FAQ

What people ask before they install.

How much does PRISM reduce token costs?

Up to 70% of context cost on long agent sessions. prism-proxy applies stacked compression — RTK for tool-definition bloat, real WebP@87 vision rendering for long prose, Caveman for the rest — while strictly preserving errors, stack traces, and results. Its markdown audit ranks every tool by context consumption, so you see exactly what to cut.

Is PRISM an agent?

No. PRISM is a harness — the set of tools, prompts, and operational discipline an agent is plugged into. The doctrine rules in agents/rules/ steer any AI coding agent toward disciplined behavior. Independent benchmarks show the same model scoring 77% and 93% on identical tasks depending only on the harness it runs in.

Do I need to install everything?

No — and you probably shouldn't. Every component is independent, so start from your goal and install the minimal set:

• Steering files / git workflow / team dev skills → just prism-harness.
• Route across providers and models, rotate plans, safe keys → prism-route.
• Cut token bills and audit context → prism-proxy.
• Overnight memory / resumable agent → prism-loop.
• Enforce reviews on every MR → prism-sober.
• Sovereign multi-agent VCS lanes → prism-graf.
• A lean, fast Hermes/OpenClaw-style chat straight to your models → prism-chat.

Add more later as you need it — nothing requires the full suite. See the decision matrix →

What models does it work with?

Any. Claude Code, OpenAI Codex, OpenCode, Hermes Agent, or your own. The doctrine is model-agnostic; prism-route handles the actual model call, with KDL profiles for OpenAI-compatible and Anthropic providers, plan rotation, and failover tiers.

How does prism-route keep my API keys safe?

Keys live in files under ~/.secrets/ and are loaded only by the selector process. prism-route serve injects the auth header server-side on every request; agents and chat clients never see a key, and nothing is logged unredacted.

What is prism-chat?

The lightweight chat surface: talk to your routed models without an agent. Terminal commands (ask, repl) and a local installable PWA at 127.0.0.1:8789, both riding prism-route serve. Streaming, session usage, markdown export — and no keys in the client. More on the eight components →

What is prism-graf?

Added in the Sept 2026 RC train. Graf is the sovereign VCS (not GitHub) for multi-agent work: lane naming conventions, worktree hygiene, the agents/rules/graf-first.md contract JARVIS SPEC-028's runtime graf adapter hires specialists onto. prism-graf alone is useful for any operator who wants Graf-first discipline without the rest of the suite.

What is prism-mem? What is AKF?

The newest component — portable memory. AKF, the Agentic Knowledge Format, is an open standard for curated agent knowledge: a bundle is a plain directory of Markdown prose with KDL sidecar metadata, optional evidence, retained revision history, and a BLAKE3 integrity manifest with detached signatures. No database, no embeddings, no vendor service required to read it.

prism-mem binds one signed bundle ("brain") to a project. Eligible Codex or Claude sessions can receive a bounded, cited packet after the provider trusts and enables that hook. Check a fresh session for actual delivery; Mnemos re-verifies signatures and policy whenever the Knowledge hook runs. A second surface fronts Mnemos operational context, so Claude can resume what Codex was doing (cited next steps, explicitly labeled untrusted evidence). PRISM is a strict JSON facade in front of your local Mnemos owner — it runs no second memory engine and opens no bundle itself.

Does prism-mem replace prism-loop?

No — they compose. prism-loop is the self-contained file protocol for overnight runs in one repo: durable .prism/ memory, run boundaries, no owner process needed. prism-mem is the owner-backed facade for signed, portable AKF knowledge and cross-provider context. Loop remembers this project's runs; mem carries what you've established — to any agent, any machine.

What is the GitSpawn-class attack?

The Sept 2026 wave of malicious-git-config attacks against AI coding agents. A repo delivered as a zip, USB stick, cloud-sync folder, or shared drive can carry core.fsmonitor = <attacker command> in its .git/config. ANY subsequent git call — git status, git rev-parse, git diff, worktree ops — triggers git to read the local config and execute the attacker's command as the operator, BEFORE any sandbox, prompt, or approval gate fires. The wave hit goose, OpenAI Codex, Claude Code, and Hermes Agent as CVE-2026-72718 (goose, CVSS 7.0), CVE-2026-19592 (Codex), CVE-2026-55607 (Claude Code, 2.1.193–2.1.252), and CVE-2026-71963 (Hermes). The Claude Code claude ultrareview code path is still unpatched at publication. Full writeup →

How does PRISM defend against GitSpawn?

Two layers ship today, fail-closed. A third, the pinned installer, is not available yet.

1. Auto-scrub in every CLI. prism-harness init, prism-graf init, prism-loop doctor, prism-route smoke, and prism-proxy smoke all scrub the LOCAL .git/config of the target before any other git call. Hard-fails with exit 1 on scrub errors.
2. Standalone scrub subcommand. prism-harness scrub /path/to/untrusted-repo removes core.fsmonitor, core.hooksPath, core.sshCommand, filter.*.clean/ .smudge, and adjacent command-execution vectors from the LOCAL .git/config only. Never --global, never --system. --dry-run reports, --json emits the report. Same scrubber exposed on every other CLI in the suite.
3. Pinned installer (not yet available). install.sh has a --verify option for minisign signatures, but no signed release has been published yet, so it exits 4 today. Signed releases with a signed manifest of every component's version and digest are planned.

The scrub itself passes -c core.fsmonitor=false -c core.hooksPath= -c core.sshCommand= -c core.gitProxy= on every internal git call, so the scrub cannot trigger an attack mid-run.

Does the defense work without minisign?

Yes. The scrub and the auto-scrub work without minisign. minisign will only be needed for the pinned install, which is not available yet: no signed release has been published, so install.sh --verify exits 4 today.

Can I install only some components?

Yes. prism-harness is the doctrine + CLI core (it also installs the prism-mem CLI). The other seven are components you pick by what you need:

• prism-route — routing + rotation + auth.
• prism-mem — portable signed AKF knowledge, delivered through trusted startup bindings.
• prism-loop — overnight autonomous work with memory.
• prism-sober — MR-level review steering against your doctrine.
• prism-proxy — loopback auditor + compressor on your model calls.
• prism-chat — direct chat (terminal + PWA) through the gateway.
• prism-graf — sovereign multi-agent VCS lane discipline.

Is PRISM free?

Yes — LSL-1.0, Libertaria Sovereign License v1.0. File-level copyleft on the doctrine rules, templates, CLI, installer, and container. Touch them, publish your changes back. No copyleft infection for proprietary product code; the CLI sits next to your code, your code is yours.

Why the Debian container for the agent?

Reproducible, small (~80 MB compressed), and fully equipped — Bun + Git + build-essential + Python + gnupg. The image bundles the six registry packages (seven components; prism-graf is not included) on one shared Bun runtime. Distribution is versioned tarballs + a latest pointer at pkg.getharness.app, with a SHA256SUMS manifest for verification. Runs as a systemd quadlet (sandboxed by default) or as a one-shot interactive container.

Does the identity canon leak to public registries?

No. The canon lives at ~/.prism/identity/ on the operator's machine. The sovereign Forgejo registry hosts only the six @prism/* packages (seven CLIs — prism-mem rides @prism/harness; prism-graf is built from its Git repository) and their metadata. No telemetry, no tracking, no central control.

What happens if I edit SOUL.md?

You tell the agent first. SOUL.md changes only by joint decision. Procedure moves to DOCTRINE.md; cadence lives in the file matching its tempo. If a paragraph has a date or a cadence in it, it belongs elsewhere.

Why "name is the LAST question"?

By the time the human picks a name, the designation, primary purpose, tone, and scope are already in place — the name lands better that way. The questionnaire holds name until the end.

Can the agent run without an identity canon?

Yes, but it's stillborn. The agent has no name, no purpose, no memory, no heartbeat. prism-harness identity init is what brings it to life. How the canon works →

Where does the doctrine come from?

The Mosaic Trust Network team — mosaic-trust-network/agents on dlabs GitLab, authored over 2026-Q2. Adopted under LSL-1.0; mirrored byte-for-byte. The CLI, installer, identity canon, and container are original Virgil / Hermes Agent work, July–August 2026. The GitSpawn-class defense shipped in the 1.0.0-rc.3 release on 2026-09-02.

Where can I report issues or security findings?

git.sovereign-society.org/prism — issue trackers per component repo. Security findings: email [email protected] (PGP key in KEYS) or open a SECURITY-tagged issue. No Discord, no Slack — the forge is the surface.