@gotgenes/pi-permission-system 20.8.0 → 20.9.1

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [20.9.1](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.9.0...pi-permission-system-v20.9.1) (2026-07-20)
+
+
+### Documentation
+
+* **pi-permission-system:** cite pi-permission-model-judge as a registerAuthorizer example ([6bc1e67](https://github.com/gotgenes/pi-packages/commit/6bc1e6710ea70c7d95b87d77fb4e744f0b81e614))
+
+## [20.9.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.8.0...pi-permission-system-v20.9.0) (2026-07-19)
+
+
+### Features
+
+* **pi-permission-system:** add authorizerChain config field ([#599](https://github.com/gotgenes/pi-packages/issues/599)) ([6c0bb72](https://github.com/gotgenes/pi-packages/commit/6c0bb72680d864b70e8fac5bb5c480b9a96751f8))
+* **pi-permission-system:** add registerAuthorizer cross-extension seam ([#599](https://github.com/gotgenes/pi-packages/issues/599)) ([ea60900](https://github.com/gotgenes/pi-packages/commit/ea60900439d68ccc028ba75c3e432945e0ac3b72))
+* **pi-permission-system:** cap link verdicts with the delegation envelope ([#599](https://github.com/gotgenes/pi-packages/issues/599)) ([28733fc](https://github.com/gotgenes/pi-packages/commit/28733fca298f1fea1f7a810b61728f9c96bf225f))
+* **pi-permission-system:** inject a session-scoped PermissionQuery into chain links ([#599](https://github.com/gotgenes/pi-packages/issues/599)) ([29452ff](https://github.com/gotgenes/pi-packages/commit/29452ff8cbec6abc431a318b7937843ecefb724d))
+* **pi-permission-system:** resolve the configured authorizer chain ([#599](https://github.com/gotgenes/pi-packages/issues/599)) ([fb366d9](https://github.com/gotgenes/pi-packages/commit/fb366d9aed47ab439ffc033e4967a4285d37fe8a))
+
+
+### Documentation
+
+* **pi-permission-system:** document registerAuthorizer + authorizerChain and mark Phase 12 Step 5 complete ([#599](https://github.com/gotgenes/pi-packages/issues/599)) ([1d6b228](https://github.com/gotgenes/pi-packages/commit/1d6b22889296b3277a118cc8168486664c691305))
+
 ## [20.8.0](https://github.com/gotgenes/pi-packages/compare/pi-permission-system-v20.7.3...pi-permission-system-v20.8.0) (2026-07-18)
 
 

package/README.md

@@ -112,6 +112,10 @@ Within a surface map like `bash` or `mcp`, **last matching rule wins** — put b
 
 The optional `shellTools` field records which non-`bash` tools carry shell semantics (e.g. an `exec_command` tool that replaces native `bash`), so they are gated at full parity with native `bash` — see [docs/configuration.md](docs/configuration.md#shelltools--gating-aliased-shell-tools).
 
+The optional `authorizerChain` field names registered case-by-case decision links (e.g. a light model judge) to consult when a request lands on `ask`, ahead of the interactive prompt.
+A downstream extension registers a link via `getPermissionsService().registerAuthorizer(name, authorize)`; it decides nothing until you name it here (opt-in), config order fixes the chain order, and the chain owner caps any link's `allow` on `external_directory`/`path` to keep it within your policy — see [docs/configuration.md](docs/configuration.md#authorizer-chain--case-by-case-decision-links).
+[`@gotgenes/pi-permission-model-judge`](https://github.com/gotgenes/pi-packages/tree/main/packages/pi-permission-model-judge) is a first-party reference implementation of such a link — a deny-first reviewer that auto-denies mistyped out-of-directory paths.
+
 For the full reference — all surfaces, runtime knobs, per-agent overrides, merge semantics, and common recipes — see [docs/configuration.md](docs/configuration.md).
 
 ## Upgrading

package/config/config.example.json

@@ -11,6 +11,8 @@
 
   "piInfrastructureReadPaths": [],
 
+  "authorizerChain": [],
+
   "shellTools": {
     "exec_command": { "commandArgument": "cmd", "workdirArgument": "workdir" }
   },

package/dist/public.d.ts

@@ -1,65 +1,5 @@
 import { z } from 'zod';
 
-/**
- * Registry for custom tool access-intent extractors.
- *
- * Lets sibling extensions declare the filesystem path a tool will access when
- * the tool's input shape is not the default `input.path` convention, so the
- * cross-cutting `path` and `external_directory` gates can see it.
- * One extractor per tool name; duplicate registration throws.
- */
-/** Returns the filesystem path this tool will access, or `undefined` to decline. */
-type ToolAccessExtractor = (input: Record<string, unknown>) => string | undefined;
-
-/**
- * Registry for custom tool-input preview formatters.
- *
- * Allows extensions to register a formatter for a specific tool name so
- * permission prompts can show a human-readable summary instead of raw JSON.
- * One formatter per tool name; duplicate registration throws.
- */
-/** A custom preview formatter for one tool's input. Returns `undefined` to decline. */
-type ToolInputFormatter = (input: Record<string, unknown>) => string | undefined;
-
-declare const permissionStateSchema: z.ZodUnion<readonly [z.ZodLiteral<"allow">, z.ZodLiteral<"deny">, z.ZodLiteral<"ask">]>;
-/** A permission decision. */
-type PermissionState = z.infer<typeof permissionStateSchema>;
-
-/**
- * Provenance of a rule — which source contributed it.
- *
- * Config scopes: "global", "project", "agent", "project-agent".
- * Synthesized:   "builtin" (universal default / evaluate() fallback),
- *                "baseline" (conditional MCP metadata auto-allow).
- * Runtime:       "session" (session approvals).
- * Rewrite:       "yolo" (composition-stage ask→allow rewrite under yolo mode).
- */
-type RuleOrigin = "global" | "project" | "agent" | "project-agent" | "builtin" | "baseline" | "session" | "yolo";
-
-/**
- * Execution context of a bash command nested inside a substitution or subshell.
- * Absent for current-shell (top-level) commands.
- */
-type BashCommandContext = "command_substitution" | "process_substitution" | "subshell";
-interface PermissionCheckResult {
-    toolName: string;
-    state: PermissionState;
-    /** Custom denial reason from a deny-with-reason pattern, when present. */
-    reason?: string;
-    matchedPattern?: string;
-    command?: string;
-    target?: string;
-    source: "tool" | "bash" | "mcp" | "skill" | "special" | "default" | "session";
-    /** Which source contributed the winning rule. */
-    origin: RuleOrigin;
-    /**
-     * Execution context of the offending nested command, when the winning bash
-     * unit came from a substitution or subshell. Absent for current-shell
-     * (top-level) commands.
-     */
-    commandContext?: BashCommandContext;
-}
-
 /** Emitted at `session_start`, after the service is published. */
 declare const PERMISSIONS_READY_CHANNEL = "permissions:ready";
 /** Emitted when a permission request is committed to the active UI prompt path. */
@@ -135,6 +75,175 @@ interface PermissionDecisionEvent {
     matchedPattern: string | null;
 }
 
+declare const permissionStateSchema: z.ZodUnion<readonly [z.ZodLiteral<"allow">, z.ZodLiteral<"deny">, z.ZodLiteral<"ask">]>;
+/** A permission decision. */
+type PermissionState = z.infer<typeof permissionStateSchema>;
+
+/**
+ * Provenance of a rule — which source contributed it.
+ *
+ * Config scopes: "global", "project", "agent", "project-agent".
+ * Synthesized:   "builtin" (universal default / evaluate() fallback),
+ *                "baseline" (conditional MCP metadata auto-allow).
+ * Runtime:       "session" (session approvals).
+ * Rewrite:       "yolo" (composition-stage ask→allow rewrite under yolo mode).
+ */
+type RuleOrigin = "global" | "project" | "agent" | "project-agent" | "builtin" | "baseline" | "session" | "yolo";
+
+/**
+ * Execution context of a bash command nested inside a substitution or subshell.
+ * Absent for current-shell (top-level) commands.
+ */
+type BashCommandContext = "command_substitution" | "process_substitution" | "subshell";
+interface PermissionCheckResult {
+    toolName: string;
+    state: PermissionState;
+    /** Custom denial reason from a deny-with-reason pattern, when present. */
+    reason?: string;
+    matchedPattern?: string;
+    command?: string;
+    target?: string;
+    source: "tool" | "bash" | "mcp" | "skill" | "special" | "default" | "session";
+    /** Which source contributed the winning rule. */
+    origin: RuleOrigin;
+    /**
+     * Execution context of the offending nested command, when the winning bash
+     * unit came from a substitution or subshell. Absent for current-shell
+     * (top-level) commands.
+     */
+    commandContext?: BashCommandContext;
+}
+
+/**
+ * The child's session-approval suggestion, relayed to the serving node so a
+ * human who grants "the whole session" records the same pattern the child
+ * would have recorded locally.
+ *
+ * A plain data shape (not the `SessionApproval` value object) so it serializes
+ * onto the forwarded request; the serving node rebuilds a `SessionApproval`
+ * from it via `SessionApproval.multiple`.
+ */
+interface ForwardedSessionApproval {
+    surface: string;
+    patterns: readonly string[];
+}
+/**
+ * The child-fixed facts a gate emits: the surface it evaluated and the match
+ * set it computed. `requesterCwd` and `principal` are stamped at the escalation
+ * edge (`ParentAuthorizer`), so a gate carries only what it alone can produce.
+ *
+ * Strings only — an `AccessPath` never crosses onto the wire
+ * (`docs/decisions/0002-path-values-string-boundary.md`).
+ */
+interface ForwardedAccessFacts {
+    /** Gate surface: `"path"`, `"external_directory"`, `"bash"`, a tool name, or a skill name. */
+    surface: string;
+    /**
+     * The child-fixed match set. Path surface: `AccessPath.matchValues()`
+     * (absolute ∪ cwd-relative ∪ canonical), computed at the child. Non-path
+     * surface: the already-portable single value as a one-element array.
+     */
+    matchValues: string[];
+    /** `AccessPath.boundaryValue()` (canonical) for a path surface; `null` for a non-path surface. */
+    boundaryValue: string | null;
+}
+
+type PermissionReviewSource = "tool_call" | "skill_input" | "skill_read";
+/**
+ * Provenance of a forwarded ask: who is really asking, one hop below.
+ *
+ * Present on {@link PromptPermissionDetails} only when the ask was forwarded
+ * from a subagent. Structurally identical to the event's `ForwardedPromptContext`
+ * so the details flow straight into `buildUiPrompt`, but declared here to keep
+ * the prompter layer free of an events-module import.
+ */
+interface ForwardedAskProvenance {
+    requesterAgentName: string | null;
+    requesterSessionId: string | null;
+}
+/** Details passed when prompting the user for a permission decision. */
+interface PromptPermissionDetails {
+    requestId: string;
+    source: PermissionReviewSource;
+    agentName: string | null;
+    message: string;
+    toolCallId?: string;
+    toolName?: string;
+    skillName?: string;
+    path?: string;
+    command?: string;
+    target?: string;
+    toolInputPreview?: string;
+    /** Override label for the "for this session" dialog option. */
+    sessionLabel?: string;
+    /** Explicit display-surface override (a forwarded ask carries the child's original). */
+    surface?: string | null;
+    /** Explicit display-value override (a forwarded ask carries the child's original). */
+    value?: string | null;
+    /** Present iff this ask was forwarded from a subagent; drives the non-degraded broadcast + "(Subagent)" title. */
+    forwarding?: ForwardedAskProvenance;
+    /**
+     * The session-approval suggestion for this ask. On the child's escalation it
+     * rides into the forwarded request; on the serving node it lets the dialog
+     * offer a whole-session grant scope. Absent when the gate computed no
+     * suggestion.
+     */
+    sessionApproval?: ForwardedSessionApproval;
+    /**
+     * The child-fixed access facts the raising gate computed (surface + match
+     * set). Rides through the runner to the escalation edge, which completes
+     * them into a `ForwardedAccessIntent` by stamping `requesterCwd` and
+     * `principal`. Absent for a serving-node local prompt reconstructed from a
+     * forwarded request.
+     */
+    accessIntent?: ForwardedAccessFacts;
+}
+
+/**
+ * A non-terminal chain link's ruling on an `ask`: decide (`allow`/`deny`) or
+ * pass the ask on to the next link (`defer`). A `deny` carries an optional
+ * teaching `reason` the invoking model sees, so it can self-correct.
+ */
+type AuthorizerVerdict = {
+    kind: "allow";
+} | {
+    kind: "deny";
+    reason?: string;
+} | {
+    kind: "defer";
+};
+/**
+ * A non-terminal link in the live-authority chain: reviews an `ask` and may
+ * decide it or defer to the next link (ADR 0007). The chain injects a narrow,
+ * session-scoped {@link PermissionQuery} at `authorize` time (§3), so a link
+ * queries the deterministic engine at gate parity rather than reaching for the
+ * cross-extension service via `Symbol.for()`.
+ */
+interface Authorizer {
+    authorize(details: PromptPermissionDetails, query: PermissionQuery): Promise<AuthorizerVerdict>;
+}
+
+/**
+ * Registry for custom tool access-intent extractors.
+ *
+ * Lets sibling extensions declare the filesystem path a tool will access when
+ * the tool's input shape is not the default `input.path` convention, so the
+ * cross-cutting `path` and `external_directory` gates can see it.
+ * One extractor per tool name; duplicate registration throws.
+ */
+/** Returns the filesystem path this tool will access, or `undefined` to decline. */
+type ToolAccessExtractor = (input: Record<string, unknown>) => string | undefined;
+
+/**
+ * Registry for custom tool-input preview formatters.
+ *
+ * Allows extensions to register a formatter for a specific tool name so
+ * permission prompts can show a human-readable summary instead of raw JSON.
+ * One formatter per tool name; duplicate registration throws.
+ */
+/** A custom preview formatter for one tool's input. Returns `undefined` to decline. */
+type ToolInputFormatter = (input: Record<string, unknown>) => string | undefined;
+
 /**
  * Cross-extension service accessor backed by `Symbol.for()` on `globalThis`.
  *
@@ -149,13 +258,12 @@ interface PermissionDecisionEvent {
  */
 
 /**
- * Public interface exposed to other extensions via `getPermissionsService()`.
- *
- * `checkPermission` takes a surface + optional value + optional agent name,
- * and delegates to `PermissionManager.checkPermission()` with current session
- * rules internally.
+ * The narrow, read-only projection of {@link PermissionsService}: answer a
+ * policy query for a surface, and report a tool-level state. This is the
+ * capability an Authorizer chain link is handed (ISP) — it never sees the
+ * registration surface.
  */
-interface PermissionsService {
+interface PermissionQuery {
     /**
      * Query the permission policy for a surface and value.
      *
@@ -168,6 +276,27 @@ interface PermissionsService {
      * @returns Full check result including state, matched pattern, and origin.
      */
     checkPermission(surface: string, value?: string, agentName?: string): PermissionCheckResult;
+    /**
+     * Query the tool-level permission state for pre-filtering tools before
+     * creating a child session.
+     *
+     * Returns `"deny"` | `"allow"` | `"ask"` based on the composed policy.
+     * Does not consider command-level rules (e.g. per-bash-command patterns) —
+     * use `checkPermission` for runtime invocation gates.
+     *
+     * @param toolName  - Tool name (e.g. `"bash"`, `"read"`, `"my-extension:tool"`).
+     * @param agentName - Optional agent name for per-agent policy resolution.
+     */
+    getToolPermission(toolName: string, agentName?: string): PermissionState;
+}
+/**
+ * Public interface exposed to other extensions via `getPermissionsService()`.
+ *
+ * `checkPermission` takes a surface + optional value + optional agent name,
+ * and delegates to `PermissionManager.checkPermission()` with current session
+ * rules internally.
+ */
+interface PermissionsService extends PermissionQuery {
     /**
      * Register a custom preview formatter for a specific tool name.
      *
@@ -203,17 +332,25 @@ interface PermissionsService {
      */
     registerToolAccessExtractor(toolName: string, extractor: ToolAccessExtractor): () => void;
     /**
-     * Query the tool-level permission state for pre-filtering tools before
-     * creating a child session.
+     * Register a named live-authority chain link (ADR 0007 §4).
      *
-     * Returns `"deny"` | `"allow"` | `"ask"` based on the composed policy.
-     * Does not consider command-level rules (e.g. per-bash-command patterns) —
-     * use `checkPermission` for runtime invocation gates.
+     * A link reviews an `ask` and returns `allow` / `deny` (with an optional
+     * teaching `reason`) / `defer`. It is handed a narrow, session-scoped
+     * {@link PermissionQuery} at `authorize` time so it can query the
+     * deterministic engine at gate parity. Register from a `permissions:ready`
+     * handler so registration is robust to load order and survives `/reload`.
      *
-     * @param toolName  - Tool name (e.g. `"bash"`, `"read"`, `"my-extension:tool"`).
-     * @param agentName - Optional agent name for per-agent policy resolution.
+     * Registration alone grants **no authority**: the link decides nothing until
+     * the operator names it in the `authorizerChain` config (opt-in activation),
+     * and the chain owner caps every verdict with the bounded-delegation
+     * checkpoint (an `allow` on an excluded surface downgrades to `defer`). Only
+     * one link may be registered per name — a second call for the same name
+     * throws. The returned disposer unregisters the link.
+     *
+     * @param name      - Operator-facing link name referenced from `authorizerChain`.
+     * @param authorize - The link's decision callback (`(details, query) => verdict`).
      */
-    getToolPermission(toolName: string, agentName?: string): PermissionState;
+    registerAuthorizer(name: string, authorize: Authorizer["authorize"]): () => void;
 }
 /**
  * Store a `PermissionsService` on `globalThis` so other extensions can
@@ -246,4 +383,4 @@ declare function getPermissionsService(): PermissionsService | undefined;
 declare function unpublishPermissionsService(service: PermissionsService): void;
 
 export { PERMISSIONS_DECISION_CHANNEL, PERMISSIONS_READY_CHANNEL, PERMISSIONS_UI_PROMPT_CHANNEL, getPermissionsService, publishPermissionsService, unpublishPermissionsService };
-export type { ForwardedPromptContext, PermissionCheckResult, PermissionDecisionEvent, PermissionState, PermissionUiPromptEvent, PermissionUiPromptSource, PermissionsReadyEvent, PermissionsService, ToolInputFormatter };
+export type { Authorizer, AuthorizerVerdict, ForwardedPromptContext, PermissionCheckResult, PermissionDecisionEvent, PermissionQuery, PermissionState, PermissionUiPromptEvent, PermissionUiPromptSource, PermissionsReadyEvent, PermissionsService, PromptPermissionDetails, ToolInputFormatter };

package/docs/configuration.md

@@ -52,6 +52,9 @@ Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`, `doublePressToConf
     "exec_command": { "commandArgument": "cmd", "workdirArgument": "workdir" }
   },
 
+  // Ordered names of registered live-authority chain links (empty = none)
+  "authorizerChain": [],
+
   // Flat permission policy
   "permission": {
     "*": "ask",                              // universal fallback
@@ -81,15 +84,16 @@ Scalar fields (`debugLog`, `permissionReviewLog`, `yoloMode`, `doublePressToConf
 
 ## Runtime Knobs
 
-| Key                         | Default | Description                                                                                                                                          |
-| --------------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `debugLog`                  | `false` | Enables verbose diagnostic logging to `logs/pi-permission-system-debug.jsonl`                                                                        |
-| `permissionReviewLog`       | `true`  | Enables the permission request/denial review log at `logs/pi-permission-system-permission-review.jsonl`                                              |
-| `yoloMode`                  | `false` | Auto-approves `ask` results instead of prompting when yolo mode is enabled                                                                           |
-| `doublePressToConfirm`      | `true`  | Requires a confirming second press of a decision hotkey in the inline TUI dialog (see below). TUI sessions only; set to `false` for single-press.    |
-| `toolInputPreviewMaxLength` | `200`   | Max characters of inline JSON shown in permission prompts for tool inputs. Omit to use the default. Set to a large value to disable truncation.      |
-| `toolTextSummaryMaxLength`  | `80`    | Max characters of inline pattern/path summaries (grep patterns, find globs, ls paths) in permission prompts. Omit to use the default.                |
-| `piInfrastructureReadPaths` | `[]`    | Extra directories to auto-allow for reads, bypassing the `external_directory` gate. Supports `~`/`$HOME` expansion and wildcard patterns (`*`, `?`). |
+| Key                         | Default | Description                                                                                                                                                                |
+| --------------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `debugLog`                  | `false` | Enables verbose diagnostic logging to `logs/pi-permission-system-debug.jsonl`                                                                                              |
+| `permissionReviewLog`       | `true`  | Enables the permission request/denial review log at `logs/pi-permission-system-permission-review.jsonl`                                                                    |
+| `yoloMode`                  | `false` | Auto-approves `ask` results instead of prompting when yolo mode is enabled                                                                                                 |
+| `doublePressToConfirm`      | `true`  | Requires a confirming second press of a decision hotkey in the inline TUI dialog (see below). TUI sessions only; set to `false` for single-press.                          |
+| `toolInputPreviewMaxLength` | `200`   | Max characters of inline JSON shown in permission prompts for tool inputs. Omit to use the default. Set to a large value to disable truncation.                            |
+| `toolTextSummaryMaxLength`  | `80`    | Max characters of inline pattern/path summaries (grep patterns, find globs, ls paths) in permission prompts. Omit to use the default.                                      |
+| `piInfrastructureReadPaths` | `[]`    | Extra directories to auto-allow for reads, bypassing the `external_directory` gate. Supports `~`/`$HOME` expansion and wildcard patterns (`*`, `?`).                       |
+| `authorizerChain`           | `[]`    | Ordered names of registered live-authority chain links to consult before the terminal authorizer (see [Authorizer chain](#authorizer-chain--case-by-case-decision-links)). |
 
 Both logs write to `~/.pi/agent/extensions/pi-permission-system/logs/`.
 No debug output is printed to the terminal.
@@ -159,6 +163,39 @@ To change a specific tool's mapping, set that tool's key at the project scope (t
 `shellTools` only ever *tightens* enforcement and is inert when the named tool is not registered in the current session.
 Opting a project out of a shell-aliasing extension is a package-disable concern, not a `shellTools` edit.
 
+### Authorizer chain — case-by-case decision links
+
+The deterministic policy above decides `allow` / `deny` / `ask` for every request.
+When a request lands on `ask`, the **authorizer chain** decides who answers it.
+By default that is you (an interactive prompt), the subagent-forwarding path, or a headless deny.
+A downstream extension can register a **link** — a reviewer that sees the `ask` and returns `allow`, `deny` (with an optional teaching reason), or `defer` to the next link — and the chain ends at the default terminal that always decides.
+The canonical use case is a light model judge that reviews asks case by case (e.g. auto-denying an errant typo-path with a corrective reason).
+
+`authorizerChain` is the ordered list of link names to consult, ahead of the terminal:
+
+```jsonc
+{
+  "authorizerChain": ["model-judge"]
+}
+```
+
+Three invariants govern the chain:
+
+1. **Config order wins, never registration order.**
+   The order in `authorizerChain` — not the order extensions happen to register in — fixes the security-relevant chain order.
+2. **A missing link is skipped fail-safe.**
+   A name with no registered link is skipped with a logged warning; the `ask` still reaches the terminal.
+   Absence of a judge means *more* prompting, never less.
+3. **Registration alone grants no authority.**
+   Installing a judge extension gives it nothing; a link decides nothing until you name it here (opt-in activation).
+
+The chain owner caps every link with a **bounded-delegation checkpoint**: a link's `allow` on an excluded surface (`external_directory` or the `path` surface) is downgraded to `defer`, so a buggy or over-eager judge can never approve access outside your policy.
+Deny and defer are never capped.
+
+Extension authors: register a link from a `permissions:ready` handler via `getPermissionsService().registerAuthorizer(name, authorize)`; the callback receives the ask details and a narrow, session-scoped `PermissionQuery` (`checkPermission` / `getToolPermission`) so it can consult the deterministic engine at gate parity.
+Registration returns a disposer, and only one link may hold a given name.
+For a complete working example, see [`@gotgenes/pi-permission-model-judge`](https://github.com/gotgenes/pi-packages/tree/main/packages/pi-permission-model-judge): it registers a `model-judge` link on `permissions:ready` that reviews `external_directory` asks and auto-denies mistyped paths with a corrective reason.
+
 ---
 
 ## Policy Reference

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gotgenes/pi-permission-system",
-  "version": "20.8.0",
+  "version": "20.9.1",
   "description": "Permission enforcement extension for the Pi coding agent.",
   "type": "module",
   "exports": {

package/schemas/permissions.schema.json

@@ -55,6 +55,16 @@
         "minLength": 1
       }
     },
+    "authorizerChain": {
+      "description": "Ordered names of registered live-authority chain links to consult before the terminal authorizer. Config order (not registration order) fixes the chain order; an unregistered name is skipped fail-safe (more prompting, never less); a link decides nothing until it is named here.",
+      "markdownDescription": "Ordered names of registered **live-authority chain links** (e.g. a model judge) to consult before the terminal authorizer (the human, or the subagent-forwarding / headless-deny fallback).\n\nA link reviews an `ask` and returns `allow` / `deny` (with an optional teaching reason) / `defer` to the next link. Three invariants govern the chain:\n\n- **Config order wins.** The order here — not the order extensions register in — fixes the security-relevant chain order.\n- **Fail-safe skip.** A name with no registered link is skipped with a warning; the `ask` still reaches the terminal (more prompting, never less).\n- **Opt-in activation.** Installing a judge extension grants it no authority; a link decides nothing until you name it here.\n\nThe chain owner caps every verdict with a bounded-delegation checkpoint: a link's `allow` on an excluded surface (`external_directory` or `path`) is downgraded to `defer`, so a link cannot exceed your policy.\n\nDefaults to an empty list (no links).",
+      "default": [],
+      "type": "array",
+      "items": {
+        "type": "string",
+        "minLength": 1
+      }
+    },
     "permission": {
       "type": "object",
       "propertyNames": {

package/src/authority/approval-escalator.ts

@@ -35,7 +35,7 @@ import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
 import { buildUiPrompt } from "#src/permission-ui-prompt";
 import type { DebugReviewLogger } from "#src/session-logger";
 import { toRecord } from "#src/value-guards";
-import type { Authorizer } from "./authorizer";
+import type { TerminalAuthorizer } from "./authorizer";
 import type { PromptPermissionDetails } from "./permission-prompter";
 
 // ── Module-private helpers ────────────────────────────────────────────────
@@ -100,7 +100,7 @@ export interface ParentAuthorizerDeps {
  * (formerly `ApprovalEscalator.requestApproval`'s `hasUI` / `!isSubagent`
  * arms, both dead once every caller routes through `selectAuthorizer`).
  */
-export class ParentAuthorizer implements Authorizer {
+export class ParentAuthorizer implements TerminalAuthorizer {
   private readonly forwardingDir: string;
   private readonly registry: SubagentSessionRegistry | undefined;
   private readonly logger: DebugReviewLogger;

package/src/authority/authorizer-chain.ts

@@ -0,0 +1,60 @@
+import type { PermissionQuery } from "#src/service";
+import type {
+  Authorizer,
+  AuthorizerVerdict,
+  TerminalAuthorizer,
+} from "./authorizer";
+import { createDeniedPermissionDecision } from "./permission-dialog";
+
+/**
+ * Compose the live-authority chain (ADR 0007): try each non-terminal `link`
+ * in order, and on `defer` fall through to the next link, ending at the
+ * context-selected `terminal` that always decides.
+ *
+ * The signature is the type-level terminal-cannot-defer invariant: `links` are
+ * deferring {@link Authorizer}s while `terminal` is a {@link TerminalAuthorizer}
+ * (returns a full decision), so a deferring link cannot occupy the terminal
+ * slot.
+ *
+ * Each link is handed the session-scoped `query` at `authorize` time (ADR 0007
+ * §3) so it queries the deterministic engine at gate parity; the terminal never
+ * queries. With zero links the composed chain **is** the terminal instance
+ * (identity), so behavior is byte-identical to the pre-chain spine — the
+ * empty-links case that ships until a link registers.
+ */
+export function composeAuthorizerChain(
+  links: readonly Authorizer[],
+  terminal: TerminalAuthorizer,
+  query: PermissionQuery,
+): TerminalAuthorizer {
+  if (links.length === 0) {
+    return terminal;
+  }
+  return {
+    async authorize(details) {
+      for (const link of links) {
+        const verdict = await link.authorize(details, query);
+        const decision = decideFromVerdict(verdict);
+        if (decision) {
+          return decision;
+        }
+        // `defer` \u2014 try the next link.
+      }
+      return terminal.authorize(details);
+    },
+  };
+}
+
+/** Map a link's decisive verdict to a decision; `defer` yields `null`. */
+function decideFromVerdict(verdict: AuthorizerVerdict) {
+  switch (verdict.kind) {
+    case "allow":
+      // A link grant is non-persistent (state `approved`, never
+      // `approved_for_session`), per ADR 0007's off-by-default envelope.
+      return { approved: true, state: "approved" } as const;
+    case "deny":
+      return createDeniedPermissionDecision(verdict.reason);
+    case "defer":
+      return null;
+  }
+}

package/src/authority/authorizer-registry.ts

@@ -0,0 +1,69 @@
+/**
+ * Registry for named live-authority chain links (ADR 0007 §4).
+ *
+ * A downstream extension offers a named `Authorizer` link via
+ * `PermissionsService.registerAuthorizer`; this registry stores the link's
+ * `authorize` callback so composition can bind names to capabilities. One link
+ * per name; duplicate registration throws.
+ *
+ * Registration alone grants no authority — a link decides nothing until the
+ * operator names it in the `authorizerChain` config (the opt-in activation
+ * model). `AuthorizerSelection` owns that config-order resolution; this registry
+ * is storage only.
+ */
+
+import type { Authorizer } from "./authorizer";
+
+/**
+ * Read-only lookup used by chain composition (ISP — exposes only the read side,
+ * not the registration surface).
+ */
+export interface AuthorizerLookup {
+  get(name: string): Authorizer["authorize"] | undefined;
+}
+
+/**
+ * Registration side of the registry (ISP — exposes only the write surface,
+ * mirroring the read-only {@link AuthorizerLookup}).
+ */
+export interface AuthorizerRegistrar {
+  register(name: string, authorize: Authorizer["authorize"]): () => void;
+}
+
+/**
+ * Persistent registry mapping link names to their `authorize` callbacks.
+ *
+ * Owned by the extension factory (`index.ts`) so it survives across session
+ * activations. Exposed to sibling extensions via
+ * `PermissionsService.registerAuthorizer` and consulted by
+ * `AuthorizerSelection` during chain resolution.
+ */
+export class AuthorizerRegistry
+  implements AuthorizerLookup, AuthorizerRegistrar
+{
+  private readonly links = new Map<string, Authorizer["authorize"]>();
+
+  /**
+   * Register a link under `name`.
+   *
+   * Throws if a link is already registered for that name — keeps resolution
+   * deterministic (a pi-permission-system package priority). Returns a disposer
+   * that removes the link; the disposer is identity-guarded so a stale call
+   * cannot evict a later registration.
+   */
+  register(name: string, authorize: Authorizer["authorize"]): () => void {
+    if (this.links.has(name)) {
+      throw new Error(`An authorizer is already registered for '${name}'.`);
+    }
+    this.links.set(name, authorize);
+    return () => {
+      if (this.links.get(name) === authorize) {
+        this.links.delete(name);
+      }
+    };
+  }
+
+  get(name: string): Authorizer["authorize"] | undefined {
+    return this.links.get(name);
+  }
+}

package/src/authority/authorizer-selection.ts

@@ -1,10 +1,15 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
+import type { PermissionQuery } from "#src/service";
 import {
   type Authorizer,
   type AuthorizerSelectionDeps,
   selectAuthorizer,
+  type TerminalAuthorizer,
 } from "./authorizer";
+import { composeAuthorizerChain } from "./authorizer-chain";
+import type { AuthorizerLookup } from "./authorizer-registry";
+import { encloseInDelegationEnvelope } from "./delegation-envelope";
 import type {
   PermissionPrompterApi,
   PromptPermissionDetails,
@@ -49,38 +54,79 @@ export interface AskEscalator {
 export class AuthorizerSelection
   implements AskEscalator, AuthorizerSelectionLifecycle
 {
-  private selected: Authorizer | null = null;
+  private terminal: TerminalAuthorizer | null = null;
 
   constructor(
     private readonly deps: AuthorizerSelectionDeps & {
       prompter: PermissionPrompterApi;
+      /** The session-scoped query injected into each chain link (ADR 0007 §3). */
+      getPermissionQuery: () => PermissionQuery;
+      /** Read-only lookup of registered links by name. */
+      authorizerRegistry: AuthorizerLookup;
+      /** The operator's configured link names, read live per ask. */
+      getAuthorizerChain: () => string[];
     },
   ) {}
 
-  /** Select the Authorizer for `ctx` and store it. */
+  /**
+   * Select the terminal Authorizer for `ctx` and store it. The non-terminal
+   * chain is composed per ask in {@link escalate}, not here: ADR 0007 §4 lets a
+   * link register in a `permissions:ready` handler that may fire after
+   * activation, so link resolution is deferred to the session's first ask.
+   */
   activate(ctx: ExtensionContext): void {
-    this.selected = selectAuthorizer(ctx, this.deps);
+    this.terminal = selectAuthorizer(ctx, this.deps);
+  }
+
+  /**
+   * Resolve the operator's `authorizerChain` names to registered links, in
+   * config order (ADR 0007 invariant 1). An unregistered name is skipped with a
+   * warning (invariant 2 — more prompting, never less); each resolved link is
+   * wrapped in the bounded-delegation envelope so an `allow` on an excluded
+   * surface cannot exceed the operator's policy.
+   */
+  private resolveConfiguredLinks(): Authorizer[] {
+    const links: Authorizer[] = [];
+    for (const name of this.deps.getAuthorizerChain()) {
+      const authorize = this.deps.authorizerRegistry.get(name);
+      if (authorize === undefined) {
+        this.deps.logger.review("authorizer_chain_unregistered_link", { name });
+        continue;
+      }
+      links.push({ authorize: encloseInDelegationEnvelope(authorize) });
+    }
+    return links;
   }
 
   /** Clear the stored selection. */
   deactivate(): void {
-    this.selected = null;
+    this.terminal = null;
   }
 
   /**
-   * Escalate an ask to the selected authorizer and return its decision.
+   * Escalate an ask through the composed chain and return its decision.
+   *
+   * Resolves the configured links freshly (so a link registered any time before
+   * this first ask is honored) and composes them ahead of the selected
+   * terminal. With zero links the composed value **is** the terminal instance,
+   * so behavior is identical to a bare terminal escalation.
    *
-   * Rejects if no authorizer has been selected — i.e. before the session was
+   * Rejects if no terminal has been selected — i.e. before the session was
    * activated. Implements {@link AskEscalator}.
    */
   escalate(
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision> {
-    if (this.selected === null) {
+    if (this.terminal === null) {
       return Promise.reject(
         new Error("escalate called before the session was activated"),
       );
     }
-    return this.deps.prompter.prompt(this.selected, details);
+    const chain = composeAuthorizerChain(
+      this.resolveConfiguredLinks(),
+      this.terminal,
+      this.deps.getPermissionQuery(),
+    );
+    return this.deps.prompter.prompt(chain, details);
   }
 }

package/src/authority/authorizer.ts

@@ -6,6 +6,7 @@ import type {
 } from "#src/authority/permission-prompt-component";
 import type { SubagentSessionRegistry } from "#src/authority/subagent-registry";
 import type { PermissionEventBus } from "#src/permission-events";
+import type { PermissionQuery } from "#src/service";
 import type { DebugReviewLogger } from "#src/session-logger";
 import { ParentAuthorizer } from "./approval-escalator";
 import { DenyingAuthorizer } from "./denying-authorizer";
@@ -14,15 +15,41 @@ import type { PromptPermissionDetails } from "./permission-prompter";
 import type { SubagentDetector } from "./subagent-detection";
 
 /**
- * The live-authority role: on `ask`, an `Authorizer` rules on a single
- * request and is told the decision.
+ * A non-terminal chain link's ruling on an `ask`: decide (`allow`/`deny`) or
+ * pass the ask on to the next link (`defer`). A `deny` carries an optional
+ * teaching `reason` the invoking model sees, so it can self-correct.
+ */
+export type AuthorizerVerdict =
+  | { kind: "allow" }
+  | { kind: "deny"; reason?: string }
+  | { kind: "defer" };
+
+/**
+ * A non-terminal link in the live-authority chain: reviews an `ask` and may
+ * decide it or defer to the next link (ADR 0007). The chain injects a narrow,
+ * session-scoped {@link PermissionQuery} at `authorize` time (§3), so a link
+ * queries the deterministic engine at gate parity rather than reaching for the
+ * cross-extension service via `Symbol.for()`.
+ */
+export interface Authorizer {
+  authorize(
+    details: PromptPermissionDetails,
+    query: PermissionQuery,
+  ): Promise<AuthorizerVerdict>;
+}
+
+/**
+ * The terminal link: on `ask`, rules on a single request and is told the
+ * decision. Structurally cannot defer — it always returns a full
+ * {@link PermissionPromptDecision}, which is the type-level enforcement of
+ * ADR 0007's terminal-cannot-defer invariant.
  *
  * One method, one responsibility. `DenyingAuthorizer` ignores `details`;
  * `LocalUserAuthorizer` reads `message`/`sessionLabel` and derives the UI
  * event from it; `ParentAuthorizer` reads `message` and derives the
  * forwarded display from it.
  */
-export interface Authorizer {
+export interface TerminalAuthorizer {
   authorize(
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision>;
@@ -56,7 +83,7 @@ export interface AuthorizerSelectionDeps {
 export function selectAuthorizer(
   ctx: ExtensionContext,
   deps: AuthorizerSelectionDeps,
-): Authorizer {
+): TerminalAuthorizer {
   if (ctx.hasUI) {
     return new LocalUserAuthorizer({
       ui: ctx.ui,

package/src/authority/delegation-envelope.ts

@@ -0,0 +1,52 @@
+/**
+ * The bounded-delegation enforcement checkpoint (ADR 0007 §5).
+ *
+ * The chain owner caps every registered link's verdict so a buggy or over-eager
+ * external judge can never exceed the operator's policy: a link's `allow` on an
+ * excluded surface is downgraded to `defer`, letting the `ask` fall through to
+ * the terminal (a prompt) instead. The checkpoint only ever *tightens* a
+ * verdict — it never turns a `defer`/`deny` into an `allow`.
+ *
+ * The excluded set is the whole `path` surface plus `external_directory`. A
+ * finer secret-shaped-`path` exclusion (letting a link allow a non-secret path)
+ * is deferred to the allow-capable slice that needs it (#620); until then the
+ * conservative whole-surface exclusion ships. The checkpoint is dormant while
+ * the only registered links are deny-first (they never `allow`).
+ */
+
+import type { Authorizer } from "./authorizer";
+import type { PromptPermissionDetails } from "./permission-prompter";
+
+/** Surfaces on which a link may never grant an `allow` (ADR 0007 §5). */
+export const DELEGATION_EXCLUDED_SURFACES: ReadonlySet<string> = new Set([
+  "external_directory",
+  "path",
+]);
+
+/**
+ * Wrap a link's `authorize` so an `allow` on an excluded surface is capped to
+ * `defer`. All other verdicts, and `allow`s on non-excluded surfaces, pass
+ * through unchanged. `details` and the injected `query` are forwarded as-is.
+ */
+export function encloseInDelegationEnvelope(
+  authorize: Authorizer["authorize"],
+): Authorizer["authorize"] {
+  return async (details, query) => {
+    const verdict = await authorize(details, query);
+    if (verdict.kind === "allow" && isExcludedSurface(details)) {
+      return { kind: "defer" };
+    }
+    return verdict;
+  };
+}
+
+/**
+ * Whether the ask's surface is excluded from link grants. Reads the
+ * gate-authoritative `accessIntent.surface`, falling back to the display
+ * `surface`. Fail-safe: an ask whose surface cannot be determined is treated as
+ * excluded (more prompting, never less — ADR 0007 invariant 2).
+ */
+function isExcludedSurface(details: PromptPermissionDetails): boolean {
+  const surface = details.accessIntent?.surface ?? details.surface ?? undefined;
+  return surface === undefined || DELEGATION_EXCLUDED_SURFACES.has(surface);
+}

package/src/authority/denying-authorizer.ts

@@ -1,5 +1,5 @@
 import type { PermissionPromptDecision } from "#src/authority/permission-dialog";
-import type { Authorizer } from "./authorizer";
+import type { TerminalAuthorizer } from "./authorizer";
 
 /**
  * Least-privilege Authorizer: no authority is reachable for this session
@@ -9,7 +9,7 @@ import type { Authorizer } from "./authorizer";
  * distinguish "nobody could answer" from an interactive user denial when it
  * derives the review-entry and decision-event resolution.
  */
-export class DenyingAuthorizer implements Authorizer {
+export class DenyingAuthorizer implements TerminalAuthorizer {
   authorize(): Promise<PermissionPromptDecision> {
     return Promise.resolve({
       approved: false,

package/src/authority/local-user-authorizer.ts

@@ -14,7 +14,7 @@ import {
   type PermissionEventBus,
 } from "#src/permission-events";
 import { buildUiPrompt } from "#src/permission-ui-prompt";
-import type { Authorizer } from "./authorizer";
+import type { TerminalAuthorizer } from "./authorizer";
 import type { PromptPermissionDetails } from "./permission-prompter";
 
 /** Dependencies required by {@link LocalUserAuthorizer}. */
@@ -41,7 +41,7 @@ export interface LocalUserAuthorizerDeps {
  * class renders (populated `forwarding` context + "(Subagent)" title) so the
  * broadcast stays non-degraded (#292) without a second emission path.
  */
-export class LocalUserAuthorizer implements Authorizer {
+export class LocalUserAuthorizer implements TerminalAuthorizer {
   constructor(private readonly deps: LocalUserAuthorizerDeps) {}
 
   authorize(

package/src/authority/permission-prompter.ts

@@ -4,7 +4,7 @@ import type {
   ForwardedSessionApproval,
 } from "#src/authority/permission-forwarding";
 import type { ReviewLogger } from "#src/session-logger";
-import type { Authorizer } from "./authorizer";
+import type { TerminalAuthorizer } from "./authorizer";
 
 export type PermissionReviewSource = "tool_call" | "skill_input" | "skill_read";
 
@@ -69,7 +69,7 @@ export interface PromptPermissionDetails {
  */
 export interface PermissionPrompterApi {
   prompt(
-    authorizer: Authorizer,
+    authorizer: TerminalAuthorizer,
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision>;
 }
@@ -82,7 +82,7 @@ export interface PermissionPrompterDeps {
 
 /**
  * Brackets the ask-path flow with review-log entries and delegates the
- * live decision to the selected {@link Authorizer}:
+ * live decision to the selected {@link TerminalAuthorizer}:
  *   1. Review-log "waiting" entry.
  *   2. `authorizer.authorize(details)`.
  *   3. Review-log "approved" / "denied" entry.
@@ -100,7 +100,7 @@ export class PermissionPrompter implements PermissionPrompterApi {
   constructor(private readonly deps: PermissionPrompterDeps) {}
 
   async prompt(
-    authorizer: Authorizer,
+    authorizer: TerminalAuthorizer,
     details: PromptPermissionDetails,
   ): Promise<PermissionPromptDecision> {
     this.writeReviewEntry("permission_request.waiting", details);

package/src/config-loader.ts

@@ -231,10 +231,11 @@ export function mergeUnifiedConfigs(
   }
 
   // Array fields: override replaces base when defined
-  const piInfrastructureReadPaths =
-    override.piInfrastructureReadPaths ?? base.piInfrastructureReadPaths;
-  if (piInfrastructureReadPaths !== undefined) {
-    merged.piInfrastructureReadPaths = piInfrastructureReadPaths;
+  for (const key of ["piInfrastructureReadPaths", "authorizerChain"] as const) {
+    const value = override[key] ?? base[key];
+    if (value !== undefined) {
+      merged[key] = value;
+    }
   }
 
   // shellTools: shallow-merge by tool name so a project entry overrides a

package/src/config-schema.ts

@@ -206,6 +206,13 @@ export const unifiedConfigSchema = z
         "Additional directories to auto-allow for reads as Pi infrastructure, bypassing the `external_directory` gate.\n\nThe extension auto-discovers the global node_modules root (walks up from the extension's install path; falls back to `npm root -g` from a dev checkout), Pi's own install directory (via the coding-agent `getPackageDir()` API), `agentDir`, `agentDir/git`, and project-local `.pi/npm/` and `.pi/git/`. Add entries here for edge cases where auto-discovery is insufficient (e.g. custom `npmCommand` pointing to pnpm).\n\nSupports `~`/`$HOME` expansion. Entries may be plain directory prefixes or wildcard patterns using `*` (matches any characters, including `/`) and `?` (matches exactly one character). `**` and `*` are equivalent — both cross directory boundaries.\n\nOn Windows, matching is case-insensitive and tolerant of either path separator.",
       default: [],
     }),
+    authorizerChain: z.array(z.string().min(1)).optional().meta({
+      description:
+        "Ordered names of registered live-authority chain links to consult before the terminal authorizer. Config order (not registration order) fixes the chain order; an unregistered name is skipped fail-safe (more prompting, never less); a link decides nothing until it is named here.",
+      markdownDescription:
+        "Ordered names of registered **live-authority chain links** (e.g. a model judge) to consult before the terminal authorizer (the human, or the subagent-forwarding / headless-deny fallback).\n\nA link reviews an `ask` and returns `allow` / `deny` (with an optional teaching reason) / `defer` to the next link. Three invariants govern the chain:\n\n- **Config order wins.** The order here \u2014 not the order extensions register in \u2014 fixes the security-relevant chain order.\n- **Fail-safe skip.** A name with no registered link is skipped with a warning; the `ask` still reaches the terminal (more prompting, never less).\n- **Opt-in activation.** Installing a judge extension grants it no authority; a link decides nothing until you name it here.\n\nThe chain owner caps every verdict with a bounded-delegation checkpoint: a link's `allow` on an excluded surface (`external_directory` or `path`) is downgraded to `defer`, so a link cannot exceed your policy.\n\nDefaults to an empty list (no links).",
+      default: [],
+    }),
     permission: permissionSchema.optional(),
     shellTools: shellToolsSchema.optional(),
   })

package/src/extension-config.ts

@@ -23,6 +23,8 @@ export interface PermissionSystemExtensionConfig {
   toolTextSummaryMaxLength?: number;
   /** Non-bash tools that carry shell semantics, keyed by tool name. */
   shellTools?: ShellToolsConfig;
+  /** Ordered names of registered live-authority chain links to consult before the terminal authorizer. */
+  authorizerChain?: string[];
 }
 
 export const DEFAULT_EXTENSION_CONFIG: PermissionSystemExtensionConfig = {
@@ -75,6 +77,9 @@ export function normalizePermissionSystemConfig(
   if (raw.shellTools !== undefined) {
     result.shellTools = raw.shellTools;
   }
+  if (raw.authorizerChain !== undefined) {
+    result.authorizerChain = raw.authorizerChain;
+  }
   return result;
 }
 

package/src/index.ts

@@ -2,6 +2,7 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { getAgentDir, getPackageDir } from "@earendil-works/pi-coding-agent";
 import { warmBashParser } from "./access-intent/bash/parser";
 import { buildResolvedIntentFromMatchValues } from "./access-intent/input-normalizer";
+import { AuthorizerRegistry } from "./authority/authorizer-registry";
 import { AuthorizerSelection } from "./authority/authorizer-selection";
 import {
   ForwardedRequestServer,
@@ -64,6 +65,10 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   const formatterRegistry = new ToolInputFormatterRegistry();
   registerBuiltinToolInputFormatters(formatterRegistry);
   const accessExtractorRegistry = new ToolAccessExtractorRegistry();
+  // One registry instance backs both the registerAuthorizer service surface and
+  // AuthorizerSelection's chain resolution, so a registration is visible to
+  // composition.
+  const authorizerRegistry = new AuthorizerRegistry();
 
   // Both `configStore` and `session` are forward-declared so the logger's
   // lazy thunks can close over them without a cast or null-init holder.
@@ -108,6 +113,15 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     registry: subagentRegistry,
     logger,
     prompter,
+    // The published service is the narrow, session-scoped PermissionQuery a
+    // chain link is handed (it routes bash/path at gate parity against the live
+    // session cwd). A thunk because `permissionsService` is constructed below;
+    // it resolves at session_start (activate), well after assignment.
+    getPermissionQuery: () => permissionsService,
+    // Same registry instance the registerAuthorizer service surface writes to,
+    // resolved in config order at activation.
+    authorizerRegistry,
+    getAuthorizerChain: () => configStore.current().authorizerChain ?? [],
   });
 
   // Resolver composes the manager + session ruleset and owns the
@@ -174,6 +188,7 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     session,
     formatterRegistry,
     accessExtractorRegistry,
+    authorizerRegistry,
   );
 
   // Subscribe to @gotgenes/pi-subagents' child lifecycle events so child

package/src/permissions-service.ts

@@ -1,5 +1,7 @@
 import type { AccessIntent } from "./access-intent/access-intent";
 import { buildAccessIntentForSurface } from "./access-intent/input-normalizer";
+import type { Authorizer } from "./authority/authorizer";
+import type { AuthorizerRegistrar } from "./authority/authorizer-registry";
 import { resolveBashAdvisoryCheck } from "./bash-advisory-check";
 import type { PathNormalizer } from "./path-normalizer";
 import type { PermissionsService } from "./service";
@@ -44,6 +46,7 @@ export class LocalPermissionsService implements PermissionsService {
     private readonly session: PathNormalizerProvider,
     private readonly formatterRegistry: ToolInputFormatterRegistrar,
     private readonly accessExtractorRegistry: ToolAccessExtractorRegistrar,
+    private readonly authorizerRegistry: AuthorizerRegistrar,
   ) {}
 
   checkPermission(
@@ -87,4 +90,11 @@ export class LocalPermissionsService implements PermissionsService {
   ): ReturnType<PermissionsService["registerToolAccessExtractor"]> {
     return this.accessExtractorRegistry.register(toolName, extractor);
   }
+
+  registerAuthorizer(
+    name: string,
+    authorize: Authorizer["authorize"],
+  ): ReturnType<PermissionsService["registerAuthorizer"]> {
+    return this.authorizerRegistry.register(name, authorize);
+  }
 }

package/src/service.ts

@@ -11,10 +11,16 @@
  * reference — this ensures resilience across `/reload` and load-order edge cases.
  */
 
+import type { Authorizer } from "./authority/authorizer";
 import type { ToolAccessExtractor } from "./tool-access-extractor-registry";
 import type { ToolInputFormatter } from "./tool-input-formatter-registry";
 import type { PermissionCheckResult, PermissionState } from "./types";
 
+export type {
+  Authorizer,
+  AuthorizerVerdict,
+} from "./authority/authorizer";
+export type { PromptPermissionDetails } from "./authority/permission-prompter";
 export type {
   ForwardedPromptContext,
   PermissionDecisionEvent,
@@ -33,13 +39,12 @@ export type { PermissionCheckResult, PermissionState, ToolInputFormatter };
 const SERVICE_KEY = Symbol.for("@gotgenes/pi-permission-system:service");
 
 /**
- * Public interface exposed to other extensions via `getPermissionsService()`.
- *
- * `checkPermission` takes a surface + optional value + optional agent name,
- * and delegates to `PermissionManager.checkPermission()` with current session
- * rules internally.
+ * The narrow, read-only projection of {@link PermissionsService}: answer a
+ * policy query for a surface, and report a tool-level state. This is the
+ * capability an Authorizer chain link is handed (ISP) — it never sees the
+ * registration surface.
  */
-export interface PermissionsService {
+export interface PermissionQuery {
   /**
    * Query the permission policy for a surface and value.
    *
@@ -57,6 +62,28 @@ export interface PermissionsService {
     agentName?: string,
   ): PermissionCheckResult;
 
+  /**
+   * Query the tool-level permission state for pre-filtering tools before
+   * creating a child session.
+   *
+   * Returns `"deny"` | `"allow"` | `"ask"` based on the composed policy.
+   * Does not consider command-level rules (e.g. per-bash-command patterns) —
+   * use `checkPermission` for runtime invocation gates.
+   *
+   * @param toolName  - Tool name (e.g. `"bash"`, `"read"`, `"my-extension:tool"`).
+   * @param agentName - Optional agent name for per-agent policy resolution.
+   */
+  getToolPermission(toolName: string, agentName?: string): PermissionState;
+}
+
+/**
+ * Public interface exposed to other extensions via `getPermissionsService()`.
+ *
+ * `checkPermission` takes a surface + optional value + optional agent name,
+ * and delegates to `PermissionManager.checkPermission()` with current session
+ * rules internally.
+ */
+export interface PermissionsService extends PermissionQuery {
   /**
    * Register a custom preview formatter for a specific tool name.
    *
@@ -100,17 +127,28 @@ export interface PermissionsService {
   ): () => void;
 
   /**
-   * Query the tool-level permission state for pre-filtering tools before
-   * creating a child session.
+   * Register a named live-authority chain link (ADR 0007 §4).
    *
-   * Returns `"deny"` | `"allow"` | `"ask"` based on the composed policy.
-   * Does not consider command-level rules (e.g. per-bash-command patterns) —
-   * use `checkPermission` for runtime invocation gates.
+   * A link reviews an `ask` and returns `allow` / `deny` (with an optional
+   * teaching `reason`) / `defer`. It is handed a narrow, session-scoped
+   * {@link PermissionQuery} at `authorize` time so it can query the
+   * deterministic engine at gate parity. Register from a `permissions:ready`
+   * handler so registration is robust to load order and survives `/reload`.
    *
-   * @param toolName  - Tool name (e.g. `"bash"`, `"read"`, `"my-extension:tool"`).
-   * @param agentName - Optional agent name for per-agent policy resolution.
+   * Registration alone grants **no authority**: the link decides nothing until
+   * the operator names it in the `authorizerChain` config (opt-in activation),
+   * and the chain owner caps every verdict with the bounded-delegation
+   * checkpoint (an `allow` on an excluded surface downgrades to `defer`). Only
+   * one link may be registered per name — a second call for the same name
+   * throws. The returned disposer unregisters the link.
+   *
+   * @param name      - Operator-facing link name referenced from `authorizerChain`.
+   * @param authorize - The link's decision callback (`(details, query) => verdict`).
    */
-  getToolPermission(toolName: string, agentName?: string): PermissionState;
+  registerAuthorizer(
+    name: string,
+    authorize: Authorizer["authorize"],
+  ): () => void;
 }
 
 /**