prism-mcp-server 20.21.2 → 20.21.3

package/dist/tools/prismInferHandler.js

@@ -30,6 +30,7 @@ import { getEntitlements, clampCeiling, multiTurnPolicy, ABSOLUTE_MULTI_TURN } f
 import { ddLog } from "../utils/ddLogger.js";
 import { stripThink } from "../utils/thinkStrip.js";
 import { passesQualityGate } from "../utils/qualityGate.js";
+import { passesClinicalQualityGate, formatClinicalSections, } from "../utils/clinicalQualityPolicy.js";
 import { applyDeterministicCodingRepairs, buildCodingRepairPrompt, passesCodingQualityGate, } from "../utils/codingQualityPolicy.js";
 import { checkInputSafety, checkOutputSafety } from "../utils/safetyGate.js";
 import { callLayer1 as defaultCallLayer1, classifyDeterministicLayer1, keywordBackstop, reservedCategory, MAX_CLASSIFIER_PROMPT_LENGTH } from "../utils/layer1.js";
@@ -402,7 +403,9 @@ export const PRISM_INFER_TOOL = {
         "For a FOLLOW-UP to an earlier prism_infer answer, pass the accepted prior turns as `messages` " +
         "(paid plans): without them the worker answers the follow-up from nothing and fabricates. " +
         "Every entitlement-resolved result reports `multi_turn` (your plan's caps) and `history_turns` (what was sent); " +
-        "the crisis intercept reports only `history_turns`. " +
+        "the crisis intercept reports only `history_turns`. "
+        +
+            "A behaviour-plan request also reports `clinical_sections` — how many required sections were found and which were not. That is a structural census, never a clinical endorsement: a section can be present and still be wrong, and a credentialed BCBA decides whether a plan is adequate. " +
         "History over the plan's caps is refused (history_over_plan_cap), never trimmed; a free plan " +
         "or a host with no portal is refused (multi_turn_not_in_plan). Hosts that compact large " +
         "schemas may drop parameter text, so the contract lives here.",
@@ -2239,6 +2242,21 @@ export async function runInfer(args, deps) {
                 if (gate.pass && mode === "code") {
                     gate = passesCodingQualityGate(args.prompt, output);
                 }
+                // Clinical structural check runs in EVERY mode. A behaviour plan
+                // arrives as chat as readily as code, and the mode a caller picked
+                // must not decide whether clinical output is inspected. The gate
+                // self-gates on the prompt, so it is a no-op for everything else.
+                // A clinical reason does not match the repair loop's code_/python_
+                // prefixes, so it escalates instead of being locally patched —
+                // deliberate: a local model inventing a missing decision-rules
+                // section produces plausible unratified clinical text.
+                let clinicalSections;
+                if (gate.pass) {
+                    const clinical = passesClinicalQualityGate(args.prompt, output);
+                    clinicalSections = clinical.sections;
+                    if (!clinical.pass)
+                        gate = { pass: false, reason: clinical.reason };
+                }
                 // Hard-truncation retry: the budget went on <think> and the answer
                 // was cut mid-emission. Previously this only escalated to cloud, or
                 // served the truncated text when no cloud was available — neither
@@ -2377,6 +2395,7 @@ export async function runInfer(args, deps) {
                     prompt_tokens: result.promptTokens,
                     completion_tokens: result.completionTokens,
                     quality_gate_failed: gate.pass ? undefined : true,
+                    clinical_sections: clinicalSections,
                     gate_outcome: gate.pass
                         ? { status: "success", served_anyway: false }
                         : { status: "degraded", reason: gate.reason, served_anyway: true },
@@ -2609,6 +2628,55 @@ export async function inferText(prompt, opts = {}) {
         return null;
     }
 }
+/** The one-line header the host sees above the model output.
+ *
+ *  Pure and exported so the reporting contract in PRISM_INFER_TOOL.description
+ *  ("every entitlement-resolved result reports multi_turn and history_turns")
+ *  is assertable without standing up Ollama.
+ *
+ *  Both fields were set on the result and written to the ledger for a release
+ *  before anything rendered them here, so the only way to learn what a call
+ *  carried was to open the SQLite ledger. An agent benchmarking multi-turn
+ *  sent no `messages` across three turns, saw nothing in the response saying
+ *  so, and published the resulting degradation as a model defect. */
+export function inferResponseHeader(result, memory) {
+    const tokenStr = result.prompt_tokens != null || result.completion_tokens != null
+        ? ` tokens=${result.prompt_tokens ?? "?"}in/${result.completion_tokens ?? "?"}out`
+        : "";
+    return (`[prism_infer] backend=${result.backend}` +
+        ` model=${result.model_picked ?? "n/a"}` +
+        ` plan=${result.plan ?? "unknown"}` +
+        ` free_ram=${result.ram_free_mb}MB` +
+        ` latency=${result.latency_ms}ms` +
+        ` used_cloud=${result.used_cloud}` +
+        tokenStr +
+        // What this call actually carried, on every response including zero.
+        // A caller that meant to send history and did not must be able to see
+        // that here; omitting the zero is what made the failure silent.
+        (result.history_turns != null ? ` history_turns=${result.history_turns}` : "") +
+        (result.multi_turn
+            ? ` multi_turn=${result.multi_turn.enabled
+                ? `${result.multi_turn.max_turns}/${result.multi_turn.max_chars}`
+                : "off"}`
+            : "") +
+        // Raise-only: a count of the sections found, and the names of those that
+        // were not. Never a pass/fail word — presence is not clinical soundness.
+        (result.clinical_sections ? ` ${formatClinicalSections(result.clinical_sections)}` : "") +
+        (result.quality_gate_failed ? ` quality_gate_failed=true` : "") +
+        (result.gate_outcome && result.gate_outcome.status !== "success"
+            ? ` gate=${result.gate_outcome.status}${result.gate_outcome.reason ? `:${result.gate_outcome.reason}` : ""}`
+            : "") +
+        (result.entitlements_source && result.entitlements_source !== "portal"
+            ? ` ent_source=${result.entitlements_source}`
+            : "") +
+        (result.verification ? ` verify=${result.verification.action}` : "") +
+        (result.route_guard
+            ? ` route_guard=${result.route_guard.source}:${result.route_guard.action}` +
+                (result.route_guard.reason ? `:${result.route_guard.reason}` : "")
+            : "") +
+        (memory ? ` memory=${memory.project}:${memory.depth}` : "") +
+        (result.attempts.length ? ` attempts=${JSON.stringify(result.attempts)}` : ""));
+}
 export async function prismInferHandler(args) {
     if (!isPrismInferArgs(args)) {
         const raw = typeof args === "object" && args !== null ? args : {};
@@ -2653,30 +2721,7 @@ export async function prismInferHandler(args) {
                 latency_ms: result.latency_ms,
             });
         }
-        const tokenStr = result.prompt_tokens != null || result.completion_tokens != null
-            ? ` tokens=${result.prompt_tokens ?? "?"}in/${result.completion_tokens ?? "?"}out`
-            : "";
-        const headerBase = `[prism_infer] backend=${result.backend}` +
-            ` model=${result.model_picked ?? "n/a"}` +
-            ` plan=${result.plan ?? "unknown"}` +
-            ` free_ram=${result.ram_free_mb}MB` +
-            ` latency=${result.latency_ms}ms` +
-            ` used_cloud=${result.used_cloud}` +
-            tokenStr +
-            (result.quality_gate_failed ? ` quality_gate_failed=true` : "") +
-            (result.gate_outcome && result.gate_outcome.status !== "success"
-                ? ` gate=${result.gate_outcome.status}${result.gate_outcome.reason ? `:${result.gate_outcome.reason}` : ""}`
-                : "") +
-            (result.entitlements_source && result.entitlements_source !== "portal"
-                ? ` ent_source=${result.entitlements_source}`
-                : "") +
-            (result.verification ? ` verify=${result.verification.action}` : "") +
-            (result.route_guard
-                ? ` route_guard=${result.route_guard.source}:${result.route_guard.action}` +
-                    (result.route_guard.reason ? `:${result.route_guard.reason}` : "")
-                : "") +
-            (prepared.memory ? ` memory=${prepared.memory.project}:${prepared.memory.depth}` : "") +
-            (result.attempts.length ? ` attempts=${JSON.stringify(result.attempts)}` : "");
+        const headerBase = inferResponseHeader(result, prepared.memory);
         // Append periodic session-level stats to the header line.
         // compact=true is threshold-gated (PRISM_METRICS_EVERY, default every 5 calls)
         // so it doesn't appear on every response — only as a rolling summary.

package/dist/utils/clinicalQualityPolicy.js

@@ -0,0 +1,152 @@
+/**
+ * Structural gate for clinical behaviour-analytic output.
+ *
+ * The coding gate already proves the shape of this idea: a deterministic check
+ * names a concrete defect, and the named reason drives what happens next.
+ * Python has three static passes behind it. Clinical output had none, so a
+ * behaviour plan missing its decision rules or its data-collection procedure
+ * was served exactly like a complete one.
+ *
+ * Two hard constraints, both deliberate:
+ *
+ *  1. RAISE ONLY — it never certifies. A full section count is a statement
+ *     about presence, not about clinical soundness: a section can be present
+ *     and wrong. Nothing here may be read as "this plan is safe to implement".
+ *     The `bcba_ai_assistant` standard is that the checklist reports what is
+ *     present; a credentialed BCBA decides whether the plan is adequate.
+ *
+ *  2. IT DOES NOT TOUCH THE RESERVED LIST — crisis de-escalation, restraint,
+ *     SIB with injury history and risk assessment never reach a local model at
+ *     all; that boundary is enforced upstream in the Layer 1 screen and is not
+ *     relaxed, widened or re-implemented here. This gate governs the routine
+ *     band that is already local-eligible: operational definitions,
+ *     measurement, antecedent strategies, caregiver training.
+ *
+ * A failure is NOT auto-repaired. The coding repair loop re-prompts the same
+ * tier to fix a syntax defect, which is safe for code; asking a local model to
+ * invent a missing decision-rules section produces plausible unratified
+ * clinical text, which is worse than a visibly incomplete draft. A clinical
+ * reason therefore falls out of the repair loop and escalates instead.
+ */
+/** A full written plan was asked for — the whole section list applies. */
+const CLINICAL_PLAN_REQUEST_RE = /\b(bip\b|behavi(?:o|ou)r(?:al)?[ -](?:intervention|support|management)[ -]plan|behavi(?:o|ou)r plan|treatment plan|intervention plan)\b/i;
+/** An operational definition specifically was asked for. */
+const OPERATIONAL_DEFINITION_REQUEST_RE = /\boperational(?:ly)?[ -]?(?:defin\w*)|\bdefine the (?:target )?behaviou?r\b/i;
+/** Any behaviour-analytic context at all — gates the AAC safety check. */
+const CLINICAL_CONTEXT_RE = /\b(aba\b|bcba\b|behaviou?r analyst|functional behaviou?r assessment|\bfba\b|\bbip\b|replacement behaviou?r|target behaviou?r|reinforcement schedule|\bfct\b|\bdro\b|\bdra\b|\bncr\b)/i;
+/** Ordered so the report reads the way a plan is written. */
+const PLAN_SECTIONS = [
+    { name: "operational_definition", pattern: /operational(?:ly)?[ -]?defin|\bdefinition\b[\s\S]{0,80}\b(observable|measurable)\b/i },
+    { name: "function_hypothesis", pattern: /\b(hypothesi[sz]ed function|function of the behaviou?r|maintained by|\ba-?b-?c\b|antecedent[\s\S]{0,40}consequence)\b/i },
+    { name: "antecedent_strategies", pattern: /\b(antecedent (?:strateg|modificat|intervention)|prevention strateg|setting event|environmental modificat)/i },
+    { name: "replacement_behaviour", pattern: /\b(replacement behaviou?r|functional communication training|\bfct\b|alternative behaviou?r|\bdra\b)/i },
+    { name: "consequence_strategies", pattern: /\b(consequence (?:strateg|procedure)|reinforcement (?:schedule|procedure|strateg)|\bdro\b|\bncr\b|extinction)/i },
+    { name: "data_collection", pattern: /\b(data collection|data sheet|measurement (?:system|procedure)|frequency count|partial interval|momentary time sampling|\bioa\b|interobserver)/i },
+    { name: "decision_rules", pattern: /\b(decision rule|mastery criteri|criteri\w+ for (?:change|modificat|advancement)|review (?:schedule|trigger)|plan review)/i },
+    { name: "generalisation_maintenance", pattern: /\b(generali[sz]|maintenance)\b/i },
+    { name: "caregiver_training", pattern: /\b((?:caregiver|staff|parent|family)[ -]?training|train(?:ing)? (?:the )?(?:caregivers?|staff|parents?))/i },
+    { name: "bcba_review_disclaimer", pattern: /\b(reviewed and individuali[sz]ed|credentialed bcba|licensed behaviou?r analyst|must be reviewed)\b/i },
+];
+/**
+ * AAC access may never be removed, withheld or delayed as a consequence.
+ *
+ * A correct plan states this rule explicitly ("AAC access is never restricted"),
+ * so a bare co-occurrence of an AAC term and a restriction verb fires on GOOD
+ * text. The lookback suppresses a match when the clause is negated. It is
+ * approximate by construction, which is acceptable only because this raises and
+ * never clears: an escalation costs one call, and no output is marked safe here.
+ */
+const AAC_TERM = /\b(aac\b|speech[- ]generating device|\bsgd\b|communication device|communication board|\bpecs\b|talker\b)/i;
+const RESTRICT_VERB = /\b(remov\w+|withh\w+|restrict\w+|tak\w+ away|deni\w+|deny|block\w*|delay\w*|confiscat\w+|limit\w*)\b/i;
+const NEGATOR = /\b(never|not|n't|no|avoid\w*|prohibit\w*|must not|cannot|can't|without)\b/i;
+// Asymmetric on purpose. "remove the AAC device" puts the verb BEFORE the term,
+// so a forward-only window misses the most direct phrasing of the thing this
+// check exists to catch. The backward reach is kept short because a removal
+// sentence about something else ("remove the token board") sitting a paragraph
+// above an AAC mention is not a restriction of AAC.
+const AAC_WINDOW_AFTER = 120;
+const AAC_WINDOW_BEFORE = 40;
+const NEGATION_LOOKBACK = 60;
+/** Clause boundaries. The verb must act on the AAC term, not merely sit near it:
+ *  "AAC remains available at all times; remove the token board" removes a token
+ *  board, and scanning past the semicolon read it as removing AAC. */
+const CLAUSE_BREAK = /[.;:\n]|\bhowever\b|\bwhereas\b/i;
+function clauseAfter(text, from, limit) {
+    const slice = text.slice(from, from + limit);
+    const brk = CLAUSE_BREAK.exec(slice);
+    return brk ? slice.slice(0, brk.index) : slice;
+}
+function clauseBefore(text, end, limit) {
+    const slice = text.slice(Math.max(0, end - limit), end);
+    let last = -1;
+    for (const m of slice.matchAll(new RegExp(CLAUSE_BREAK.source, "gi"))) {
+        last = (m.index ?? 0) + m[0].length;
+    }
+    return last >= 0 ? slice.slice(last) : slice;
+}
+function aacRestrictedAsConsequence(output) {
+    for (const m of output.matchAll(new RegExp(AAC_TERM.source, "gi"))) {
+        const start = m.index ?? 0;
+        const before = clauseBefore(output, start, AAC_WINDOW_BEFORE);
+        const after = clauseAfter(output, start, AAC_WINDOW_AFTER);
+        const from = start - before.length;
+        const window = before + after;
+        const verb = RESTRICT_VERB.exec(window);
+        if (!verb)
+            continue;
+        const absolute = from + (verb.index ?? 0);
+        const lookback = output.slice(Math.max(0, absolute - NEGATION_LOOKBACK), absolute);
+        if (NEGATOR.test(lookback))
+            continue; // "AAC access is never removed"
+        return true;
+    }
+    return false;
+}
+/**
+ * Raise-only structural check. `pass: true` means nothing was detected as
+ * missing — it is not a clinical endorsement.
+ */
+export function passesClinicalQualityGate(prompt, output) {
+    // An operational-definition request is clinical on its own: "write an
+    // operational definition of elopement" names no ABA vocabulary the broad
+    // pattern looks for, and was silently skipped before.
+    const clinicalContext = CLINICAL_CONTEXT_RE.test(prompt)
+        || CLINICAL_PLAN_REQUEST_RE.test(prompt)
+        || OPERATIONAL_DEFINITION_REQUEST_RE.test(prompt);
+    if (!clinicalContext)
+        return { pass: true };
+    if (aacRestrictedAsConsequence(output)) {
+        return { pass: false, reason: "clinical_aac_restricted_as_consequence" };
+    }
+    if (OPERATIONAL_DEFINITION_REQUEST_RE.test(prompt)) {
+        const hasExamples = /\bexamples?\b/i.test(output);
+        const hasNonExamples = /\bnon-?examples?\b/i.test(output);
+        if (!hasExamples || !hasNonExamples) {
+            return { pass: false, reason: "clinical_operational_definition_incomplete" };
+        }
+    }
+    if (!CLINICAL_PLAN_REQUEST_RE.test(prompt))
+        return { pass: true };
+    const missing = PLAN_SECTIONS.filter(s => !s.pattern.test(output)).map(s => s.name);
+    const sections = {
+        required: PLAN_SECTIONS.length,
+        present: PLAN_SECTIONS.length - missing.length,
+        missing,
+    };
+    // An incomplete plan REPORTS; it does not fail. Failing the gate rejects the
+    // output, and when escalation is unavailable the caller receives nothing at
+    // all — measured in review: a 3-of-10 plan with cloud_fallback:true and an
+    // unreachable portal returned "no backend produced output". A draft labelled
+    // `clinical_sections=3/10 missing:...` is strictly more useful to a clinician
+    // than silence, and suppressing it contradicts the raise-only rule above.
+    //
+    // The two findings ABOVE do fail, because they are defects rather than
+    // incompleteness: AAC restricted as a consequence is a safety violation, and
+    // an operational definition without non-examples is wrong, not unfinished.
+    return { pass: true, sections };
+}
+/** Compact, raise-only header fragment. Counts only — never a verdict word. */
+export function formatClinicalSections(s) {
+    const base = `clinical_sections=${s.present}/${s.required}`;
+    return s.missing.length ? `${base} missing:${s.missing.join(",")}` : base;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.2",
+  "version": "20.21.3",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",