@gotgenes/pi-permission-system 20.1.0 → 20.2.0

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [20.2.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.1.0...pi-permission-system-v20.2.0) (2026-07-09)
+
+
+### Features
+
+* **pi-permission-system:** serve forwarded permissions by resolution and Authorizer escalation ([#557](https://github.com/gotgenes/pi-packages/issues/557)) ([c5d3bcb](https://github.com/gotgenes/pi-packages/commit/c5d3bcbf4e69a568f750d6a7c0619d4b88d5b377))
+
+
+### Documentation
+
+* **pi-permission-system:** mark Phase 9 Step 3 complete ([a5a348f](https://github.com/gotgenes/pi-packages/commit/a5a348f3d3dc1835e64ecd7b6b0c1b6164085a97))
+
 ## [20.1.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.0.0...pi-permission-system-v20.1.0) (2026-07-08)
 
 

package/docs/cross-extension-api.md

@@ -307,7 +307,8 @@ This event is for integrations such as notification extensions that should alert
 It is not a generic "permission request entered waiting state" event, and it does not imply the prompt will be approved.
 Policy decisions that resolve without an active UI prompt, such as `policy_allow`, `policy_deny`, `session_approved`, `infrastructure_auto_allowed`, or `auto_approved`, do not emit this event.
 Non-UI child sessions also do not emit this event when they create a forwarded permission request; the parent UI session emits it immediately before showing the forwarded permission dialog.
-Forwarded prompts are not degraded: the parent emits the child's original `source` and the same `surface`/`value` display projection, plus a populated `forwarding` context identifying the requesting subagent.
+A forwarded request the parent's own recorded policy decides (a matching `allow` or `deny`) is answered without a prompt and emits no event; the event fires only when the parent is actually about to ask the human.
+Forwarded prompts that do reach the human are not degraded: the parent emits the child's original `source` and the same `surface`/`value` display projection, plus a populated `forwarding` context identifying the requesting subagent.
 
 The payload is lean by design — `surface`/`value` are the normalized display projection a notification consumer reads, not a mirror of the internal review log.
 Read defensively rather than version-gating: broadcast payloads carry no `protocolVersion`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "20.1.0",
+  "version": "20.2.0",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/authority/approval-escalator.ts

@@ -28,7 +28,7 @@ import {
   resolvePermissionForwardingTargetSessionId,
   SUBAGENT_PARENT_SESSION_ENV_CANDIDATES,
 } from "#src/permission-forwarding";
-import { buildDirectUiPrompt } from "#src/permission-ui-prompt";
+import { buildUiPrompt } from "#src/permission-ui-prompt";
 import type { DebugReviewLogger } from "#src/session-logger";
 import type { SubagentSessionRegistry } from "#src/subagent-registry";
 import { toRecord } from "#src/value-guards";
@@ -97,7 +97,7 @@ export class ParentAuthorizer implements Authorizer {
   authorize(
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision> {
-    const uiPrompt = buildDirectUiPrompt(details);
+    const uiPrompt = buildUiPrompt(details);
     return this.waitForForwardedApproval(this.ctx, details.message, {
       source: uiPrompt.source,
       surface: uiPrompt.surface,

package/src/authority/authorizer-selection.ts

@@ -1,5 +1,4 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { GatePrompter } from "#src/gate-prompter";
 import type { PermissionPromptDecision } from "#src/permission-dialog";
 import {
   type Authorizer,
@@ -23,23 +22,34 @@ export interface AuthorizerSelectionLifecycle {
   deactivate(): void;
 }
 
+/**
+ * The ask-escalation seam `GateRunner` depends on: escalate a single ask to
+ * the session's selected `Authorizer` and return its decision.
+ *
+ * Replaces the two-method `GatePrompter` role (#556). There is no
+ * "can anyone answer" pre-check: absent authority is the `DenyingAuthorizer`,
+ * which answers by denying with a `confirmationUnavailable` marker.
+ */
+export interface AskEscalator {
+  escalate(details: PromptPermissionDetails): Promise<PermissionPromptDecision>;
+}
+
 /**
  * Context-owning selection root for the Authorizer spine.
  *
  * The rewrite of `PromptingGateway`: owns the stored `ExtensionContext`, runs
- * `selectAuthorizer` once per activation, and implements `GatePrompter` by
+ * `selectAuthorizer` once per activation, and implements `AskEscalator` by
  * delegating to the selected `Authorizer` via `PermissionPrompter`.
  *
- * `canConfirm()` survives this step (dissolved in #556): it is recomputed
- * transitionally alongside `selectAuthorizer`'s own branch, rather than
- * derived from the selected authorizer, to keep the ask path byte-identical
- * until #556 derives confirmability from a `DenyingAuthorizer` marker.
+ * `selectAuthorizer` encodes the liveness decision in *which* `Authorizer` it
+ * returns (`LocalUserAuthorizer` / `ParentAuthorizer` when authority is
+ * reachable, `DenyingAuthorizer` otherwise), so no separate confirmability
+ * predicate survives (#556 dissolved `canConfirm()`).
  */
 export class AuthorizerSelection
-  implements GatePrompter, AuthorizerSelectionLifecycle
+  implements AskEscalator, AuthorizerSelectionLifecycle
 {
   private selected: Authorizer | null = null;
-  private confirmable = false;
 
   constructor(
     private readonly deps: AuthorizerSelectionDeps & {
@@ -47,39 +57,28 @@ export class AuthorizerSelection
     },
   ) {}
 
-  /** Select the Authorizer for `ctx` and store both it and the confirmable predicate. */
+  /** Select the Authorizer for `ctx` and store it. */
   activate(ctx: ExtensionContext): void {
     this.selected = selectAuthorizer(ctx, this.deps);
-    this.confirmable = ctx.hasUI || this.deps.detection.isSubagent(ctx);
   }
 
   /** Clear the stored selection. */
   deactivate(): void {
     this.selected = null;
-    this.confirmable = false;
-  }
-
-  /**
-   * Whether an interactive permission prompt can be shown.
-   *
-   * Returns false when no authorizer has been selected. Otherwise true when
-   * the context had UI or was a forwarding subagent at selection time — the
-   * two Authorizer-selection predicates, evaluated once at `activate`.
-   */
-  canConfirm(): boolean {
-    return this.selected !== null && this.confirmable;
   }
 
   /**
-   * Prompt for a permission decision using the selected authorizer.
+   * Escalate an ask to the selected authorizer and return its decision.
    *
-   * Rejects if no authorizer has been selected — `canConfirm()` guards this
-   * in normal use. Implements {@link GatePrompter}.
+   * Rejects if no authorizer has been selected — i.e. before the session was
+   * activated. Implements {@link AskEscalator}.
    */
-  prompt(details: PromptPermissionDetails): Promise<PermissionPromptDecision> {
+  escalate(
+    details: PromptPermissionDetails,
+  ): Promise<PermissionPromptDecision> {
     if (this.selected === null) {
       return Promise.reject(
-        new Error("prompt called before the session was activated"),
+        new Error("escalate called before the session was activated"),
       );
     }
     return this.deps.prompter.prompt(this.selected, details);

package/src/authority/denying-authorizer.ts

@@ -4,9 +4,17 @@ import type { Authorizer } from "./authorizer";
 /**
  * Least-privilege Authorizer: no authority is reachable for this session
  * (no UI, not a subagent), so every ask is denied.
+ *
+ * The denial carries the `confirmationUnavailable` marker so the ask path can
+ * distinguish "nobody could answer" from an interactive user denial when it
+ * derives the review-entry and decision-event resolution.
  */
 export class DenyingAuthorizer implements Authorizer {
   authorize(): Promise<PermissionPromptDecision> {
-    return Promise.resolve({ approved: false, state: "denied" });
+    return Promise.resolve({
+      approved: false,
+      state: "denied",
+      confirmationUnavailable: true,
+    });
   }
 }

package/src/authority/forwarded-request-server.ts

@@ -3,26 +3,17 @@ import {
   type ForwarderContext,
   getSessionId,
 } from "#src/authority/forwarder-context";
-import type { ConfigReader } from "#src/config-store";
-import { isYoloModeEnabled } from "#src/extension-config";
-import type {
-  PermissionDecisionUi,
-  PermissionPromptDecision,
-  RequestPermissionOptions,
-} from "#src/permission-dialog";
-import {
-  emitUiPromptEvent,
-  type PermissionEventBus,
-} from "#src/permission-events";
+import type { PermissionPromptDecision } from "#src/permission-dialog";
 import {
   type ForwardedPermissionRequest,
   type ForwardedPermissionResponse,
   isForwardedPermissionRequestForSession,
   type PermissionForwardingLocation,
 } from "#src/permission-forwarding";
-import { buildForwardedUiPrompt } from "#src/permission-ui-prompt";
 import type { DebugReviewLogger } from "#src/session-logger";
-
+import type { SubagentSessionRegistry } from "#src/subagent-registry";
+import type { PermissionCheckResult } from "#src/types";
+import type { AskEscalator } from "./authorizer-selection";
 import {
   cleanupPermissionForwardingLocationIfEmpty,
   ensureDirectoryExists,
@@ -34,6 +25,7 @@ import {
   safeDeleteFile,
   writeJsonFileAtomic,
 } from "./forwarding-io";
+import type { PromptPermissionDetails } from "./permission-prompter";
 
 /**
  * Narrow seam describing what `ForwardingManager` needs from the server: a
@@ -47,20 +39,30 @@ export interface InboxProcessor {
   processInbox(ctx: ForwarderContext): Promise<void>;
 }
 
+/**
+ * Recorded-authority view the serving node resolves a forwarded request
+ * against: answer one `(surface, value)` query on the serving session's
+ * composed base ruleset (agent-neutral — the child already applied its own
+ * per-agent overrides before forwarding).
+ *
+ * Narrow by design (ISP): the server needs one decision, not the whole
+ * resolver. The composition root satisfies it with an access-intent build plus
+ * `resolver.resolve`, the same primitives `LocalPermissionsService` composes.
+ */
+export interface ServingPolicy {
+  check(surface: string, value: string | null): PermissionCheckResult;
+}
+
 /** Constructor config for `ForwardedRequestServer`. */
 export interface ForwardedRequestServerDeps {
   forwardingDir: string;
   logger: DebugReviewLogger;
-  /** Event bus used for UI prompt broadcasts. */
-  events?: PermissionEventBus;
-  requestPermissionDecisionFromUi: (
-    ui: PermissionDecisionUi,
-    title: string,
-    message: string,
-    options?: RequestPermissionOptions,
-  ) => Promise<PermissionPromptDecision>;
-  /** Read current config for the retained forwarded-inbox yolo auto-approve check. */
-  config: ConfigReader;
+  /** Recorded-authority resolution for `(surface, value)` requests. */
+  policy: ServingPolicy;
+  /** Escalation seam to the serving session's selected `Authorizer` on `ask`. */
+  escalator: AskEscalator;
+  /** In-process subagent registry, read only by the one-hop canary. */
+  registry?: SubagentSessionRegistry;
 }
 
 // ── Module-private helpers ────────────────────────────────────────────────
@@ -78,39 +80,70 @@ function formatForwardedPermissionPrompt(
   ].join("\n");
 }
 
+/**
+ * A request is resolvable against the ruleset only when it carries a concrete
+ * `(surface, value)` display projection. A legacy/version-skew request without
+ * them floors to `ask` (escalate), never a silent grant.
+ */
+function hasDisplayFields(
+  request: ForwardedPermissionRequest,
+): request is ForwardedPermissionRequest & { surface: string; value: string } {
+  return (
+    typeof request.surface === "string" &&
+    request.surface.length > 0 &&
+    typeof request.value === "string" &&
+    request.value.length > 0
+  );
+}
+
+/**
+ * Map a forwarded request onto the escalated ask's details, carrying the
+ * forwarded provenance (requester agent/session + the child's original display
+ * projection) so `LocalUserAuthorizer` emits a non-degraded broadcast (#292).
+ */
+function buildForwardedAskDetails(
+  request: ForwardedPermissionRequest,
+): PromptPermissionDetails {
+  return {
+    requestId: request.id,
+    source: request.source ?? "tool_call",
+    agentName: request.requesterAgentName || null,
+    message: formatForwardedPermissionPrompt(request),
+    surface: request.surface ?? null,
+    value: request.value ?? null,
+    forwarding: {
+      requesterAgentName: request.requesterAgentName || null,
+      requesterSessionId: request.requesterSessionId || null,
+    },
+  };
+}
+
 // ── ForwardedRequestServer ────────────────────────────────────────────────
 
 /**
  * Owner of the serving-down role of the forwarded-permission behavior:
  * draining this session's forwarded-permission inbox and answering each
- * request (auto-approve under yolo, or prompt via the injected UI).
+ * request the same way the session resolves a local action — `evaluate()`
+ * against its recorded authority (`ServingPolicy`), then escalation to its
+ * selected `Authorizer` (`AskEscalator`) on `ask`.
  */
 export class ForwardedRequestServer implements InboxProcessor {
   private readonly forwardingDir: string;
-  private readonly events: PermissionEventBus | undefined;
   private readonly logger: DebugReviewLogger;
-  private readonly requestPermissionDecisionFromUi: (
-    ui: PermissionDecisionUi,
-    title: string,
-    message: string,
-    options?: RequestPermissionOptions,
-  ) => Promise<PermissionPromptDecision>;
-  private readonly config: ConfigReader;
+  private readonly policy: ServingPolicy;
+  private readonly escalator: AskEscalator;
+  private readonly registry: SubagentSessionRegistry | undefined;
 
   constructor(deps: ForwardedRequestServerDeps) {
     this.forwardingDir = deps.forwardingDir;
-    this.events = deps.events;
     this.logger = deps.logger;
-    this.requestPermissionDecisionFromUi = deps.requestPermissionDecisionFromUi;
-    this.config = deps.config;
+    this.policy = deps.policy;
+    this.escalator = deps.escalator;
+    this.registry = deps.registry;
   }
 
   /** Drain and respond to this session's forwarded-permission inbox. */
   async processInbox(ctx: ForwarderContext): Promise<void> {
-    if (!ctx.hasUI) {
-      return;
-    }
-
     const currentSessionId = getSessionId(ctx);
     const location = getExistingPermissionForwardingLocation(
       this.forwardingDir,
@@ -152,7 +185,6 @@ export class ForwardedRequestServer implements InboxProcessor {
       }
 
       await this.processSingleForwardedRequest(
-        ctx,
         request,
         location,
         requestPath,
@@ -166,7 +198,6 @@ export class ForwardedRequestServer implements InboxProcessor {
   // ── Private methods ────────────────────────────────────────────────────
 
   private async processSingleForwardedRequest(
-    ctx: ForwarderContext,
     request: ForwardedPermissionRequest,
     location: PermissionForwardingLocation,
     requestPath: string,
@@ -185,6 +216,8 @@ export class ForwardedRequestServer implements InboxProcessor {
       return;
     }
 
+    this.warnOnMultiHop(request, currentSessionId);
+
     const forwardedPermissionLogDetails = {
       requestId: request.id,
       source: location.label,
@@ -194,55 +227,32 @@ export class ForwardedRequestServer implements InboxProcessor {
       requestPath,
     };
 
-    let decision: PermissionPromptDecision = {
-      approved: false,
-      state: "denied",
-    };
-    // Last yolo check outside the composed ruleset: dissolves when
-    // processInbox is refactored onto evaluate() + Authorizer selection in
-    // the Phase 9 spine work.
-    if (isYoloModeEnabled(this.config.current())) {
-      this.logger.review(
-        "forwarded_permission.auto_approved",
-        forwardedPermissionLogDetails,
-      );
-      decision = { approved: true, state: "approved" };
-    } else {
-      this.logger.review(
-        "forwarded_permission.prompted",
-        forwardedPermissionLogDetails,
-      );
-      try {
-        const forwardedMessage = formatForwardedPermissionPrompt(request);
-        if (this.events) {
-          emitUiPromptEvent(
-            this.events,
-            buildForwardedUiPrompt({
-              requestId: request.id,
-              message: forwardedMessage,
-              requesterAgentName: request.requesterAgentName || null,
-              requesterSessionId: request.requesterSessionId || null,
-              source: request.source ?? null,
-              surface: request.surface ?? null,
-              value: request.value ?? null,
-            }),
-          );
-        }
-        decision = await this.requestPermissionDecisionFromUi(
-          ctx.ui,
-          "Permission Required (Subagent)",
-          forwardedMessage,
-        );
-      } catch (error) {
-        logPermissionForwardingError(
-          this.logger,
-          "Failed to show forwarded permission confirmation dialog",
-          error,
-        );
-        decision = { approved: false, state: "denied" };
-      }
-    }
+    const decision = await this.resolveDecision(
+      request,
+      forwardedPermissionLogDetails,
+    );
 
+    this.recordForwardedDecision(
+      request,
+      location,
+      requestPath,
+      currentSessionId,
+      decision,
+    );
+  }
+
+  /**
+   * Persist the served decision: write the response file the child polls for,
+   * log the outcome, and delete the drained request. The symmetric "respond"
+   * half to {@link resolveDecision}'s "decide" half.
+   */
+  private recordForwardedDecision(
+    request: ForwardedPermissionRequest,
+    location: PermissionForwardingLocation,
+    requestPath: string,
+    currentSessionId: string,
+    decision: PermissionPromptDecision,
+  ): void {
     const responsePath = join(location.responsesDir, `${request.id}.json`);
     this.logger.review(
       decision.approved
@@ -282,4 +292,68 @@ export class ForwardedRequestServer implements InboxProcessor {
       `${location.label} forwarded permission request`,
     );
   }
+
+  /**
+   * Resolve the request the same way the session resolves a local action:
+   * recorded authority first (a request carrying `(surface, value)` resolves
+   * against the serving node's composed ruleset — `allow`, including
+   * yolo-rewritten, auto-approves; `deny` auto-denies), then escalate `ask`
+   * (or a request without display fields) to the selected `Authorizer`.
+   */
+  private async resolveDecision(
+    request: ForwardedPermissionRequest,
+    logDetails: Record<string, unknown>,
+  ): Promise<PermissionPromptDecision> {
+    const state = hasDisplayFields(request)
+      ? this.policy.check(request.surface, request.value).state
+      : "ask";
+
+    if (state === "allow") {
+      this.logger.review("forwarded_permission.auto_approved", logDetails);
+      return { approved: true, state: "approved" };
+    }
+    if (state === "deny") {
+      this.logger.review("forwarded_permission.auto_denied", logDetails);
+      return { approved: false, state: "denied" };
+    }
+
+    this.logger.review("forwarded_permission.prompted", logDetails);
+    try {
+      return await this.escalator.escalate(buildForwardedAskDetails(request));
+    } catch (error) {
+      logPermissionForwardingError(
+        this.logger,
+        `Failed to escalate forwarded permission request '${request.id}'`,
+        error,
+      );
+      return { approved: false, state: "denied" };
+    }
+  }
+
+  /**
+   * One-hop canary: forwarding is depth-1 (child → root). If the requester is
+   * itself a registered subagent whose parent is not this serving session, the
+   * request came through more than one hop (or was misrouted) — resolution is
+   * still well-defined, so keep serving, but warn loudly so a future
+   * recursion-guard break is visible rather than silent. Unregistered
+   * (external file-based) requesters have no recorded parent and are silent.
+   */
+  private warnOnMultiHop(
+    request: ForwardedPermissionRequest,
+    currentSessionId: string,
+  ): void {
+    const requesterInfo = this.registry?.get(request.requesterSessionId);
+    if (
+      requesterInfo?.parentSessionId &&
+      requesterInfo.parentSessionId !== currentSessionId
+    ) {
+      logPermissionForwardingWarning(
+        this.logger,
+        `Forwarded permission request '${request.id}' violates the one-hop ` +
+          `invariant: requester '${request.requesterSessionId}' is a registered ` +
+          `subagent whose parent '${requesterInfo.parentSessionId}' is not this ` +
+          `serving session '${currentSessionId}' (multi-hop or misrouted).`,
+      );
+    }
+  }
 }

package/src/authority/local-user-authorizer.ts

@@ -7,7 +7,7 @@ import {
   emitUiPromptEvent,
   type PermissionEventBus,
 } from "#src/permission-events";
-import { buildDirectUiPrompt } from "#src/permission-ui-prompt";
+import { buildUiPrompt } from "#src/permission-ui-prompt";
 import type { Authorizer } from "./authorizer";
 import type { PromptPermissionDetails } from "./permission-prompter";
 
@@ -26,7 +26,10 @@ export interface LocalUserAuthorizerDeps {
  *
  * Emits the `permissions:ui_prompt` broadcast (moved here from
  * `PermissionPrompter`'s `ctx.hasUI` arm) before showing the dialog, so
- * observers know a decision is imminent.
+ * observers know a decision is imminent. This is the single emit site: a
+ * forwarded ask carries its provenance on `details.forwarding`, which this
+ * class renders (populated `forwarding` context + "(Subagent)" title) so the
+ * broadcast stays non-degraded (#292) without a second emission path.
  */
 export class LocalUserAuthorizer implements Authorizer {
   constructor(private readonly deps: LocalUserAuthorizerDeps) {}
@@ -34,11 +37,13 @@ export class LocalUserAuthorizer implements Authorizer {
   authorize(
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision> {
-    const uiPrompt = buildDirectUiPrompt(details);
+    const uiPrompt = buildUiPrompt(details);
     emitUiPromptEvent(this.deps.events, uiPrompt);
     return this.deps.requestPermissionDecisionFromUi(
       this.deps.ui,
-      "Permission Required",
+      details.forwarding
+        ? "Permission Required (Subagent)"
+        : "Permission Required",
       details.message,
       details.sessionLabel ? { sessionLabel: details.sessionLabel } : undefined,
     );

package/src/authority/permission-prompter.ts

@@ -4,6 +4,19 @@ import type { Authorizer } from "./authorizer";
 
 export type PermissionReviewSource = "tool_call" | "skill_input" | "skill_read";
 
+/**
+ * Provenance of a forwarded ask: who is really asking, one hop below.
+ *
+ * Present on {@link PromptPermissionDetails} only when the ask was forwarded
+ * from a subagent. Structurally identical to the event's `ForwardedPromptContext`
+ * so the details flow straight into `buildUiPrompt`, but declared here to keep
+ * the prompter layer free of an events-module import.
+ */
+export interface ForwardedAskProvenance {
+  requesterAgentName: string | null;
+  requesterSessionId: string | null;
+}
+
 /** Details passed when prompting the user for a permission decision. */
 export interface PromptPermissionDetails {
   requestId: string;
@@ -19,6 +32,12 @@ export interface PromptPermissionDetails {
   toolInputPreview?: string;
   /** Override label for the "for this session" dialog option. */
   sessionLabel?: string;
+  /** Explicit display-surface override (a forwarded ask carries the child's original). */
+  surface?: string | null;
+  /** Explicit display-value override (a forwarded ask carries the child's original). */
+  value?: string | null;
+  /** Present iff this ask was forwarded from a subagent; drives the non-degraded broadcast + "(Subagent)" title. */
+  forwarding?: ForwardedAskProvenance;
 }
 
 /**
@@ -75,7 +94,9 @@ export class PermissionPrompter implements PermissionPrompterApi {
         : "permission_request.denied",
       {
         ...details,
-        resolution: decision.state,
+        resolution: decision.confirmationUnavailable
+          ? "confirmation_unavailable"
+          : decision.state,
         denialReason: decision.denialReason,
       },
     );

package/src/handlers/gates/helpers.ts

@@ -53,13 +53,14 @@ export function buildDecisionEvent(
  * @param action    - The gate's resulting action ("allow" | "block").
  * @param hasSession - True when the gate result carries a sessionApproval
  *                    (indicates the user chose "for this session").
- * @param canConfirm - Whether an interactive prompt was available.
+ * @param confirmationUnavailable - True when the denial came from the
+ *                    DenyingAuthorizer (no live authority was reachable).
  */
 export function deriveResolution(
   state: "allow" | "deny" | "ask",
   action: "allow" | "block",
   hasSession: boolean,
-  canConfirm: boolean,
+  confirmationUnavailable: boolean,
   autoApproved = false,
 ): PermissionDecisionResolution {
   if (state === "allow") return autoApproved ? "auto_approved" : "policy_allow";
@@ -69,5 +70,5 @@ export function deriveResolution(
     if (autoApproved) return "auto_approved";
     return hasSession ? "user_approved_for_session" : "user_approved";
   }
-  return canConfirm ? "user_denied" : "confirmation_unavailable";
+  return confirmationUnavailable ? "confirmation_unavailable" : "user_denied";
 }

package/src/handlers/gates/runner.ts

@@ -1,10 +1,10 @@
+import type { AskEscalator } from "#src/authority/authorizer-selection";
 import type { DecisionReporter } from "#src/decision-reporter";
 import {
   formatDenyReason,
   formatUnavailableReason,
   formatUserDeniedReason,
 } from "#src/denial-messages";
-import type { GatePrompter } from "#src/gate-prompter";
 import type { PermissionPromptDecision } from "#src/permission-dialog";
 import { applyPermissionGate } from "#src/permission-gate";
 import type { ScopedPermissionResolver } from "#src/permission-resolver";
@@ -30,7 +30,7 @@ export class GateRunner {
   constructor(
     private readonly resolver: ScopedPermissionResolver,
     private readonly recorder: SessionApprovalRecorder,
-    private readonly prompter: GatePrompter,
+    private readonly prompter: AskEscalator,
     private readonly reporter: DecisionReporter,
   ) {}
 
@@ -127,8 +127,8 @@ export class GateRunner {
       return { action: "allow" };
     }
 
-    // 3. Apply the deny/ask/allow gate
-    const canConfirm = this.prompter.canConfirm();
+    // 3. Apply the deny/ask/allow gate — always escalate on ask; the selected
+    // Authorizer answers (the DenyingAuthorizer by denying with a marker).
 
     // Construct messages from the centralized formatter.
     const messages = {
@@ -139,16 +139,17 @@ export class GateRunner {
     };
 
     let autoApproved = false;
+    let confirmationUnavailable = false;
     const gateResult = await applyPermissionGate({
       state: check.state,
-      canConfirm,
       sessionApproval: descriptor.sessionApproval?.toGateApproval(),
       promptForApproval: async () => {
-        const decision = await this.prompter.prompt({
+        const decision = await this.prompter.escalate({
           requestId: toolCallId,
           ...descriptor.promptDetails,
         });
         autoApproved = decision.autoApproved === true;
+        confirmationUnavailable = decision.confirmationUnavailable === true;
         return decision;
       },
       writeLog: (event, details) =>
@@ -172,7 +173,7 @@ export class GateRunner {
           check.state,
           gateResult.action,
           hasSessionApproval,
-          canConfirm,
+          confirmationUnavailable,
           autoApproved,
         ),
       ),

package/src/index.ts

@@ -3,7 +3,7 @@ import { getAgentDir, getPackageDir } from "@earendil-works/pi-coding-agent";
 import { AuthorizerSelection } from "./authority/authorizer-selection";
 import {
   ForwardedRequestServer,
-  type ForwardedRequestServerDeps,
+  type ServingPolicy,
 } from "./authority/forwarded-request-server";
 import { PermissionPrompter } from "./authority/permission-prompter";
 import { SubagentDetection } from "./authority/subagent-detection";
@@ -25,6 +25,7 @@ import { GateRunner } from "./handlers/gates/runner";
 import { SkillInputGatePipeline } from "./handlers/gates/skill-input-gate-pipeline";
 import { ToolCallGatePipeline } from "./handlers/gates/tool-call-gate-pipeline";
 import { createFailClosedToolCall } from "./handlers/tool-call-boundary";
+import { buildAccessIntentForSurface } from "./input-normalizer";
 import { requestPermissionDecisionFromUi } from "./permission-dialog";
 import { PermissionManager } from "./permission-manager";
 import { PermissionResolver } from "./permission-resolver";
@@ -90,15 +91,6 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     logger,
   });
 
-  const requestServerDeps: ForwardedRequestServerDeps = {
-    forwardingDir: paths.forwardingDir,
-    logger,
-    events: pi.events,
-    requestPermissionDecisionFromUi,
-    config: configStore,
-  };
-  const requestServer = new ForwardedRequestServer(requestServerDeps);
-
   const prompter = new PermissionPrompter({ logger });
 
   const authorizerSelection = new AuthorizerSelection({
@@ -111,6 +103,38 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     prompter,
   });
 
+  // Resolver composes the manager + session ruleset and owns the
+  // access-path → path-values unwrap. Constructed here (before `session`) so
+  // the forwarded-request server's ServingPolicy can resolve against it; the
+  // service and gates below share this one instance.
+  const resolver = new PermissionResolver(permissionManager, sessionRules);
+
+  // Serving a forwarded request is resolution: evaluate (surface, value)
+  // against the serving node's composed base ruleset (agentName undefined —
+  // the child already applied its own per-agent overrides before forwarding).
+  // The session.getPathNormalizer() read is deferred behind the closure: inbox
+  // polling starts at session_start, after `session` is assigned — the same
+  // deferred-binding precedent as the logger notify sink below.
+  const servingPolicy: ServingPolicy = {
+    check: (surface, value) =>
+      resolver.resolve(
+        buildAccessIntentForSurface(
+          surface,
+          value ?? undefined,
+          session.getPathNormalizer(),
+          undefined,
+        ),
+      ),
+  };
+
+  const requestServer = new ForwardedRequestServer({
+    forwardingDir: paths.forwardingDir,
+    logger,
+    policy: servingPolicy,
+    escalator: authorizerSelection,
+    registry: subagentRegistry,
+  });
+
   session = new PermissionSession(
     paths,
     new ForwardingManager(subagentDetection, requestServer),
@@ -136,11 +160,6 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
       ),
   });
 
-  // Resolver composes the manager + session ruleset and owns the
-  // access-path → path-values unwrap; the service routes its policy
-  // queries through it, so it is constructed before it.
-  const resolver = new PermissionResolver(permissionManager, sessionRules);
-
   const permissionsService = new LocalPermissionsService(
     resolver,
     session,

package/src/permission-dialog.ts

@@ -14,6 +14,14 @@ export type PermissionPromptDecision = {
    * rather than "user_approved" in the permissions:decision broadcast.
    */
   autoApproved?: true;
+  /**
+   * True when no live authority was reachable and the DenyingAuthorizer denied
+   * this ask (a no-UI, non-subagent session). Consumed by deriveResolution (the
+   * decision-event resolution), the gate (block reason), and PermissionPrompter
+   * (review-entry resolution) to emit "confirmation_unavailable" rather than a
+   * plain user denial.
+   */
+  confirmationUnavailable?: true;
 };
 
 export interface PermissionDecisionUi {

package/src/permission-forwarding.ts

@@ -44,7 +44,8 @@ const SESSION_FORWARDING_RESPONSES_DIRECTORY_NAME = "responses";
  * can emit a non-degraded `permissions:ui_prompt` event.
  *
  * Carried separately from the prompt message because the parent reconstructs
- * the original event through `buildForwardedUiPrompt`, not from the message text.
+ * the original event from the escalated ask's details (`buildUiPrompt`), not
+ * from the message text.
  */
 export interface ForwardedPromptDisplay {
   source: PermissionUiPromptSource;

package/src/permission-gate.ts

@@ -10,10 +10,11 @@ export interface PermissionGateParams {
   /** The resolved permission state from checkPermission(). */
   state: "allow" | "deny" | "ask";
 
-  /** Whether the current context supports interactive prompts. */
-  canConfirm: boolean;
-
-  /** Prompt the user for approval. Only called when state === "ask" and canConfirm is true. */
+  /**
+   * Escalate the ask to the session's Authorizer for a decision. Called for
+   * every `ask`; the DenyingAuthorizer answers by denying with the
+   * `confirmationUnavailable` marker when no live authority is reachable.
+   */
   promptForApproval: () => Promise<PermissionPromptDecision>;
 
   /**
@@ -45,14 +46,7 @@ export interface PermissionGateParams {
 export async function applyPermissionGate(
   params: PermissionGateParams,
 ): Promise<PermissionGateResult> {
-  const {
-    state,
-    canConfirm,
-    promptForApproval,
-    writeLog,
-    logContext,
-    messages,
-  } = params;
+  const { state, promptForApproval, writeLog, logContext, messages } = params;
 
   if (state === "deny") {
     writeLog("permission_request.blocked", {
@@ -63,17 +57,17 @@ export async function applyPermissionGate(
   }
 
   if (state === "ask") {
-    if (!canConfirm) {
-      writeLog("permission_request.blocked", {
-        ...logContext,
-        resolution: "confirmation_unavailable",
-      });
-      return { action: "block", reason: messages.unavailableReason };
-    }
-
     const decision = await promptForApproval();
     if (!decision.approved) {
-      return { action: "block", reason: messages.userDeniedReason(decision) };
+      // The gate writes no review entry for an ask denial — the prompter
+      // brackets it (waiting/denied). The block reason distinguishes an
+      // absent-authority denial (confirmationUnavailable) from a user denial.
+      return {
+        action: "block",
+        reason: decision.confirmationUnavailable
+          ? messages.unavailableReason
+          : messages.userDeniedReason(decision),
+      };
     }
     if (decision.state === "approved_for_session" && params.sessionApproval) {
       return { action: "allow", sessionApproval: params.sessionApproval };

package/src/permission-ui-prompt.ts

@@ -1,9 +1,10 @@
 /**
  * Centralized construction for `permissions:ui_prompt` payloads.
  *
- * Every emit site builds its event through one of these functions, so the
- * public contract's shape — including the normalized `surface`/`value`
- * projection — lives in exactly one place and cannot drift by source.
+ * The single builder `buildUiPrompt` handles both direct and forwarded asks, so
+ * the public contract's shape — including the normalized `surface`/`value`
+ * projection and the `forwarding` context — lives in exactly one place and
+ * cannot drift by source.
  *
  * This module is a leaf: it owns narrow input types that each call site's
  * domain object satisfies structurally, so it imports nothing from the
@@ -11,8 +12,8 @@
  */
 
 import type {
+  ForwardedPromptContext,
   PermissionUiPromptEvent,
-  PermissionUiPromptSource,
 } from "./permission-events";
 
 /** Input for a direct (non-forwarded) tool or skill prompt. */
@@ -28,18 +29,42 @@ export interface DirectPromptInput {
   target?: string;
 }
 
-/** Input for a file-forwarded subagent prompt shown by the parent UI. */
-export interface ForwardedPromptInput {
-  requestId: string;
-  message: string;
-  requesterAgentName: string | null;
-  requesterSessionId: string | null;
-  /** Original prompt origin, when the forwarded request carries it. */
-  source?: PermissionUiPromptSource | null;
-  /** Original normalized surface, when the forwarded request carries it. */
+/**
+ * Input for any UI prompt — direct or forwarded.
+ *
+ * A direct prompt supplies only the `DirectPromptInput` fields and lets
+ * `surface`/`value` derive and `forwarding` default to `null`; a forwarded ask
+ * supplies the child's original `surface`/`value` projection explicitly and a
+ * populated `forwarding` context, so the parent's broadcast stays non-degraded
+ * (the #292 contract hardening).
+ */
+export interface UiPromptInput extends DirectPromptInput {
+  /** Explicit display surface; falls back to the derived projection when omitted. */
   surface?: string | null;
-  /** Original normalized value, when the forwarded request carries it. */
+  /** Explicit display value; falls back to the derived projection when omitted. */
   value?: string | null;
+  /** Forwarding context for a forwarded subagent ask; `null`/omitted for a direct prompt. */
+  forwarding?: ForwardedPromptContext | null;
+}
+
+/**
+ * Build a `permissions:ui_prompt` event from either a direct or a forwarded ask.
+ *
+ * `surface`/`value` use the explicit override when the caller sets them (an
+ * explicit `null` is honored, not treated as "derive"); otherwise they fall
+ * back to the direct-prompt projection. `forwarding` passes through, defaulting
+ * to `null`.
+ */
+export function buildUiPrompt(input: UiPromptInput): PermissionUiPromptEvent {
+  return {
+    requestId: input.requestId,
+    source: input.source,
+    surface: input.surface !== undefined ? input.surface : directSurface(input),
+    value: input.value !== undefined ? input.value : directValue(input),
+    agentName: input.agentName,
+    message: input.message,
+    forwarding: input.forwarding ?? null,
+  };
 }
 
 /** Normalized display surface for a direct prompt. */
@@ -61,43 +86,3 @@ function directValue(input: DirectPromptInput): string | null {
     null
   );
 }
-
-/** Build the UI prompt event for a direct tool/skill prompt. */
-export function buildDirectUiPrompt(
-  input: DirectPromptInput,
-): PermissionUiPromptEvent {
-  return {
-    requestId: input.requestId,
-    source: input.source,
-    surface: directSurface(input),
-    value: directValue(input),
-    agentName: input.agentName,
-    message: input.message,
-    forwarding: null,
-  };
-}
-
-/**
- * Build the UI prompt event for a file-forwarded subagent prompt.
- *
- * `source` defaults to `"tool_call"` (the dominant forwarded origin) when the
- * persisted request predates carrying it — a parent on a newer version may read
- * a request written by an older child during an upgrade. The consumer still
- * receives the notify-now signal, message, and forwarding context.
- */
-export function buildForwardedUiPrompt(
-  input: ForwardedPromptInput,
-): PermissionUiPromptEvent {
-  return {
-    requestId: input.requestId,
-    source: input.source ?? "tool_call",
-    surface: input.surface ?? null,
-    value: input.value ?? null,
-    agentName: input.requesterAgentName,
-    message: input.message,
-    forwarding: {
-      requesterAgentName: input.requesterAgentName,
-      requesterSessionId: input.requesterSessionId,
-    },
-  };
-}

package/src/gate-prompter.ts

@@ -1,12 +0,0 @@
-import type { PromptPermissionDetails } from "./authority/permission-prompter";
-import type { PermissionPromptDecision } from "./permission-dialog";
-
-/**
- * The prompting role the gate runner needs: a yes/no on whether an
- * interactive confirmation is possible, and the prompt itself. The context
- * is bound by the implementor, not threaded per call.
- */
-export interface GatePrompter {
-  canConfirm(): boolean;
-  prompt(details: PromptPermissionDetails): Promise<PermissionPromptDecision>;
-}