@gotgenes/pi-permission-system 20.7.3 → 20.9.0

package/src/authority/approval-escalator.ts

@@ -6,6 +6,7 @@ import {
 } from "#src/active-agent";
 import {
   type ForwarderContext,
+  getCwd,
   getSessionId,
 } from "#src/authority/forwarder-context";
 import {
@@ -20,6 +21,7 @@ import {
 } from "#src/authority/forwarding-io";
 import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
 import {
+  type ForwardedAccessFacts,
   type ForwardedPermissionRequest,
   type ForwardedPromptDisplay,
   type ForwardedSessionApproval,
@@ -33,7 +35,7 @@ import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
 import { buildUiPrompt } from "#src/permission-ui-prompt";
 import type { DebugReviewLogger } from "#src/session-logger";
 import { toRecord } from "#src/value-guards";
-import type { Authorizer } from "./authorizer";
+import type { TerminalAuthorizer } from "./authorizer";
 import type { PromptPermissionDetails } from "./permission-prompter";
 
 // ── Module-private helpers ────────────────────────────────────────────────
@@ -61,6 +63,23 @@ function getContextSystemPrompt(ctx: ForwarderContext): string | undefined {
 
 // ── ParentAuthorizer ────────────────────────────────────────────────────
 
+/**
+ * The facts a forwarded request relays unchanged from the child's ask: the
+ * prompt message, the optional display projection, and the optional
+ * session-approval suggestion.
+ *
+ * Bundled into one object so the two-hop private chain
+ * (`waitForForwardedApproval` → `buildForwardedRequest`) threads a single
+ * relayed value instead of three positional optionals.
+ */
+interface ForwardedRequestFacts {
+  message: string;
+  display?: ForwardedPromptDisplay;
+  sessionApproval?: ForwardedSessionApproval;
+  /** The child-fixed access facts; the edge completes them into a `ForwardedAccessIntent`. */
+  accessIntent?: ForwardedAccessFacts;
+}
+
 /** Constructor config for {@link ParentAuthorizer}. */
 export interface ParentAuthorizerDeps {
   forwardingDir: string;
@@ -81,7 +100,7 @@ export interface ParentAuthorizerDeps {
  * (formerly `ApprovalEscalator.requestApproval`'s `hasUI` / `!isSubagent`
  * arms, both dead once every caller routes through `selectAuthorizer`).
  */
-export class ParentAuthorizer implements Authorizer {
+export class ParentAuthorizer implements TerminalAuthorizer {
   private readonly forwardingDir: string;
   private readonly registry: SubagentSessionRegistry | undefined;
   private readonly logger: DebugReviewLogger;
@@ -99,25 +118,23 @@ export class ParentAuthorizer implements Authorizer {
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision> {
     const uiPrompt = buildUiPrompt(details);
-    return this.waitForForwardedApproval(
-      this.ctx,
-      details.message,
-      {
+    return this.waitForForwardedApproval(this.ctx, {
+      message: details.message,
+      display: {
         source: uiPrompt.source,
         surface: uiPrompt.surface,
         value: uiPrompt.value,
       },
-      details.sessionApproval,
-    );
+      sessionApproval: details.sessionApproval,
+      accessIntent: details.accessIntent,
+    });
   }
 
   // ── Private methods ────────────────────────────────────────────────────
 
   private async waitForForwardedApproval(
     ctx: ForwarderContext,
-    message: string,
-    forwarded?: ForwardedPromptDisplay,
-    sessionApproval?: ForwardedSessionApproval,
+    facts: ForwardedRequestFacts,
   ): Promise<PermissionPromptDecision> {
     const requesterSessionId = getSessionId(ctx);
     const targetSessionId = resolvePermissionForwardingTargetSessionId({
@@ -159,11 +176,9 @@ export class ParentAuthorizer implements Authorizer {
 
     const request = this.buildForwardedRequest(
       ctx,
-      message,
+      facts,
       requesterSessionId,
       targetSessionId,
-      forwarded,
-      sessionApproval,
     );
     const requestPath = join(location.requestsDir, `${request.id}.json`);
     const responsePath = join(location.responsesDir, `${request.id}.json`);
@@ -198,32 +213,47 @@ export class ParentAuthorizer implements Authorizer {
 
   private buildForwardedRequest(
     ctx: ForwarderContext,
-    message: string,
+    facts: ForwardedRequestFacts,
     requesterSessionId: string,
     targetSessionId: string,
-    forwarded?: ForwardedPromptDisplay,
-    sessionApproval?: ForwardedSessionApproval,
   ): ForwardedPermissionRequest {
     const requestId = `${Date.now()}-${Math.random().toString(36).slice(2, 10)}-${process.pid}`;
     const requesterAgentName =
       getActiveAgentName(ctx) ??
       getActiveAgentNameFromSystemPrompt(getContextSystemPrompt(ctx)) ??
       "unknown";
+    // Complete the child-fixed facts into a full ForwardedAccessIntent: the
+    // gate fixed the access facts; the edge stamps the requester identity it
+    // alone knows (cwd + principal). The parent resolves against this intent
+    // and never re-derives the match set (ADR 0008).
+    const accessIntent = facts.accessIntent
+      ? {
+          ...facts.accessIntent,
+          requesterCwd: getCwd(ctx),
+          principal: {
+            sessionId: requesterSessionId,
+            agentName: requesterAgentName,
+          },
+        }
+      : undefined;
     return {
       id: requestId,
       createdAt: Date.now(),
       requesterSessionId,
       targetSessionId,
       requesterAgentName,
-      message,
-      ...(forwarded
+      message: facts.message,
+      ...(facts.display
         ? {
-            source: forwarded.source,
-            surface: forwarded.surface,
-            value: forwarded.value,
+            source: facts.display.source,
+            surface: facts.display.surface,
+            value: facts.display.value,
           }
         : {}),
-      ...(sessionApproval ? { sessionApproval } : {}),
+      ...(facts.sessionApproval
+        ? { sessionApproval: facts.sessionApproval }
+        : {}),
+      ...(accessIntent ? { accessIntent } : {}),
     };
   }
 

package/src/authority/authorizer-chain.ts

@@ -0,0 +1,60 @@
+import type { PermissionQuery } from "#src/service";
+import type {
+  Authorizer,
+  AuthorizerVerdict,
+  TerminalAuthorizer,
+} from "./authorizer";
+import { createDeniedPermissionDecision } from "./permission-dialog";
+
+/**
+ * Compose the live-authority chain (ADR 0007): try each non-terminal `link`
+ * in order, and on `defer` fall through to the next link, ending at the
+ * context-selected `terminal` that always decides.
+ *
+ * The signature is the type-level terminal-cannot-defer invariant: `links` are
+ * deferring {@link Authorizer}s while `terminal` is a {@link TerminalAuthorizer}
+ * (returns a full decision), so a deferring link cannot occupy the terminal
+ * slot.
+ *
+ * Each link is handed the session-scoped `query` at `authorize` time (ADR 0007
+ * §3) so it queries the deterministic engine at gate parity; the terminal never
+ * queries. With zero links the composed chain **is** the terminal instance
+ * (identity), so behavior is byte-identical to the pre-chain spine — the
+ * empty-links case that ships until a link registers.
+ */
+export function composeAuthorizerChain(
+  links: readonly Authorizer[],
+  terminal: TerminalAuthorizer,
+  query: PermissionQuery,
+): TerminalAuthorizer {
+  if (links.length === 0) {
+    return terminal;
+  }
+  return {
+    async authorize(details) {
+      for (const link of links) {
+        const verdict = await link.authorize(details, query);
+        const decision = decideFromVerdict(verdict);
+        if (decision) {
+          return decision;
+        }
+        // `defer` \u2014 try the next link.
+      }
+      return terminal.authorize(details);
+    },
+  };
+}
+
+/** Map a link's decisive verdict to a decision; `defer` yields `null`. */
+function decideFromVerdict(verdict: AuthorizerVerdict) {
+  switch (verdict.kind) {
+    case "allow":
+      // A link grant is non-persistent (state `approved`, never
+      // `approved_for_session`), per ADR 0007's off-by-default envelope.
+      return { approved: true, state: "approved" } as const;
+    case "deny":
+      return createDeniedPermissionDecision(verdict.reason);
+    case "defer":
+      return null;
+  }
+}

package/src/authority/authorizer-registry.ts

@@ -0,0 +1,69 @@
+/**
+ * Registry for named live-authority chain links (ADR 0007 §4).
+ *
+ * A downstream extension offers a named `Authorizer` link via
+ * `PermissionsService.registerAuthorizer`; this registry stores the link's
+ * `authorize` callback so composition can bind names to capabilities. One link
+ * per name; duplicate registration throws.
+ *
+ * Registration alone grants no authority — a link decides nothing until the
+ * operator names it in the `authorizerChain` config (the opt-in activation
+ * model). `AuthorizerSelection` owns that config-order resolution; this registry
+ * is storage only.
+ */
+
+import type { Authorizer } from "./authorizer";
+
+/**
+ * Read-only lookup used by chain composition (ISP — exposes only the read side,
+ * not the registration surface).
+ */
+export interface AuthorizerLookup {
+  get(name: string): Authorizer["authorize"] | undefined;
+}
+
+/**
+ * Registration side of the registry (ISP — exposes only the write surface,
+ * mirroring the read-only {@link AuthorizerLookup}).
+ */
+export interface AuthorizerRegistrar {
+  register(name: string, authorize: Authorizer["authorize"]): () => void;
+}
+
+/**
+ * Persistent registry mapping link names to their `authorize` callbacks.
+ *
+ * Owned by the extension factory (`index.ts`) so it survives across session
+ * activations. Exposed to sibling extensions via
+ * `PermissionsService.registerAuthorizer` and consulted by
+ * `AuthorizerSelection` during chain resolution.
+ */
+export class AuthorizerRegistry
+  implements AuthorizerLookup, AuthorizerRegistrar
+{
+  private readonly links = new Map<string, Authorizer["authorize"]>();
+
+  /**
+   * Register a link under `name`.
+   *
+   * Throws if a link is already registered for that name — keeps resolution
+   * deterministic (a pi-permission-system package priority). Returns a disposer
+   * that removes the link; the disposer is identity-guarded so a stale call
+   * cannot evict a later registration.
+   */
+  register(name: string, authorize: Authorizer["authorize"]): () => void {
+    if (this.links.has(name)) {
+      throw new Error(`An authorizer is already registered for '${name}'.`);
+    }
+    this.links.set(name, authorize);
+    return () => {
+      if (this.links.get(name) === authorize) {
+        this.links.delete(name);
+      }
+    };
+  }
+
+  get(name: string): Authorizer["authorize"] | undefined {
+    return this.links.get(name);
+  }
+}

package/src/authority/authorizer-selection.ts

@@ -1,10 +1,15 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
+import type { PermissionQuery } from "#src/service";
 import {
   type Authorizer,
   type AuthorizerSelectionDeps,
   selectAuthorizer,
+  type TerminalAuthorizer,
 } from "./authorizer";
+import { composeAuthorizerChain } from "./authorizer-chain";
+import type { AuthorizerLookup } from "./authorizer-registry";
+import { encloseInDelegationEnvelope } from "./delegation-envelope";
 import type {
   PermissionPrompterApi,
   PromptPermissionDetails,
@@ -49,38 +54,79 @@ export interface AskEscalator {
 export class AuthorizerSelection
   implements AskEscalator, AuthorizerSelectionLifecycle
 {
-  private selected: Authorizer | null = null;
+  private terminal: TerminalAuthorizer | null = null;
 
   constructor(
     private readonly deps: AuthorizerSelectionDeps & {
       prompter: PermissionPrompterApi;
+      /** The session-scoped query injected into each chain link (ADR 0007 §3). */
+      getPermissionQuery: () => PermissionQuery;
+      /** Read-only lookup of registered links by name. */
+      authorizerRegistry: AuthorizerLookup;
+      /** The operator's configured link names, read live per ask. */
+      getAuthorizerChain: () => string[];
     },
   ) {}
 
-  /** Select the Authorizer for `ctx` and store it. */
+  /**
+   * Select the terminal Authorizer for `ctx` and store it. The non-terminal
+   * chain is composed per ask in {@link escalate}, not here: ADR 0007 §4 lets a
+   * link register in a `permissions:ready` handler that may fire after
+   * activation, so link resolution is deferred to the session's first ask.
+   */
   activate(ctx: ExtensionContext): void {
-    this.selected = selectAuthorizer(ctx, this.deps);
+    this.terminal = selectAuthorizer(ctx, this.deps);
+  }
+
+  /**
+   * Resolve the operator's `authorizerChain` names to registered links, in
+   * config order (ADR 0007 invariant 1). An unregistered name is skipped with a
+   * warning (invariant 2 — more prompting, never less); each resolved link is
+   * wrapped in the bounded-delegation envelope so an `allow` on an excluded
+   * surface cannot exceed the operator's policy.
+   */
+  private resolveConfiguredLinks(): Authorizer[] {
+    const links: Authorizer[] = [];
+    for (const name of this.deps.getAuthorizerChain()) {
+      const authorize = this.deps.authorizerRegistry.get(name);
+      if (authorize === undefined) {
+        this.deps.logger.review("authorizer_chain_unregistered_link", { name });
+        continue;
+      }
+      links.push({ authorize: encloseInDelegationEnvelope(authorize) });
+    }
+    return links;
   }
 
   /** Clear the stored selection. */
   deactivate(): void {
-    this.selected = null;
+    this.terminal = null;
   }
 
   /**
-   * Escalate an ask to the selected authorizer and return its decision.
+   * Escalate an ask through the composed chain and return its decision.
+   *
+   * Resolves the configured links freshly (so a link registered any time before
+   * this first ask is honored) and composes them ahead of the selected
+   * terminal. With zero links the composed value **is** the terminal instance,
+   * so behavior is identical to a bare terminal escalation.
    *
-   * Rejects if no authorizer has been selected — i.e. before the session was
+   * Rejects if no terminal has been selected — i.e. before the session was
    * activated. Implements {@link AskEscalator}.
    */
   escalate(
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision> {
-    if (this.selected === null) {
+    if (this.terminal === null) {
       return Promise.reject(
         new Error("escalate called before the session was activated"),
       );
     }
-    return this.deps.prompter.prompt(this.selected, details);
+    const chain = composeAuthorizerChain(
+      this.resolveConfiguredLinks(),
+      this.terminal,
+      this.deps.getPermissionQuery(),
+    );
+    return this.deps.prompter.prompt(chain, details);
   }
 }

package/src/authority/authorizer.ts

@@ -6,6 +6,7 @@ import type {
 } from "#src/authority/permission-prompt-component";
 import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
 import type { PermissionEventBus } from "#src/permission-events";
+import type { PermissionQuery } from "#src/service";
 import type { DebugReviewLogger } from "#src/session-logger";
 import { ParentAuthorizer } from "./approval-escalator";
 import { DenyingAuthorizer } from "./denying-authorizer";
@@ -14,15 +15,41 @@ import type { PromptPermissionDetails } from "./permission-prompter";
 import type { SubagentDetector } from "./subagent-detection";
 
 /**
- * The live-authority role: on `ask`, an `Authorizer` rules on a single
- * request and is told the decision.
+ * A non-terminal chain link's ruling on an `ask`: decide (`allow`/`deny`) or
+ * pass the ask on to the next link (`defer`). A `deny` carries an optional
+ * teaching `reason` the invoking model sees, so it can self-correct.
+ */
+export type AuthorizerVerdict =
+  | { kind: "allow" }
+  | { kind: "deny"; reason?: string }
+  | { kind: "defer" };
+
+/**
+ * A non-terminal link in the live-authority chain: reviews an `ask` and may
+ * decide it or defer to the next link (ADR 0007). The chain injects a narrow,
+ * session-scoped {@link PermissionQuery} at `authorize` time (§3), so a link
+ * queries the deterministic engine at gate parity rather than reaching for the
+ * cross-extension service via `Symbol.for()`.
+ */
+export interface Authorizer {
+  authorize(
+    details: PromptPermissionDetails,
+    query: PermissionQuery,
+  ): Promise<AuthorizerVerdict>;
+}
+
+/**
+ * The terminal link: on `ask`, rules on a single request and is told the
+ * decision. Structurally cannot defer — it always returns a full
+ * {@link PermissionPromptDecision}, which is the type-level enforcement of
+ * ADR 0007's terminal-cannot-defer invariant.
  *
  * One method, one responsibility. `DenyingAuthorizer` ignores `details`;
  * `LocalUserAuthorizer` reads `message`/`sessionLabel` and derives the UI
  * event from it; `ParentAuthorizer` reads `message` and derives the
  * forwarded display from it.
  */
-export interface Authorizer {
+export interface TerminalAuthorizer {
   authorize(
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision>;
@@ -56,7 +83,7 @@ export interface AuthorizerSelectionDeps {
 export function selectAuthorizer(
   ctx: ExtensionContext,
   deps: AuthorizerSelectionDeps,
-): Authorizer {
+): TerminalAuthorizer {
   if (ctx.hasUI) {
     return new LocalUserAuthorizer({
       ui: ctx.ui,

package/src/authority/delegation-envelope.ts

@@ -0,0 +1,52 @@
+/**
+ * The bounded-delegation enforcement checkpoint (ADR 0007 §5).
+ *
+ * The chain owner caps every registered link's verdict so a buggy or over-eager
+ * external judge can never exceed the operator's policy: a link's `allow` on an
+ * excluded surface is downgraded to `defer`, letting the `ask` fall through to
+ * the terminal (a prompt) instead. The checkpoint only ever *tightens* a
+ * verdict — it never turns a `defer`/`deny` into an `allow`.
+ *
+ * The excluded set is the whole `path` surface plus `external_directory`. A
+ * finer secret-shaped-`path` exclusion (letting a link allow a non-secret path)
+ * is deferred to the allow-capable slice that needs it (#620); until then the
+ * conservative whole-surface exclusion ships. The checkpoint is dormant while
+ * the only registered links are deny-first (they never `allow`).
+ */
+
+import type { Authorizer } from "./authorizer";
+import type { PromptPermissionDetails } from "./permission-prompter";
+
+/** Surfaces on which a link may never grant an `allow` (ADR 0007 §5). */
+export const DELEGATION_EXCLUDED_SURFACES: ReadonlySet<string> = new Set([
+  "external_directory",
+  "path",
+]);
+
+/**
+ * Wrap a link's `authorize` so an `allow` on an excluded surface is capped to
+ * `defer`. All other verdicts, and `allow`s on non-excluded surfaces, pass
+ * through unchanged. `details` and the injected `query` are forwarded as-is.
+ */
+export function encloseInDelegationEnvelope(
+  authorize: Authorizer["authorize"],
+): Authorizer["authorize"] {
+  return async (details, query) => {
+    const verdict = await authorize(details, query);
+    if (verdict.kind === "allow" && isExcludedSurface(details)) {
+      return { kind: "defer" };
+    }
+    return verdict;
+  };
+}
+
+/**
+ * Whether the ask's surface is excluded from link grants. Reads the
+ * gate-authoritative `accessIntent.surface`, falling back to the display
+ * `surface`. Fail-safe: an ask whose surface cannot be determined is treated as
+ * excluded (more prompting, never less — ADR 0007 invariant 2).
+ */
+function isExcludedSurface(details: PromptPermissionDetails): boolean {
+  const surface = details.accessIntent?.surface ?? details.surface ?? undefined;
+  return surface === undefined || DELEGATION_EXCLUDED_SURFACES.has(surface);
+}

package/src/authority/denying-authorizer.ts

@@ -1,5 +1,5 @@
 import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
-import type { Authorizer } from "./authorizer";
+import type { TerminalAuthorizer } from "./authorizer";
 
 /**
  * Least-privilege Authorizer: no authority is reachable for this session
@@ -9,7 +9,7 @@ import type { Authorizer } from "./authorizer";
  * distinguish "nobody could answer" from an interactive user denial when it
  * derives the review-entry and decision-event resolution.
  */
-export class DenyingAuthorizer implements Authorizer {
+export class DenyingAuthorizer implements TerminalAuthorizer {
   authorize(): Promise<PermissionPromptDecision> {
     return Promise.resolve({
       approved: false,

package/src/authority/forwarded-request-server.ts

@@ -5,6 +5,7 @@ import {
 } from "#src/authority/forwarder-context";
 import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
 import {
+  type ForwardedAccessIntent,
   type ForwardedPermissionRequest,
   type ForwardedPermissionResponse,
   isForwardedPermissionRequestForSession,
@@ -43,23 +44,25 @@ export interface InboxProcessor {
 
 /**
  * Recorded-authority view the serving node resolves a forwarded request
- * against: answer one `(surface, value)` query on the serving session's
- * composed base ruleset (agent-neutral — the child already applied its own
- * per-agent overrides before forwarding).
+ * against: answer one {@link ForwardedAccessIntent} query on the serving
+ * session's composed ruleset, agent-scoped to the requester
+ * (`principal.agentName`, ADR 0008 §3) — the child-fixed `matchValues` are
+ * used as-is, never re-derived through this session's `PathNormalizer`/cwd.
  *
  * Narrow by design (ISP): the server needs one decision, not the whole
- * resolver. The composition root satisfies it with an access-intent build plus
- * `resolver.resolve`, the same primitives `LocalPermissionsService` composes.
+ * resolver. The composition root satisfies it with
+ * `buildResolvedIntentFromMatchValues` plus `resolver.resolve`, the same
+ * `resolve` entry point `LocalPermissionsService` composes.
  */
 export interface ServingPolicy {
-  check(surface: string, value: string | null): PermissionCheckResult;
+  resolve(intent: ForwardedAccessIntent): PermissionCheckResult;
 }
 
 /** Constructor config for `ForwardedRequestServer`. */
 export interface ForwardedRequestServerDeps {
   forwardingDir: string;
   logger: DebugReviewLogger;
-  /** Recorded-authority resolution for `(surface, value)` requests. */
+  /** Recorded-authority resolution for a forwarded `ForwardedAccessIntent`. */
   policy: ServingPolicy;
   /** Escalation seam to the serving session's selected `Authorizer` on `ask`. */
   escalator: AskEscalator;
@@ -87,22 +90,6 @@ function formatForwardedPermissionPrompt(
   ].join("\n");
 }
 
-/**
- * A request is resolvable against the ruleset only when it carries a concrete
- * `(surface, value)` display projection. A legacy/version-skew request without
- * them floors to `ask` (escalate), never a silent grant.
- */
-function hasDisplayFields(
-  request: ForwardedPermissionRequest,
-): request is ForwardedPermissionRequest & { surface: string; value: string } {
-  return (
-    typeof request.surface === "string" &&
-    request.surface.length > 0 &&
-    typeof request.value === "string" &&
-    request.value.length > 0
-  );
-}
-
 /**
  * Map a forwarded request onto the escalated ask's details, carrying the
  * forwarded provenance (requester agent/session + the child's original display
@@ -135,9 +122,10 @@ function buildForwardedAskDetails(
 /**
  * Owner of the serving-down role of the forwarded-permission behavior:
  * draining this session's forwarded-permission inbox and answering each
- * request the same way the session resolves a local action — `evaluate()`
- * against its recorded authority (`ServingPolicy`), then escalation to its
- * selected `Authorizer` (`AskEscalator`) on `ask`.
+ * request the same way the session resolves a local action — resolving its
+ * `ForwardedAccessIntent` against recorded authority (`ServingPolicy`), then
+ * escalation to its selected `Authorizer` (`AskEscalator`) on `ask` (ADR
+ * 0008).
  */
 export class ForwardedRequestServer implements InboxProcessor {
   private readonly forwardingDir: string;
@@ -343,17 +331,19 @@ export class ForwardedRequestServer implements InboxProcessor {
 
   /**
    * Resolve the request the same way the session resolves a local action:
-   * recorded authority first (a request carrying `(surface, value)` resolves
-   * against the serving node's composed ruleset — `allow`, including
-   * yolo-rewritten, auto-approves; `deny` auto-denies), then escalate `ask`
-   * (or a request without display fields) to the selected `Authorizer`.
+   * recorded authority first (a request carrying an `accessIntent` — the
+   * child-fixed facts, ADR 0008 §2 — resolves against the serving node's
+   * composed ruleset — `allow`, including yolo-rewritten, auto-approves;
+   * `deny` auto-denies), then escalate `ask` (or a request missing
+   * `accessIntent`, the version-skew floor, ADR 0008 §4) to the selected
+   * `Authorizer`.
    */
   private async resolveDecision(
     request: ForwardedPermissionRequest,
     logDetails: Record<string, unknown>,
   ): Promise<PermissionPromptDecision> {
-    const state = hasDisplayFields(request)
-      ? this.policy.check(request.surface, request.value).state
+    const state = request.accessIntent
+      ? this.policy.resolve(request.accessIntent).state
       : "ask";
 
     if (state === "allow") {

package/src/authority/forwarder-context.ts

@@ -12,6 +12,8 @@ import type { PermissionDecisionUi } from "#src/authority/permission-dialog";
 export interface ForwarderContext {
   hasUI: boolean;
   ui: PermissionDecisionUi;
+  /** The session's working directory, stamped onto a forwarded request as the requester cwd. */
+  cwd: string;
   sessionManager: {
     getSessionId(): string;
     getSessionDir(): string;
@@ -19,6 +21,11 @@ export interface ForwarderContext {
   };
 }
 
+/** Reads the current session cwd off `ctx`. */
+export function getCwd(ctx: ForwarderContext): string {
+  return ctx.cwd;
+}
+
 /** Reads the current session id off `ctx`, falling back to `"unknown"`. */
 export function getSessionId(ctx: ForwarderContext): string {
   try {