prism-mcp-server 20.21.24 → 20.21.25

package/README.md

@@ -61,6 +61,12 @@ A paid subscription adds cloud sync, higher model tiers, and team features throu
 
 ## Get started
 
+Memory search automatically applies ACT-R ranking: relevance plus recency,
+frequency and memory associations. No upvote or prompt instruction is required.
+To opt out, use **Account & Settings → Preferences → Automatic Memory Ranking
+(ACT-R)**, then restart your AI client. `PRISM_ACTR_ENABLED=false` also disables
+it. This ranking is separate from the neural graph's stored importance filter.
+
 ```bash
 npm install -g prism-mcp-server
 prism connect
@@ -164,6 +170,17 @@ or by re-enabling after each run.
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.21.25
+
+Semantic memory search now automatically applies ACT-R ranking, combining
+relevance with recency, frequency and associations. **Account & Settings →
+Preferences → Automatic Memory Ranking (ACT-R)** lets you opt out after an AI
+client restart; an explicit environment value takes precedence.
+
+Synalux Cloud uses authenticated, owner-scoped access-history and candidate-link
+APIs. Cloud deployment requires the matching Portal history migration. Stored
+importance thresholds remain separate, and HRR drift detection remains independent.
+
 ## What's New in v20.21.24
 
 - Synalux cloud preserves initial importance and handles votes, graduated

package/dist/backgroundScheduler.js

@@ -17,7 +17,7 @@
  * storage backends during maintenance windows.
  */
 import { getStorage } from "./storage/index.js";
-import { PRISM_USER_ID, PRISM_SCHOLAR_ENABLED, PRISM_SCHOLAR_INTERVAL_MS, PRISM_GRAPH_PRUNING_ENABLED, PRISM_GRAPH_PRUNE_MIN_STRENGTH, PRISM_GRAPH_PRUNE_PROJECT_COOLDOWN_MS, PRISM_GRAPH_PRUNE_SWEEP_BUDGET_MS, PRISM_GRAPH_PRUNE_MAX_PROJECTS_PER_SWEEP, PRISM_ACTR_ENABLED, PRISM_ACTR_ACCESS_LOG_RETENTION_DAYS, } from "./config.js";
+import { PRISM_USER_ID, PRISM_SCHOLAR_ENABLED, PRISM_SCHOLAR_INTERVAL_MS, PRISM_GRAPH_PRUNING_ENABLED, PRISM_GRAPH_PRUNE_MIN_STRENGTH, PRISM_GRAPH_PRUNE_PROJECT_COOLDOWN_MS, PRISM_GRAPH_PRUNE_SWEEP_BUDGET_MS, PRISM_GRAPH_PRUNE_MAX_PROJECTS_PER_SWEEP, PRISM_ACTR_ACCESS_LOG_RETENTION_DAYS, } from "./config.js";
 import { randomBytes } from "node:crypto";
 import { debugLog } from "./utils/logger.js";
 import { runWebScholar } from "./scholar/webScholar.js";
@@ -103,7 +103,9 @@ export const DEFAULT_SCHEDULER_CONFIG = {
     graphPruneProjectCooldownMs: PRISM_GRAPH_PRUNE_PROJECT_COOLDOWN_MS,
     graphPruneSweepBudgetMs: PRISM_GRAPH_PRUNE_SWEEP_BUDGET_MS,
     graphPruneMaxProjectsPerSweep: PRISM_GRAPH_PRUNE_MAX_PROJECTS_PER_SWEEP,
-    enableAccessLogPrune: PRISM_ACTR_ENABLED,
+    // Default-on retrieval must not silently opt users into destructive maintenance.
+    // Preserve the existing explicit environment opt-in for access-log pruning.
+    enableAccessLogPrune: process.env.PRISM_ACTR_ENABLED === "true",
     accessLogRetentionDays: PRISM_ACTR_ACCESS_LOG_RETENTION_DAYS,
 };
 // ─── Scheduler State ─────────────────────────────────────────

package/dist/config.js

@@ -275,7 +275,7 @@ export const PRISM_GRAPH_PRUNE_MAX_PROJECTS_PER_SWEEP = parseInt(process.env.PRI
 // cognitive architecture. Replaces simple Ebbinghaus decay with
 // a composite similarity + activation model.
 /** Master switch for ACT-R activation-based re-ranking. */
-export const PRISM_ACTR_ENABLED = process.env.PRISM_ACTR_ENABLED === "true";
+export const PRISM_ACTR_ENABLED = process.env.PRISM_ACTR_ENABLED !== "false";
 /** ACT-R decay parameter d in t^(-d). Higher = faster forgetting. (Paper default: 0.5) */
 export const PRISM_ACTR_DECAY = parseFloat(process.env.PRISM_ACTR_DECAY || "0.5");
 /** Weight of cosine similarity in composite score. (Default: 0.7 — similarity dominates) */

package/dist/dashboard/server.js

@@ -41,6 +41,7 @@ import { DASHBOARD_READ_MESSAGES } from "./readMessages.js";
 import { isDashboardSettingKeyAllowed, isDashboardSettingValueAllowed } from "./settingsPolicy.js";
 import { isTrustedRequest, isRebindGuardedPath } from "./hostGuard.js";
 import { darkFactoryEnablementState, DARK_FACTORY_SETTINGS_UNAVAILABLE } from "../darkfactory/enablement.js";
+import { actrEnablementState } from "../utils/actrEnablement.js";
 import { resolveDashboardToken, requestHasToken, buildTokenCookie, dashboardTokenCookieName, isDashboardTokenProtectedPath, } from "./dashboardToken.js";
 import { safeCompare, generateToken, isAuthenticated, createRateLimiter, initJWKS, } from "./authUtils.js";
 const PORT = parseInt(process.env.PRISM_DASHBOARD_PORT || "3000", 10);
@@ -730,10 +731,11 @@ return false;}
             // ─── API: Settings — GET (v3.0 Dashboard Settings) ───
             if (url.pathname === "/api/settings" && req.method === "GET") {
                 try {
-                    const { getAllSettings } = await import("../storage/configStorage.js");
+                    const { getAllSettings, initConfigStorage } = await import("../storage/configStorage.js");
+                    await initConfigStorage();
                     const settings = await getAllSettings();
                     res.writeHead(200, { "Content-Type": "application/json" });
-                    return res.end(JSON.stringify({ settings, darkFactory: darkFactoryEnablementState() }));
+                    return res.end(JSON.stringify({ settings, darkFactory: darkFactoryEnablementState(), actr: actrEnablementState() }));
                 }
                 catch {
                     res.writeHead(503, { "Content-Type": "application/json" });

package/dist/dashboard/settingsPolicy.js

@@ -29,7 +29,7 @@ export function isDashboardSettingValueAllowed(key, value) {
     if (["auto_capture", "hivemind_enabled", "task_router_enabled"].includes(key)) {
         return value === "true" || value === "false";
     }
-    if (key === "PRISM_DARK_FACTORY_ENABLED")
+    if (key === "PRISM_DARK_FACTORY_ENABLED" || key === "PRISM_ACTR_ENABLED")
         return value === "true" || value === "false";
     if (key === "agent_name")
         return value.length <= 80 && !/[<>]/.test(value);

package/dist/dashboard/ui.js

@@ -15,6 +15,7 @@
  */
 import { ANALYTICS_DATE_PATTERN, ANALYTICS_METRIC_IDS, DASHBOARD_READ_MESSAGES } from './readMessages.js';
 import { DARK_FACTORY_SETTINGS_UNAVAILABLE } from '../darkfactory/enablement.js';
+import { ACTR_SETTINGS_UNAVAILABLE, ACTR_UI } from '../utils/actrEnablement.js';
 export function renderDashboardLocalOpenHTML() {
     return `<!DOCTYPE html>
 <html lang="en">
@@ -1302,6 +1303,15 @@ export function renderDashboardHTML(version) {
 
         <div class="setting-section">Boot Settings <span class="boot-badge">Restart Required</span></div>
 
+        <div class="setting-row">
+          <div>
+            <div class="setting-label">${ACTR_UI.label}</div>
+            <div class="setting-desc">${ACTR_UI.description}</div>
+            <div id="actr-state" style="color:var(--text-muted);font-size:0.78rem;margin-top:0.25rem">${ACTR_UI.loading}</div>
+          </div>
+          <button class="toggle" id="toggle-actr" type="button" role="switch" aria-label="${ACTR_UI.label}" aria-checked="false" disabled onclick="toggleBootSetting('PRISM_ACTR_ENABLED', this)"></button>
+        </div>
+
         <div class="setting-row">
           <div>
             <div class="setting-label">Hivemind Mode</div>
@@ -4009,6 +4019,7 @@ function loadSettings() {
                 case 2:
                     data = _a.sent();
                     if (!data.darkFactory) throw new Error(DARK_FACTORY_SETTINGS_UNAVAILABLE_MESSAGE);
+                    loadActrSettingState(data.actr);
                     s = data.settings || {};
                     // Runtime toggles
                     if (s.auto_capture === 'true')
@@ -4069,6 +4080,8 @@ function loadSettings() {
                 case 3:
                     e_19 = _a.sent();
                     console.warn('Settings load failed:', e_19);
+                    document.getElementById('actr-state').textContent = ACTR_SETTINGS_UNAVAILABLE_MESSAGE;
+                    document.getElementById('toggle-actr').disabled = true;
                     document.getElementById('dark-factory-state').textContent = DARK_FACTORY_SETTINGS_UNAVAILABLE_MESSAGE;
                     document.getElementById('toggle-dark-factory').disabled = true;
                     document.getElementById('toggle-dark-factory').setAttribute('aria-disabled', 'true');
@@ -4122,11 +4135,30 @@ function toggleSetting(key, el) {
             el.classList.toggle('active'); // rollback on failure
     });
 }
+function loadActrSettingState(ar) {
+    var toggle = document.getElementById('toggle-actr');
+    if (!ar) {
+        toggle.disabled = true;
+        document.getElementById('actr-state').textContent = ACTR_SETTINGS_UNAVAILABLE_MESSAGE;
+        return;
+    }
+    var effective = ar.envOverride === null ? ar.saved : ar.envOverride;
+    toggle.disabled = ar.envOverride !== null;
+    toggle.setAttribute('aria-disabled', toggle.disabled ? 'true' : 'false');
+    toggle.classList.toggle('active', effective);
+    toggle.setAttribute('aria-checked', effective ? 'true' : 'false');
+    document.getElementById('actr-state').textContent = ar.envOverride === null
+        ? 'Saved: ' + (ar.saved ? 'on' : 'off') + ' · Active in this process: ' + (ar.active ? 'on' : 'off') + (ar.pendingRestart ? ' · restart required' : '')
+        : 'Environment override: ' + (ar.envOverride ? 'on' : 'off') + ' · saved preference: ' + (ar.saved ? 'on' : 'off');
+}
 function toggleBootSetting(key, el) {
+    if (el.disabled) return;
+    if (key === 'PRISM_ACTR_ENABLED') el.disabled = true;
     var isActive = el.classList.toggle('active');
     el.setAttribute('aria-checked', isActive ? 'true' : 'false');
     saveSetting(key, isActive ? 'true' : 'false').then(function (ok) {
         if (!ok) {
+            if (key === 'PRISM_ACTR_ENABLED') el.disabled = false;
             el.classList.toggle('active'); // rollback on failure
             el.setAttribute('aria-checked', isActive ? 'false' : 'true');
         }
@@ -4137,6 +4169,7 @@ function toggleBootSetting(key, el) {
     });
 }
 var DARK_FACTORY_SETTINGS_UNAVAILABLE_MESSAGE = ${JSON.stringify(DARK_FACTORY_SETTINGS_UNAVAILABLE)};
+var ACTR_SETTINGS_UNAVAILABLE_MESSAGE = ${JSON.stringify(ACTR_SETTINGS_UNAVAILABLE)};
 var DARK_FACTORY_RESTART_MESSAGE = 'Saved. Restart your AI client for this to take effect.';
 function saveBootSetting(key, value) {
     saveSetting(key, value).then(function (ok) {

package/dist/server.js

@@ -62,6 +62,7 @@ ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ReadResourceRequ
 SubscribeRequestSchema, UnsubscribeRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
 import { SERVER_CONFIG, SESSION_MEMORY_ENABLED, PRISM_USER_ID, PRISM_ENABLE_HIVEMIND, WATCHDOG_INTERVAL_MS, WATCHDOG_STALE_MIN, WATCHDOG_FROZEN_MIN, WATCHDOG_OFFLINE_MIN, WATCHDOG_LOOP_THRESHOLD, PRISM_SCHEDULER_ENABLED, PRISM_SCHEDULER_INTERVAL_MS, PRISM_HDC_ENABLED, PRISM_TASK_ROUTER_ENABLED_ENV, YDC_API_KEY, } from "./config.js";
 import { initializeDarkFactoryEnabled, isDarkFactoryEnabled } from "./darkfactory/enablement.js";
+import { initializeActrEnabled } from "./utils/actrEnablement.js";
 import { startWatchdog, drainAlerts } from "./hivemindWatchdog.js";
 import { startScheduler } from "./backgroundScheduler.js";
 import { startDarkFactoryRunner } from "./darkfactory/runner.js";
@@ -1290,6 +1291,7 @@ export async function startServer() {
     // initConfigStorage() is local SQLite only (~5ms), safe to await.
     await initConfigStorage();
     initializeDarkFactoryEnabled();
+    initializeActrEnabled();
     // v4.6.0: Initialize OTel AFTER the settings cache is warm so that
     // initTelemetry() can read otel_enabled/otel_endpoint from getSettingSync()
     // synchronously. This is a synchronous call — no await needed.

package/dist/storage/actrSupabaseMigration.js

@@ -0,0 +1,79 @@
+// Canonical runtime SQL; parity with migration 040 is checked by a unit test.
+export const ACTR_AUTH_SQL = String.raw `
+-- Bind legacy self-hosted access history to signed identity. Preserve legitimate own-user access.
+-- The automatic upgrader must never execute caller-supplied SQL for tenant clients.
+CREATE OR REPLACE FUNCTION public.prism_apply_ddl(p_version integer, p_name text, p_sql text)
+RETURNS json LANGUAGE plpgsql SECURITY DEFINER SET search_path = public, pg_temp
+AS $$
+DECLARE existing_name text;
+BEGIN
+    IF p_version IS NULL OR p_version < 1 OR p_name IS NULL OR length(btrim(p_name)) = 0
+       OR p_sql IS NULL OR length(btrim(p_sql)) = 0 THEN
+        RAISE EXCEPTION 'Invalid migration identity or SQL' USING ERRCODE = '22023';
+    END IF;
+    PERFORM pg_advisory_xact_lock(hashtext('prism_apply_ddl'));
+    SELECT name INTO existing_name FROM public.prism_schema_versions WHERE version = p_version;
+    IF FOUND THEN
+        IF existing_name IS DISTINCT FROM p_name THEN
+            RAISE EXCEPTION 'Migration version/name conflict' USING ERRCODE = '22023';
+        END IF;
+        RETURN json_build_object('status','already_applied','version',p_version,'name',p_name);
+    END IF;
+    EXECUTE p_sql;
+    INSERT INTO public.prism_schema_versions(version,name) VALUES (p_version,p_name);
+    RETURN json_build_object('status','applied','version',p_version,'name',p_name);
+END;
+$$;
+REVOKE ALL ON FUNCTION public.prism_apply_ddl(integer,text,text) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.prism_apply_ddl(integer,text,text) TO service_role;
+CREATE OR REPLACE FUNCTION public.prism_log_access(
+    p_user_id text, p_entry_id uuid, p_accessed_at timestamptz DEFAULT now(), p_context_hash text DEFAULT NULL
+)
+RETURNS void LANGUAGE plpgsql SECURITY DEFINER SET search_path = public, pg_temp
+AS $$
+BEGIN
+    IF p_context_hash IS NOT NULL AND p_context_hash !~ '^[a-f0-9]{1,64}$' THEN
+        RAISE EXCEPTION 'Access context must be a hash' USING ERRCODE = '22023';
+    END IF;
+    INSERT INTO public.memory_access_log(entry_id,accessed_at,context_hash)
+    SELECT ledger.id, clock_timestamp(), p_context_hash FROM public.session_ledger AS ledger
+    WHERE ledger.id = p_entry_id AND ledger.user_id = p_user_id
+      AND ledger.deleted_at IS NULL AND (to_jsonb(ledger)->>'archived_at') IS NULL
+      AND (auth.role() = 'service_role' OR (p_user_id = auth.uid()::text
+        AND ((to_jsonb(ledger)->>'workspace_id') IS NULL
+          OR to_jsonb(ledger)->>'workspace_id' = auth.jwt()->>'workspace_id')));
+END;
+$$;
+CREATE OR REPLACE FUNCTION public.prism_get_access_log(
+    p_user_id text, p_entry_ids uuid[], p_max_per_entry integer DEFAULT 50
+)
+RETURNS TABLE (entry_id uuid, accessed_at timestamptz)
+LANGUAGE plpgsql SECURITY DEFINER SET search_path = public, pg_temp
+AS $$
+BEGIN
+    IF p_entry_ids IS NULL OR cardinality(p_entry_ids) NOT BETWEEN 1 AND 50
+       OR p_max_per_entry IS NULL OR p_max_per_entry NOT BETWEEN 1 AND 50 THEN
+        RAISE EXCEPTION 'Invalid access history bounds' USING ERRCODE = '22023';
+    END IF;
+    RETURN QUERY
+        SELECT ledger.id, history.accessed_at FROM public.session_ledger AS ledger
+        CROSS JOIN LATERAL (
+            SELECT access.accessed_at FROM public.memory_access_log AS access
+            WHERE access.entry_id = ledger.id ORDER BY access.accessed_at DESC LIMIT p_max_per_entry
+        ) AS history
+        WHERE ledger.id = ANY(p_entry_ids) AND ledger.user_id = p_user_id
+          AND ledger.deleted_at IS NULL AND (to_jsonb(ledger)->>'archived_at') IS NULL
+          AND (auth.role() = 'service_role' OR (p_user_id = auth.uid()::text
+            AND ((to_jsonb(ledger)->>'workspace_id') IS NULL
+              OR to_jsonb(ledger)->>'workspace_id' = auth.jwt()->>'workspace_id')));
+END;
+$$;
+REVOKE ALL ON FUNCTION public.prism_log_access(text,uuid,timestamptz,text) FROM PUBLIC, anon;
+REVOKE ALL ON FUNCTION public.prism_get_access_log(text,uuid[],integer) FROM PUBLIC, anon;
+GRANT EXECUTE ON FUNCTION public.prism_log_access(text,uuid,timestamptz,text) TO service_role, authenticated;
+GRANT EXECUTE ON FUNCTION public.prism_get_access_log(text,uuid[],integer) TO service_role, authenticated;
+-- Global retention cannot be a permission held by ordinary tenant clients.
+REVOKE ALL ON FUNCTION public.prism_prune_access_log(integer) FROM PUBLIC, anon, authenticated;
+GRANT EXECUTE ON FUNCTION public.prism_prune_access_log(integer) TO service_role;
+NOTIFY pgrst, 'reload schema';
+`;

package/dist/storage/supabase.js

@@ -1250,7 +1250,7 @@ export class SupabaseStorage {
         }
         catch (e) {
             debugLog(`[SupabaseStorage] getAccessLog fallback/no-op: ${e.message}`);
-            return result;
+            throw e;
         }
     }
     async pruneAccessLog(olderThanDays) {

package/dist/storage/supabaseMigrations.js

@@ -21,6 +21,7 @@
  * ═══════════════════════════════════════════════════════════════════
  */
 import { supabaseRpc } from "../utils/supabaseApi.js";
+import { ACTR_AUTH_SQL } from "./actrSupabaseMigration.js";
 /**
  * All Supabase DDL migrations.
  *
@@ -805,6 +806,7 @@ export const MIGRATIONS = [
       CREATE INDEX IF NOT EXISTS idx_research_tasks_status ON public.research_tasks(status, created_at ASC);
       `
     },
+    { version: 40, name: "actr_authenticated_history", sql: ACTR_AUTH_SQL },
 ];
 /**
  * Current schema version — derived from the MIGRATIONS array.

package/dist/storage/synalux.js

@@ -22,6 +22,8 @@
  *     - adjustImportance  → POST /api/v1/prism/memory  action=adjust_importance
  *     - getGraduatedInsights → POST /api/v1/prism/memory  action=graduated_insights
  *     - decayImportance   → POST /api/v1/prism/memory  action=decay_importance
+ *     - logAccess / recordAccesses / updateLastAccessed → action=record_access
+ *     - getAccessLog      → POST /api/v1/prism/memory  action=get_access_log
  *     - saveHandoff       → POST /api/v1/prism/memory  action=save_handoff
  *     - saveHistorySnapshot → POST /api/v1/prism/memory  action=save_history_snapshot
  *     - loadContext       → POST /api/v1/prism/memory  action=load_context
@@ -69,10 +71,85 @@ function resolveKnowledgeScope(callerScope) {
 }
 /** Refresh JWT this many ms before expiry to avoid edge-case 401s. */
 const JWT_REFRESH_LEEWAY_MS = 60_000;
+const ACCESS_BATCH_LIMIT = 50;
+const ACCESS_ID_RE = /^[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/i;
+const ACCESS_MESSAGES = {
+    invalid: "Invalid memory access batch",
+    write: "Invalid memory access response",
+    read: "Invalid memory access history response",
+    failed: "[SynaluxStorage] Memory access recording failed",
+};
+function accessIds(ids) {
+    if (!Array.isArray(ids) || ids.some(id => typeof id !== "string" || !ACCESS_ID_RE.test(id))) {
+        throw new Error(ACCESS_MESSAGES.invalid);
+    }
+    return [...new Set(ids.map(id => id.toLowerCase()))];
+}
 function buildContextLoadKey(project, level, userId, role) {
     return JSON.stringify({ project, level, userId, role: role ?? "" });
 }
 export class SynaluxStorage extends SupabaseStorage {
+    logAccess(entryId, contextHash) {
+        void this.recordAccesses([entryId], contextHash).catch(() => console.error(ACCESS_MESSAGES.failed));
+    }
+    async getCandidateLinks(entryIds) {
+        const ids = accessIds(entryIds);
+        if (ids.length === 0)
+            return [];
+        if (ids.length > ACCESS_BATCH_LIMIT)
+            throw new Error(ACCESS_MESSAGES.invalid);
+        const response = await this.portalPost("/api/v1/prism/memory", { action: "get_candidate_links", entry_ids: ids });
+        if (!Array.isArray(response.links) || response.links.length > ids.length * 20
+            || response.links.some(row => !row || !ids.includes(row.source_id) || !ids.includes(row.target_id)
+                || !Number.isFinite(row.strength) || row.strength < 0 || row.strength > 1))
+            throw new Error(ACCESS_MESSAGES.read);
+        return response.links;
+    }
+    async recordAccesses(entryIds, contextHash) {
+        await this.writeAccesses(entryIds, contextHash, true);
+    }
+    async updateLastAccessed(entryIds) {
+        await this.writeAccesses(entryIds, undefined, false);
+    }
+    async writeAccesses(entryIds, contextHash, recordHistory) {
+        const ids = accessIds(entryIds);
+        if (contextHash !== undefined && !/^[a-f0-9]{1,64}$/.test(contextHash))
+            throw new Error(ACCESS_MESSAGES.invalid);
+        for (let offset = 0; offset < ids.length; offset += ACCESS_BATCH_LIMIT) {
+            const batch = ids.slice(offset, offset + ACCESS_BATCH_LIMIT);
+            const response = await this.portalPost("/api/v1/prism/memory", {
+                action: "record_access", entry_ids: batch, context_hash: contextHash ?? null, record_history: recordHistory,
+            });
+            if (!Number.isInteger(response.recorded) || Number(response.recorded) < 0 || Number(response.recorded) > batch.length) {
+                throw new Error(ACCESS_MESSAGES.write);
+            }
+        }
+    }
+    async getAccessLog(entryIds, maxPerEntry = ACCESS_BATCH_LIMIT) {
+        const ids = accessIds(entryIds);
+        if (!Number.isInteger(maxPerEntry) || maxPerEntry < 1 || maxPerEntry > ACCESS_BATCH_LIMIT)
+            throw new Error(ACCESS_MESSAGES.invalid);
+        const result = new Map();
+        for (let offset = 0; offset < ids.length; offset += ACCESS_BATCH_LIMIT) {
+            const batch = ids.slice(offset, offset + ACCESS_BATCH_LIMIT);
+            const response = await this.portalPost("/api/v1/prism/memory", { action: "get_access_log", entry_ids: batch, max_per_entry: maxPerEntry });
+            if (!Array.isArray(response.accesses) || response.accesses.length > batch.length * maxPerEntry)
+                throw new Error(ACCESS_MESSAGES.read);
+            for (const row of response.accesses) {
+                if (!row || !batch.includes(row.entry_id) || typeof row.accessed_at !== "string")
+                    throw new Error(ACCESS_MESSAGES.read);
+                const timestamp = new Date(row.accessed_at);
+                if (!Number.isFinite(timestamp.getTime()))
+                    throw new Error(ACCESS_MESSAGES.read);
+                const history = result.get(row.entry_id) ?? [];
+                if (history.length >= maxPerEntry)
+                    throw new Error(ACCESS_MESSAGES.read);
+                history.push(timestamp);
+                result.set(row.entry_id, history);
+            }
+        }
+        return result;
+    }
     baseUrl;
     refreshToken;
     cachedJwt = null;

package/dist/tools/graphHandlers.js

@@ -51,7 +51,9 @@ const activeCompactions = new Set();
  */
 import { computeEffectiveImportance, recordMemoryAccess } from "../utils/cognitiveMemory.js";
 import { baseLevelActivation, candidateScopedSpreadingActivation, compositeRetrievalScore, } from "../utils/actrActivation.js";
-import { PRISM_ACTR_ENABLED, PRISM_ACTR_DECAY, PRISM_ACTR_WEIGHT_SIMILARITY, PRISM_ACTR_WEIGHT_ACTIVATION, PRISM_ACTR_SIGMOID_MIDPOINT, PRISM_ACTR_SIGMOID_STEEPNESS, PRISM_ACTR_MAX_ACCESSES_PER_ENTRY, } from "../config.js";
+import { PRISM_ACTR_DECAY, PRISM_ACTR_WEIGHT_SIMILARITY, PRISM_ACTR_WEIGHT_ACTIVATION, PRISM_ACTR_SIGMOID_MIDPOINT, PRISM_ACTR_SIGMOID_STEEPNESS, PRISM_ACTR_MAX_ACCESSES_PER_ENTRY, } from "../config.js";
+import { isActrEnabled } from "../utils/actrEnablement.js";
+import { createHash } from "node:crypto";
 import { HdcStateMachine } from "../sdm/stateMachine.js";
 import { ConceptDictionary } from "../sdm/conceptDictionary.js";
 import { PolicyGateway } from "../sdm/policyGateway.js";
@@ -361,7 +363,7 @@ export async function sessionSearchMemoryHandler(args) {
     enable_trace = false, 
     // v5.2: Context-Weighted Retrieval — biases search toward active work context
     context_boost = false, activation, } = args;
-    debugLog(`[session_search_memory] Semantic search: query="${query}", ` +
+    debugLog(`[session_search_memory] Semantic search: queryHash=${createHash("sha256").update(query).digest("hex")}, ` +
         `project=${project || "all"}, limit=${limit}, threshold=${similarity_threshold}` +
         `${context_boost ? ", context_boost=ON" : ""}`);
     // Phase 1: Start total latency timer BEFORE any work (embedding + storage)
@@ -395,7 +397,7 @@ export async function sessionSearchMemoryHandler(args) {
             }
             if (contextParts.length > 0) {
                 effectiveQuery = `[${contextParts.join("; ")}] ${query}`;
-                debugLog(`[session_search_memory] Context boost applied: "${effectiveQuery.substring(0, 100)}..."`);
+                debugLog(`[session_search_memory] Context boost applied (${effectiveQuery.length} characters)`);
             }
         }
         catch {
@@ -435,7 +437,8 @@ export async function sessionSearchMemoryHandler(args) {
         // If we only fetch `limit` rows, the re-ranker can only shuffle those exact
         // results — a memory at rank #(limit+1) by similarity but accessed 500 times
         // would never surface. Fetch 4× or minimum 20, then slice after re-ranking.
-        const candidateLimit = PRISM_ACTR_ENABLED
+        const actrEnabled = isActrEnabled();
+        const candidateLimit = actrEnabled
             ? Math.min(Math.max(limit * 4, 20), 50)
             : Math.min(limit, 20);
         const results = await storage.searchMemory({
@@ -483,28 +486,38 @@ export async function sessionSearchMemoryHandler(args) {
         }
         // ── v7.0: ACT-R Re-Ranking Pipeline ──────────────────────────
         const resultIds = results.map((r) => r.id).filter(Boolean);
+        const policyCandidates = [...results].sort((a, b) => (b.similarity ?? 0) - (a.similarity ?? 0)).slice(0, limit);
         const now = new Date();
         // Accumulate ACT-R metrics for trace output
         let actrMetrics = null;
-        if (PRISM_ACTR_ENABLED && resultIds.length > 0) {
+        if (actrEnabled && resultIds.length > 0) {
             try {
                 // Step A: Bulk-fetch access logs for all candidate IDs
                 const accessLogMap = await storage.getAccessLog(resultIds, PRISM_ACTR_MAX_ACCESSES_PER_ENTRY);
                 // Step B: Fetch outbound links for spreading activation
                 const candidateIdSet = new Set(resultIds);
                 const linksMap = new Map();
-                for (const id of resultIds) {
-                    try {
-                        const links = await storage.getLinksFrom(id, PRISM_USER_ID, 0.0, 20);
-                        linksMap.set(id, links.map((l) => ({
-                            target_id: l.target_id,
-                            strength: l.strength ?? 1.0,
-                        })));
-                    }
-                    catch {
-                        linksMap.set(id, []);
+                if (storage.getCandidateLinks) {
+                    const links = await storage.getCandidateLinks(resultIds);
+                    for (const link of links) {
+                        const outgoing = linksMap.get(link.source_id) ?? [];
+                        outgoing.push({ target_id: link.target_id, strength: link.strength });
+                        linksMap.set(link.source_id, outgoing);
                     }
                 }
+                else
+                    for (const id of resultIds) {
+                        try {
+                            const links = await storage.getLinksFrom(id, PRISM_USER_ID, 0.0, 20);
+                            linksMap.set(id, links.map((l) => ({
+                                target_id: l.target_id,
+                                strength: l.strength ?? 1.0,
+                            })));
+                        }
+                        catch {
+                            linksMap.set(id, []);
+                        }
+                    }
                 // Step C: Compute activation for each result and re-rank
                 actrMetrics = { baseLevels: [], spreadings: [], sigmoids: [], composites: [] };
                 for (const r of results) {
@@ -541,6 +554,7 @@ export async function sessionSearchMemoryHandler(args) {
                     `mean composite=${(actrMetrics.composites.reduce((a, b) => a + b, 0) / actrMetrics.composites.length).toFixed(3)}`);
             }
             catch (actrErr) {
+                actrMetrics = null;
                 // ACT-R failures are non-fatal — degrade to similarity-only ordering
                 debugLog(`[session_search_memory] ACT-R re-ranking failed (non-fatal): ${actrErr instanceof Error ? actrErr.message : String(actrErr)}`);
             }
@@ -550,13 +564,15 @@ export async function sessionSearchMemoryHandler(args) {
         // so we only log access for results actually delivered to the LLM.
         results.splice(limit);
         if (PRISM_HDC_ENABLED && results.length > 0) {
-            const topScore = PRISM_ACTR_ENABLED ? results[0]._actr_composite : results[0].similarity;
-            const secondScore = results.length > 1 ? (PRISM_ACTR_ENABLED ? results[1]._actr_composite : results[1].similarity) : 0;
+            // Policy thresholds are calibrated to semantic relevance, not activation.
+            const topScore = policyCandidates[0]?.similarity;
+            const secondScore = policyCandidates.length > 1 ? policyCandidates[1].similarity : 0;
             const gapDistance = (topScore || 0) - (secondScore || 0);
             const fallbackThreshold = PRISM_HDC_POLICY_FALLBACK_THRESHOLD || 0.85;
             const clarifyThreshold = PRISM_HDC_POLICY_CLARIFY_THRESHOLD || 0.95;
             const gapThreshold = clarifyThreshold - fallbackThreshold;
-            if ((topScore || 0) < fallbackThreshold || (results.length > 1 && gapDistance < gapThreshold)) {
+            if ((topScore || 0) < fallbackThreshold || (policyCandidates.length > 1 && gapDistance < gapThreshold)
+                || (results[0].similarity ?? 0) < fallbackThreshold) {
                 return {
                     content: [{
                             type: "text",
@@ -576,7 +592,7 @@ export async function sessionSearchMemoryHandler(args) {
         // v7.0: Writes to both access_log buffer AND legacy last_accessed_at
         const finalIds = results.map((r) => r.id).filter(Boolean);
         if (finalIds.length > 0) {
-            const queryHash = query.substring(0, 64);
+            const queryHash = createHash("sha256").update(query).digest("hex");
             recordMemoryAccess(finalIds, queryHash);
         }
         // Format results with similarity scores + effective importance + ACT-R
@@ -605,6 +621,9 @@ export async function sessionSearchMemoryHandler(args) {
                 type: "text",
                 text: `${searchResultsHeader(results.length, isHybridSearchResults(results))}\n\n${formatted}`,
             }];
+        if (actrEnabled && resultIds.length > 0 && !actrMetrics) {
+            contentBlocks.push({ type: "text", text: "Automatic memory ranking unavailable for this search; returning relevance ordering." });
+        }
         // Phase 1: content[1] = machine-readable MemoryTrace (only when enable_trace=true)
         // topScore is read from results[0].similarity — this is the cosine distance
         // already returned by SemanticSearchResult in the storage interface.
@@ -626,7 +645,7 @@ export async function sessionSearchMemoryHandler(args) {
                 totalMs,
                 project: project || null,
                 // v7.0: ACT-R observability
-                actrEnabled: PRISM_ACTR_ENABLED,
+                actrEnabled: actrMetrics !== null,
                 actrBaseLevelMean: actrMetrics ? mean(actrMetrics.baseLevels) : undefined,
                 actrSpreadingMean: actrMetrics ? mean(actrMetrics.spreadings) : undefined,
                 actrCompositeMean: actrMetrics ? mean(actrMetrics.composites) : undefined,
@@ -682,6 +701,9 @@ export async function sessionSearchMemoryHandler(args) {
                         text: contentBlocks[0].text +
                             `\n\n🔗 Graph-connected memories (${enrichedEntries.length} via 1-hop expansion):\n\n${graphFormatted}`,
                     };
+                    const deliveredGraphIds = enrichedEntries.map((entry) => entry.id).filter(Boolean);
+                    if (deliveredGraphIds.length > 0)
+                        recordMemoryAccess(deliveredGraphIds, createHash("sha256").update(query).digest("hex"));
                     // Fire-and-forget: reinforce traversed links
                     for (const directId of directIds) {
                         storage.getLinksFrom(directId, PRISM_USER_ID, 0.3, 5)

package/dist/utils/actrEnablement.js

@@ -0,0 +1,29 @@
+import { getSettingSync } from "../storage/configStorage.js";
+const SETTING_KEY = "PRISM_ACTR_ENABLED";
+const DEFAULT_ENABLED = true;
+export const ACTR_SETTINGS_UNAVAILABLE = "Automatic memory ranking settings unavailable. Retry when the server is reachable.";
+export const ACTR_UI = {
+    label: "Automatic Memory Ranking (ACT-R)",
+    description: "Rank retrieved memories by relevance, recency, frequency and associations. Enabled by default. Restart your AI client after changing this setting.",
+    loading: "Loading ranking state…",
+};
+let startupDecision;
+export function resolveActrEnabled(env, saved) {
+    if (env === "true" || env === "false")
+        return env === "true";
+    return saved === "true" || saved === "false" ? saved === "true" : DEFAULT_ENABLED;
+}
+export function initializeActrEnabled() {
+    startupDecision = resolveActrEnabled(process.env.PRISM_ACTR_ENABLED, getSettingSync(SETTING_KEY, String(DEFAULT_ENABLED)));
+    return startupDecision;
+}
+export function isActrEnabled() {
+    return startupDecision ?? initializeActrEnabled();
+}
+export function actrEnablementState() {
+    const env = process.env.PRISM_ACTR_ENABLED;
+    const envOverride = env === "true" || env === "false" ? env === "true" : null;
+    const saved = resolveActrEnabled(undefined, getSettingSync(SETTING_KEY, String(DEFAULT_ENABLED)));
+    const active = isActrEnabled();
+    return { saved, active, envOverride, pendingRestart: envOverride === null && saved !== active };
+}

package/dist/utils/cognitiveMemory.js

@@ -23,7 +23,8 @@
 import { getStorage } from "../storage/index.js";
 import { debugLog } from "./logger.js";
 import { baseLevelActivation, parameterizedSigmoid, } from "./actrActivation.js";
-import { PRISM_ACTR_ENABLED, PRISM_ACTR_DECAY, PRISM_ACTR_SIGMOID_MIDPOINT, PRISM_ACTR_SIGMOID_STEEPNESS, } from "../config.js";
+import { PRISM_ACTR_DECAY, PRISM_ACTR_SIGMOID_MIDPOINT, PRISM_ACTR_SIGMOID_STEEPNESS, } from "../config.js";
+import { isActrEnabled } from "./actrEnablement.js";
 /**
  * Computes the effective importance of a memory, combining the semantic
  * importance score with a recency-based activation factor.
@@ -53,7 +54,7 @@ export function computeEffectiveImportance(baseImportance, lastAccessedStr, crea
     // Fallback to creation date if it has never been accessed
     const referenceDateStr = lastAccessedStr || createdAtStr;
     const referenceDate = new Date(referenceDateStr);
-    if (!PRISM_ACTR_ENABLED) {
+    if (!isActrEnabled()) {
         // ── Legacy Ebbinghaus Decay (v5.2, deprecated) ──
         const diffMs = Math.max(0, now.getTime() - referenceDate.getTime());
         const daysSinceAccess = diffMs / (1000 * 60 * 60 * 24);
@@ -89,6 +90,9 @@ export function recordMemoryAccess(ids, contextHash) {
         return;
     // Fire and forget, don't block execution
     getStorage().then(storage => {
+        if (storage.recordAccesses) {
+            return storage.recordAccesses(ids, contextHash);
+        }
         // v7.0: Log access events to memory_access_log via buffer
         for (const id of ids) {
             storage.logAccess(id, contextHash);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.21.24",
+  "version": "20.21.25",
   "mcpName": "io.github.dcostenco/prism-coder",
   "description": "Persistent session memory for AI coding agents that never leaves your machine — including the on-device model that reasons over it. Restores your prior decisions, open TODOs, and changed files across sessions; adds associative recall of related past work, semantic drift detection, and local inference. Local-first by default. Works with Claude Code, Cursor, and Codex.",
   "module": "index.ts",