prism-mcp-server 20.5.2 → 20.6.0

package/README.md

@@ -56,11 +56,120 @@ Prism works locally without an account, API key, or cloud subscription. Add a
 Synalux subscription when you want cloud memory, paid-tier skills, or team
 features.
 
+### What `prism connect` changes about host subagents
+
+`connect` steers bounded work to `prism_infer` on your machine rather than to
+host-spawned agents. What it writes differs per host, and **it does not disable
+subagents everywhere** — Claude Code keeps them and is pointed at an economy
+model instead. Prism's local workers stay available over MCP in every case.
+
+| Host | Setting written | Effect |
+|---|---|---|
+| Claude Code | `env.CLAUDE_CODE_SUBAGENT_MODEL = "sonnet"` in `~/.claude/settings.json` | Subagents stay **enabled**, pinned to an economy model. Fan-out is discouraged by policy text, not by config |
+| Gemini CLI | `experimental.enableAgents = false` in `~/.gemini/settings.json` | Subagents **off**. Gemini exposes one boolean, so that is all there is to set |
+| Codex | `features.multi_agent = false` in `$CODEX_HOME/config.toml` (default `~/.codex`), plus a bounded fallback: 2 threads, depth 1, cheap subagent model, 900s cap | Subagents **off**, with a bounded profile underneath so a deliberate re-enable lands somewhere sane |
+
+Two things worth knowing:
+
+- **`experimental` is Gemini's namespace, not ours.** Prism is not enabling
+  anything experimental — it writes `false` to a flag Gemini already defines at
+  that path. Writing anywhere else would have no effect.
+- **That namespace is by definition temporary.** If Gemini promotes
+  `enableAgents` out of `experimental`, Prism keeps writing the old path, Gemini
+  reads the new one, and host subagents quietly turn back on. Nothing errors and
+  the settings file still looks correct. If you see host subagents running while
+  `enableAgents` reads `false`, check whether the key has moved before assuming
+  `connect` failed to write it.
+
+Both writes are idempotent in the sense that a host already configured this way
+is left untouched — but they are **re-applied on every `prism connect` run**,
+not only on `--refresh`. If you deliberately re-enable host subagents, the next
+`connect` will turn them off again. Keep them on by not re-running `connect`,
+or by re-enabling after each run.
+
 ---
 
 <details>
 <summary>Release history (optional)</summary>
 
+## What's New in v20.6.0
+
+### Delivery Is Not a Suggestion
+
+An audit of a real incident (an agent wiped demo data after *announcing* the
+wipe — with the ask-first rule committed, bundled, and absent from what any
+agent actually received) found the protected floor had outgrown every delivery
+budget: "unprotected" had quietly come to mean "never delivered".
+
+- **`ask-first` and `feature-preservation` join the protected floor** (14 → 16).
+  Protected skills are always inlined; these two now reach every session.
+- **Sync conflicts are loud and named.** Startup used to say "· 2 local
+  conflicts preserved" while safety skills sat months stale; it now names each
+  frozen skill and states how to resume updates.
+- **`--storage` accepts `auto` and `synalux`** — the CLI rejected its own
+  documented default and the production backend.
+- **Disclosure:** skill delivery informs; it does not gate. A live probe showed
+  a host agent still edit unverified source with the rule loaded. If your
+  threat model includes an agent acting against a loaded rule under task
+  pressure, pair this package with mechanical gates (hooks, permissions,
+  least-privilege roles). True of every prior release; stated from this one.
+
+## What's New in v20.5.3
+
+### Grounding Evidence Carries Its Age
+
+Memory-grounded answers labelled their sources but never dated them, so a
+two-year-old note and yesterday's reached the model identically. Nothing in the
+evidence let it discount the stale one. Prompted by an external review naming
+the right risk for local-first memory: *the data stays local, but bad grounding
+becomes permanent* — storing everything on your machine removes the outside
+pressure that would otherwise surface a stale note.
+
+Evidence now reads:
+
+```
+[SOURCE 1: ledger:8286581d (recorded 2025-05-29, 431 days ago)]
+```
+
+The date already existed in storage and was being dropped at the snippet layer,
+so this is plumbing rather than new data collection. Zone-less SQLite
+timestamps are normalised to UTC — read as local, a ten-minute-old record
+parsed hours into the future and its age was suppressed entirely, meaning the
+feature silently did nothing on the freshest memories. An absent or unparseable
+date renders as nothing rather than defaulting to now; defaulting would make
+the oldest memories, the ones most likely to be stale, appear freshest.
+
+`tests/integration/grounding-staleness.test.ts` runs the reviewer's own probe —
+seed a deliberately outdated note beside a contradicting fresh one and assert
+the model receives both, visibly dated. Anyone can run it.
+
+**Not solved, and not claimed:** retrieval does not weight recency. A stale note
+shown *beside* a fresh one is the easy case — the model sees both dates and can
+weigh them. The hard case is a stale note retrieved *alone*, because ranking is
+by keyword match and an old store returns old results; then the age label is the
+only defence and there is no fresher record to compare against. Tracked as
+`TECH_DEBT.md` #4.
+
+## What's New in v20.5.0 – v20.5.2
+
+### The First Message Never Leaves Your Machine
+
+Symptom-triggered skills — the rules that fire on "can't see X", "no rows",
+"the list is empty" — are meant to load on the turn an incident report arrives.
+They never did: every host template called `session_bootstrap` with `{}`, so
+there was no prompt to match against.
+
+Fixing that raised the question of where matching happens. It now happens
+locally. The 28 keyword rules are already public, so there was nothing a local
+match could not compute, and `callPortal()` has no `prompt` parameter at all —
+the guarantee is structural, not a promise. The portal request carries the
+project and role only.
+
+A matched rule now arrives as **content**, not as a name. Native hosts outside
+the skill-file mirror had no way to read a rule they were only told about, so
+the rule body is inlined into the startup display, bounded and sized against
+the real per-project budget.
+
 ## What's New in v20.4.0
 
 ### An Explicitly Named Cloud Backend Fails Loud

package/dist/cli.js

@@ -393,7 +393,11 @@ program
         // v9.2.2: --storage flag overrides PRISM_STORAGE env var to prevent
         // split-brain when CLI environment differs from MCP server config.
         if (storage) {
-            const validStorages = ['local', 'supabase'];
+            // Must mirror the PRISM_STORAGE union in config.ts. This list shipped
+            // as ['local','supabase'] — rejecting 'auto' (the documented default in
+            // this very command's --storage help text) and 'synalux' (the actual
+            // production backend). Found 2026-08-03; the config type is the truth.
+            const validStorages = ['auto', 'local', 'supabase', 'synalux'];
             if (!validStorages.includes(storage)) {
                 console.error(`Error: Invalid storage "${storage}". Must be one of: ${validStorages.join(', ')}`);
                 process.exit(1);
@@ -512,7 +516,11 @@ saveCmd
     try {
         // Storage override
         if (options.storage) {
-            const validStorages = ['local', 'supabase'];
+            // Must mirror the PRISM_STORAGE union in config.ts. This list shipped
+            // as ['local','supabase'] — rejecting 'auto' (the documented default in
+            // this very command's --storage help text) and 'synalux' (the actual
+            // production backend). Found 2026-08-03; the config type is the truth.
+            const validStorages = ['auto', 'local', 'supabase', 'synalux'];
             if (!validStorages.includes(options.storage)) {
                 console.error(`Error: Invalid storage "${options.storage}". Must be one of: ${validStorages.join(', ')}`);
                 process.exit(1);
@@ -565,7 +573,11 @@ saveCmd
     try {
         // Storage override
         if (options.storage) {
-            const validStorages = ['local', 'supabase'];
+            // Must mirror the PRISM_STORAGE union in config.ts. This list shipped
+            // as ['local','supabase'] — rejecting 'auto' (the documented default in
+            // this very command's --storage help text) and 'synalux' (the actual
+            // production backend). Found 2026-08-03; the config type is the truth.
+            const validStorages = ['auto', 'local', 'supabase', 'synalux'];
             if (!validStorages.includes(options.storage)) {
                 console.error(`Error: Invalid storage "${options.storage}". Must be one of: ${validStorages.join(', ')}`);
                 process.exit(1);

package/dist/connect.js

@@ -60,15 +60,48 @@ const LEGACY_CLAUDE_PROJECT_PRISM_ENTRY = {
 };
 const INSTALLATION_RECEIPT_SCHEMA_VERSION = 1;
 const INSTALLATION_RECEIPT_OWNER = "prism-connect";
+/**
+ * Economy subagent model per host.
+ *
+ * The local-first policy already permits exactly this — "a host-native subagent
+ * is a last resort: at most one, no nesting, using the configured economy
+ * model" — but only Claude was configured that way. Gemini and Codex banned
+ * subagents outright, which is stricter than the policy Prism publishes.
+ *
+ * The stated reason for Gemini was "native/remote subagents". That does not
+ * survive checking: Gemini CLI subagents execute locally, in-process, with
+ * optional local container sandboxes. The model is remote, which is equally
+ * true of Claude and Codex. There was no egress difference to justify the
+ * asymmetry.
+ *
+ * Cursor is deliberately absent. Its Background Agents really do run in remote
+ * cloud sandboxes with repository access — a different risk class — and no
+ * subagent-model setting was found for it.
+ */
 const CLAUDE_FALLBACK_SUBAGENT_MODEL = "sonnet";
+/** Fastest tier of the GPT-5.6 line (Sol > Terra > Luna) for simple work. */
+const CODEX_ECONOMY_SUBAGENT_MODEL = "gpt-5.6-luna";
+/**
+ * Gemini's speed tier for agentic work.
+ *
+ * Confirmed working in practice. An earlier revision changed this to
+ * `gemini-3-flash-preview` because `gemini-3.6-flash` appears in none of the
+ * 116 files of gemini-cli 0.49.0 — but the CLI does not validate Gemini model
+ * names at all. Its only ALLOWED_MODELS list gates Whisper speech binaries.
+ * Model names are passed through to the API, so absence from the bundle says
+ * nothing about resolvability. That reversion was a regression to an older ID.
+ */
+const GEMINI_ECONOMY_SUBAGENT_MODEL = "gemini-3.6-flash";
 const CODEX_LOCAL_FIRST_POLICY = {
     features: {
-        multi_agent: false,
+        // Subagents permitted, but bounded: the ceiling below is what keeps this
+        // from becoming fan-out. Previously false, which contradicted the policy.
+        multi_agent: true,
     },
     agents: {
-        max_threads: 2,
-        max_depth: 1,
-        default_subagent_model: "gpt-5.6-terra",
+        max_threads: 1, // "at most one" — was 2
+        max_depth: 1, // "no nesting"
+        default_subagent_model: CODEX_ECONOMY_SUBAGENT_MODEL,
         default_subagent_reasoning_effort: "low",
         job_max_runtime_seconds: 900,
     },
@@ -827,7 +860,21 @@ export function configureClaudeAgentPolicy(homeDir = homedir(), dryRun = false,
         return true;
     }, dryRun, beforeCommit);
 }
-/** Disable Gemini's native/remote subagents; Prism local workers remain available over MCP. */
+/**
+ * Pin Gemini's subagents to the economy model rather than banning them.
+ *
+ * Previously this wrote `enableAgents = false`, which is stricter than the
+ * local-first policy Prism publishes — that policy allows "at most one, no
+ * nesting, using the configured economy model", and Claude was configured
+ * exactly that way. The stated reason was "native/remote subagents", which does
+ * not hold: Gemini CLI subagents execute locally, in-process, with optional
+ * local container sandboxes. Only the model is remote, as it is for every host.
+ *
+ * `agents.overrides.<name>.modelConfig.model` is the documented shape. Only
+ * `codebase_investigator` is pinned: it is the built-in whose name is published,
+ * and inventing names for the others would write dead config. Unpinned
+ * subagents inherit the session model, which is the pre-existing behaviour.
+ */
 export function configureGeminiAgentPolicy(homeDir = homedir(), dryRun = false, beforeCommit) {
     const configPath = join(homeDir, ".gemini", "settings.json");
     return configureJsonAgentPolicy(configPath, "Gemini agent settings", (config) => {
@@ -835,11 +882,42 @@ export function configureGeminiAgentPolicy(homeDir = homedir(), dryRun = false,
         if (currentExperimental !== undefined && !isJsonObject(currentExperimental)) {
             throw new Error('"experimental" must be a JSON object');
         }
+        const currentAgents = config.agents;
+        if (currentAgents !== undefined && !isJsonObject(currentAgents)) {
+            throw new Error('"agents" must be a JSON object');
+        }
         const experimental = (currentExperimental ?? {});
-        if (experimental.enableAgents === false)
+        const agents = (currentAgents ?? {});
+        const currentOverrides = agents.overrides;
+        if (currentOverrides !== undefined && !isJsonObject(currentOverrides)) {
+            throw new Error('"agents.overrides" must be a JSON object');
+        }
+        const overrides = (currentOverrides ?? {});
+        const investigator = (isJsonObject(overrides.codebase_investigator)
+            ? overrides.codebase_investigator
+            : {});
+        const modelConfig = (isJsonObject(investigator.modelConfig)
+            ? investigator.modelConfig
+            : {});
+        // Respect a deliberate opt-out. Prism previously forced enableAgents=false
+        // on every run; flipping that to an unconditional `true` would repeat the
+        // same mistake pointing the other way, and switching something ON that a
+        // user turned OFF is the more intrusive direction. Only enable when the
+        // key is absent — pin the model either way, so a user who keeps subagents
+        // off still gets the economy default if they later turn them on.
+        const userDisabledDeliberately = experimental.enableAgents === false;
+        const alreadyApplied = (userDisabledDeliberately || experimental.enableAgents === true)
+            && modelConfig.model === GEMINI_ECONOMY_SUBAGENT_MODEL;
+        if (alreadyApplied)
             return false;
-        experimental.enableAgents = false;
+        if (!userDisabledDeliberately)
+            experimental.enableAgents = true;
+        modelConfig.model = GEMINI_ECONOMY_SUBAGENT_MODEL;
+        investigator.modelConfig = modelConfig;
+        overrides.codebase_investigator = investigator;
+        agents.overrides = overrides;
         config.experimental = experimental;
+        config.agents = agents;
         return true;
     }, dryRun, beforeCommit);
 }
@@ -933,7 +1011,12 @@ export function configureCodexAgentPolicy(homeDir, dryRun = false, beforeCommit,
         : undefined;
     if (!parsedFeatures
         || !parsedAgents
-        || !isDeepStrictEqual(parsedFeatures.multi_agent, false)
+        // Validate against the declared policy, not a literal. Hardcoding `false`
+        // here meant the guard rejected any change to CODEX_LOCAL_FIRST_POLICY
+        // rather than verifying the write matched it — a guard pinned to a value
+        // instead of to the invariant it exists to protect.
+        || !Object.entries(CODEX_LOCAL_FIRST_POLICY.features)
+            .every(([key, value]) => isDeepStrictEqual(parsedFeatures[key], value))
         || !Object.entries(CODEX_LOCAL_FIRST_POLICY.agents)
             .every(([key, value]) => isDeepStrictEqual(parsedAgents[key], value))) {
         throw new Error("Generated Codex local-first policy failed validation");

package/dist/tools/graphHandlers.js

@@ -268,6 +268,16 @@ export async function knowledgeSearchHandler(args) {
     if (data.results && Array.isArray(data.results) && data.results.length > 0) {
         const evidenceSnippets = data.results.map((r, i) => ({
             source: `knowledge_search:${r.id ?? i}`,
+            // Carry the record date. Without it a two-year-old note and yesterday's
+            // are indistinguishable in the grounding evidence, so a stale memory is
+            // cited with the same confidence as a fresh one — local storage removes
+            // the external correction pressure that would otherwise catch it.
+            // session_date first: it is when the work HAPPENED, which is what a
+            // staleness signal needs. created_at is when the row was written and is
+            // assigned on save — it cannot be backdated, so an import would stamp
+            // every migrated memory as brand new, failing silently toward "fresh".
+            // sqlite.ts already treats session_date as authoritative.
+            recorded: r.session_date ?? r.created_at ?? r.updated_at ?? r.timestamp ?? undefined,
             content: (r.content ?? r.summary ?? r.text ?? "").slice(0, 1000),
         })).filter((s) => s.content);
         if (evidenceSnippets.length > 0) {
@@ -624,6 +634,7 @@ export async function sessionSearchMemoryHandler(args) {
         {
             const evidenceSnippets = results.map((r, i) => ({
                 source: `session_search_memory:${r.id ?? i}`,
+                recorded: r.session_date ?? r.created_at ?? r.updated_at ?? r.timestamp ?? undefined,
                 content: (r.summary ?? "").slice(0, 1000),
             })).filter((s) => s.content);
             if (evidenceSnippets.length > 0) {

package/dist/tools/ledgerHandlers.js

@@ -276,8 +276,20 @@ async function buildNativeSystemReadyBlock(snapshot, depth) {
     const superSkills = snapshot.names.filter((name) => name.endsWith("-super-skill"));
     const superSkillAliases = superSkills.map((name) => `${name.slice(0, -"-super-skill".length)} (${name})`);
     const otherTierSkills = snapshot.names.filter((name) => !coreSkillSet.has(name) && !name.endsWith("-super-skill"));
+    // Conflicts must be LOUD, named, and actionable. This used to render as
+    // "· 2 local conflicts preserved" — a count with benign phrasing, so two
+    // safety skills (ask-first among them) sat 4 months stale on disk while
+    // every sync silently skipped them and nobody was ever told which ones.
     const conflictSuffix = snapshot.conflicts.length > 0
-        ? ` · ${snapshot.conflicts.length} local conflict${snapshot.conflicts.length === 1 ? "" : "s"} preserved`
+        ? ` · ${snapshot.conflicts.length} conflict${snapshot.conflicts.length === 1 ? "" : "s"} — see warning`
+        : "";
+    const conflictWarning = snapshot.conflicts.length > 0
+        ? `\n> - ⚠️ **SKILLS NOT UPDATING (local copy has no Prism ownership marker):** ` +
+            `${formatBoundedSkillNames([...snapshot.conflicts].sort(), "blocked")}. ` +
+            `Each named skill is frozen at whatever version is on disk — updates are ` +
+            `withheld to protect local edits. To resume updates: move the skill's ` +
+            `directory out of the native skills folder and rerun \`prism connect\` ` +
+            `(or a session bootstrap) to reinstall the managed copy.`
         : "";
     if (snapshot.source === "validated-partial") {
         return `> **Prism System Ready**\n>\n` +
@@ -287,14 +299,16 @@ async function buildNativeSystemReadyBlock(snapshot, depth) {
             `> - 🧩 **Super-skill entitlements:** ${formatBoundedSkillNames(superSkillAliases, "entitled")}\n` +
             `> - 🛠️ **Other tier entitlements:** ${formatBoundedSkillNames(otherTierSkills, "entitled")}\n` +
             `> - 🧠 **Context depth:** ${depth}\n` +
-            `> - 🔄 **Skill sync:** ${SKILL_SYNC_STATUS_LABELS[snapshot.syncStatus]} · native materialization incomplete${conflictSuffix}`;
+            `> - 🔄 **Skill sync:** ${SKILL_SYNC_STATUS_LABELS[snapshot.syncStatus]} · native materialization incomplete${conflictSuffix}` +
+            conflictWarning;
     }
     if (snapshot.source === "tier-fallback") {
         return `> **Prism System Ready**\n>\n` +
             `> - 🪪 **Subscription tier:** ${snapshot.tier}\n` +
             `> - 🛡️ **Fallback skill names:** ${formatBoundedSkillNames(snapshot.names, "fallback")}\n` +
             `> - 🧠 **Context depth:** ${depth}\n` +
-            `> - 🔄 **Skill sync:** ${SKILL_SYNC_STATUS_LABELS[snapshot.syncStatus]} · no committed manifest${conflictSuffix}`;
+            `> - 🔄 **Skill sync:** ${SKILL_SYNC_STATUS_LABELS[snapshot.syncStatus]} · no committed manifest${conflictSuffix}` +
+            conflictWarning;
     }
     return `> **Prism System Ready**\n>\n` +
         `> - 🪪 **Subscription tier:** ${snapshot.tier}\n` +
@@ -303,7 +317,8 @@ async function buildNativeSystemReadyBlock(snapshot, depth) {
         `> - 🧩 **Super-skills provisioned:** ${formatBoundedSkillNames(superSkillAliases, "provisioned")}\n` +
         `> - 🛠️ **Other tier skills provisioned:** ${formatBoundedSkillNames(otherTierSkills, "provisioned")}\n` +
         `> - 🧠 **Context depth:** ${depth}\n` +
-        `> - 🔄 **Skill sync:** ${SKILL_SYNC_STATUS_LABELS[snapshot.syncStatus]} · committed manifest${conflictSuffix}`;
+        `> - 🔄 **Skill sync:** ${SKILL_SYNC_STATUS_LABELS[snapshot.syncStatus]} · committed manifest${conflictSuffix}` +
+        conflictWarning;
 }
 function capNativeStartupText(text, level, requestedMaxChars, suffix = "") {
     const maxChars = effectiveNativeBudget(level, requestedMaxChars);

package/dist/tools/queryMemoryNaturalHandler.js

@@ -55,7 +55,7 @@ const GROUNDED_SYNTHESIS_SYSTEM = "Answer the user's question using only the sup
     "For clinical or behavioral topics, provide educational candidates for credentialed review, " +
     "not individualized treatment instructions or professional sign-off. " +
     "If the evidence is insufficient, say exactly what is missing instead of guessing.";
-function extractMemorySources(result) {
+export function extractMemorySources(result) {
     if (result.isError) {
         throw new Error(result.content[0]?.text || "knowledge_search failed");
     }
@@ -82,6 +82,7 @@ function extractMemorySources(result) {
             sources.push({
                 type: "memory",
                 source: snippet.source,
+                recorded: typeof snippet.recorded === "string" ? snippet.recorded : undefined,
                 content: snippet.content.slice(0, MAX_EVIDENCE_CHARS),
             });
         }
@@ -224,13 +225,49 @@ const DEFAULT_DEPS = {
 function toEvidence(sources) {
     return sources.map(({ source, content }) => ({ source, content }));
 }
-function buildGroundedEvidenceContext(sources) {
+/**
+ * SQLite `CURRENT_TIMESTAMP` writes "YYYY-MM-DD HH:MM:SS" in UTC with no zone,
+ * and `Date.parse` reads a zone-less stamp as LOCAL time. West of UTC that puts
+ * a ten-minute-old record hours in the FUTURE, which the guard above then hid
+ * entirely — the age disappeared exactly when the memory was freshest. Formats
+ * are not uniform across tables (semantic_knowledge writes ISO+Z, memory_links
+ * does not), so normalise rather than assume.
+ */
+function parseRecordedAt(raw) {
+    const zoneless = /^\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2}(?:\.\d+)?$/;
+    return Date.parse(zoneless.test(raw) ? `${raw.replace(" ", "T")}Z` : raw);
+}
+/**
+ * " (recorded 2026-08-02, 431 days ago)" — or "" when the store gave no date.
+ * Never guesses: an absent date stays absent rather than defaulting to now,
+ * which would make the oldest memories look freshest.
+ */
+export function describeAge(source) {
+    const recorded = source.type === "memory" ? source.recorded : undefined;
+    if (!recorded)
+        return "";
+    const at = parseRecordedAt(recorded);
+    if (Number.isNaN(at))
+        return "";
+    const elapsed = Date.now() - at;
+    // Tolerate clock skew between machines: slightly-future stamps are "today",
+    // not silence. Only a stamp more than a day ahead is treated as bad data.
+    if (elapsed < -86_400_000)
+        return "";
+    const days = Math.max(0, Math.floor(elapsed / 86_400_000));
+    const day = recorded.slice(0, 10);
+    return days === 0 ? ` (recorded ${day}, today)` : ` (recorded ${day}, ${days} days ago)`;
+}
+export function buildGroundedEvidenceContext(sources) {
     let remaining = MAX_SYNTHESIS_EVIDENCE_CHARS;
     const evidenceBlocks = [];
     for (const [index, source] of sources.entries()) {
         if (remaining <= 0)
             break;
-        const label = `[SOURCE ${index + 1}: ${source.source}]`;
+        // Age belongs in the label, not just the payload. An undated fragment
+        // cannot be reasoned about; a fragment labelled two years old can be
+        // weighed against fresher evidence or challenged outright.
+        const label = `[SOURCE ${index + 1}: ${source.source}${describeAge(source)}]`;
         const availableForContent = Math.max(0, remaining - label.length - 1);
         if (availableForContent === 0)
             break;

package/dist/tools/skillRouting.js

@@ -46,6 +46,13 @@ export const REQUIRED_PROTECTED_SKILL_NAMES = [
     // so the two sources disagreed. A portal test now asserts they match.
     'data-before-code',
     'critical-thinking-debug',
+    // Added 2026-08-03. The floor had grown past every budget tranche, so an
+    // unprotected universal skill could NEVER inline — including the destruction
+    // gate, during the very audit of a demo-venue wipe it should have prevented.
+    // If these two are absent, nothing tells the agent that announcing a wipe is
+    // not the same as being allowed to run it.
+    'ask-first',
+    'feature-preservation',
 ];
 /**
  * Native skills that paid subscription tiers receive through `prism connect`.

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "prism-mcp-server",
-  "version": "20.5.2",
+  "version": "20.6.0",
   "mcpName": "io.github.dcostenco/prism-coder",
-  "description": "Prism Coder — Cognitive memory + tool-calling intelligence for AI agents. Mind Palace persistent memory (BFCL Gold Certified, 100% Tool-Call Accuracy, 114 Agent Skills, PHI Guard, Tier Enforcement, Prompt-Based Skill Routing, Zero-Search HDC/HRR retrieval, HRR Semantic Drift Detection across BCBA/Coding/AAC domains, HIPAA-hardened local or subscription-gated Synalux storage, SLERP-optimized GRPO alignment) plus the prism-coder 1.7B–32B open-weights LLM fleet.",
+  "description": "Prism Coder \u2014 Cognitive memory + tool-calling intelligence for AI agents. Mind Palace persistent memory (BFCL Gold Certified, 100% Tool-Call Accuracy, 114 Agent Skills, PHI Guard, Tier Enforcement, Prompt-Based Skill Routing, Zero-Search HDC/HRR retrieval, HRR Semantic Drift Detection across BCBA/Coding/AAC domains, HIPAA-hardened local or subscription-gated Synalux storage, SLERP-optimized GRPO alignment) plus the prism-coder 1.7B\u201332B open-weights LLM fleet.",
   "module": "index.ts",
   "type": "module",
   "main": "dist/server.js",