prism-mcp-server 20.21.21 → 20.21.23

package/dist/storage/configStorage.js

@@ -3,6 +3,7 @@ import { resolve, dirname } from "path";
 import { homedir } from "os";
 import { existsSync } from "fs";
 import { mkdirUsableSync } from "../utils/usableDirectory.js";
+import { createHash, randomUUID } from "node:crypto";
 const PROTO_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 // We use a small, dedicated DB just for configuration settings.
 // This solves the chicken-and-egg problem: we need to know WHICH
@@ -97,6 +98,14 @@ export async function initConfigStorage() {
         PRIMARY KEY (conversation_hash, project_hash)
       )
     `);
+        await client.execute(`CREATE TABLE IF NOT EXISTS dark_factory_authority (
+      pipeline_id TEXT PRIMARY KEY, fingerprint TEXT NOT NULL, project TEXT NOT NULL,
+      user_id TEXT NOT NULL, started_at TEXT NOT NULL, spec_json TEXT NOT NULL,
+      created_at INTEGER NOT NULL
+    )`);
+        await client.execute(`CREATE TABLE IF NOT EXISTS dark_factory_execution_leases (
+      pipeline_id TEXT PRIMARY KEY, token TEXT NOT NULL, expires_at INTEGER NOT NULL, reclaimed INTEGER NOT NULL DEFAULT 0
+    )`);
         // Preload all rows into the cache so subsequent reads are zero-cost.
         const rs = await client.execute("SELECT key, value FROM system_settings");
         settingsCache = Object.create(null);
@@ -387,6 +396,41 @@ export async function getAllSettings() {
     }
     return settings;
 }
+export const DEFAULT_FACTORY_LEASE_MS = 30_000;
+export const FACTORY_LEASE_RENEW_MS = 10_000;
+function authorityFingerprint(p) {
+    const parsed = Date.parse(p.started_at);
+    if (!Number.isFinite(parsed))
+        throw new Error("Invalid Factory pipeline start time");
+    const normalized = { id: p.id, project: p.project, user_id: p.user_id, started_at: new Date(parsed).toISOString(), spec: p.spec };
+    return createHash("sha256").update(JSON.stringify(normalized)).digest("hex");
+}
+export async function registerFactoryAuthority(p) {
+    await initConfigStorage();
+    const fingerprint = authorityFingerprint(p);
+    await getClient().execute({ sql: `INSERT INTO dark_factory_authority (pipeline_id,fingerprint,project,user_id,started_at,spec_json,created_at) VALUES (?,?,?,?,?,?,?) ON CONFLICT(pipeline_id) DO NOTHING`, args: [p.id, fingerprint, p.project, p.user_id, p.started_at, JSON.stringify(p.spec), Date.now()] });
+    const existing = await getClient().execute({ sql: `SELECT fingerprint FROM dark_factory_authority WHERE pipeline_id=?`, args: [p.id] });
+    if (existing.rows[0]?.fingerprint !== fingerprint)
+        throw new Error("Factory authority fingerprint mismatch");
+    return fingerprint;
+}
+export async function isFactoryAuthorized(p) {
+    await initConfigStorage();
+    const rs = await getClient().execute({ sql: `SELECT fingerprint FROM dark_factory_authority WHERE pipeline_id=?`, args: [p.id] });
+    return rs.rows.length === 1 && rs.rows[0].fingerprint === authorityFingerprint(p);
+}
+export async function claimFactoryLease(p, leaseMs = DEFAULT_FACTORY_LEASE_MS) {
+    await initConfigStorage();
+    const token = randomUUID();
+    const now = Date.now();
+    const expires = now + leaseMs;
+    const client = getClient();
+    const result = await client.execute({ sql: `INSERT INTO dark_factory_execution_leases (pipeline_id,token,expires_at,reclaimed) SELECT ?,?,?,0 FROM dark_factory_authority WHERE pipeline_id=? AND fingerprint=? ON CONFLICT(pipeline_id) DO UPDATE SET token=excluded.token,expires_at=excluded.expires_at,reclaimed=CASE WHEN dark_factory_execution_leases.reclaimed=1 OR (dark_factory_execution_leases.token <> '' AND dark_factory_execution_leases.expires_at <= ?) THEN 1 ELSE 0 END WHERE dark_factory_execution_leases.expires_at <= ? RETURNING reclaimed`, args: [p.id, token, expires, p.id, authorityFingerprint(p), now, now] });
+    if (!result.rows.length)
+        return null;
+    const reclaimed = Number(result.rows[0].reclaimed) === 1;
+    return { token, reclaimed, isHeld: async () => { const heldNow = Date.now(); const held = await client.execute({ sql: `SELECT 1 FROM dark_factory_execution_leases WHERE pipeline_id=? AND token=? AND expires_at>? AND EXISTS (SELECT 1 FROM dark_factory_authority WHERE pipeline_id=? AND fingerprint=?)`, args: [p.id, token, heldNow, p.id, authorityFingerprint(p)] }); return held.rows.length === 1; }, renew: async () => { const renewNow = Date.now(); const renewed = await client.execute({ sql: `UPDATE dark_factory_execution_leases SET expires_at=? WHERE pipeline_id=? AND token=? AND expires_at>? AND EXISTS (SELECT 1 FROM dark_factory_authority WHERE pipeline_id=? AND fingerprint=?)`, args: [renewNow + leaseMs, p.id, token, renewNow, p.id, authorityFingerprint(p)] }); return renewed.rowsAffected === 1; }, acknowledgeRecovery: async () => { await client.execute({ sql: `UPDATE dark_factory_execution_leases SET reclaimed=0 WHERE pipeline_id=? AND token=?`, args: [p.id, token] }); }, release: async () => { await client.execute({ sql: `UPDATE dark_factory_execution_leases SET expires_at=0,token='' WHERE pipeline_id=? AND token=?`, args: [p.id, token] }); } };
+}
 /**
  * Closes the config SQLite client to release the file handle on prism-config.db.
  * Called by the lifecycle module during graceful shutdown.
@@ -399,5 +443,10 @@ export function closeConfigStorage() {
         catch (e) {
             console.error(`[ConfigStorage] Error closing db:`, e);
         }
+        finally {
+            configClient = null;
+            initialized = false;
+            settingsCache = null;
+        }
     }
 }

package/dist/storage/index.js

@@ -123,8 +123,22 @@ async function ensureSupabaseCredentials() {
     return false;
 }
 let storageInstance = null;
+let storageInitialization = null;
 export let activeStorageBackend = "local";
 export async function getStorage() {
+    if (storageInitialization)
+        return storageInitialization;
+    if (storageInstance)
+        return storageInstance;
+    storageInitialization = initializeStorage();
+    try {
+        return await storageInitialization;
+    }
+    finally {
+        storageInitialization = null;
+    }
+}
+async function initializeStorage() {
     if (storageInstance)
         return storageInstance;
     const envStorage = process.env.PRISM_STORAGE;
@@ -198,21 +212,33 @@ export async function getStorage() {
     // ─── Initialize ───────────────────────────────────────────────
     activeStorageBackend = requested;
     debugLog(`[Prism Storage] Initializing backend: ${activeStorageBackend}`);
+    let instance;
     if (activeStorageBackend === "synalux") {
         const { SynaluxStorage } = await import("./synalux.js");
-        storageInstance = new SynaluxStorage();
+        instance = new SynaluxStorage();
     }
     else if (activeStorageBackend === "supabase") {
-        storageInstance = new SupabaseStorage();
+        instance = new SupabaseStorage();
     }
     else if (activeStorageBackend === "local") {
         const { SqliteStorage } = await import("./sqlite.js");
-        storageInstance = new SqliteStorage();
+        instance = new SqliteStorage();
     }
     else {
         throw new Error(`Unknown PRISM_STORAGE value: "${activeStorageBackend}".`);
     }
-    await storageInstance.initialize(activeStorageBackend === "local");
+    try {
+        await instance.initialize(activeStorageBackend === "local");
+    }
+    catch (error) {
+        try {
+            await instance.close();
+        }
+        catch (cleanupError) {
+            throw new Error(`${error instanceof Error ? error.message : String(error)}; storage cleanup failed: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`, { cause: error });
+        }
+        throw error;
+    }
     // ─── Cross-backend reconciliation (local + Supabase available) ─
     // v9.2.4: when running on local SQLite but Supabase credentials exist, pull
     // newer handoffs from Supabase into SQLite. Fixes the split-brain where one
@@ -222,16 +248,19 @@ export async function getStorage() {
         try {
             const { reconcileHandoffs } = await import("./reconcile.js");
             const { SqliteStorage } = await import("./sqlite.js");
-            const sqliteInstance = storageInstance;
-            await reconcileHandoffs(storageInstance, () => sqliteInstance.getHandoffTimestamps());
+            const sqliteInstance = instance;
+            await reconcileHandoffs(instance, () => sqliteInstance.getHandoffTimestamps());
         }
         catch (err) {
             debugLog(`[Prism Storage] Reconciliation skipped: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
-    return storageInstance;
+    storageInstance = instance;
+    return instance;
 }
 export async function closeStorage() {
+    if (storageInitialization)
+        await storageInitialization.catch(() => { });
     if (!storageInstance)
         return;
     const closing = storageInstance;
@@ -246,6 +275,7 @@ export async function closeStorage() {
     }
     finally {
         storageInstance = null;
+        storageInitialization = null;
     }
 }
 /**
@@ -264,4 +294,5 @@ export async function closeStorage() {
  */
 export function _setStorageForTesting(instance) {
     storageInstance = instance;
+    storageInitialization = null;
 }

package/dist/storage/portalContracts.js

@@ -17,6 +17,7 @@
  *   3. Add a schema-contract test in synalux-portal-contract.test.ts.
  */
 import { z } from "zod";
+import { TestAssertionSchema } from '../verification/schema.js';
 import { ANALYTICS_DATE_PATTERN } from "../dashboard/readMessages.js";
 const AnalyticsCountSchema = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
 const UTC_DAY_MS = 24 * 60 * 60 * 1000;
@@ -40,6 +41,60 @@ export const ProjectAnalyticsResponseSchema = z.object({
     project: z.string().min(1).max(100),
     analytics: ProjectAnalyticsSchema,
 });
+// Factory reads fail closed: corrupt rows must not become an empty or partial list.
+const PipelineTextSchema = z.string().refine(value => value.trim().length > 0);
+const PipelineTimestampSchema = z.string().refine(value => Number.isFinite(Date.parse(value)));
+const PipelineSpecSchema = z.string().refine(value => {
+    try {
+        const spec = JSON.parse(value);
+        return spec !== null && typeof spec === 'object' && !Array.isArray(spec);
+    }
+    catch {
+        return false;
+    }
+});
+export const FactoryPipelineSchema = z.object({
+    id: PipelineTextSchema,
+    project: PipelineTextSchema,
+    user_id: PipelineTextSchema,
+    status: z.enum(['PENDING', 'RUNNING', 'PAUSED', 'ABORTED', 'COMPLETED', 'FAILED']),
+    current_step: PipelineTextSchema,
+    iteration: AnalyticsCountSchema,
+    eval_revisions: AnalyticsCountSchema.optional(),
+    started_at: PipelineTimestampSchema,
+    updated_at: PipelineTimestampSchema,
+    spec: PipelineSpecSchema,
+    error: z.string().nullable().optional(),
+    last_heartbeat: PipelineTimestampSchema.nullable().optional(),
+    contract_payload: z.object({
+        criteria: z.array(z.object({ id: z.string(), description: z.string() }).passthrough()),
+    }).passthrough().nullable().optional(),
+    notes: z.string().nullable().optional(),
+}).passthrough();
+export const FactoryPipelinesResponseSchema = z.object({
+    status: z.literal('success'),
+    pipelines: z.array(FactoryPipelineSchema).max(100)
+        .refine(rows => new Set(rows.map(row => row.id)).size === rows.length),
+});
+export const FactoryPipelineResponseSchema = z.object({
+    status: z.literal('success'),
+    pipeline: FactoryPipelineSchema.nullable(),
+});
+const VerificationHarnessSchema = z.object({
+    project: z.string().min(1), conversation_id: z.string().min(1), created_at: PipelineTimestampSchema,
+    rubric_hash: z.string().regex(/^[a-f0-9]{64}$/), min_pass_rate: z.number().min(0).max(1),
+    tests: z.array(z.custom(value => TestAssertionSchema.safeParse(value).success)), metadata: z.record(z.string(), z.unknown()).optional(),
+});
+const VerificationRunSchema = z.object({
+    id: z.string().min(1), rubric_hash: z.string().regex(/^[a-f0-9]{64}$/), project: z.string().min(1),
+    conversation_id: z.string().min(1), run_at: PipelineTimestampSchema, passed: z.boolean(),
+    pass_rate: z.number().min(0).max(1), critical_failures: AnalyticsCountSchema,
+    coverage_score: z.number().min(0).max(1), result_json: PipelineSpecSchema,
+    gate_action: z.enum(['continue', 'block', 'abort']), gate_override: z.boolean().optional(), override_reason: z.string().optional(),
+});
+export const FactoryHarnessResponseSchema = z.object({ status: z.literal('success'), harness: VerificationHarnessSchema.nullable(), reused: z.boolean().optional() });
+export const FactoryRunResponseSchema = z.object({ status: z.literal('success'), run: VerificationRunSchema.nullable() });
+export const FactoryRunsResponseSchema = z.object({ status: z.literal('success'), runs: z.array(VerificationRunSchema).max(100).refine(runs => new Set(runs.map(run => run.id)).size === runs.length) });
 // ─── knowledge_search ────────────────────────────────────────────
 export const KnowledgeSearchRequestSchema = z.object({
     action: z.literal("knowledge_search"),

package/dist/storage/sqlite.js

@@ -3105,10 +3105,11 @@ export class SqliteStorage {
     }
     // ─── Dark Factory (v7.3) ───────────────────────────────────
     async savePipeline(state) {
-        const now = new Date().toISOString();
-        const updatedState = { ...state, updated_at: now };
         // Status Guard: prevent overwriting a terminated pipeline
         const existing = await this.getPipeline(state.id, state.user_id);
+        const clock = Date.now();
+        const prior = existing ? Date.parse(existing.updated_at) : 0;
+        const updatedState = { ...state, updated_at: new Date(Math.max(clock, prior + 1)).toISOString() };
         if (existing) {
             if (existing.status === 'ABORTED' || existing.status === 'COMPLETED') {
                 throw new Error(`Cannot update pipeline ${state.id} because it is already ${existing.status}.`);
@@ -3120,7 +3121,7 @@ export class SqliteStorage {
                     `${SafetyController.getLegalTransitions(existing.status).join(', ') || 'NONE (terminal)'}.`);
             }
         }
-        await this.db.execute({
+        const result = await this.db.execute({
             sql: `
         INSERT INTO dark_factory_pipelines (id, project, user_id, status, current_step, iteration, eval_revisions, started_at, updated_at, spec, error, last_heartbeat, contract_payload, notes)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
@@ -3135,6 +3136,9 @@ export class SqliteStorage {
           last_heartbeat = excluded.last_heartbeat,
           contract_payload = excluded.contract_payload,
           notes = excluded.notes
+        WHERE dark_factory_pipelines.user_id = excluded.user_id
+          AND dark_factory_pipelines.updated_at = ?
+          AND dark_factory_pipelines.status NOT IN ('ABORTED', 'COMPLETED')
       `,
             args: [
                 updatedState.id,
@@ -3150,9 +3154,14 @@ export class SqliteStorage {
                 updatedState.error || null,
                 updatedState.last_heartbeat || null,
                 updatedState.contract_payload ? JSON.stringify(updatedState.contract_payload) : null,
-                updatedState.notes || null
+                updatedState.notes || null,
+                existing ? state.updated_at : null
             ]
         });
+        if (result.rowsAffected !== 1) {
+            throw new Error(`Pipeline ${state.id} changed concurrently or is no longer writable.`);
+        }
+        state.updated_at = updatedState.updated_at;
     }
     async getPipeline(id, userId) {
         const result = await this.db.execute({

package/dist/storage/supabase.js

@@ -1283,10 +1283,11 @@ export class SupabaseStorage {
     }
     // ─── Dark Factory (v7.3) ───────────────────────────────────
     async savePipeline(state) {
-        const now = new Date().toISOString();
-        const updatedState = { ...state, updated_at: now };
         // Status Guard: prevent overwriting a terminated pipeline
         const existing = await this.getPipeline(state.id, state.user_id);
+        const clock = Date.now();
+        const prior = existing ? Date.parse(existing.updated_at) : 0;
+        const updatedState = { ...state, updated_at: new Date(Math.max(clock, prior + 1)).toISOString() };
         if (existing) {
             if (existing.status === 'ABORTED' || existing.status === 'COMPLETED') {
                 throw new Error(`Cannot update pipeline ${state.id} because it is already ${existing.status}.`);
@@ -1299,7 +1300,26 @@ export class SupabaseStorage {
             }
         }
         try {
-            await supabasePost("dark_factory_pipelines", {
+            if (existing) {
+                const result = await supabasePatch("dark_factory_pipelines", {
+                    user_id: updatedState.user_id,
+                    status: updatedState.status,
+                    current_step: updatedState.current_step,
+                    iteration: updatedState.iteration,
+                    updated_at: updatedState.updated_at,
+                    spec: updatedState.spec,
+                    error: updatedState.error || null,
+                    last_heartbeat: updatedState.last_heartbeat || null,
+                    eval_revisions: updatedState.eval_revisions ?? 0,
+                    contract_payload: updatedState.contract_payload ? JSON.stringify(updatedState.contract_payload) : null,
+                    notes: updatedState.notes || null,
+                }, { id: `eq.${state.id}`, user_id: `eq.${state.user_id}`, updated_at: `eq.${state.updated_at}`, status: `eq.${existing.status}` }, { Prefer: "return=representation" });
+                if (!Array.isArray(result) || result.length !== 1)
+                    throw new Error(`Pipeline ${state.id} changed concurrently or is no longer writable.`);
+                state.updated_at = updatedState.updated_at;
+                return;
+            }
+            const inserted = await supabasePost("dark_factory_pipelines", {
                 id: updatedState.id,
                 project: updatedState.project,
                 user_id: updatedState.user_id,
@@ -1317,13 +1337,15 @@ export class SupabaseStorage {
                     ? JSON.stringify(updatedState.contract_payload)
                     : null,
                 notes: updatedState.notes || null,
-            }, { on_conflict: "id" }, { Prefer: "return=minimal,resolution=merge-duplicates" });
+            }, { on_conflict: "id" }, { Prefer: "return=representation" });
+            if (!Array.isArray(inserted) || inserted.length !== 1)
+                throw new Error(`Pipeline ${state.id} was not created.`);
         }
         catch (e) {
             // PGRST202 fallback if the table doesn't exist yet
             if (e.message?.includes("PGRST202") || e.message?.includes("Could not find the relation")) {
                 debugLog("[SupabaseStorage] dark_factory_pipelines missing — please run migration 038");
-                return;
+                throw new Error(`Pipeline ${state.id} was not saved because dark_factory_pipelines is unavailable.`);
             }
             throw e;
         }

package/dist/storage/synalux.js

@@ -31,6 +31,7 @@
  *     - getEntriesMissingEmbeddings → POST /api/v1/prism/memory  action=list_missing_embeddings
  *     - listProjects      → POST /api/v1/prism/memory  action=list_projects
  *     - getAnalytics      → GET /api/v1/prism/analytics  view=project
+ *     - listPipelines     → GET /api/v1/prism/factory/pipelines
  *     - exportLedger      → POST /api/v1/prism/memory  action=export_memory (paginated)
  *
  *   Methods still falling through to SupabaseStorage (Phase 3 Tier B+):
@@ -52,7 +53,7 @@ import { SupabaseStorage } from "./supabase.js";
 import { debugLog } from "../utils/logger.js";
 import { PRISM_SYNALUX_BASE_URL, PRISM_SYNALUX_API_KEY } from "../config.js";
 import { isSynaluxSignedOut } from "../utils/synaluxCredentialState.js";
-import { KnowledgeSearchRequestSchema, KnowledgeSearchResponseSchema, ProjectAnalyticsResponseSchema } from "./portalContracts.js";
+import { KnowledgeSearchRequestSchema, KnowledgeSearchResponseSchema, ProjectAnalyticsResponseSchema, FactoryPipelinesResponseSchema, FactoryPipelineResponseSchema, FactoryHarnessResponseSchema, FactoryRunResponseSchema, FactoryRunsResponseSchema } from "./portalContracts.js";
 function resolveKnowledgeScope(callerScope) {
     if (callerScope === "user" || callerScope === "workspace") {
         return callerScope;
@@ -77,6 +78,7 @@ export class SynaluxStorage extends SupabaseStorage {
     inflightContextLoads = new Map();
     closeController = new AbortController();
     closed = false;
+    factoryReady = false;
     constructor() {
         super();
         const url = process.env.PRISM_SYNALUX_BASE_URL || PRISM_SYNALUX_BASE_URL;
@@ -94,9 +96,18 @@ export class SynaluxStorage extends SupabaseStorage {
     }
     async initialize(_isLocal = false) {
         debugLog(`[SynaluxStorage] Initializing (portal=${this.baseUrl})`);
+        try {
+            const capabilities = await this.portalPost('/api/v1/prism/factory/verification', { action: 'capabilities' });
+            this.factoryReady = capabilities.status === 'success' && capabilities.execution_ready === true;
+        }
+        catch {
+            this.factoryReady = false;
+        }
     }
+    isFactoryReady() { return !this.closed && !isSynaluxSignedOut() && this.factoryReady; }
     async close() {
         this.closed = true;
+        this.factoryReady = false;
         this.cachedJwt = null;
         this.cachedJwtExpiresAt = 0;
         this.closeController.abort();
@@ -758,6 +769,71 @@ export class SynaluxStorage extends SupabaseStorage {
             created_at: v.created_at ?? new Date().toISOString(),
         }));
     }
+    // ─── Factory read path ────────────────────────────────────────
+    async getPipeline(id, _userId) {
+        const result = FactoryPipelineResponseSchema.safeParse(await this.portalGet(`/api/v1/prism/factory/pipeline?id=${encodeURIComponent(id)}`));
+        if (!result.success || (result.data.pipeline && result.data.pipeline.id !== id))
+            throw new Error('[SynaluxStorage] Invalid Factory pipeline response');
+        return result.data.pipeline;
+    }
+    async saveVerificationHarness(harness, _userId) {
+        const result = FactoryHarnessResponseSchema.safeParse(await this.portalPost('/api/v1/prism/factory/verification', { action: 'save_harness', harness }));
+        if (!result.success || !result.data.harness || result.data.harness.rubric_hash !== harness.rubric_hash
+            || result.data.harness.min_pass_rate !== harness.min_pass_rate
+            || (!result.data.reused && (result.data.harness.project !== harness.project || result.data.harness.conversation_id !== harness.conversation_id)))
+            throw new Error('[SynaluxStorage] Invalid verification harness save response');
+    }
+    async getVerificationHarness(rubric_hash, _userId) {
+        const result = FactoryHarnessResponseSchema.safeParse(await this.portalPost('/api/v1/prism/factory/verification', { action: 'get_harness', rubric_hash }));
+        if (!result.success || (result.data.harness && result.data.harness.rubric_hash !== rubric_hash))
+            throw new Error('[SynaluxStorage] Invalid verification harness response');
+        return result.data.harness;
+    }
+    async saveVerificationRun(run, _userId) {
+        const result = FactoryRunResponseSchema.safeParse(await this.portalPost('/api/v1/prism/factory/verification', { action: 'save_run', run }));
+        if (!result.success || !result.data.run || result.data.run.id !== run.id || result.data.run.rubric_hash !== run.rubric_hash
+            || result.data.run.project !== run.project || result.data.run.conversation_id !== run.conversation_id || result.data.run.result_json !== run.result_json)
+            throw new Error('[SynaluxStorage] Invalid verification run save response');
+    }
+    async getVerificationRun(id, _userId) {
+        const result = FactoryRunResponseSchema.safeParse(await this.portalPost('/api/v1/prism/factory/verification', { action: 'get_run', id }));
+        if (!result.success || (result.data.run && result.data.run.id !== id))
+            throw new Error('[SynaluxStorage] Invalid verification run response');
+        return result.data.run;
+    }
+    async listVerificationRuns(project, _userId) {
+        const result = FactoryRunsResponseSchema.safeParse(await this.portalPost('/api/v1/prism/factory/verification', { action: 'list_runs', project }));
+        if (!result.success || result.data.runs.some(run => run.project !== project))
+            throw new Error('[SynaluxStorage] Invalid verification runs response');
+        return result.data.runs;
+    }
+    async savePipeline(state) {
+        const { user_id: _userId, ...pipeline } = state;
+        const create = state.status === 'PENDING' && state.current_step === 'INIT' && state.iteration === 0 && state.started_at === state.updated_at;
+        const result = FactoryPipelineResponseSchema.safeParse(await this.portalPost('/api/v1/prism/factory/pipeline', {
+            operation: create ? 'create' : 'update', pipeline,
+            ...(create ? {} : { expected_updated_at: state.updated_at }),
+        }));
+        if (!result.success || !result.data.pipeline || result.data.pipeline.id !== state.id || result.data.pipeline.project !== state.project
+            || result.data.pipeline.status !== state.status || result.data.pipeline.current_step !== state.current_step
+            || result.data.pipeline.iteration !== state.iteration || result.data.pipeline.spec !== state.spec
+            || Date.parse(result.data.pipeline.updated_at) <= Date.parse(state.updated_at))
+            throw new Error('[SynaluxStorage] Invalid Factory save response');
+        state.updated_at = result.data.pipeline.updated_at;
+        state.user_id = result.data.pipeline.user_id;
+    }
+    async listPipelines(project, status, _userId) {
+        const query = new URLSearchParams();
+        if (project !== undefined)
+            query.set('project', project);
+        if (status !== undefined)
+            query.set('status', status);
+        const result = FactoryPipelinesResponseSchema.safeParse(await this.portalGet('/api/v1/prism/factory/pipelines' + (query.size ? '?' + query : '')));
+        if (!result.success || result.data.pipelines.some(row => (project !== undefined && row.project !== project) || (status !== undefined && row.status !== status))) {
+            throw new Error('Factory pipelines unavailable');
+        }
+        return result.data.pipelines;
+    }
     // ─── Health Check ─────────────────────────────────────────────
     async getAnalytics(project, _userId) {
         const query = new URLSearchParams({ view: 'project', project });

package/dist/tools/ledgerHandlers.js

@@ -37,6 +37,9 @@ import { mergeHandoff, dbToHandoffSchema, sanitizeForMerge } from "../utils/crdt
 import { resolveProject } from "../utils/projectResolver.js";
 import { getUpdateNotice } from "../updateNotice.js";
 import { findRunningDashboardAccessState } from "../dashboard/dashboardAccess.js";
+import { isDarkFactoryEnabled } from "../darkfactory/enablement.js";
+import { routeFactoryPrompt, formatFactoryPromptRoute } from "../darkfactory/promptRouting.js";
+import { factoryBackendReadiness } from "../darkfactory/backendReadiness.js";
 // The running server's own version, for the update-available notice. A read
 // failure must never affect startup: an empty string fails the notice's
 // semver gate, so no notice renders rather than a bogus "running 0.0.0".
@@ -2317,10 +2320,20 @@ export async function sessionRoutePromptHandler(args) {
         ? input.loaded.filter((n) => typeof n === "string")
         : [];
     const result = await runPromptRouteFromCache(prompt, loaded);
+    const project = typeof input.project === "string" ? input.project : undefined;
+    const workingDirectory = typeof input.working_directory === "string" ? input.working_directory :
+        (project ? await getSetting(`repo_path:${project}`, "") : "") || undefined;
+    const route = routeFactoryPrompt(prompt, {
+        enabled: isDarkFactoryEnabled(), project, working_directory: workingDirectory,
+        files_involved: Array.isArray(input.files_involved) ? input.files_involved.filter((file) => typeof file === "string") : undefined,
+        test_command: typeof input.test_command === "string" ? input.test_command : undefined,
+        ...(await factoryBackendReadiness()),
+        allowed_write_paths: Array.isArray(input.allowed_write_paths) ? input.allowed_write_paths.filter((file) => typeof file === "string") : undefined,
+    });
     // Text only, never structuredContent. A result carrying both lets a host
     // surface just the structured half — which is exactly how Claude Code
     // silently dropped the bootstrap payload for three weeks.
-    return { content: [{ type: "text", text: result.text }] };
+    return { content: [{ type: "text", text: `${result.text}\n\n${formatFactoryPromptRoute(route)}` }] };
 }
 export async function sessionBootstrapHandler(args = {}, options = {}) {
     if (typeof args !== "object" || args === null || Array.isArray(args)) {
@@ -2357,7 +2370,16 @@ export async function sessionBootstrapHandler(args = {}, options = {}) {
         : "developer";
     const role = sanitizeNativeIdentity(defaultRole) || "global";
     const manifestSnapshot = await resolveNativeSkillManifestSnapshot(skillSyncResult);
-    const { text: systemReadyBlock, floorDigestChars } = await buildNativeSystemReadyBlock(manifestSnapshot, depth);
+    const { text: baseSystemReadyBlock, floorDigestChars } = await buildNativeSystemReadyBlock(manifestSnapshot, depth);
+    const startupProject = projects.length === 1 ? projects[0] : undefined;
+    const startupFactoryRoute = routeFactoryPrompt(typeof input.prompt === "string" ? input.prompt : "", {
+        enabled: isDarkFactoryEnabled(), project: startupProject,
+        working_directory: startupProject ? await getSetting(`repo_path:${startupProject}`, "") : undefined,
+        ...(await factoryBackendReadiness()),
+    });
+    const factoryStatusLine = `- 🏭 **Factory:** ${isDarkFactoryEnabled() ? "enabled" : "disabled"} for this MCP startup; enablement does not prove execution readiness.`;
+    const systemReadyBlock = `${baseSystemReadyBlock}\n${factoryStatusLine}` +
+        (startupFactoryRoute.candidate ? `\n${formatFactoryPromptRoute(startupFactoryRoute)}\nFor a suitable request, supply the current workspace and verification command through session_route_prompt, then automatically call its recommended pipeline tool.` : "");
     // First run = the dashboard has never been touched: no agent identity AND no
     // projects. Measured 2026-08-05: a brand-new free-tier install was greeted
     // with "Welcome back", three "Not loaded" rows, a warning, and three

package/dist/tools/pipelineDefinitions.js

@@ -3,7 +3,7 @@ export const SESSION_START_PIPELINE_TOOL = {
     name: "session_start_pipeline",
     description: "Start an autonomous Dark Factory pipeline. The pipeline runs in the background " +
         "and executes a PLAN → EXECUTE → VERIFY cycle up to `max_iterations` times.\n\n" +
-        "**Requires:** `PRISM_DARK_FACTORY_ENABLED=true` in the environment.\n\n" +
+        "**Requires:** Dark Factory is enabled at startup (enabled by default; the dashboard setting applies when no explicit `PRISM_DARK_FACTORY_ENABLED=true|false` override is present).\n\n" +
         "**How it works:**\n" +
         "1. Call this tool with an objective (what to accomplish)\n" +
         "2. The pipeline is queued and executes autonomously in the background\n" +
@@ -45,6 +45,8 @@ export const SESSION_START_PIPELINE_TOOL = {
                 description: "Optional model name to use instead of the default LLM. " +
                     "Useful for routing to a local model (e.g., 'qwen3') via Claw.",
             },
+            test_command: { type: "string", description: "Caller-authorized verification command. Factory runs this without a shell and requires it to pass." },
+            allowed_write_paths: { type: "array", items: { type: "string" }, description: "Relative files Factory may change. Other context files remain read-only." },
         },
         required: ["project", "objective"],
     },
@@ -109,6 +111,10 @@ export function isStartPipelineArgs(args) {
         return false;
     if (a.model_override !== undefined && typeof a.model_override !== "string")
         return false;
+    if (a.test_command !== undefined && (typeof a.test_command !== "string" || !a.test_command.trim()))
+        return false;
+    if (a.allowed_write_paths !== undefined && (!Array.isArray(a.allowed_write_paths) || !a.allowed_write_paths.every((f) => typeof f === "string" && f.trim())))
+        return false;
     return true;
 }
 export function isCheckPipelineStatusArgs(args) {

package/dist/tools/pipelineHandlers.js

@@ -10,11 +10,13 @@
  * all other tools in /tools/*.ts.
  */
 import { randomUUID } from 'crypto';
+import { resolve } from 'node:path';
 import { getStorage } from '../storage/index.js';
 import { PRISM_USER_ID } from '../config.js';
 import { getSettingSync } from '../storage/configStorage.js';
 import { isStartPipelineArgs, isCheckPipelineStatusArgs, isAbortPipelineArgs, } from './pipelineDefinitions.js';
 import { debugLog } from '../utils/logger.js';
+import { registerPipelineAuthority } from '../darkfactory/executionAuthority.js';
 // ─── Start Pipeline Handler ─────────────────────────────────
 export async function sessionStartPipelineHandler(args) {
     if (!isStartPipelineArgs(args)) {
@@ -23,7 +25,7 @@ export async function sessionStartPipelineHandler(args) {
             isError: true,
         };
     }
-    const { project, objective, working_directory, max_iterations, context_files, model_override } = args;
+    const { project, objective, working_directory, max_iterations, context_files, model_override, test_command, allowed_write_paths } = args;
     // Resolve working directory: explicit arg > dashboard repo_path > reject
     let resolvedWorkDir = working_directory;
     if (!resolvedWorkDir) {
@@ -37,6 +39,7 @@ export async function sessionStartPipelineHandler(args) {
             };
         }
     }
+    resolvedWorkDir = resolve(resolvedWorkDir);
     const pipelineId = randomUUID();
     const now = new Date().toISOString();
     const spec = {
@@ -45,6 +48,8 @@ export async function sessionStartPipelineHandler(args) {
         workingDirectory: resolvedWorkDir,
         contextFiles: context_files,
         modelOverride: model_override,
+        testCommand: test_command,
+        allowedWritePaths: allowed_write_paths,
     };
     const pipelineState = {
         id: pipelineId,
@@ -62,6 +67,18 @@ export async function sessionStartPipelineHandler(args) {
     try {
         const storage = await getStorage();
         await storage.savePipeline(pipelineState);
+        try {
+            await registerPipelineAuthority(pipelineState);
+        }
+        catch (error) {
+            try {
+                await storage.savePipeline({ ...pipelineState, status: 'ABORTED', error: 'Local execution authorization could not be persisted.' });
+            }
+            catch (abortError) {
+                throw new Error(`Local execution authorization failed; cancelling the queued pipeline also failed: ${abortError instanceof Error ? abortError.message : String(abortError)}`, { cause: error });
+            }
+            throw error;
+        }
         debugLog(`[PipelineHandler] Pipeline ${pipelineId} created for project=${project} objective="${objective.slice(0, 80)}"`);
         return {
             content: [{

package/dist/tools/sessionMemoryDefinitions.js

@@ -184,7 +184,9 @@ export const SESSION_ROUTE_PROMPT_TOOL = {
         "table and the same account-scoped frontmatter triggers; it never leaves the machine. Calling it is cheap: when " +
         "nothing new matches it returns a single line, and anything named in `loaded` is never returned again. When it " +
         "does return skills, read and follow them before doing the work \u2014 they are the rules for the task at hand, " +
-        "not background. Skip it only for follow-ups within work you have already routed.",
+        "not background. It also checks bounded implementation requests for Factory. Supply the current project, working_directory, files_involved and test_command when known. " +
+        "When prism_factory_route recommends session_start_pipeline, call it automatically with recommended_args, then report the pipeline id and monitor it. " +
+        "Routing itself does not execute code. Skip it only for follow-ups within work you have already routed.",
     annotations: {
         readOnlyHint: true,
         destructiveHint: false,
@@ -208,6 +210,10 @@ export const SESSION_ROUTE_PROMPT_TOOL = {
                 type: "string",
                 description: "Optional project override. Omit to use the session's project.",
             },
+            working_directory: { type: "string", description: "Current repository's absolute path for a bounded Factory task." },
+            files_involved: { type: "array", items: { type: "string" }, description: "Relative code files the current implementation task concerns." },
+            test_command: { type: "string", description: "Repository verification command, supplied by the host from the request or repository instructions." },
+            allowed_write_paths: { type: "array", items: { type: "string" }, description: "Relative files the user authorized Factory to change." },
         },
         required: ["prompt"],
     },