verifierChain,
-            refusalClaim: failing.claim,
-        };
-    }
-    return {
-        action: "served",
-        finalText: opts.draft,
-        claims: parsedClaims,
-        verifierChain,
-    };
-}
-// ─── helpers ────────────────────────────────────────────────────────────
-function firstAssertiveSpan(draft) {
-    const m = draft.match(ASSERTIVE_RX);
-    if (m)
-        return m[0];
-    return draft.slice(0, 80);
-}