@gotgenes/pi-permission-system 20.1.0 → 20.3.0

package/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [20.3.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.2.0...pi-permission-system-v20.3.0) (2026-07-09)
+
+
+### Features
+
+* **pi-permission-system:** forward the child's session-approval suggestion ([fa04d8c](https://github.com/gotgenes/pi-packages/commit/fa04d8ca3485ca3f6e29bbe8d53146f5eeb6672c))
+* **pi-permission-system:** offer whole-session scope on forwarded approvals ([bd2be07](https://github.com/gotgenes/pi-packages/commit/bd2be0799923ed809cd0939047486fdc1b2a477f))
+
+
+### Documentation
+
+* **pi-permission-system:** record forwarded grant-scope selection (Phase 9 Step 4) ([a3d1fca](https://github.com/gotgenes/pi-packages/commit/a3d1fca183dc5e4d6fb15ec6ec78199f5d092bc3))
+
+## [20.2.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.1.0...pi-permission-system-v20.2.0) (2026-07-09)
+
+
+### Features
+
+* **pi-permission-system:** serve forwarded permissions by resolution and Authorizer escalation ([#557](https://github.com/gotgenes/pi-packages/issues/557)) ([c5d3bcb](https://github.com/gotgenes/pi-packages/commit/c5d3bcbf4e69a568f750d6a7c0619d4b88d5b377))
+
+
+### Documentation
+
+* **pi-permission-system:** mark Phase 9 Step 3 complete ([a5a348f](https://github.com/gotgenes/pi-packages/commit/a5a348f3d3dc1835e64ecd7b6b0c1b6164085a97))
+
 ## [20.1.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.0.0...pi-permission-system-v20.1.0) (2026-07-08)
 
 

package/docs/cross-extension-api.md

@@ -307,7 +307,8 @@ This event is for integrations such as notification extensions that should alert
 It is not a generic "permission request entered waiting state" event, and it does not imply the prompt will be approved.
 Policy decisions that resolve without an active UI prompt, such as `policy_allow`, `policy_deny`, `session_approved`, `infrastructure_auto_allowed`, or `auto_approved`, do not emit this event.
 Non-UI child sessions also do not emit this event when they create a forwarded permission request; the parent UI session emits it immediately before showing the forwarded permission dialog.
-Forwarded prompts are not degraded: the parent emits the child's original `source` and the same `surface`/`value` display projection, plus a populated `forwarding` context identifying the requesting subagent.
+A forwarded request the parent's own recorded policy decides (a matching `allow` or `deny`) is answered without a prompt and emits no event; the event fires only when the parent is actually about to ask the human.
+Forwarded prompts that do reach the human are not degraded: the parent emits the child's original `source` and the same `surface`/`value` display projection, plus a populated `forwarding` context identifying the requesting subagent.
 
 The payload is lean by design — `surface`/`value` are the normalized display projection a notification consumer reads, not a mirror of the internal review log.
 Read defensively rather than version-gating: broadcast payloads carry no `protocolVersion`.

package/docs/subagent-integration.md

@@ -17,6 +17,7 @@ The integration enables:
 2. **Per-agent policy enforcement** - the permission system's `before_agent_start` handler resolves the agent name from the `<active_agent>` system-prompt tag and applies per-agent `permission:` frontmatter overrides.
 3. **`ask`-state forwarding** - when a child triggers an `ask` permission, the request forwards to the parent session's UI through the existing polling mechanism.
    The parent approves or denies, and the child resumes.
+   When the parent approves "for this session," it chooses a scope: **this subagent only** (the least-privilege default) records the grant on the requesting child, while **the whole session** records it on the serving parent so the parent and all its subagents resolve it without re-prompting.
 
 No configuration is required - the integration is automatic when both extensions are installed.
 When `@gotgenes/pi-permission-system` is not installed, `@gotgenes/pi-subagents` emits its lifecycle events with no subscriber - a harmless no-op.
@@ -25,6 +26,7 @@ When `@gotgenes/pi-permission-system` is not installed, `@gotgenes/pi-subagents`
 
 When a delegated or routed subagent runs without direct UI access, `ask` permissions can still be enforced by forwarding the confirmation request through Pi session directories.
 The main interactive session polls for forwarded requests, shows the confirmation prompt, writes the response, and the subagent resumes once that decision is available.
+A parent `allow`/`deny` rule governs a child's escalation directly (the serving node resolves it as recorded authority before prompting), and a "whole session" grant recorded on the parent auto-approves later forwards of the same pattern.
 
 This keeps `ask` policies usable even when the original permission check happens inside a non-UI execution context.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "20.1.0",
+  "version": "20.3.0",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/src/authority/approval-escalator.ts

@@ -22,13 +22,14 @@ import type { PermissionPromptDecision } from "#src/permission-dialog";
 import {
   type ForwardedPermissionRequest,
   type ForwardedPromptDisplay,
+  type ForwardedSessionApproval,
   PERMISSION_FORWARDING_POLL_INTERVAL_MS,
   PERMISSION_FORWARDING_TIMEOUT_MS,
   type PermissionForwardingLocation,
   resolvePermissionForwardingTargetSessionId,
   SUBAGENT_PARENT_SESSION_ENV_CANDIDATES,
 } from "#src/permission-forwarding";
-import { buildDirectUiPrompt } from "#src/permission-ui-prompt";
+import { buildUiPrompt } from "#src/permission-ui-prompt";
 import type { DebugReviewLogger } from "#src/session-logger";
 import type { SubagentSessionRegistry } from "#src/subagent-registry";
 import { toRecord } from "#src/value-guards";
@@ -97,12 +98,17 @@ export class ParentAuthorizer implements Authorizer {
   authorize(
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision> {
-    const uiPrompt = buildDirectUiPrompt(details);
-    return this.waitForForwardedApproval(this.ctx, details.message, {
-      source: uiPrompt.source,
-      surface: uiPrompt.surface,
-      value: uiPrompt.value,
-    });
+    const uiPrompt = buildUiPrompt(details);
+    return this.waitForForwardedApproval(
+      this.ctx,
+      details.message,
+      {
+        source: uiPrompt.source,
+        surface: uiPrompt.surface,
+        value: uiPrompt.value,
+      },
+      details.sessionApproval,
+    );
   }
 
   // ── Private methods ────────────────────────────────────────────────────
@@ -111,6 +117,7 @@ export class ParentAuthorizer implements Authorizer {
     ctx: ForwarderContext,
     message: string,
     forwarded?: ForwardedPromptDisplay,
+    sessionApproval?: ForwardedSessionApproval,
   ): Promise<PermissionPromptDecision> {
     const requesterSessionId = getSessionId(ctx);
     const targetSessionId = resolvePermissionForwardingTargetSessionId({
@@ -156,6 +163,7 @@ export class ParentAuthorizer implements Authorizer {
       requesterSessionId,
       targetSessionId,
       forwarded,
+      sessionApproval,
     );
     const requestPath = join(location.requestsDir, `${request.id}.json`);
     const responsePath = join(location.responsesDir, `${request.id}.json`);
@@ -194,6 +202,7 @@ export class ParentAuthorizer implements Authorizer {
     requesterSessionId: string,
     targetSessionId: string,
     forwarded?: ForwardedPromptDisplay,
+    sessionApproval?: ForwardedSessionApproval,
   ): ForwardedPermissionRequest {
     const requestId = `${Date.now()}-${Math.random().toString(36).slice(2, 10)}-${process.pid}`;
     const requesterAgentName =
@@ -214,6 +223,7 @@ export class ParentAuthorizer implements Authorizer {
             value: forwarded.value,
           }
         : {}),
+      ...(sessionApproval ? { sessionApproval } : {}),
     };
   }
 

package/src/authority/authorizer-selection.ts

@@ -1,5 +1,4 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { GatePrompter } from "#src/gate-prompter";
 import type { PermissionPromptDecision } from "#src/permission-dialog";
 import {
   type Authorizer,
@@ -23,23 +22,34 @@ export interface AuthorizerSelectionLifecycle {
   deactivate(): void;
 }
 
+/**
+ * The ask-escalation seam `GateRunner` depends on: escalate a single ask to
+ * the session's selected `Authorizer` and return its decision.
+ *
+ * Replaces the two-method `GatePrompter` role (#556). There is no
+ * "can anyone answer" pre-check: absent authority is the `DenyingAuthorizer`,
+ * which answers by denying with a `confirmationUnavailable` marker.
+ */
+export interface AskEscalator {
+  escalate(details: PromptPermissionDetails): Promise<PermissionPromptDecision>;
+}
+
 /**
  * Context-owning selection root for the Authorizer spine.
  *
  * The rewrite of `PromptingGateway`: owns the stored `ExtensionContext`, runs
- * `selectAuthorizer` once per activation, and implements `GatePrompter` by
+ * `selectAuthorizer` once per activation, and implements `AskEscalator` by
  * delegating to the selected `Authorizer` via `PermissionPrompter`.
  *
- * `canConfirm()` survives this step (dissolved in #556): it is recomputed
- * transitionally alongside `selectAuthorizer`'s own branch, rather than
- * derived from the selected authorizer, to keep the ask path byte-identical
- * until #556 derives confirmability from a `DenyingAuthorizer` marker.
+ * `selectAuthorizer` encodes the liveness decision in *which* `Authorizer` it
+ * returns (`LocalUserAuthorizer` / `ParentAuthorizer` when authority is
+ * reachable, `DenyingAuthorizer` otherwise), so no separate confirmability
+ * predicate survives (#556 dissolved `canConfirm()`).
  */
 export class AuthorizerSelection
-  implements GatePrompter, AuthorizerSelectionLifecycle
+  implements AskEscalator, AuthorizerSelectionLifecycle
 {
   private selected: Authorizer | null = null;
-  private confirmable = false;
 
   constructor(
     private readonly deps: AuthorizerSelectionDeps & {
@@ -47,39 +57,28 @@ export class AuthorizerSelection
     },
   ) {}
 
-  /** Select the Authorizer for `ctx` and store both it and the confirmable predicate. */
+  /** Select the Authorizer for `ctx` and store it. */
   activate(ctx: ExtensionContext): void {
     this.selected = selectAuthorizer(ctx, this.deps);
-    this.confirmable = ctx.hasUI || this.deps.detection.isSubagent(ctx);
   }
 
   /** Clear the stored selection. */
   deactivate(): void {
     this.selected = null;
-    this.confirmable = false;
-  }
-
-  /**
-   * Whether an interactive permission prompt can be shown.
-   *
-   * Returns false when no authorizer has been selected. Otherwise true when
-   * the context had UI or was a forwarding subagent at selection time — the
-   * two Authorizer-selection predicates, evaluated once at `activate`.
-   */
-  canConfirm(): boolean {
-    return this.selected !== null && this.confirmable;
   }
 
   /**
-   * Prompt for a permission decision using the selected authorizer.
+   * Escalate an ask to the selected authorizer and return its decision.
    *
-   * Rejects if no authorizer has been selected — `canConfirm()` guards this
-   * in normal use. Implements {@link GatePrompter}.
+   * Rejects if no authorizer has been selected — i.e. before the session was
+   * activated. Implements {@link AskEscalator}.
    */
-  prompt(details: PromptPermissionDetails): Promise<PermissionPromptDecision> {
+  escalate(
+    details: PromptPermissionDetails,
+  ): Promise<PermissionPromptDecision> {
     if (this.selected === null) {
       return Promise.reject(
-        new Error("prompt called before the session was activated"),
+        new Error("escalate called before the session was activated"),
       );
     }
     return this.deps.prompter.prompt(this.selected, details);

package/src/authority/denying-authorizer.ts

@@ -4,9 +4,17 @@ import type { Authorizer } from "./authorizer";
 /**
  * Least-privilege Authorizer: no authority is reachable for this session
  * (no UI, not a subagent), so every ask is denied.
+ *
+ * The denial carries the `confirmationUnavailable` marker so the ask path can
+ * distinguish "nobody could answer" from an interactive user denial when it
+ * derives the review-entry and decision-event resolution.
  */
 export class DenyingAuthorizer implements Authorizer {
   authorize(): Promise<PermissionPromptDecision> {
-    return Promise.resolve({ approved: false, state: "denied" });
+    return Promise.resolve({
+      approved: false,
+      state: "denied",
+      confirmationUnavailable: true,
+    });
   }
 }

package/src/authority/forwarded-request-server.ts

@@ -3,26 +3,19 @@ import {
   type ForwarderContext,
   getSessionId,
 } from "#src/authority/forwarder-context";
-import type { ConfigReader } from "#src/config-store";
-import { isYoloModeEnabled } from "#src/extension-config";
-import type {
-  PermissionDecisionUi,
-  PermissionPromptDecision,
-  RequestPermissionOptions,
-} from "#src/permission-dialog";
-import {
-  emitUiPromptEvent,
-  type PermissionEventBus,
-} from "#src/permission-events";
+import type { PermissionPromptDecision } from "#src/permission-dialog";
 import {
   type ForwardedPermissionRequest,
   type ForwardedPermissionResponse,
   isForwardedPermissionRequestForSession,
   type PermissionForwardingLocation,
 } from "#src/permission-forwarding";
-import { buildForwardedUiPrompt } from "#src/permission-ui-prompt";
+import { SessionApproval } from "#src/session-approval";
+import type { SessionApprovalRecorder } from "#src/session-approval-recorder";
 import type { DebugReviewLogger } from "#src/session-logger";
-
+import type { SubagentSessionRegistry } from "#src/subagent-registry";
+import type { PermissionCheckResult } from "#src/types";
+import type { AskEscalator } from "./authorizer-selection";
 import {
   cleanupPermissionForwardingLocationIfEmpty,
   ensureDirectoryExists,
@@ -34,6 +27,7 @@ import {
   safeDeleteFile,
   writeJsonFileAtomic,
 } from "./forwarding-io";
+import type { PromptPermissionDetails } from "./permission-prompter";
 
 /**
  * Narrow seam describing what `ForwardingManager` needs from the server: a
@@ -47,20 +41,35 @@ export interface InboxProcessor {
   processInbox(ctx: ForwarderContext): Promise<void>;
 }
 
+/**
+ * Recorded-authority view the serving node resolves a forwarded request
+ * against: answer one `(surface, value)` query on the serving session's
+ * composed base ruleset (agent-neutral — the child already applied its own
+ * per-agent overrides before forwarding).
+ *
+ * Narrow by design (ISP): the server needs one decision, not the whole
+ * resolver. The composition root satisfies it with an access-intent build plus
+ * `resolver.resolve`, the same primitives `LocalPermissionsService` composes.
+ */
+export interface ServingPolicy {
+  check(surface: string, value: string | null): PermissionCheckResult;
+}
+
 /** Constructor config for `ForwardedRequestServer`. */
 export interface ForwardedRequestServerDeps {
   forwardingDir: string;
   logger: DebugReviewLogger;
-  /** Event bus used for UI prompt broadcasts. */
-  events?: PermissionEventBus;
-  requestPermissionDecisionFromUi: (
-    ui: PermissionDecisionUi,
-    title: string,
-    message: string,
-    options?: RequestPermissionOptions,
-  ) => Promise<PermissionPromptDecision>;
-  /** Read current config for the retained forwarded-inbox yolo auto-approve check. */
-  config: ConfigReader;
+  /** Recorded-authority resolution for `(surface, value)` requests. */
+  policy: ServingPolicy;
+  /** Escalation seam to the serving session's selected `Authorizer` on `ask`. */
+  escalator: AskEscalator;
+  /**
+   * The serving session's `SessionRules`. Records a whole-session grant when a
+   * human approves a forwarded request for the entire serving session.
+   */
+  recorder: SessionApprovalRecorder;
+  /** In-process subagent registry, read only by the one-hop canary. */
+  registry?: SubagentSessionRegistry;
 }
 
 // ── Module-private helpers ────────────────────────────────────────────────
@@ -78,39 +87,77 @@ function formatForwardedPermissionPrompt(
   ].join("\n");
 }
 
+/**
+ * A request is resolvable against the ruleset only when it carries a concrete
+ * `(surface, value)` display projection. A legacy/version-skew request without
+ * them floors to `ask` (escalate), never a silent grant.
+ */
+function hasDisplayFields(
+  request: ForwardedPermissionRequest,
+): request is ForwardedPermissionRequest & { surface: string; value: string } {
+  return (
+    typeof request.surface === "string" &&
+    request.surface.length > 0 &&
+    typeof request.value === "string" &&
+    request.value.length > 0
+  );
+}
+
+/**
+ * Map a forwarded request onto the escalated ask's details, carrying the
+ * forwarded provenance (requester agent/session + the child's original display
+ * projection) so `LocalUserAuthorizer` emits a non-degraded broadcast (#292).
+ */
+function buildForwardedAskDetails(
+  request: ForwardedPermissionRequest,
+): PromptPermissionDetails {
+  return {
+    requestId: request.id,
+    source: request.source ?? "tool_call",
+    agentName: request.requesterAgentName || null,
+    message: formatForwardedPermissionPrompt(request),
+    surface: request.surface ?? null,
+    value: request.value ?? null,
+    forwarding: {
+      requesterAgentName: request.requesterAgentName || null,
+      requesterSessionId: request.requesterSessionId || null,
+    },
+    // Carries the child's suggestion so LocalUserAuthorizer can offer the
+    // whole-session grant scope; absent for a legacy/version-skew request.
+    ...(request.sessionApproval
+      ? { sessionApproval: request.sessionApproval }
+      : {}),
+  };
+}
+
 // ── ForwardedRequestServer ────────────────────────────────────────────────
 
 /**
  * Owner of the serving-down role of the forwarded-permission behavior:
  * draining this session's forwarded-permission inbox and answering each
- * request (auto-approve under yolo, or prompt via the injected UI).
+ * request the same way the session resolves a local action — `evaluate()`
+ * against its recorded authority (`ServingPolicy`), then escalation to its
+ * selected `Authorizer` (`AskEscalator`) on `ask`.
  */
 export class ForwardedRequestServer implements InboxProcessor {
   private readonly forwardingDir: string;
-  private readonly events: PermissionEventBus | undefined;
   private readonly logger: DebugReviewLogger;
-  private readonly requestPermissionDecisionFromUi: (
-    ui: PermissionDecisionUi,
-    title: string,
-    message: string,
-    options?: RequestPermissionOptions,
-  ) => Promise<PermissionPromptDecision>;
-  private readonly config: ConfigReader;
+  private readonly policy: ServingPolicy;
+  private readonly escalator: AskEscalator;
+  private readonly recorder: SessionApprovalRecorder;
+  private readonly registry: SubagentSessionRegistry | undefined;
 
   constructor(deps: ForwardedRequestServerDeps) {
     this.forwardingDir = deps.forwardingDir;
-    this.events = deps.events;
     this.logger = deps.logger;
-    this.requestPermissionDecisionFromUi = deps.requestPermissionDecisionFromUi;
-    this.config = deps.config;
+    this.policy = deps.policy;
+    this.escalator = deps.escalator;
+    this.recorder = deps.recorder;
+    this.registry = deps.registry;
   }
 
   /** Drain and respond to this session's forwarded-permission inbox. */
   async processInbox(ctx: ForwarderContext): Promise<void> {
-    if (!ctx.hasUI) {
-      return;
-    }
-
     const currentSessionId = getSessionId(ctx);
     const location = getExistingPermissionForwardingLocation(
       this.forwardingDir,
@@ -152,7 +199,6 @@ export class ForwardedRequestServer implements InboxProcessor {
       }
 
       await this.processSingleForwardedRequest(
-        ctx,
         request,
         location,
         requestPath,
@@ -166,7 +212,6 @@ export class ForwardedRequestServer implements InboxProcessor {
   // ── Private methods ────────────────────────────────────────────────────
 
   private async processSingleForwardedRequest(
-    ctx: ForwarderContext,
     request: ForwardedPermissionRequest,
     location: PermissionForwardingLocation,
     requestPath: string,
@@ -185,6 +230,8 @@ export class ForwardedRequestServer implements InboxProcessor {
       return;
     }
 
+    this.warnOnMultiHop(request, currentSessionId);
+
     const forwardedPermissionLogDetails = {
       requestId: request.id,
       source: location.label,
@@ -194,55 +241,66 @@ export class ForwardedRequestServer implements InboxProcessor {
       requestPath,
     };
 
-    let decision: PermissionPromptDecision = {
-      approved: false,
-      state: "denied",
-    };
-    // Last yolo check outside the composed ruleset: dissolves when
-    // processInbox is refactored onto evaluate() + Authorizer selection in
-    // the Phase 9 spine work.
-    if (isYoloModeEnabled(this.config.current())) {
-      this.logger.review(
-        "forwarded_permission.auto_approved",
-        forwardedPermissionLogDetails,
-      );
-      decision = { approved: true, state: "approved" };
-    } else {
-      this.logger.review(
-        "forwarded_permission.prompted",
-        forwardedPermissionLogDetails,
+    const decision = await this.resolveDecision(
+      request,
+      forwardedPermissionLogDetails,
+    );
+
+    this.recordForwardedDecision(
+      request,
+      location,
+      requestPath,
+      currentSessionId,
+      this.applyGrantScope(request, decision, forwardedPermissionLogDetails),
+    );
+  }
+
+  /**
+   * Apply the human's grant-scope choice on a forwarded approval.
+   *
+   * A whole-session grant (`approved_for_serving_session`) records the child's
+   * suggested pattern into this serving node's `SessionRules` — the single
+   * source of truth for the scope — and is then translated to a plain
+   * `approved` so the child records nothing (its next identical action
+   * re-forwards and resolves as recorded authority). Every other decision
+   * passes through unchanged (`approved_for_session` → the child records).
+   */
+  private applyGrantScope(
+    request: ForwardedPermissionRequest,
+    decision: PermissionPromptDecision,
+    logDetails: Record<string, unknown>,
+  ): PermissionPromptDecision {
+    if (decision.state !== "approved_for_serving_session") {
+      return decision;
+    }
+    if (request.sessionApproval) {
+      this.recorder.recordSessionApproval(
+        SessionApproval.multiple(
+          request.sessionApproval.surface,
+          request.sessionApproval.patterns,
+        ),
       );
-      try {
-        const forwardedMessage = formatForwardedPermissionPrompt(request);
-        if (this.events) {
-          emitUiPromptEvent(
-            this.events,
-            buildForwardedUiPrompt({
-              requestId: request.id,
-              message: forwardedMessage,
-              requesterAgentName: request.requesterAgentName || null,
-              requesterSessionId: request.requesterSessionId || null,
-              source: request.source ?? null,
-              surface: request.surface ?? null,
-              value: request.value ?? null,
-            }),
-          );
-        }
-        decision = await this.requestPermissionDecisionFromUi(
-          ctx.ui,
-          "Permission Required (Subagent)",
-          forwardedMessage,
-        );
-      } catch (error) {
-        logPermissionForwardingError(
-          this.logger,
-          "Failed to show forwarded permission confirmation dialog",
-          error,
-        );
-        decision = { approved: false, state: "denied" };
-      }
+      this.logger.review("forwarded_permission.session_recorded", {
+        ...logDetails,
+        surface: request.sessionApproval.surface,
+        patterns: request.sessionApproval.patterns,
+      });
     }
+    return { approved: true, state: "approved" };
+  }
 
+  /**
+   * Persist the served decision: write the response file the child polls for,
+   * log the outcome, and delete the drained request. The symmetric "respond"
+   * half to {@link resolveDecision}'s "decide" half.
+   */
+  private recordForwardedDecision(
+    request: ForwardedPermissionRequest,
+    location: PermissionForwardingLocation,
+    requestPath: string,
+    currentSessionId: string,
+    decision: PermissionPromptDecision,
+  ): void {
     const responsePath = join(location.responsesDir, `${request.id}.json`);
     this.logger.review(
       decision.approved
@@ -282,4 +340,68 @@ export class ForwardedRequestServer implements InboxProcessor {
       `${location.label} forwarded permission request`,
     );
   }
+
+  /**
+   * Resolve the request the same way the session resolves a local action:
+   * recorded authority first (a request carrying `(surface, value)` resolves
+   * against the serving node's composed ruleset — `allow`, including
+   * yolo-rewritten, auto-approves; `deny` auto-denies), then escalate `ask`
+   * (or a request without display fields) to the selected `Authorizer`.
+   */
+  private async resolveDecision(
+    request: ForwardedPermissionRequest,
+    logDetails: Record<string, unknown>,
+  ): Promise<PermissionPromptDecision> {
+    const state = hasDisplayFields(request)
+      ? this.policy.check(request.surface, request.value).state
+      : "ask";
+
+    if (state === "allow") {
+      this.logger.review("forwarded_permission.auto_approved", logDetails);
+      return { approved: true, state: "approved" };
+    }
+    if (state === "deny") {
+      this.logger.review("forwarded_permission.auto_denied", logDetails);
+      return { approved: false, state: "denied" };
+    }
+
+    this.logger.review("forwarded_permission.prompted", logDetails);
+    try {
+      return await this.escalator.escalate(buildForwardedAskDetails(request));
+    } catch (error) {
+      logPermissionForwardingError(
+        this.logger,
+        `Failed to escalate forwarded permission request '${request.id}'`,
+        error,
+      );
+      return { approved: false, state: "denied" };
+    }
+  }
+
+  /**
+   * One-hop canary: forwarding is depth-1 (child → root). If the requester is
+   * itself a registered subagent whose parent is not this serving session, the
+   * request came through more than one hop (or was misrouted) — resolution is
+   * still well-defined, so keep serving, but warn loudly so a future
+   * recursion-guard break is visible rather than silent. Unregistered
+   * (external file-based) requesters have no recorded parent and are silent.
+   */
+  private warnOnMultiHop(
+    request: ForwardedPermissionRequest,
+    currentSessionId: string,
+  ): void {
+    const requesterInfo = this.registry?.get(request.requesterSessionId);
+    if (
+      requesterInfo?.parentSessionId &&
+      requesterInfo.parentSessionId !== currentSessionId
+    ) {
+      logPermissionForwardingWarning(
+        this.logger,
+        `Forwarded permission request '${request.id}' violates the one-hop ` +
+          `invariant: requester '${request.requesterSessionId}' is a registered ` +
+          `subagent whose parent '${requesterInfo.parentSessionId}' is not this ` +
+          `serving session '${currentSessionId}' (multi-hop or misrouted).`,
+      );
+    }
+  }
 }