@leonhardthust/dsh-decision-engine 1.9.1 → 1.9.2

package/docs/auto-review-hotfix.md

@@ -26,6 +26,27 @@
 - 用户提示为可读说明，机器码留在 reasonCode / denial info。
 - 旧记录证据不足时保持原样，不把 0ms 倒推为特定调用状态。
 
+## 1.9.1 实录复查与后续修正（未发布）
+
+按用户指定的北京时间 2026-11-15 00:30 起读取当前日志及 `.1` 轮转备份。首次完整提取快照有 182 条时间范围内记录，其中 39 条拒绝，JSON 均可解析。真实日志仅留在 Git 忽略目录，不提交会话标识、用户正文或工具参数。
+
+- 26 条 `unresolved-effect-needs-model-review`：primary 已运行，但非 Auto 分支把 unknown 无条件覆盖为 ask/deny，连 tolerance=delegate 也被拒绝。
+- 12 条 `advisory-failed-unknown-effect`：工作区 edit 已知 safe、四个核心信号有值，但 primary 解析失效；历史未记录具体 validation errors，不能反推原始错误分布。旧解析器确实会因附加 confidence/probabilities 校验失败使整体失效。
+- 1 条 `fallback-model-deny`：唯一一条实际调用独立回退模型后拒绝的记录，不能和其余 38 条混淆。
+- 5 条 MCP 拒绝中，4 条的 primary 与 tolerance 均已有有效 delegate，最终仍被 unknown 分支覆盖；另 1 条 primary 解析失败。5 条全部未请求 fallback。
+
+修正非 Auto 分支：有效 primary 与所选 tolerance 不再被 unknown 无条件覆盖；只有最终确实 ask 且 approval=never 才拒绝。Auto 不确定性仍独立复核，真实硬约束保持不变。
+
+附加概率和 confidence 元数据校验失败时只保留 warning 并弃用该元数据，不归一化、不用它抬高 severity，也不使有效必需信号整体失效；risk choice 或必需 noul 无效仍失败关闭。新审计记录 validationErrors、metadataWarnings、raw_class_probabilities，避免再只剩 answer-shape-mismatch。
+
+服务解析依据宿主源码：先用 agentPresets.serviceFor 读取确实存在的隔离 preset 实例；正常未覆盖时使用 actor.ctx 的共享基础服务。实例存在但方法返回 undefined 不再重试更宽全局实例；解析抛错保持不可用。回退 LLM 同样按 actor 解析。日志新增 permissionPreset、approvalPolicy、automatic 和 serviceSources。历史 39 条没有 permissionPreset，不能断言它们全因 Auto 识别错误造成。
+
+60 项匿名实录形状回归及包含作用域的 231 项组合回归通过；不是对原请求副作用的重放。全量 996 项中 993 通过、3 项失败，均为已有 Windows POSIX 文件权限断言。
+
+本地另对 39 条拒绝的已记录核心信号和阈值运行修正后的监听器，分手动 / Auto 两种显式场景共 78 次；手动场景 28 allow / 11 deny，Auto 场景在固定 LLM allow stub 下为 39 allow（31 次独立复核、8 次核心信号与软摩擦已允许的有限编辑）。这些计数不代表真实模型效果：历史 preset、完整参数与可选原始分布未完整保留，不重建或伪造；固定 stub 也不推翻原先那一次真实 fallback deny。仅验证 unknown 不再无条件覆盖有效判定，以及符合条件的 Auto 请求确实进入回退。原始实录与逐行回放仍在 Git 忽略目录。
+
+真实主端点探测在配置前置检查退出，没有发请求，没有更改用户配置；运行中的已发布 1.9.1 不会自动获得这些源码修正。
+
 ## 验证边界
 
 125 项专项回归、212 项组合回归通过；24 个独立合成情景的四档矩阵通过。组合之间有重叠，不相加成独立样本数。模型 stub 的 allow/deny/failure 仅验证路由不变量，不代表真实危险 FNR 或概率校准。

package/docs/releasing.md

@@ -1,14 +1,15 @@
 # npm 发布
 
-发布目标：`@leonhardthust/dsh-decision-engine`，当前版本 `1.9.1`，公开包。
+发布目标：`@leonhardthust/dsh-decision-engine`，当前版本 `1.9.2`，公开包。
 
 本分支基于 `zuosus/dsh-decision-engine` 的 MIT 代码，保留原作者与许可证；npm scope、源码仓库、bundle 引用和浏览器主模块 / charts chunk 标识已同步为本分支身份。内部 API、样式标识和用户数据目录保留旧名称以兼容已有配置。不要同时启用原包与本 scoped fork，它们提供相同的服务与页面。
 
 ## 工作流
 
 - `.github/workflows/ci.yml`：main push、PR、手动运行或发布工作流复用；Ubuntu 24.04 + Node.js 24 + Vite+ 1.6.0。执行 frozen install、完整测试与接线、隔离情景、实际打包和 tarball 检查。失败不会被忽略。
-- `.github/workflows/publish.yml`：版本 tag push 或 main 上手动运行。只有 `LeonhardtHUST/dsh-decision-engine` 可以进入发布；发布必须等待上述 CI 成功。
-- 手动运行必须填写与 manifest 完全一致的 `v1.9.1`。后续发版同步修改 manifest 与 tag。预发布版本不能覆盖 npm `latest`。
+- `.github/workflows/publish.yml`：每次 `main` push 自动检测版本。先比较整个 push 的 `before` 与当前 manifest，拒绝错误包名、非法或倒退版本；再只读查询 npmjs。当前版本已上传则跳过；当前版本高于 npmjs latest 且未上传则进入完整验证及发布。多提交 push 比较整个 push 前后，不仅比较 HEAD 的父提交。
+- 后续发版只需修改 `package.json` 版本并提交到 main；无需创建 tag 或手动点运行。发布依赖检测和本次提交的完整 CI 均成功，不跳过测试。稳定版本发布到 `latest`，预发布版本自动进入 `next`。
+- 当前 `1.9.2` 包含实录 MCP 误拒、附加元数据校验和 actor/preset 服务解析修复；边界见 `docs/auto-review-hotfix.md`。
 - checkout 与 setup-vp Action 固定到已核对的 commit SHA；不通过 `pull_request_target` 运行不可信 PR。
 - 验证任务只有 `contents: read`；只有发布 job 有 `id-token: write`。发布 step 只使用 OIDC（trusted publishing），不再读取任何 npm token secret。代码 checkout 不保留 Git 凭据。此工作流不会自动修改版本、提交源码或推送 Git。
 
@@ -41,7 +42,6 @@ vp run verify
 vp run verify:guard
 vp run pack:release
 vp run verify:package
-$env:RELEASE_TAG = "v1.9.1"
 vp run verify:release
 ```
 
@@ -49,7 +49,7 @@ vp run verify:release
 
 `verify:package` 读取真正的 gzip/tar，检查 manifest、scoped 模块 id、bundle 引用、全部安全模块、locale、图表资源和相对 import。配置、凭据、日志、测试目录等不能进入包。输出文件数、大小和 SHA-512 integrity。
 
-当前 Windows 完整测试的 5 个基线失败及安全边界见 `bench/guard-revision/validation.md`（仅在源码仓库保留完整证据）。发布 CI 选择 Linux，依然必须运行完整测试，不跳过或忽略它们；本机专测通过不等同于 CI 发布成功。
+Windows 全量测试最近仍有 3 个既有 POSIX 文件权限断言失败；旧验证检查点及安全边界见 `bench/guard-revision/validation.md` 与 `docs/auto-review-hotfix.md`（完整证据仅在源码仓库保留）。发布 CI 选择 Linux，依然必须运行完整测试，不跳过或忽略它们；本机专测通过不等同于 CI 发布成功。
 
 ## 手动发布相同的已验证 tarball
 
@@ -58,12 +58,12 @@ vp run verify:release
 授权及完整验证均满足后：
 
 ```powershell
-npm publish ./release-artifacts/leonhardthust-dsh-decision-engine-1.9.1.tgz --registry "https://registry.npmjs.org/" --access public --tag latest
+npm publish ./release-artifacts/leonhardthust-dsh-decision-engine-1.9.2.tgz --registry "https://registry.npmjs.org/" --access public --tag latest
 npm view @leonhardthust/dsh-decision-engine version --registry "https://registry.npmjs.org/" --json
 ```
 
-本地发布不伪造 GitHub provenance；在 GitHub Actions 中由工作流增加 `--provenance`。发布操作不可覆盖已存在的同版本；版本冲突必须停止，不自动递增重试。
+本地发布不伪造 GitHub provenance；在 GitHub Actions 中由工作流增加 `--provenance`。发布操作不可覆盖已存在的同版本；已发布版本的后续提交会跳过发布。若升版后的 CI 失败，修复代码并推送 main 会自动重试仍未发布的版本，无需再升版或手动触发。npmjs 查询错误会停止，不能把网络或权限错误当成未发布。自动检测不自动修改版本或源码。
 
 ## 安装
 
-DSH 插件管理中使用 `@leonhardthust/dsh-decision-engine` 或指定 `@leonhardthust/dsh-decision-engine@1.9.1`。安装和启用是另外的用户动作，发布工作流不会修改本机 DSH profile。
+DSH 插件管理中使用 `@leonhardthust/dsh-decision-engine` 或指定 `@leonhardthust/dsh-decision-engine@1.9.2`。安装和启用是另外的用户动作，发布工作流不会修改本机 DSH profile。

package/lib/guard/advisory.js

@@ -2,6 +2,7 @@ export const GUARD_QUESTIONS_VERSION = "guard-questions-v2";
 export const CONFIDENCE_KINDS = ["normalized", "provider_raw", "unavailable"];
 
 const probability = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= 1;
+const finite = (value) => typeof value === "number" && Number.isFinite(value);
 
 export function guardQuestions() {
   return {
@@ -31,26 +32,42 @@ export function guardQuestions() {
 
 export function parseModelAdvisory(answers, options = {}) {
   const errors = [];
+  const warnings = [];
   const source = answers && typeof answers === "object" && !Array.isArray(answers) ? answers : {};
   const risk = source.risk;
   const choice = risk?.type === "choice" && ["low", "medium", "high"].includes(risk.choice) ? risk.choice : "unknown";
   if (choice === "unknown") errors.push("risk-choice-unavailable");
   const declaredKind = risk?.confidenceKind ?? options.confidenceKind ?? "unavailable";
-  const confidenceKind = CONFIDENCE_KINDS.includes(declaredKind) ? declaredKind : "unavailable";
-  if (!CONFIDENCE_KINDS.includes(declaredKind)) errors.push("confidence-kind-invalid");
-  const confidence = typeof risk?.confidence === "number" && Number.isFinite(risk.confidence) ? risk.confidence : null;
-  if (risk?.confidence !== undefined && confidence === null) errors.push("confidence-invalid");
-  if (confidenceKind === "normalized" && !probability(confidence)) errors.push("normalized-confidence-out-of-range");
-  if (confidenceKind === "provider_raw" && confidence === null) errors.push("provider-confidence-unavailable");
-  let probabilities = null;
-  if (risk?.probabilities !== undefined) {
-    const values = risk.probabilities;
-    if (values && typeof values === "object" && !Array.isArray(values)
-      && ["low", "medium", "high"].every((key) => probability(values[key]))
-      && Math.abs(values.low + values.medium + values.high - 1) <= 1e-6) {
-      probabilities = { low: values.low, medium: values.medium, high: values.high };
-    } else errors.push("class-probabilities-invalid");
+  let confidenceKind = CONFIDENCE_KINDS.includes(declaredKind) ? declaredKind : "unavailable";
+  if (!CONFIDENCE_KINDS.includes(declaredKind)) warnings.push("confidence-kind-invalid");
+  const confidence = finite(risk?.confidence) ? risk.confidence : null;
+  if (risk?.confidence !== undefined && confidence === null) warnings.push("confidence-invalid");
+  if (confidenceKind === "normalized" && !probability(confidence)) {
+    warnings.push("normalized-confidence-out-of-range");
+    confidenceKind = "unavailable";
   }
+  if (confidenceKind === "provider_raw" && confidence === null) {
+    warnings.push("provider-confidence-unavailable");
+    confidenceKind = "unavailable";
+  }
+  let distribution = null;
+  let probabilityStatus = "unavailable";
+  const supplied = risk?.probabilities;
+  if (supplied !== undefined) {
+    if (supplied && typeof supplied === "object" && !Array.isArray(supplied)
+      && ["low", "medium", "high"].every((key) => probability(supplied[key]))
+      && Math.abs(supplied.low + supplied.medium + supplied.high - 1) <= 1e-6) {
+      distribution = { low: supplied.low, medium: supplied.medium, high: supplied.high };
+      probabilityStatus = "validated-distribution";
+    } else {
+      warnings.push("class-probabilities-invalid");
+      probabilityStatus = "invalid-distribution";
+    }
+  }
+  const rawProbabilities = supplied && typeof supplied === "object" && !Array.isArray(supplied)
+    ? Object.fromEntries(["low", "medium", "high"].map((key) => [key, finite(supplied[key]) ? supplied[key] : null])) : null;
+  const probabilities = warnings.length ? null : distribution;
+  if (distribution && warnings.length) probabilityStatus = "ignored-metadata-warning";
   const scalar = (name) => {
     const answer = source[name];
     if (answer?.type !== "noul" || !probability(answer.noul)) {
@@ -67,18 +84,16 @@ export function parseModelAdvisory(answers, options = {}) {
     risk: { choice, confidence, confidenceKind, ...(probabilities ? { probabilities } : {}) },
     irreversibleP, taskP, injectionP,
     metadata: {
-      questionsVersion: GUARD_QUESTIONS_VERSION,
-      confidenceKind,
+      questionsVersion: GUARD_QUESTIONS_VERSION, confidenceKind,
       raw_decision_confidence: confidence,
+      raw_class_probabilities: rawProbabilities,
       class_probabilities: probabilities ?? "unknown",
       p_high: probabilities?.high ?? null,
       p_non_low: probabilities ? probabilities.medium + probabilities.high : null,
-      calibrated_p_unsafe: "unknown",
-      authorization_status: "unknown",
-      source_trust: "unknown",
-      probabilityStatus: probabilities ? "validated-distribution" : "unavailable",
+      calibrated_p_unsafe: "unknown", authorization_status: "unknown", source_trust: "unknown",
+      probabilityStatus, warnings, validationErrors: errors,
     },
-    errors,
+    errors, warnings,
   };
 }
 

package/lib/guard/audit.js

@@ -55,10 +55,14 @@ export function createGuardAudit(options = {}) {
       p_non_low: finite(advisory.metadata?.p_non_low),
       irreversibleP: finite(advisory.irreversibleP), taskP: finite(advisory.taskP), injectionP: finite(advisory.injectionP),
       calibrated_p_unsafe: "unknown",
+      validationErrors: advisory.errors ?? [],
+      metadataWarnings: advisory.metadata?.warnings ?? [],
+      probabilityStatus: advisory.metadata?.probabilityStatus ?? "unavailable",
+      raw_class_probabilities: advisory.metadata?.raw_class_probabilities ?? null,
     },
     mandatory: { status: ["safe", "requires_approval", "deny", "unknown"].includes(mandatory.status) ? mandatory.status : "unknown", reasonCodes: mandatory.reasonCodes ?? [], evidence_summary: hashSummary(mandatory.evidence) },
     effect: { kind: effect.kind ?? "unknown", highImpact: effect.highImpact ?? "unknown", summary: hashSummary(effect) },
-    permission: { approvalPolicy: context.approvalPolicy ?? "unknown", approvalAvailable: context.approvalAvailable ?? "unknown", sandboxMode: context.sandboxMode ?? "unknown" },
+    permission: { permissionPreset: context.permissionPreset ?? "unknown", serviceSources: context.serviceSources ?? {}, approvalPolicy: context.approvalPolicy ?? "unknown", approvalAvailable: context.approvalAvailable ?? "unknown", sandboxMode: context.sandboxMode ?? "unknown" },
     baseAction: actionOf(options.baseAction),
     tolerance: { level: options.tolerance?.level ?? "unknown", changed: options.tolerance?.changed ?? "unknown", action: actionOf(options.tolerance?.kind), severity: finite(options.tolerance?.severity), severityMeaning: "ranking-score-not-calibrated-probability" },
     pluginReturnedAction: actionOf(options.pluginReturnedAction),

package/lib/guard/context.js

@@ -2,12 +2,29 @@ import { createHash } from "node:crypto";
 
 export const TRUSTED_CONTEXT_VERSION = "guard-context-v1";
 
-function service(ctx, name) {
-  try {
-    return ctx?.get?.(name);
-  } catch {
+function rootService(ctx, name) {
+  try { return ctx?.get?.(name); } catch { return undefined; }
+}
+
+export function guardService(ctx, agent, name, sources = {}) {
+  const actor = agent?.ctx;
+  if (actor) {
+    const presets = rootService(ctx, "agentPresets");
+    if (typeof presets?.serviceFor === "function") {
+      try {
+        const scoped = presets.serviceFor(agent, name);
+        if (scoped !== undefined) { sources[name] = "preset"; return scoped; }
+      } catch { sources[name] = "preset-error"; return undefined; }
+    }
+    if (typeof actor.get === "function") {
+      try { sources[name] = "actor-host"; return actor.get(name); }
+      catch { sources[name] = "actor-error"; return undefined; }
+    }
+    sources[name] = "actor-unavailable";
     return undefined;
   }
+  sources[name] = "legacy-host";
+  return rootService(ctx, name);
 }
 
 function textOf(message) {
@@ -40,7 +57,9 @@ export async function buildTrustedContext({ agent, ctx, exec, host = {}, downstr
     messageTarget: { id: "unknown", membership: "unknown", continuable: "unknown", permissions: "unknown", downstreamIndependentApproval: "unknown" },
     availability,
     evidence,
+    serviceSources: {},
   };
+  const scopedService = (name) => guardService(ctx, agent, name, context.serviceSources);
   const read = async (field, operation) => {
     try {
       const value = await operation();
@@ -62,32 +81,32 @@ export async function buildTrustedContext({ agent, ctx, exec, host = {}, downstr
       availability.originalUserGoal = { available: false, reason: "no-host-user-message" };
     }
   }
-  const presets = service(ctx, "permissionPresets");
+  const presets = scopedService("permissionPresets");
   const presetName = await read("permissionPreset", () => session && presets?.current?.(session));
   if (typeof presetName === "string") context.permissionPreset = presetName;
   const preset = await read("permissionBundle", () => presetName && presets?.resolve?.(presetName));
-  const approval = service(ctx, "approval");
+  const approval = scopedService("approval");
   const override = await read("approvalOverride", () => session && approval?.overrideOf?.(session));
   const policy = override ?? preset?.approval;
   if (policy === "ask" || policy === "never") context.approvalPolicy = policy;
   context.approvalAvailable = policy === "never" ? false
     : policy === "ask" && typeof approval?.request === "function" ? true : "unknown";
   availability.approvalPolicy = { available: context.approvalPolicy !== "unknown", reason: override !== undefined ? "host-session-override" : preset?.approval ? "host-preset" : "host-default-unavailable" };
-  const sandboxPolicy = service(ctx, "sandboxPolicy");
+  const sandboxPolicy = scopedService("sandboxPolicy");
   const sandbox = await read("sandboxPolicy", () => session && sandboxPolicy?.resolve?.({ session }));
   const sandboxMode = sandbox?.mode ?? preset?.sandbox;
   if (["read-only", "workspace-write", "danger-full-access"].includes(sandboxMode)) context.sandboxMode = sandboxMode;
   if (typeof sandbox?.workspaceRoot === "string") {
     context.workspaceRoots = [sandbox.workspaceRoot, ...(sandbox.additionalWritableRoots ?? []).filter((root) => typeof root === "string")];
   }
-  const tools = service(ctx, "tools");
+  const tools = scopedService("tools");
   if (typeof tools?.executable === "function" && exec?.name) {
     const definition = await read("toolAccess", () => tools.executable(exec.name, agent, exec.toolSet));
     context.toolAccess = availability.toolAccess.available ? "available" : availability.toolAccess.reason === "host-field-unavailable" ? "denied" : "unknown";
     if (definition) evidence.push({ source: "tools.executable", field: "toolAccess", value: "available" });
   }
   const args = exec?.arguments;
-  const fs = service(ctx, "fs");
+  const fs = scopedService("fs");
   if (["write", "edit"].includes(exec?.name) && typeof args?.file_path === "string" && context.workspaceRoots.length && typeof fs?.resolve === "function" && typeof fs?.contains === "function") {
     const contained = await read("fileTargetScope", async () => {
       const target = await fs.resolve(args.file_path, { cwd: context.workspaceRoots[0], signal: exec.signal });
@@ -100,7 +119,7 @@ export async function buildTrustedContext({ agent, ctx, exec, host = {}, downstr
     }
   }
   if (exec?.name === "send_message" && typeof args?.agent === "string") {
-    const subagents = service(ctx, "subagents");
+    const subagents = scopedService("subagents");
     const target = await read("messageTarget", async () => {
       if (!agent || typeof subagents?.rootOf !== "function" || typeof subagents?.resolveName !== "function" || typeof subagents?.listDescendants !== "function") return undefined;
       const root = subagents.rootOf(agent);
@@ -110,7 +129,7 @@ export async function buildTrustedContext({ agent, ctx, exec, host = {}, downstr
       const descendants = await subagents.listDescendants(rootId, exec.signal);
       const member = descendants.find((entry) => entry.kind === "child" && entry.id === targetId && entry.mode === "continuable");
       const verified = targetId === rootId || Boolean(member);
-      const resident = targetId === rootId ? root : service(ctx, "agents")?.get?.(targetId);
+      const resident = targetId === rootId ? root : scopedService("agents")?.get?.(targetId);
       const hostLocal = (resident?.id ?? resident?.session?.id) === targetId;
       return { id: targetId, membership: verified ? "same-tree" : "unknown", continuable: verified ? true : "unknown", hostLocal, permissions: "unknown", downstreamIndependentApproval: verified && hostLocal && downstreamPolicyEnforced === true ? true : "unknown" };
     });

package/lib/guard/listener.js

@@ -1,4 +1,4 @@
-import { buildTrustedContext } from "./context.js";
+import { buildTrustedContext, guardService } from "./context.js";
 import { classifyToolEffect } from "./effects.js";
 import { evaluateMandatoryPolicy } from "./policy.js";
 import { GUARD_QUESTIONS_VERSION, guardQuestions, parseModelAdvisory, decideModelAdvisory } from "./advisory.js";
@@ -85,13 +85,14 @@ export function mountGuard(ctx, deps) {
     const runFallback = async () => {
       const started = Date.now();
       let llm;
-      try { llm = ctx.get?.("llm"); } catch { llm = undefined; }
+      const serviceSources = {};
+      llm = guardService(ctx, exec.agent, "llm", serviceSources);
       fallback = await reviewWithFallback({ config, context, mandatory: config.guardPolicyMode === "observe" ? undefined : mandatory, state, advisory, session, llm, signal: exec.signal });
       decisionSource = ["allow", "deny"].includes(fallback.fallback) ? "fallback_policy" : "fallback_model";
       secondary = {
         status: fallback.selection ? (fallback.reason === "fallback-review-failed" || fallback.kind === "cancel" ? "failed" : "completed") : "not_requested",
         provider: identityOrNull(fallback.selection?.provider), model: identityOrNull(fallback.selection?.model),
-        latencyMs: fallback.selection ? Date.now() - started : null, reason: fallback.reason,
+        latencyMs: fallback.selection ? Date.now() - started : null, reason: fallback.reason, serviceScope: serviceSources.llm ?? "unavailable",
       };
       return fallback;
     };
@@ -122,7 +123,9 @@ export function mountGuard(ctx, deps) {
         try { client.recordDecision({ facts: result.statsFacts, action: action.kind, detail: action.reason, degraded: Boolean(degradedReason) }); }
         catch { ctx.logger?.warn?.("decision-engine: guard statistics unavailable"); }
       }
+      const reviewMode = { automatic: automaticReview(context, config), permissionPreset: context?.permissionPreset ?? "unknown", approvalPolicy: context?.approvalPolicy ?? "unknown", approvalAvailable: context?.approvalAvailable ?? "unknown", sandboxMode: context?.sandboxMode ?? "unknown", serviceSources: context?.serviceSources ?? {} };
       const scores = {
+        reviewMode,
         risk_p: advisory?.risk?.confidence ?? null, raw_decision_confidence: advisory?.risk?.confidence ?? null,
         confidenceKind: advisory?.risk?.confidenceKind ?? "unavailable", p_high: advisory?.risk?.probabilities?.high ?? null,
         p_non_low: advisory?.risk?.probabilities ? advisory.risk.probabilities.high + advisory.risk.probabilities.medium : null,
@@ -182,7 +185,7 @@ export function mountGuard(ctx, deps) {
       try {
         result = await client.classify({ point: "authorize", tag: "guard", mode: config.mode, pointMode, tool: exec.name, state, questions, signal: exec.signal });
         advisory = result && !result.degraded ? parseModelAdvisory(result.answers) : undefined;
-        primary = { status: advisory?.status === "valid" ? (result.cached ? "cache_hit" : "completed") : "failed", provider: identityOrNull(result?.provider), model: identityOrNull(result?.model), latencyMs: numberOrNull(result?.latencyMs) ?? Date.now() - primaryStarted, reason: result?.degraded ?? (advisory?.status === "valid" ? null : "answer-shape-mismatch") };
+        primary = { status: advisory?.status === "valid" ? (result.cached ? "cache_hit" : "completed") : "failed", provider: identityOrNull(result?.provider), model: identityOrNull(result?.model), latencyMs: numberOrNull(result?.latencyMs) ?? Date.now() - primaryStarted, reason: result?.degraded ?? (advisory?.status === "valid" ? null : "answer-shape-mismatch"), validationErrors: advisory?.errors ?? [], metadataWarnings: advisory?.metadata?.warnings ?? [], probabilityStatus: advisory?.metadata?.probabilityStatus ?? "unavailable" };
       } catch {
         primary = { ...idleEvaluation(), status: "failed", latencyMs: Date.now() - primaryStarted, reason: "primary-review-exception" };
       }
@@ -198,8 +201,10 @@ export function mountGuard(ctx, deps) {
       const unresolved = mandatory.status === "unknown";
       if (automaticReview(context, config) && (unresolved || baseAction.kind === "ask" || action.kind === "ask" || primary.status === "failed")) {
         action = await runFallback();
-      } else if (unresolved || primary.status === "failed") {
-        action = { kind: context.approvalAvailable === true ? "ask" : "deny", reason: unresolved ? "unresolved-effect-needs-model-review" : "advisory-failed-unknown-effect" };
+      } else if (primary.status === "failed") {
+        action = { kind: context.approvalAvailable === true ? "ask" : "deny", reason: "advisory-failed-unknown-effect" };
+      } else if (action.kind === "ask" && context.approvalPolicy === "never") {
+        action = { ...action, kind: "deny" };
       }
       return finish(action, degradedReason);
     } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leonhardthust/dsh-decision-engine",
-  "version": "1.9.1",
+  "version": "1.9.2",
   "description": "dsh-decision-engine: a cheap judgement layer for DeepSeek Harness — a small decision model answers structured questions before the main model acts, so calls can be allowed, escalated, rerouted to a cheaper model, or skipped. All eight decision points (tool authorization, model routing, delegation, compaction, turn continuation, retrieval, skill pick, COT translation) are implemented and individually switchable. Works against any service exposing a decision endpoint: built-in presets (system one, bamboonode, SiliconFlow, Silicon Flow) or a custom base URL.",
   "icon": "./icon.svg",
   "type": "module",