pi-verdict 0.11.0 → 0.12.0

package/README.md

@@ -8,7 +8,7 @@
 
 **pi-verdict is a minimal permission gate for [pi](https://pi.dev) in the style of Claude Code's auto mode: every tool call gets checked before it runs — allow, deny, or ask you first.**
 
-- Minimal — just 1k+ lines of code
+- Minimal — just 2k lines of code
 - Built-in danger rules and your own allow/deny rules settle the clear cases first, at zero latency
 - Everything else goes to a model classifier that sees the conversation context
 - Any uncertainty or failure fails closed; nothing ever runs silently
@@ -69,7 +69,7 @@ pi-verdict runs on both [pi](https://github.com/badlogic/pi-mono) and [oh-my-pi]
 | user rules | `~/.pi/agent/config/pi-verdict.json` | `~/.omp/agent/config/pi-verdict.json` |
 | credential file (S0 hard deny) | `~/.pi/agent/auth.json` | `~/.omp/agent/auth.json` |
 
-- `/automode` — show current status: on/off + shadow-cache stats for the session
+- `/automode` — show current status: on/off
 - `/automode on`
 - `/automode off`
 - `ctrl+shift+a` — toggle the master switch silently (the always-on footer is the only feedback; rebind or disable via `toggleShortcut`)
@@ -97,6 +97,12 @@ pi-verdict runs on both [pi](https://github.com/badlogic/pi-mono) and [oh-my-pi]
     "~/.zshrc",
     "~/.bashrc"
   ],
+  "ignoreTools": [
+    "todo",
+    "ask_user_question",
+    "memory_write",
+    "memory_search"
+  ],
   "builtinDenyFloor": true,
   "classifierModel": null,
   "toggleShortcut": "ctrl+shift+a",
@@ -104,18 +110,19 @@ pi-verdict runs on both [pi](https://github.com/badlogic/pi-mono) and [oh-my-pi]
   "notifyAllows": false,
   "classifierMinConfidence": null,
   "classifierFallbackModel": null,
-  "classifierFallbackMode": "shadow"
+  "classifierFallbackMode": "enforce"
 }
 ```
 
 - `allow`/`deny` are JS regex arrays; **`deny` wins over `allow`**, both beat the classifier
-- `denyPaths` are plain paths you declare **protected** — touches trigger a terminal ask you adjudicate (non-interactive → deny); the classifier never learns the paths themselves, only that they exist. `grep`/`find`/`ls` compare their whole **search scope**: an omitted `path` (pi's default: the current directory) or a parent directory of a declared path triggers the ask as well. A fresh install pre-fills a **starter list** (`~/.ssh/`, `~/.gnupg`, `~/.mc`, shell rc/profile files), active from the first session after the initial run (any config change applies to new sessions) — a pre-filled *user declaration*, not a built-in floor: edit or empty it freely, add your own (`~/Documents/private`, …) alongside; existing configs are never rewritten
+- `denyPaths` are plain paths you declare **protected** — touches trigger a terminal ask you adjudicate (non-interactive → deny); the classifier never learns the paths themselves, only that they exist. `grep`/`find`/`ls` compare their whole **search scope**: an omitted `path` (pi's default: the current directory) or a parent directory of a declared path triggers the ask as well. A fresh install pre-fills a **starter list** (`~/.ssh/`, `~/.gnupg`, `~/.mc`, shell rc/profile files)
+- `ignoreTools` names uncovered tools (`todo`, `web_search`, MCP/custom tools) that skip adjudication — **allow with zero model calls**; entries naming covered tools (`bash`/`read`/`write`/`edit`/`grep`/`find`/`ls`/`powershell`) are inert: those stay governed by the deny floor and your allow/deny rules, and the self-protection layer always runs first. A fresh install pre-fills a **starter list** (`todo`, `ask_user_question`, `memory_write`, `memory_search` — observed harmless across the 1265-verdict production audit). Caveat: an exempted tool loses the classifier's `denyPaths` existence-hint vigilance (uncovered tools never hit the path extractor anyway)
 - `builtinDenyFloor: false` turns off the built-in danger/path floor (your risk; the self-protection layer below always stays on)
 - `classifierModel` pins the classifier model, e.g. `"zai/glm-5.3-flash:low"` (thinking suffix supported; default: session model with thinking off)
 - `classifierModel: "typesafe/jev-latest"` opts into the bundled **jev decisions adapter** — gray-zone verdicts via TypeSafe's jev (OpenRouter by default, or TypeSafe's official API directly with `PI_VERDICT_JEV_TRANSPORT=typesafe`); experimental, see [ADR-0003](docs/adr/0003-jev-decisions-adapter.md)
 - `audit: true` records every **gray-zone adjudication** (the full transcript sent to the classifier, its raw response, the parsed verdict) as JSONL under `~/.pi/agent/verdicts/<sessionId>.jsonl` — one file per session, the 20 most recent kept. Interactive asks also record your answer (`userAnswer` ground truth, written after the confirm resolves), and protected-path asks are recorded too (#62); rule allow/deny stays unaudited. Local-only and full-fidelity (protected-path plaintext may appear — it never leaves your machine; [ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) boundary note); the agent can neither read nor write the directory. `/automode` shows the audit state and path while on
-- `notifyAllows: true` notifies on every **classifier allow** (reason + action line — e.g. jev's probability breakdown); default `false` keeps passes silent. Mechanical passes (your own allow rules, protected-path confirms) never notify; shadow-cache annotations stay debug-only; with both switches on the notification appears once
-- `classifierMinConfidence` (optional, [ADR-0004](docs/adr/0004-classifier-fallback-cascade.md)) sets the **confidence floor**: a jev verdict below it is demoted — cascaded to `classifierFallbackModel` if set (`shadow` = the second layer records its opinion and you are asked; `enforce` = the second layer adjudicates, except a demoted deny can never be auto-allowed), otherwise asked of you directly. At/above the floor the first layer is autonomous. A natural pairing: jev first + a haiku-class fallback
+- `notifyAllows: true` notifies on every **classifier allow** (reason + action line — e.g. jev's probability breakdown); default `false` keeps passes silent. Mechanical passes (your own allow rules, protected-path confirms) never notify; with both switches on the notification appears once
+- `classifierMinConfidence` (optional, [ADR-0004](docs/adr/0004-classifier-fallback-cascade.md)) sets the **confidence floor**: a jev verdict below it is demoted — cascaded to `classifierFallbackModel` if set (`enforce`, the default = the second layer adjudicates, except a demoted **deny or ask** can never be auto-relaxed to an allow — a fail-closed layer emitted no verdict, so its rescue stands; `shadow` = records its opinion only and you are asked — `/automode` hints the activation switch), otherwise asked of you directly. At/above the floor the first layer is autonomous. A natural pairing: jev first + a haiku/flash-class fallback
 
 No built-in allowlist — every "always allow" claim is yours ([why](docs/configuration.md#why-no-built-in-allowlist)). Full reference: [docs/configuration.md](docs/configuration.md).
 
@@ -134,7 +141,7 @@ No built-in allowlist — every "always allow" claim is yours ([why](docs/config
 - **Hosts**: pi only. On omp the setting warns and falls back to the session model; and it must never be selected as the session model (no text generation — selecting it warns)
 - **Escape hatch**: `PI_VERDICT_JEV_URL` overrides the active transport's endpoint (OpenRouter's is an alpha API)
 
-jev's calibrated confidence is exactly what the confidence floor keys on — pair it with a second layer (`"classifierMinConfidence": 50, "classifierFallbackModel": "anthropic/claude-haiku-4-5"`) so its low-confidence calls go to a deeper model instead of standing ([ADR-0004](docs/adr/0004-classifier-fallback-cascade.md)).
+jev's calibrated confidence is exactly what the confidence floor keys on — pair it with a second layer (`"classifierMinConfidence", "classifierFallbackModel"`) so its low-confidence calls go to a deeper model instead of standing ([ADR-0004](docs/adr/0004-classifier-fallback-cascade.md)).
 
 ### Self-protection (the gate guards itself — [ADR-0001](docs/adr/0001-self-protection-layer.md))
 
@@ -145,6 +152,8 @@ The gate's own files — the config and the installed extension copy — are **u
 
 Requires pi ≥ 0.84. Works in interactive and non-interactive (`-p`/json/rpc) sessions; in non-interactive modes `ask` degrades to `deny`.
 
+---
+
 ## How it compares
 
 | | three-state verdict | classifier sees context | fail direction | runtime deps |
@@ -173,6 +182,7 @@ tool_call
   │     ├─ your rules: user deny beats user allow
   │     ├─ denyPaths (ADR-0002): protected paths → terminal ask,
   │     │   before user allow; classifier sees an existence hint only
+  │     ├─ ignoreTools: your declared uncovered tools → allow, zero model calls
   │     └─ no built-in allowlist — every "always allow" claim is yours to make
   │
   ├─ 2. Gray zone → model classifier (defaults to session model — "self-reflection")
@@ -185,7 +195,6 @@ tool_call
         ├─ deny  → block, reason returned to the agent
         └─ ask   → human confirm; non-interactive modes degrade to deny
 
-  [shadow cache] observe-only telemetry alongside 2/3, never changes a verdict
 ```
 
 **fail-closed**: classifier exception / timeout (25s) / contract violation → deny. Never silently allow.
@@ -194,7 +203,7 @@ tool_call
 
 Design decisions here are settled by measurement, and the lab notes ship with the repo:
 
-- [`research/cache-sim`](research/cache-sim/README.md) — replayed 1.2k+ real classifier verdicts to measure verdict-cache hit rate (**3.2%** → cache deferred, shadow-mode telemetry built instead)
+- [`research/cache-sim`](research/cache-sim/README.md) — replayed 1.2k+ real classifier verdicts to measure verdict-cache hit rate (**3.2%** → serving cache declined; the runtime shadow telemetry built afterwards measured 3.3% and was later removed too, #73)
 - [`research/thinking-param-blackhole.md`](research/thinking-param-blackhole.md) — three-layer forensic root-cause of thinking models burning the classifier budget; why the fix is `thinkingEnabled: false`
 - [`research/rule-engine-sim`](research/rule-engine-sim/README.md) — measured a tree-sitter rule-engine port against 746 real bash calls (**absorbs 0 gray calls**) and rejected it
 - [`research/pi-permission-landscape.md`](research/pi-permission-landscape.md) — the competitive landscape this README's positioning is checked against
@@ -210,7 +219,6 @@ Design decisions here are settled by measurement, and the lab notes ship with th
 - AGENTS.md is not passed to the classifier as downweighted intent evidence (Claude Code does this)
 - parallel gray-zone calls are adjudicated serially
 - self-reflection means the session model adjudicates — point `--auto-mode-model` at a lighter model if verdict latency/cost matters (open question tracked in the issue tracker)
-- shadow cache is observe-only by decision; the serving switch is a one-line change once measured hit rates justify it
 - `denyPaths` bash extraction is token-level ([ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md)): command substitution, base64-embedded paths and external script contents produce no hit signal — those calls fall back to the classifier's existence-hint vigilance. MCP and custom tools bypass the extractor entirely (their gray-zone adjudication still carries the hint). Path normalization is base-tier only (ADR-0002): a nonexistent target written through a symlinked directory rebuilds no real form and produces no hit — that indirection falls to the hint vigilance too (the ancestor-rebuilding tier applies to the self-protection layer and the sensitivity floor, not denyPaths). Honest framing, same as the self-protection substring precedent: the deterministic layer is obfuscatable, which is exactly why a hit routes to *you* rather than silently deciding
 - `denyPaths` bash tokens contain no spaces: a *declared* path containing spaces cannot be spelled in a bash command in a way the extractor sees — `cat "/path with space/x"` splits into two tokens and never hits (file tools still hit, their path is not tokenized). A glob covering the final segment of a base (`cat /proj/pers*` against `denyPaths: ["/proj/personal"]`) also misses — the base's own name never appears literally. A recursive search issued from a shell misses in both spellings — no path argument (defaults to the cwd, e.g. a bare `rg foo`) or a parent-directory argument (`rg foo <parent-of-a-declared-path>`): an argument-less command contributes no token at all and bash tokens otherwise compare one-directionally, while the file tools' bidirectional subtree compare covers the same shapes issued through `grep`/`find`/`ls`. All three holes fall back to the classifier's existence hint, alongside substitution/base64 above
 - self-protection bash matching is substring regex — obfuscatable; the tamper-detection backstop catches within-session bypasses, but a cross-session baseline (hash + change confirmation at startup, incl. upgrade UX) is phase 2 per [ADR-0001](docs/adr/0001-self-protection-layer.md)
@@ -225,7 +233,7 @@ The name: the three-state **verdict** is the core concept. The UX keeps `/automo
 ```bash
 bun install
 bun run typecheck
-bun test          # offline stub tests: self-protection, tamper detection, deny floor, user rules, denyPaths, bypass regression, classifier retry, shadow cache, commands, toggle shortcut
+bun test          # offline stub tests: self-protection, tamper detection, deny floor, user rules, denyPaths, bypass regression, classifier retry, commands, toggle shortcut
 ```
 
 Issue tracker and decision records live in the GitHub issues ("map" issue #1 indexes them).

package/README.zh-CN.md

@@ -8,7 +8,7 @@
 
 **pi-verdict 是 [pi](https://pi.dev) 的 Claude Code 风格的 Auto mode 式的极简权限门禁:每次工具调用执行前先过检查——放行、拦截,或先问你。**
 
-- 只有1k行左右的极简代码
+- 只有2k行左右的极简代码
 - 内置危险规则与你的 allow/deny 规则以零延迟先行裁决明确情形
 - 其余交给携带会话上下文的模型分类器
 - 任何不确定或失败一律 fail-closed, 绝不静默放行
@@ -70,7 +70,7 @@ pi-verdict 同时支持 [pi](https://github.com/badlogic/pi-mono) 与 [oh-my-pi]
 | 用户规则 | `~/.pi/agent/config/pi-verdict.json` | `~/.omp/agent/config/pi-verdict.json` |
 | 凭据文件(S0 硬 deny) | `~/.pi/agent/auth.json` | `~/.omp/agent/auth.json` |
 
-- `/automode` —— 显示当前状态:开/关 + 本会话影子缓存统计
+- `/automode` —— 显示当前状态:开/关
 - `/automode on`
 - `/automode off`
 - `ctrl+shift+a` —— 静默切换主开关(footer 始终显示为唯一反馈;键位可经 `toggleShortcut` 重绑或禁用)
@@ -99,6 +99,12 @@ pi-verdict 同时支持 [pi](https://github.com/badlogic/pi-mono) 与 [oh-my-pi]
     "~/.zshrc",
     "~/.bashrc"
   ],
+  "ignoreTools": [
+    "todo",
+    "ask_user_question",
+    "memory_write",
+    "memory_search"
+  ],
   "builtinDenyFloor": true,
   "classifierModel": null,
   "toggleShortcut": "ctrl+shift+a",
@@ -106,18 +112,19 @@ pi-verdict 同时支持 [pi](https://github.com/badlogic/pi-mono) 与 [oh-my-pi]
   "notifyAllows": false,
   "classifierMinConfidence": null,
   "classifierFallbackModel": null,
-  "classifierFallbackMode": "shadow"
+  "classifierFallbackMode": "enforce"
 }
 ```
 
 - `allow`/`deny` 为 JS 正则数组;**`deny` 优先于 `allow`**,两者都优先于分类器
-- `denyPaths` 是你声明**受保护**的普通路径列表:触碰触发**终局 ask** 由你裁决(非交互降级 deny);分类器只被告知路径**存在**,路径明文永不出本机。`grep`/`find`/`ls` 按**整个搜索范围**比较:省略 `path`(pi 默认:当前目录)或传入位于声明路径之上的父目录,同样触发 ask。全新安装会预填一份**入门列表**(`~/.ssh/`、`~/.gnupg`、`~/.mc`、shell rc/profile 文件),自初次运行后的第一个会话起生效(一切配置变更均自新会话生效)——它是预填的*用户声明*而非内置 floor:可随意增删清空,也可与自己的路径(`~/Documents/private`、……)并列;既有配置永不被改写
+- `denyPaths` 是你声明**受保护**的普通路径列表:触碰触发**终局 ask** 由你裁决(非交互降级 deny);分类器只被告知路径**存在**,路径明文永不出本机。`grep`/`find`/`ls` 按**整个搜索范围**比较:省略 `path`(pi 默认:当前目录)或传入位于声明路径之上的父目录,同样触发 ask。全新安装会预填一份**入门列表**(`~/.ssh/`、`~/.gnupg`、`~/.mc`、shell rc/profile 文件)
+- `ignoreTools` 列出规则未覆盖的工具(`todo`、`web_search`、MCP/自定义工具):**直接放行、零模型调用**;列出已覆盖工具(`bash`/`read`/`write`/`edit`/`grep`/`find`/`ls`/`powershell`)的条目无效:它们仍受 deny floor 与你的 allow/deny 规则约束,自保护层也永远先行。全新安装会预填一份**入门列表**(`todo`、`ask_user_question`、`memory_write`、`memory_search`——来自项目 1265 条生产审计的观察) 注意:被豁免的工具失去分类器对 `denyPaths` 的存在性话术警戒(未覆盖工具本就不进路径提取器)
 - `builtinDenyFloor: false` 整体关闭内置危险/路径拦截(风险自担;下方自保护层永远开启)
 - `classifierModel` 指定分类器模型,如 `"zai/glm-5.3-flash:low"`(支持思考后缀;缺省 = 会话模型且显式关思考)
 - `classifierModel: "typesafe/jev-latest"` 启用随包的 **jev 决策适配器**——灰区裁决经 TypeSafe jev 完成(默认 OpenRouter,或 `PI_VERDICT_JEV_TRANSPORT=typesafe` 直连官方 API);实验性质,详见 [ADR-0003](docs/adr/0003-jev-decisions-adapter.md)
 - `audit: true` 把每次**灰区裁决**(发给分类器的完整转录、其原始响应、解析出的裁决)以 JSONL 记录到 `~/.pi/agent/verdicts/<sessionId>.jsonl`——按会话一分文件,保留最近 20 个。交互式 ask 还会记录你的应答(`userAnswer` ground truth,确认结束后落盘),protected-path ask 也入审计(#62);规则 allow/deny 仍不入。仅存本机且全保真(受保护路径明文可能出现——永不出本机;[ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) 边界注);agent 对该目录读写双拒。开启时 `/automode` 会显示审计状态与路径
-- `notifyAllows: true` 对每次 **classifier 放行**发通知(reason + action 行——如 jev 的概率分解);默认 `false` 保持放行静默。机械放行(你自己的 allow 规则、protected-path 确认)永不通知;shadow 标注仍属 debug;两开关同开时通知只出现一次
-- `classifierMinConfidence`(可选,[ADR-0004](docs/adr/0004-classifier-fallback-cascade.md))设定**置信地板**:低于它的 jev 裁决被降级——配置了 `classifierFallbackModel` 则级联(`shadow` = 第二层只记录意见、由你裁决;`enforce` = 第二层全权裁决,但降级 deny 永不被自动翻成 allow),否则直接问你。不低于地板时第一层自主。天然搭配:jev 打头 + haiku 级兜底
+- `notifyAllows: true` 对每次 **classifier 放行**发通知(reason + action 行——如 jev 的概率分解);默认 `false` 保持放行静默。机械放行(你自己的 allow 规则、protected-path 确认)永不通知;两开关同开时通知只出现一次
+- `classifierMinConfidence`(可选,[ADR-0004](docs/adr/0004-classifier-fallback-cascade.md))设定**置信地板**:低于它的 jev 裁决被降级——配置了 `classifierFallbackModel` 则级联(`enforce`,默认 = 第二层全权裁决,但降级的 **deny 与 ask** 永不被自动放宽为 allow——fail-closed 未产生任何裁决,其获救裁决照常生效;`shadow` = 只记录意见、由你裁决——`/automode` 会提示激活开关),否则直接问你。不低于地板时第一层自主。天然搭配:jev 打头 + haiku/flash 级兜底
 
 没有内置白名单——每一条「永远放行」声明都归你([为什么](docs/configuration.md#why-no-built-in-allowlist))。完整参考:[docs/configuration.md](docs/configuration.md)。
 
@@ -136,7 +143,7 @@ pi-verdict 同时支持 [pi](https://github.com/badlogic/pi-mono) 与 [oh-my-pi]
 - **宿主**:仅支持pi。omp 上该设置会警告并回退会话模型。也绝不能选作会话主模型(不生成文本,选中即警告)
 - **逃生口**:`PI_VERDICT_JEV_URL` 可覆盖当前 transport 的端点(OpenRouter 侧为 alpha 接口)
 
-jev 的校准 confidence 正是置信地板的判定依据——搭配第二层使用(`"classifierMinConfidence": 50, "classifierFallbackModel": "anthropic/claude-haiku-4-5"`),让低置信调用交给更深的模型而非直接生效([ADR-0004](docs/adr/0004-classifier-fallback-cascade.md))。
+jev 的校准 confidence 正是置信地板的判定依据——搭配第二层使用(`"classifierMinConfidence", "classifierFallbackModel"`),让低置信调用交给更深的模型而非直接生效([ADR-0004](docs/adr/0004-classifier-fallback-cascade.md))。
 
 ### 自保护(门禁守护自身——[ADR-0001](docs/adr/0001-self-protection-layer.md))
 
@@ -147,6 +154,8 @@ jev 的校准 confidence 正是置信地板的判定依据——搭配第二层
 
 需要 pi ≥ 0.84。交互与非交互(`-p`/json/rpc)会话均支持;非交互模式下 `ask` 降级为 `deny`。
 
+---
+
 ## 与品类对比
 
 | | 三态裁决 | 分类器携带上下文 | fail 方向 | 运行时依赖 |
@@ -175,6 +184,7 @@ tool_call
   │     ├─ 用户规则:deny 优先于 allow
   │     ├─ denyPaths(ADR-0002):受保护路径 → 终局 ask,先于用户 allow;
   │     │   分类器只见存在性话术
+  │     ├─ ignoreTools:用户声明的未覆盖工具 → 直接放行,零模型调用
   │     └─ 无内置白名单 —— 「永远放行」的声明由你自己做
   │
   ├─ 2. 灰区 → 模型分类器(默认继承会话模型 —— "自省")
@@ -187,7 +197,6 @@ tool_call
         ├─ deny  → 拦截,理由回传 agent
         └─ ask   → 人工确认;非交互模式降级为 deny
 
-  [影子缓存] observe-only 遥测,与 2/3 并行,永不改变裁决
 ```
 
 **fail-closed**:分类器异常 / 超时(25s)/ 输出违反契约 → 拦截,绝不静默放行。
@@ -212,7 +221,6 @@ tool_call
 - AGENTS.md 未作为降权意图证据传入分类器(Claude Code 有此设计)
 - 并行灰区调用串行裁决
 - 自省意味着会话模型亲自裁决 —— 若延迟/成本敏感,用 `--auto-mode-model` 指向轻量模型(开放问题见 issue tracker)
-- 影子缓存按决议仅观察不生效;实测命中率达标后,生效开关是一行改动
 - `denyPaths` 的 bash 提取是 token 级([ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md)):命令替换、base64 内嵌路径、外部脚本内容不产生命中信号——这些调用回落到分类器的存在性话术警戒。MCP 与自定义工具完全绕过提取器(其灰区裁决仍带话术)。路径归一化亦为基础档(ADR-0002):经符号链接目录写入尚不存在的目标不重建真实形、不产生命中——该间接路径同样由话术警戒覆盖(祖先重建档只适用于自保护层与路径敏感度 floor,不适用 denyPaths)。诚实表述,与自保护子串正则同例:确定性层可被混淆——这正是命中交由**你**裁决而非静默决定的原因
 - `denyPaths` 的 bash token 不含空格:**声明路径本身含空格时**,bash 拼写无法被提取器识别——`cat "/path with space/x"` 被拆成两个 token 永不命中(文件类工具仍命中,其路径不经 token 化)。glob 覆盖基名末段(`denyPaths: ["/proj/personal"]` 时 `cat /proj/pers*`)同样漏过——基名自身从未字面出现。经 shell 发起的递归搜索在两种拼写下都漏过——不带路径参数(默认搜 cwd,如裸 `rg foo`)或带父目录参数(`rg foo <声明路径的父目录>`):无参命令根本不产生 token,带参时 bash token 只做单向比较;同一形状经 `grep`/`find`/`ls` 工具发起则由双向子树比较覆盖。三个洞与上述替换/base64 一样回落到分类器的存在性话术
 - 自保护 bash 匹配是子串正则——可被混淆绕过;变更检测兜底覆盖会话内绕过,跨会话基线(启动时哈希比对与变更确认,含升级 UX)按 ADR-0001 为二期
@@ -227,7 +235,7 @@ tool_call
 ```bash
 bun install
 bun run typecheck
-bun test          # 离线桩测试:自保护 / 变更检测 / deny floor / 用户规则 / denyPaths / 绕过回归 / 分类器重试 / 影子缓存 / 命令 / toggle 快捷键
+bun test          # 离线桩测试:自保护 / 变更检测 / deny floor / 用户规则 / denyPaths / 绕过回归 / 分类器重试 / 命令 / toggle 快捷键
 ```
 
 Issue tracker 与决策记录在 GitHub issues(「地图」issue #1 为索引)。

package/extensions/pi-verdict.ts

@@ -39,14 +39,10 @@
  * Structure: the pipeline is adjudicate() — a zero-UI module returning a Verdict
  * value object (source: rule|protected-path|classifier|fail-closed, plus a
  * `degraded` flag for ask→deny in non-interactive sessions); the tool_call
- * handler maps verdicts to UI (notify/confirm/select) by source × degraded and
+ * handler maps verdicts to UI (notify/confirm/select) by source (the degraded
+ * context is implicit in the protected-path source's deny wording) and
  * runs IntegrityWatch (ADR-0001) as a pre-pipeline gate-integrity check.
  *
- * Shadow cache (observe-only, #7): gray-zone verdicts are replayed against a
- * double-key LRU(128) to measure would-be hit rate; recorded, never applied
- * (verdicts always come from the model), accumulating pi field data for the
- * "should a serving cache ship" question (#5 decision).
- *
  * fail-closed: classifier exception/timeout/contract violation → deny; in
  * non-interactive modes (no UI) ask → deny.
  *
@@ -60,8 +56,7 @@
  *                                   suffix (pi-native --model syntax; default off
  *                                   = thinking explicitly disabled)
  *   PI_AUTO_MODE_MODEL             env-var form of the above
- *   --auto-mode-debug              notify on every verdict (incl. allows); shadow
- *                                   cache annotation on
+ *   --auto-mode-debug              notify on every verdict (incl. allows)
  *   PI_AUTO_MODE_DEBUG=1           env-var form of the above (kept for compat)
  *   <agentDir>/config/pi-verdict.json   user rules: { allow: [regex], deny: [regex],
  *                                   denyPaths: [path], builtinDenyFloor,
@@ -74,9 +69,9 @@
  * Known prototype simplifications (see README "Status & limitations"):
  *   - no built-in bash allowlist; danger detection is regex floor (no AST parsing)
  *     — unknown shapes go to the classifier
- *   - serving verdict cache deferred (#5 decision): currently observe-only shadow
- *     telemetry, revisit once measured; no circuit breaker (revisit signals =
- *     deny-storm cost blowup / long non-interactive runs)
+ *   - no serving verdict cache (#5 decision; runtime shadow telemetry removed #73 —
+ *     re-evaluation belongs to offline replay tooling); no circuit breaker (revisit
+ *     signals = deny-storm cost blowup / long non-interactive runs)
  *   - AGENTS.md not passed to the classifier as downweighted intent evidence
  *   - denyPaths bash extraction is token-level: command substitution, base64-
  *     embedded paths and external script contents produce no hit signal — those
@@ -254,6 +249,14 @@ interface UserRules {
 	deny: RegExp[];
 	/** User-declared protected paths (ADR-0002): plain paths, tool-owned normalization; hit → ask */
 	denyPaths: string[];
+	/** User-declared tool passthrough: names of tools OUTSIDE the command/file
+	 *  families (todo, web_search, MCP/custom tools, …) that skip adjudication —
+	 *  session-metadata/read-only tools the owner exempts, same stance as user allow
+	 *  rules: no built-in passthrough, every exemption is the user's own claim.
+	 *  Entries naming covered tools (bash/read/write/edit/grep/find/ls/powershell)
+	 *  are inert: those are governed by the deny floor and user allow/deny rules,
+	 *  which this list can never weaken. */
+	ignoreTools: string[];
 	/** 内置 deny floor 开关(危险正则 + 路径敏感度 deny),默认 true;关闭后依赖用户规则与分类器 */
 	builtinDenyFloor: boolean;
 	/** 分类器模型 spec(provider/id);null = 未配置(自省继承会话模型) */
@@ -271,12 +274,12 @@ interface UserRules {
 	/** #63/#67: second-layer model spec (provider/id[:thinking]); consulted on demotion
 	 *  and fail-closed only. null = no second layer. */
 	classifierFallbackModel: string | null;
-	/** #67: does the second layer adjudicate cascaded calls ("enforce") or only record its
-	 *  opinion while the human decides ("shadow", default)? */
+	/** #67: does the second layer adjudicate cascaded calls ("enforce", default since
+	 *  0.12.0) or only record its opinion while the human decides ("shadow")? */
 	classifierFallbackMode: "shadow" | "enforce";
 }
 
-const EMPTY_RULES: UserRules = { allow: [], deny: [], denyPaths: [], builtinDenyFloor: true, classifierModel: null, toggleShortcut: DEFAULT_TOGGLE_SHORTCUT, audit: false, notifyAllows: false, classifierMinConfidence: null, classifierFallbackModel: null, classifierFallbackMode: "shadow" };
+const EMPTY_RULES: UserRules = { allow: [], deny: [], denyPaths: [], ignoreTools: [], builtinDenyFloor: true, classifierModel: null, toggleShortcut: DEFAULT_TOGGLE_SHORTCUT, audit: false, notifyAllows: false, classifierMinConfidence: null, classifierFallbackModel: null, classifierFallbackMode: "enforce" };
 
 /** This module's own file location (import.meta.url resolved; null = unresolvable). */
 const OWN_FILE_PATH: string | null = (() => {
@@ -325,7 +328,6 @@ function userConfigPath(): string {
 }
 
 const USER_CONFIG_TEMPLATE = `${JSON.stringify({
-	_hint: "pi-verdict user rules — full reference: https://github.com/jesset/pi-verdict/blob/main/docs/configuration.md. deny beats allow. denyPaths: protected paths, any touch asks for your confirmation (non-interactive degrades to deny); the pre-filled starter list is your declaration, edit or empty freely. builtinDenyFloor=false disables the built-in danger floor at your own risk (the self-protection layer always stays on). classifierModel pins the classifier (provider/id, e.g. zai/glm-5.3-flash; empty = session model). classifierFallbackModel (optional) adds a second-layer classifier consulted only when the first layer is uncertain (ask / fail-closed / jev confidence below classifierFallbackConfidence, default 50); mode shadow (default) observes without changing verdicts, enforce escalates strictness only. toggleShortcut sets the master-switch toggle key (null or empty disables). This file is part of the permission gate: agent-side modification is denied — edit it manually outside pi. Changes apply to new sessions.",
 	allow: ["^ls\\b"],
 	deny: [],
 	denyPaths: [
@@ -336,6 +338,12 @@ const USER_CONFIG_TEMPLATE = `${JSON.stringify({
 		"~/.zshrc",
 		"~/.bashrc",
 	],
+	ignoreTools: [
+		"todo",
+		"ask_user_question",
+		"memory_write",
+		"memory_search",
+	],
 	builtinDenyFloor: true,
 	classifierModel: null,
 	toggleShortcut: DEFAULT_TOGGLE_SHORTCUT,
@@ -343,13 +351,16 @@ const USER_CONFIG_TEMPLATE = `${JSON.stringify({
 	notifyAllows: false,
 	classifierMinConfidence: null,
 	classifierFallbackModel: null,
-	classifierFallbackMode: "shadow",
+	classifierFallbackMode: "enforce",
 }, null, 2)}\n`;
 
 /**
- * 加载用户规则。首启生成带注释模板(allow 内示例默认仅 ^ls\b 可用,其余为说明占位);
- * 配置缺失/损坏/字段非法一律回退空规则(安全默认,不失效),非法正则收集回报,
- * 非法 toggleShortcut 收集警告文案(与 skipped 同经 session_start 发出)。
+ * Load user rules. First run generates a template (bare keys + starter lists, no
+ * embedded prose — the full reference is docs/configuration.md; only ^ls\b in the
+ * allow example is live, the rest are placeholders). A missing/malformed/invalid
+ * config falls back to empty rules (safe default — the gate never disables);
+ * invalid regexes are collected and reported, an invalid toggleShortcut collects
+ * a warning text (both surface via session_start alongside `skipped`).
  */
 function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning: string | null } {
 	try {
@@ -361,7 +372,7 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 			} catch { /* 只读环境静默跳过 */ }
 			return { rules: EMPTY_RULES, skipped: [], shortcutWarning: null };
 		}
-		let raw: { allow?: unknown; deny?: unknown; denyPaths?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown; toggleShortcut?: unknown; audit?: unknown; notifyAllows?: unknown; classifierFallbackModel?: unknown; classifierFallbackConfidence?: unknown; classifierMinConfidence?: unknown; classifierFallbackMode?: unknown };
+		let raw: { allow?: unknown; deny?: unknown; denyPaths?: unknown; ignoreTools?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown; toggleShortcut?: unknown; audit?: unknown; notifyAllows?: unknown; classifierFallbackModel?: unknown; classifierFallbackConfidence?: unknown; classifierMinConfidence?: unknown; classifierFallbackMode?: unknown };
 		try {
 			raw = JSON.parse(fs.readFileSync(p, "utf8")) as typeof raw;
 		} catch (err) {
@@ -389,6 +400,15 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 			}
 			return [x.trim()];
 		});
+		// ignoreTools entries are plain tool names: only type-valid non-empty strings
+		// survive; anything else joins the same one-shot warning channel
+		const ignoreTools = (Array.isArray(raw.ignoreTools) ? raw.ignoreTools : []).flatMap((x) => {
+			if (typeof x !== "string" || !x.trim()) {
+				if (x !== undefined && x !== null) skipped.push(`ignoreTools: ${JSON.stringify(x)}`);
+				return [];
+			}
+			return [x.trim()];
+		});
 		const shortcut = resolveToggleShortcut(raw.toggleShortcut);
 		// #63/#67: confidence-floor keys — invalid values skip into the one-shot warning channel
 		if (raw.classifierFallbackConfidence !== undefined) skipped.push("classifierFallbackConfidence: renamed to classifierMinConfidence (0.11.0) — key ignored");
@@ -402,6 +422,7 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 				allow: compile(raw.allow),
 				deny: compile(raw.deny),
 				denyPaths,
+				ignoreTools,
 				builtinDenyFloor: raw.builtinDenyFloor !== false,
 				classifierModel: typeof raw.classifierModel === "string" && raw.classifierModel.trim() ? raw.classifierModel.trim() : null,
 				toggleShortcut: shortcut.key,
@@ -409,7 +430,7 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 				notifyAllows: raw.notifyAllows === true,
 				classifierFallbackModel: typeof raw.classifierFallbackModel === "string" && raw.classifierFallbackModel.trim() ? raw.classifierFallbackModel.trim() : null,
 				classifierMinConfidence: minConfOk ? minConfRaw : null,
-				classifierFallbackMode: fbModeRaw === "enforce" ? "enforce" : "shadow",
+				classifierFallbackMode: fbModeRaw === undefined ? "enforce" : fbModeRaw === "enforce" ? "enforce" : "shadow", // invalid values land on the conservative shadow (standing invalid-config precedent); the key-less default is enforce
 			},
 			skipped,
 			shortcutWarning: shortcut.warning,
@@ -923,7 +944,8 @@ class IntegrityWatch {
  *   2. user deny → deny (beats allow)
  *   3. denyPaths hit → terminal ask (ADR-0002: the declaring user adjudicates; before user allow)
  *   4. user allow → allow
- *   5. base (path tools' default allow/gray; everything else gray) → classifier
+ *   5. base (path tools' default allow/gray; uncovered tools: ignoreTools hit → allow
+ *      passthrough, else gray) → classifier
  */
 function classifyByRules(toolName: string, input: Record<string, unknown>, cwd: string, user: UserRules, prot: ProtectedSet, denyPathBases: string[]): RuleResult {
 	// 第 0 层:自保护层(ADR-0001)——先于一切,不可经任何配置豁免
@@ -946,7 +968,12 @@ function classifyByRules(toolName: string, input: Record<string, unknown>, cwd:
 		const p = typeof input.path === "string" ? input.path : undefined;
 		base = p ? classifyPath(toolName, p, cwd, false, user.builtinDenyFloor) : { verdict: "allow" };
 	} else {
-		base = { verdict: "gray", reason: `tool not covered by built-in rules: ${toolName}` };
+		// ignoreTools passthrough: user-declared exempt tools skip adjudication;
+		// reached only after self-protection and the deny floor, so neither can be
+		// weakened by it. Everything else uncovered stays gray for the classifier.
+		base = user.ignoreTools.includes(toolName)
+			? { verdict: "allow", reason: `user ignoreTools passthrough: ${toolName}` }
+			: { verdict: "gray", reason: `tool not covered by built-in rules: ${toolName}` };
 	}
 	if (base.verdict === "deny") return base; // 内置 floor:deny 优先于一切用户规则
 
@@ -1032,7 +1059,6 @@ export type PipelineHost = Pick<ExtensionContext["sessionManager"], "getBranch"
 /**
  * 从会话分支收集精简转录原料:user 消息行与 assistant 工具调用行。
  * 丢弃 assistant 叙述/thinking 与 toolResult(注入面与 token 大头)。
- * 影子缓存的 contextKey 与 buildTranscript 同源(同一批 user 行),保证键与模型输入一致。
  */
 function collectTranscriptParts(host: PipelineHost): { userLines: string[]; toolLines: string[] } {
 	const userLines: string[] = [];
@@ -1271,126 +1297,7 @@ async function classifyWithModel(
 }
 
 // ============================================================================
-// 影子缓存:双键命中率遥测(observe-only,#7;设计定案见 #5)
-//
-// 键设计(#5 定案):
-//   commandKey = hash(toolName + JSON.stringify(input) + cwd)  —— 不做命令规范化
-//   contextKey = hash(最近 5 条 sanitized user 行,与 transcript 同源同窗口)
-// 行为:
-//   每次灰区裁决前查 would-be 命中;真实模型 allow/deny 回写(LRU 128,上下文变更覆写);
-//   ask 与 fail-closed 不入缓存;命中时对比缓存裁决与本次模型裁决(反事实一致性)。
-//   永不生效:裁决永远来自模型,此处只记录。
-// ============================================================================
-
-const SHADOW_LRU_MAX = 128;
-
-type ShadowVerdict = "allow" | "deny";
-interface ShadowEntry {
-	ctxKey: string;
-	verdict: ShadowVerdict;
-}
-
-/** FNV-1a 32 位摘要:仅会话内键用,非密码学 */
-function fnv1a(s: string): string {
-	let h = 0x811c9dc5;
-	for (let i = 0; i < s.length; i++) {
-		h ^= s.charCodeAt(i);
-		h = Math.imul(h, 0x01000193);
-	}
-	return (h >>> 0).toString(16);
-}
-
-interface ShadowStats {
-	gray: number; // 灰区裁决总数(含 ask/fail-closed)
-	hits: number; // 双键命中(would-be)
-	missNoEntry: number;
-	missCtx: number;
-	cmdRepeats: number; // 命令键重复(忽略 context 的上界口径)
-	divergeDangerous: number; // 命中且缓存 allow → 模型 deny(若缓存生效会放过本次拦截)
-	divergeConservative: number; // 命中且缓存 deny → 模型 allow
-}
-
-type ShadowProbe =
-	| { result: "hit"; entry: ShadowEntry }
-	| { result: "no-entry" }
-	| { result: "ctx-changed"; prevVerdict: ShadowVerdict };
-
-class ShadowCache {
-	private lru = new Map<string, ShadowEntry>();
-	private seen = new Set<string>();
-	readonly stats: ShadowStats = { gray: 0, hits: 0, missNoEntry: 0, missCtx: 0, cmdRepeats: 0, divergeDangerous: 0, divergeConservative: 0 };
-
-	/** 会话重置:清空 LRU 与统计(#5 定案:会话内存态) */
-	reset(): void {
-		this.lru.clear();
-		this.seen.clear();
-		Object.assign(this.stats, { gray: 0, hits: 0, missNoEntry: 0, missCtx: 0, cmdRepeats: 0, divergeDangerous: 0, divergeConservative: 0 });
-	}
-
-	/** 灰区裁决前置查询(仅遥测,不影响裁决) */
-	probe(commandKey: string, ctxKey: string): ShadowProbe {
-		this.stats.gray++;
-		if (this.seen.has(commandKey)) this.stats.cmdRepeats++;
-		else this.seen.add(commandKey);
-		const entry = this.lru.get(commandKey);
-		if (!entry) {
-			this.stats.missNoEntry++;
-			return { result: "no-entry" };
-		}
-		if (entry.ctxKey !== ctxKey) {
-			this.stats.missCtx++;
-			return { result: "ctx-changed", prevVerdict: entry.verdict };
-		}
-		this.stats.hits++;
-		// LRU 位置刷新,保留原裁决(命中即重放)
-		this.lru.delete(commandKey);
-		this.lru.set(commandKey, entry);
-		return { result: "hit", entry };
-	}
-
-	/** 真实模型 allow/deny 裁决后回写;ask 与 fail-closed 不入 */
-	record(commandKey: string, ctxKey: string, verdict: ShadowVerdict): void {
-		this.lru.delete(commandKey);
-		this.lru.set(commandKey, { ctxKey, verdict });
-		if (this.lru.size > SHADOW_LRU_MAX) {
-			const oldest = this.lru.keys().next().value;
-			if (oldest !== undefined) this.lru.delete(oldest);
-		}
-	}
-
-	/** 命中后的反事实一致性计数(仅与可缓存裁决对比;ask/fail-closed 不可比) */
-	countDivergence(cached: ShadowVerdict, actual: ShadowVerdict): void {
-		if (cached === actual) return;
-		if (cached === "allow" && actual === "deny") this.stats.divergeDangerous++;
-		else this.stats.divergeConservative++;
-	}
-
-	/** /automode 展示用摘要 */
-	summary(): string {
-		const s = this.stats;
-		if (s.gray === 0) return "shadow cache: no gray-zone verdicts yet this session";
-		const rate = ((100 * s.hits) / s.gray).toFixed(1);
-		return `shadow cache: gray ${s.gray} · two-key hits ${s.hits} (${rate}%) · miss no-entry ${s.missNoEntry}/ctx-changed ${s.missCtx} · cmd repeats ${s.cmdRepeats} · divergence dangerous ${s.divergeDangerous}/conservative ${s.divergeConservative}`;
-	}
-}
-
-function shadowCommandKey(toolName: string, input: Record<string, unknown>, cwd: string): string {
-	return fnv1a(`${toolName}\u0000${JSON.stringify(input)}\u0000${cwd}`);
-}
-
-function shadowContextKey(host: PipelineHost): string {
-	const { userLines } = collectTranscriptParts(host);
-	return fnv1a(userLines.slice(-MAX_USER_MESSAGES).join("\u0000"));
-}
-
-function shadowTag(probe: ShadowProbe): string {
-	if (probe.result === "hit") return `(shadow cache: would-hit ${probe.entry.verdict})`;
-	if (probe.result === "ctx-changed") return `(shadow cache: miss:context-changed, previous ${probe.prevVerdict})`;
-	return `(shadow cache: miss:no-entry)`;
-}
-
-// ============================================================================
-// Confidence cascade stats (#63/#67: observe-first, session-memory state; the #7 discipline)
+// Confidence cascade stats (#63/#67: observe-first, session-memory state)
 // ============================================================================
 
 interface FallbackStats {
@@ -1398,14 +1305,15 @@ interface FallbackStats {
 	agreed: number; // fallback verdict equals the first layer's (fail-closed defaults to deny)
 	overruled: number; // fallback verdict differs (enforce applies it; shadow observes the would-be)
 	errored: number; // fallback unresolvable or its call failed
+	rescuedAllow: number; // #71: fail-closed origin the fallback ruled allow (enforce: actually allowed; shadow: would) — counted within overruled as well, surfaced distinctly for the rescue reading
 }
 
 class FallbackCascade {
-	readonly stats: FallbackStats = { triggered: 0, agreed: 0, overruled: 0, errored: 0 };
+	readonly stats: FallbackStats = { triggered: 0, agreed: 0, overruled: 0, errored: 0, rescuedAllow: 0 };
 
-	/** Session reset (#7 discipline: session-memory state) */
+	/** Session reset (session-memory state) */
 	reset(): void {
-		Object.assign(this.stats, { triggered: 0, agreed: 0, overruled: 0, errored: 0 });
+		Object.assign(this.stats, { triggered: 0, agreed: 0, overruled: 0, errored: 0, rescuedAllow: 0 });
 	}
 
 	note(first: "allow" | "ask" | "deny" | null, fb: "allow" | "ask" | "deny" | null): void {
@@ -1415,6 +1323,7 @@ class FallbackCascade {
 			return;
 		}
 		// A fail-closed origin produced no first-layer verdict; its default outcome is deny
+		if (first === null && fb === "allow") this.stats.rescuedAllow++;
 		if ((first ?? "deny") !== fb) this.stats.overruled++;
 		else this.stats.agreed++;
 	}
@@ -1423,7 +1332,7 @@ class FallbackCascade {
 	summary(mode: "shadow" | "enforce"): string {
 		const s = this.stats;
 		if (s.triggered === 0) return "confidence cascade: not triggered this session";
-		return `confidence cascade (${mode}): triggered ${s.triggered} · agreed ${s.agreed} · ${mode === "enforce" ? "overruled" : "would-overrule"} ${s.overruled} · errored ${s.errored}`;
+		return `confidence cascade (${mode}): triggered ${s.triggered} · agreed ${s.agreed} · ${mode === "enforce" ? "overruled" : "would-overrule"} ${s.overruled} · ${mode === "enforce" ? "rescued-allow" : "would-rescue-allow"} ${s.rescuedAllow} · errored ${s.errored}`;
 	}
 }
 
@@ -1473,7 +1382,6 @@ export interface AuditRecord {
 	/** #62: protected-path asks are recorded too — their user answers grade the
 	 *  denyPaths rules; rule allow/deny verdicts remain unaudited. */
 	source: "model" | "fail-closed" | "protected-path";
-	shadow: string;
 	degraded: boolean;
 	/** #62 ground truth: the user's answer to an interactive ask confirm. Present only
 	 *  on records whose confirm actually ran; headless/degraded asks omit it. */
@@ -1554,7 +1462,6 @@ export class AuditLog {
  */
 export class SessionState {
 	readonly prot: ProtectedSet;
-	readonly shadow = new ShadowCache();
 	readonly fallback = new FallbackCascade();
 	userRules: UserRules;
 	audit: AuditLog | null;
@@ -1574,12 +1481,11 @@ export class SessionState {
 	}
 
 	/** 会话重置:重载用户规则(配置改动新会话生效)+ 按会话 cwd 重锚 denyPaths
-	 *  (ADR-0002: 每会话锚定一次)+ 清影子缓存;返回加载报告供表现层通知 */
+	 *  (ADR-0002: 每会话锚定一次);返回加载报告供表现层通知 */
 	reset(cwd: string): { skipped: string[]; shortcutWarning: string | null } {
 		const loaded = loadUserRules();
 		this.userRules = loaded.rules;
 		this.denyPathBases = anchorDenyPaths(loaded.rules.denyPaths, cwd); // anchored to the session cwd, once (ADR-0002)
-		this.shadow.reset();
 		this.fallback.reset();
 		this.audit = this.makeAudit(loaded.rules);
 		return { skipped: loaded.skipped, shortcutWarning: loaded.shortcutWarning };
@@ -1604,14 +1510,13 @@ export type VerdictSource = "rule" | "protected-path" | "classifier" | "fail-clo
 
 /** 判定管线的输出值对象:一次 tool_call 的完整裁决。detail 为 UI-only 明文(受保护
  *  路径仅入本地确认框,ADR-0002 零泄漏承诺——reason 与通知永不携带);degraded 标记
- *  ask 在无 UI 会话的降级产物;shadow 为影子缓存标注(仅 debug 呈现拼接用)。 */
+ *  ask 在无 UI 会话的降级产物。 */
 export interface Verdict {
 	verdict: "allow" | "ask" | "deny";
 	reason: string;
 	detail?: string;
 	source: VerdictSource;
 	degraded: boolean;
-	shadow?: string;
 	/** #62: pending audit record for an interactive ask — adjudicate defers the append so
 	 *  the handler can attach the user's answer after the confirm resolves. The handler
 	 *  owns the single finalize: append with userAnswer/answeredAt, or without them when
@@ -1657,8 +1562,9 @@ interface CascadeResult {
  *  - demotion with no fallback → ask the human
  *  - shadow → the fallback records its opinion; a demotion still asks the human, a
  *    fail-closed deny stands
- *  - enforce → the fallback adjudicates de novo, with one carve-out: a demoted first-layer
- *    deny may not be flipped to an automatic allow — the human decides
+ *  - enforce → the fallback adjudicates de novo, with one carve-out family (#71): a demoted
+ *    first-layer deny or ask may not be auto-relaxed to an allow — the human decides; a
+ *    fail-closed origin has no first-layer verdict, so any fallback ruling applies
  *  - fallback failure/unresolvable on a cascaded call → ask the human (the tier that was
  *    to adjudicate is down); headless degrades downstream */
 async function runConfidenceCascade(
@@ -1698,20 +1604,25 @@ async function runConfidenceCascade(
 	state.fallback.note(first?.verdict ?? null, outcome.verdict);
 	const fb: FallbackAudit = { ...base, model: resolved.model.id, verdict: outcome.verdict, reason: outcome.reason, durationMs: Date.now() - start, error: null };
 	if (mode === "shadow") return { ...demotedMark, fb, ...shadowApplied };
-	// The one carve-out on second-layer authority: a demoted first-layer deny may not
-	// become an automatic allow — the human decides (headless degrades to deny downstream)
-	if (trigger.kind === "demotion" && first?.verdict === "deny" && outcome.verdict === "allow") {
-		return { demoted: true, fb: { ...fb, effective: "ask" }, effective: { verdict: "ask", reason: `${outcome.reason} (first layer said deny at confidence ${trigger.confidence}%; second opinion allows — your call)`, source: "classifier" } };
+	// The carve-outs on second-layer authority (#71): it may not auto-relax a negative
+	// first-layer verdict — a demoted deny OR ask that the fallback would allow goes to
+	// the human (headless degrades to deny downstream). A fail-closed origin has no
+	// first-layer verdict to relax; its fallback allow is a de novo ruling and stands.
+	if (trigger.kind === "demotion" && (first?.verdict === "deny" || first?.verdict === "ask") && outcome.verdict === "allow") {
+		return { demoted: true, fb: { ...fb, effective: "ask" }, effective: { verdict: "ask", reason: `${outcome.reason} (first layer said ${first!.verdict} at confidence ${trigger.confidence}%; second opinion allows — your call)`, source: "classifier" } };
 	}
 	return { ...demotedMark, fb: { ...fb, effective: outcome.verdict }, effective: { verdict: outcome.verdict, reason: outcome.reason, source: "classifier" } };
 }
 
 /**
  * 判定管线(CONTEXT.md「判定管线」词条的实现):自保护 → 内置 floor → 用户 deny →
- * denyPaths ask → 用户 allow → 灰区分类器;ask 降级(无 UI → deny)与 fail-closed
- * 内建于此,两处重复的降级实现自此唯一。零 UI:表现(notify/confirm/select)由扩展
- * handler 按 source × degraded 模板呈现;变更检测(IntegrityWatch)是管线前置的
- * 独立关注点,不在 adjudicate 内。导出仅为测试(内部 seam 的测试面,#35 既有模式)。
+ * denyPaths ask → user allow → gray-zone classifier; ask degradation (no UI → deny)
+ * and fail-closed are built in here — the two formerly duplicated degradation
+ * implementations now live in one place. Zero UI: presentation (notify/confirm/
+ * select) is the handler's job, keyed on source alone (the degraded context is
+ * implicit in the protected-path deny wording); IntegrityWatch (tamper detection)
+ * is a pre-pipeline concern, not part of adjudicate. Exported for tests only
+ * (the internal-seam test surface, the standing #35 pattern).
  */
 export async function adjudicate(
 	state: SessionState,
@@ -1729,7 +1640,7 @@ export async function adjudicate(
 	// appends immediately. Recording stays observe-only — it never changes a verdict; write
 	// failures stay fail-soft in the sink and surface once via drainWarning.
 	const actionLine = toolCallLine(call.toolName, call.input);
-	const buildRecord = (v: Pick<AuditRecord, "verdict" | "reason" | "source" | "degraded">, raw: ClassifierOutcome["auditRaw"] | null, shadow: string): AuditRecord => ({
+	const buildRecord = (v: Pick<AuditRecord, "verdict" | "reason" | "source" | "degraded">, raw: ClassifierOutcome["auditRaw"] | null): AuditRecord => ({
 		ts: new Date().toISOString(),
 		sessionId: env.host.getSessionId(),
 		cwd: env.cwd,
@@ -1740,18 +1651,17 @@ export async function adjudicate(
 		thinking: raw?.thinking ?? null,
 		transcript: raw?.transcript ?? null,
 		rawResponse: raw?.rawResponse ?? null,
-		shadow,
 		...v,
 	});
 
 	if (rule.verdict === "ask") {
 		// denyPaths 命中 → ask 终局(ADR-0002):声明者本人裁决例外;无 UI 降级为 deny
 		if (env.hasUI) {
-			const ppRecord: AuditRecord = { ...buildRecord({ verdict: "ask", reason: rule.reason ?? "", source: "protected-path", degraded: false }, null, "-"), detail: rule.detail };
+			const ppRecord: AuditRecord = { ...buildRecord({ verdict: "ask", reason: rule.reason ?? "", source: "protected-path", degraded: false }, null), detail: rule.detail };
 			return { verdict: "ask", reason: rule.reason ?? "", detail: rule.detail, source: "protected-path", degraded: false, ...(state.audit ? { pendingAudit: ppRecord } : {}) };
 		}
 		// headless: the ask degrades to deny — recorded like the gray-zone rule (the effective post-degradation verdict is what lands in the record)
-		state.audit?.append({ ...buildRecord({ verdict: "deny", reason: rule.reason ?? "", source: "protected-path", degraded: true }, null, "-"), detail: rule.detail });
+		state.audit?.append({ ...buildRecord({ verdict: "deny", reason: rule.reason ?? "", source: "protected-path", degraded: true }, null), detail: rule.detail });
 		return { verdict: "deny", reason: rule.reason ?? "", detail: rule.detail, source: "protected-path", degraded: true };
 	}
 
@@ -1765,33 +1675,23 @@ export async function adjudicate(
 		// shadow records its opinion and the deny stands
 		const cascade = await runConfidenceCascade(state, env, null, { kind: "fail-closed" }, state.userRules.denyPaths.length > 0, actionLine);
 		const eff = cascade.effective;
-		const fcRecord = buildRecord({ verdict: "deny", reason, source: "fail-closed", degraded: false }, null, "-");
+		// #71: a fail-closed layer emits no negative verdict — its deny is a default, not
+		// a ruling. When an enforcing fallback rescues the call, the record's top level
+		// carries the applied verdict; a shadow rescue (no effective) keeps the deny.
+		const effAskHeadless = eff?.verdict === "ask" && !env.hasUI;
+		const fcRecord = buildRecord({ verdict: eff ? (effAskHeadless ? "deny" : eff.verdict) : "deny", reason: eff?.reason ?? reason, source: "fail-closed", degraded: effAskHeadless }, null);
 		if (cascade.fb) fcRecord.fallback = cascade.fb;
 		if (eff?.verdict === "ask" && env.hasUI) {
 			return { verdict: "ask", reason: eff.reason, source: eff.source, degraded: false, ...(state.audit ? { pendingAudit: fcRecord } : {}) };
 		}
 		state.audit?.append(fcRecord);
 		if (eff?.verdict === "allow") return { verdict: "allow", reason: eff.reason, source: "classifier", degraded: false };
-		if (eff) return { verdict: "deny", reason: eff.reason, source: eff.source, degraded: !env.hasUI };
+		if (eff) return { verdict: "deny", reason: eff.reason, source: eff.source, degraded: effAskHeadless };
 		return { verdict: "deny", reason, source: "fail-closed", degraded: false };
 	}
 
-	// 影子缓存(observe-only):前置查询 would-be 命中,不改变任何裁决
-	const cmdKey = shadowCommandKey(call.toolName, call.input, env.cwd);
-	const ctxKey = shadowContextKey(env.host);
-	const probe = state.shadow.probe(cmdKey, ctxKey);
-
 	const outcome = await classifyWithModel(env.host, env.signal, env.complete, resolved.model, actionLine, resolved.thinking, state.userRules.denyPaths.length > 0);
 
-	// 影子回记:真实模型 allow/deny 入缓存;ask 与 fail-closed 不入(#5 定案);
-	// 命中且本次为可缓存裁决时,对比反事实一致性
-	if (outcome.source === "model" && outcome.verdict !== "ask") {
-		if (probe.result === "hit") state.shadow.countDivergence(probe.entry.verdict, outcome.verdict);
-		state.shadow.record(cmdKey, ctxKey, outcome.verdict);
-	}
-
-	const shadow = shadowTag(probe);
-
 	// #67 cascade: a confidence-floor demotion, or a classifier fail-closed outcome
 	// (the first layer produced no verdict)
 	const demotion = confidenceDemotion(outcome, state.userRules);
@@ -1805,21 +1705,25 @@ export async function adjudicate(
 	// #62/#67: top-level keeps first-layer semantics (corpus comparability); the applied
 	// verdict lives in fallback.effective (enforce rows). Non-interactive asks of any
 	// origin — native, demoted, escalated — record as their effective deny, the
-	// pre-existing ask-degradation convention.
+	// pre-existing ask-degradation convention. #71 exception: a fail-closed first layer
+	// rescued by an enforcing fallback records the applied verdict at the top level —
+	// a fail-closed layer emits no negative verdict, so its default deny would distort
+	// deny-rate statistics (26 observed rows, 25 actually allowed); shadow rescues keep it.
 	const appliedAskHeadless = !env.hasUI && effVerdict === "ask";
-	const grayRecord = buildRecord({ verdict: appliedAskHeadless ? "deny" : outcome.verdict, reason: outcome.reason, source: outcome.source, degraded: appliedAskHeadless }, outcome.auditRaw ?? null, shadow);
+	const fcRescued = cascade.effective !== undefined && outcome.source === "fail-closed";
+	const grayRecord = buildRecord({ verdict: appliedAskHeadless ? "deny" : fcRescued ? effVerdict : outcome.verdict, reason: fcRescued ? effReason : outcome.reason, source: outcome.source, degraded: appliedAskHeadless }, outcome.auditRaw ?? null);
 	if (cascade.demoted) grayRecord.demoted = true;
 	if (cascade.fb) grayRecord.fallback = cascade.fb;
 	// #62: an interactive ask defers the append to the handler finalize (ground truth);
 	// every other outcome appends immediately as before
 	if (effVerdict === "ask" && env.hasUI) {
-		return { verdict: "ask", reason: effReason, source: effSource, degraded: false, shadow, ...(state.audit ? { pendingAudit: grayRecord } : {}) };
+		return { verdict: "ask", reason: effReason, source: effSource, degraded: false, ...(state.audit ? { pendingAudit: grayRecord } : {}) };
 	}
 	state.audit?.append(grayRecord);
-	if (effVerdict === "allow") return { verdict: "allow", reason: effReason, source: effSource, degraded: false, shadow };
-	if (effVerdict === "deny") return { verdict: "deny", reason: effReason, source: effSource, degraded: false, shadow };
+	if (effVerdict === "allow") return { verdict: "allow", reason: effReason, source: effSource, degraded: false };
+	if (effVerdict === "deny") return { verdict: "deny", reason: effReason, source: effSource, degraded: false };
 	// ask:无 UI 降级为 deny(ask 降级,CONTEXT.md 词条)
-	return { verdict: "deny", reason: effReason, source: effSource, degraded: true, shadow };
+	return { verdict: "deny", reason: effReason, source: effSource, degraded: true };
 }
 
 // ============================================================================
@@ -1842,7 +1746,7 @@ export interface AutoModeDeps {
 export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	pi.registerFlag("auto-mode", { description: "Enable Auto Mode (rules + model classifier gating for tool calls)", type: "boolean", default: true });
 	pi.registerFlag("auto-mode-model", { description: "Classifier model as provider/id[:thinking] (pi --model syntax; default: inherit session model)", type: "string" });
-	pi.registerFlag("auto-mode-debug", { description: "Notify every verdict incl. allows, with shadow-cache annotation", type: "boolean", default: false });
+	pi.registerFlag("auto-mode-debug", { description: "Notify every verdict incl. allows", type: "boolean", default: false });
 
 	let enabled = pi.getFlag("auto-mode") !== false;
 	const debug = pi.getFlag("auto-mode-debug") === true || process.env.PI_AUTO_MODE_DEBUG === "1";
@@ -1857,19 +1761,21 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 		return { block: true, reason: blockedReason("tamper", r.reason) };
 	}
 
-	/** Verdict → UI(本扩展唯一的裁决呈现点):按 source × degraded 查模板,文案与
-	 *  重构前逐字节一致。受保护路径分支的通知永不携带路径明文与 action 行
+	/** Verdict → UI (the extension's single presentation point): presentation keys on
+	 *  source alone — the degraded context is implicit in the protected-path deny
+	 *  wording. Byte-identical with the pre-refactor wording; protected-path
+	 *  notifications never carry path plaintext or the action line
 	 *  (ADR-0002 story 11:通知与 block reason 回流 agent context)。 */
 	async function presentVerdict(v: Verdict, action: string, ctx: ExtensionContext): Promise<{ block: true; reason: string } | undefined> {
 		if (v.verdict === "allow") {
 			// #60 (CONTEXT.md 通知): classifier allows surface via notifyAllows OR
-			// debug — exactly one notification either way; the shadow suffix stays
-			// debug-only; mechanical passes (rule echo, protected-path confirm) stay
-			// debug-only — notifications carry judgment, the audit log carries completeness
+			// debug — exactly one notification either way; mechanical passes
+			// (rule echo, protected-path confirm) stay silent — notifications carry
+			// judgment, the audit log carries completeness
 			if (debug) {
 				if (v.source === "rule") ctx.ui.notify(`🛡️ allow (rule): ${action}`, "info");
 				else if (v.source === "protected-path") ctx.ui.notify("🛡️ allow (protected-path confirm)", "info");
-				else ctx.ui.notify(`🛡️ allow (classifier): ${v.reason}\n  ${action}${v.shadow ? " " + v.shadow : ""}`, "info");
+				else ctx.ui.notify(`🛡️ allow (classifier): ${v.reason}\n  ${action}`, "info");
 			} else if (state.userRules.notifyAllows && v.source === "classifier") {
 				ctx.ui.notify(`🛡️ allow (classifier): ${v.reason}\n  ${action}`, "info");
 			}
@@ -1889,7 +1795,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 				ctx.ui.notify(`🛡️ Auto Mode blocked: ${v.reason}\n  ${action}`, "warning");
 				return { block: true, reason: blockedReason("rule", v.reason) };
 			}
-			ctx.ui.notify(`🛡️ Auto Mode blocked: ${v.reason}\n  ${action}${debug && v.shadow ? " " + v.shadow : ""}`, "warning");
+			ctx.ui.notify(`🛡️ Auto Mode blocked: ${v.reason}\n  ${action}`, "warning");
 			return { block: true, reason: blockedReason("classifier", v.reason) };
 		}
 		// ask → 人工确认;非交互已在管线内降级,能走到这里的必有 UI
@@ -1918,7 +1824,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 		refreshStatus(ctx);
 	}
 
-	// session_start:重置影子缓存(会话内存态,#5 定案)+ 重载用户规则(配置改动新会话生效)
+	// session_start:重置级联计数(会话内存态)+ 重载用户规则(配置改动新会话生效)
 	// + 重建自保护基线(ADR-0001:受保护文件的会话启动快照)
 	pi.on("session_start", async (_event, ctx) => {
 		const report = state.reset(ctx.cwd);
@@ -1951,15 +1857,21 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	/** Status line audit hint (#54): shown only while the sink is active */
 	const auditHint = () => (state.audit ? `\naudit: on → ${state.audit.dir}` : "");
 	/** Status line cascade hint (#63/#67): shown while the floor or the fallback is configured */
-	const fallbackHint = () => (state.userRules.classifierMinConfidence !== null || state.userRules.classifierFallbackModel ? `\n${state.fallback.summary(state.userRules.classifierFallbackMode)}` : "");
+	const fallbackHint = () => {
+		if (state.userRules.classifierMinConfidence === null && !state.userRules.classifierFallbackModel) return "";
+		const shadowNote = state.userRules.classifierFallbackModel && state.userRules.classifierFallbackMode === "shadow"
+			? "\nsecond layer is shadow (records only, never applies) — set classifierFallbackMode to \"enforce\" to activate it"
+			: "";
+		return `\n${state.fallback.summary(state.userRules.classifierFallbackMode)}${shadowNote}`;
+	};
 
 	pi.registerCommand("automode", {
-		description: "Show Auto Mode status and shadow-cache stats, or set it: /automode on|off",
+		description: "Show Auto Mode status, or set it: /automode on|off",
 		handler: async (args, ctx) => {
 			const arg = args.trim().toLowerCase();
-			// 裸调用:只读状态展示,无副作用(含影子缓存统计行)
+			// 裸调用:只读状态展示,无副作用
 			if (arg === "") {
-				ctx.ui.notify(`${enabled ? "🛡️ Auto Mode: on" : "Auto Mode: off"}\n${state.shadow.summary()}${denyPathsHint()}${auditHint()}${fallbackHint()}\nUsage: /automode on|off${toggleHint()}`, "info");
+				ctx.ui.notify(`${enabled ? "🛡️ Auto Mode: on" : "Auto Mode: off"}\n${denyPathsHint()}${auditHint()}${fallbackHint()}\nUsage: /automode on|off${toggleHint()}`, "info");
 			return;
 			}
 			// 幂等设定:与现值相同不翻转,仅确认
@@ -1970,7 +1882,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 				const head = next
 					? `🛡️ Auto Mode enabled${changed ? "" : " (unchanged)"}: tool calls adjudicated by rules + classifier`
 					: `Auto Mode disabled${changed ? "" : " (unchanged)"}: tool calls execute directly`;
-				ctx.ui.notify(`${head}\n${state.shadow.summary()}${fallbackHint()}`, "info");
+				ctx.ui.notify(`${head}\n${fallbackHint()}`, "info");
 				return;
 			}
 			// 未知参数:严格拒绝并列出用法(大小写已归一化)
@@ -2092,7 +2004,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 			}
 		}
 
-		// 判定管线(零 UI)→ 呈现(source × degraded 模板)
+		// 判定管线(零 UI)→ 呈现(source 模板)
 		const verdict = await adjudicate(state, { toolName: event.toolName, input }, {
 			cwd: ctx.cwd,
 			hasUI: !!ctx.hasUI,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-verdict",
-	"version": "0.11.0",
+	"version": "0.12.0",
 	"description": "A minimal permission gate for Pi in the style of Claude Code's auto mode",
 	"author": "Jesset (https://github.com/jesset)",
 	"type": "module",