pi-verdict 0.13.0 → 0.14.0

package/README.md

@@ -119,7 +119,7 @@ pi-verdict 0.13+ requires **pi ≥ 0.99** and runs on pi only (native classifier
 
 - `allow`/`deny` are JS regex arrays; **`deny` wins over `allow`**, both beat the classifier
 - `denyPaths` are plain paths you declare **protected** — touches trigger a terminal ask you adjudicate (non-interactive → deny); the classifier never learns the paths themselves, only that they exist. `grep`/`find`/`ls` compare their whole **search scope**: an omitted `path` (pi's default: the current directory) or a parent directory of a declared path triggers the ask as well. A fresh install pre-fills a **starter list** (`~/.ssh/`, `~/.gnupg`, `~/.mc`, shell rc/profile files)
-- `ignoreTools` names uncovered tools (`todo`, `web_search`, MCP/custom tools) that skip adjudication — **allow with zero model calls**; entries naming covered tools (`bash`/`read`/`write`/`edit`/`grep`/`find`/`ls`/`powershell`) are inert: those stay governed by the deny floor and your allow/deny rules, and the self-protection layer always runs first. A fresh install pre-fills a **starter list** (`todo`, `ask_user_question`, `memory_write`, `memory_search` — observed harmless across the 1265-verdict production audit). Caveat: an exempted tool loses the classifier's `denyPaths` existence-hint vigilance (uncovered tools never hit the path extractor anyway)
+- `ignoreTools` names uncovered tools (`todo`, `web_search`, MCP/custom tools) that skip adjudication — **allow with zero model calls**; entries naming covered tools (`bash`/`read`/`write`/`edit`/`grep`/`find`/`ls`/`powershell`) are inert: those stay governed by the deny floor and your allow/deny rules, and the self-protection layer always runs first. A fresh install pre-fills a **starter list** (`todo`, `ask_user_question`, `memory_write`, `memory_search` — observed harmless across the 1265-verdict production audit). Caveat: an exempted tool loses the classifier's `denyPaths` existence-hint vigilance (uncovered tools never hit the path extractor anyway); MCP tool names are normalized before matching — see [codemode & MCP](#pi-099-codemode--mcp-indirect-calls-are-still-gated)
 - `builtinDenyFloor: false` turns off the built-in danger/path floor (your risk; the self-protection layer below always stays on)
 - `classifierModel` pins the classifier model, e.g. `"zai/glm-5.3-flash:low"` (thinking suffix supported; default: session model with thinking off)
 - `classifierModel: "typesafe/jev-latest"` opts into the **native jev classifier** — one structured `classify()` call per gray-zone verdict via pi's built-in classifier catalog (TypeSafe direct, or Jev on OpenRouter/OpenCode/Cloudflare/Vercel); see [ADR-0005](docs/adr/0005-native-classifier-migration.md)
@@ -141,13 +141,24 @@ No built-in allowlist — every "always allow" claim is yours ([why](docs/config
    - or try it once: `PI_AUTO_MODE_MODEL=typesafe/jev-latest pi`
 
 **Notes**:
-- Verdicts are structured `classify()` answers (choice + probabilities + confidence); the reason line keeps the historical `jev:` shape, other classifier APIs render `classifier:`
+- Verdicts are structured `classify()` answers (choice + probabilities + confidence); the reason line keeps the historical `jev:` probability breakdown (tag-free — the `<verdict>` prefix survives only in the audit record's rawResponse), other classifier APIs render `classifier:`
 - Classifier specs resolve through pi's classifier catalog first (`findOfType`), chat registry second; on same-id dual listings (llama.cpp) the native entry wins; thinking suffixes on a classifier spec warn once and drop (recorded `thinking: null`)
 - Custom endpoints: override the provider's `baseUrl` in models.json (the 0.12 `PI_VERDICT_JEV_URL` escape hatch is gone, as is `PI_VERDICT_JEV_TRANSPORT` — transport choice is now the spec itself)
 - Carried-over limit: the denyPaths existence hint still does not reach classifier-typed models ([ADR-0005](docs/adr/0005-native-classifier-migration.md)); on the TypeSafe direct transport per-call cost shows $0 (its API does not report it)
 
 jev's calibrated confidence is exactly what the confidence floor keys on — pair it with a second layer (`"classifierMinConfidence", "classifierFallbackModel"`) so its low-confidence calls go to a deeper model instead of standing ([ADR-0004](docs/adr/0004-classifier-fallback-cascade.md)).
 
+### pi 0.99 codemode & MCP: indirect calls are still gated
+
+pi 0.99 can run model-written JavaScript in a QuickJS sandbox (`codemode`) that calls pi's tools, and MCP servers register tools as `mcp__<server>__<tool>`. Neither surface bypasses this gate:
+
+- **Nested calls are gated exactly like direct ones** — pi routes every tool call a codemode script makes through the same `tool_call` pipeline (tagged `parentToolCallId`, ids `<parent>/<n>`); a blocked call returns as an error to the script, which the model sees
+- **MCP tools land in the gray zone** — the rule layer covers the built-in command/file tools only; each `mcp__*` call is classified, fail-closed included
+- **`ignoreTools` and MCP names**: tool names are normalized — every character outside `[A-Za-z0-9_]` becomes `_` (`mcp__dev-radius__x` → `mcp__dev_radius__x`); exemption entries must use the normalized form
+- **Cost amplification**: one script may issue up to 256 nested calls; gray-zone calls classify one by one, so a slow LLM classifier multiplies per-call latency
+- **Exposure boundary**: adding an MCP server auto-enables codemode, and `pi --no-extensions -e builtin:mcp` runs MCP tools with no extensions loaded — i.e. without this gate. The gate is itself an extension, so it cannot be active in a session that loads none; the boundary is inherent to pi's extension model, stated here rather than papered over
+- **Batch latency is configurable** ([ADR-0006](docs/adr/0006-codemode-nested-calls-policy.md)): every nested call adjudicates individually and gray-zone adjudication is serial (~350ms/call measured), so large script batches pay real latency. `"codemodeNestedCalls": "rules-only"` opts nested calls into the deterministic layers only (rules, floor, self-protection, denyPaths + ask) — the gray zone passes; the trade-off is that rule-passing actions the classifier would have caught (e.g. a nested `bash head ~/.ssh/config` without a denyPaths declaration) pass too. Audit records carry `toolCallId`/`parentToolCallId` either way
+
 ### Self-protection (the gate guards itself — [ADR-0001](docs/adr/0001-self-protection-layer.md))
 
 The gate's own files — the config and the installed extension copy — are **user-editable only**: writes from inside the gate hard-deny (reads pass); your editor never passes through the gate, the sudoers/visudo precedent.
@@ -174,7 +185,7 @@ Honest framing: pi-automode and pi-verdict have **converged on the same architec
 
 ![pi-verdict security gate — tool-call adjudication pipeline](https://cdn.jsdelivr.net/gh/jesset/pi-verdict@main/docs/diagrams/security-pipeline.en.svg)
 
-*Diagram source & regeneration: [docs/diagrams/](docs/diagrams/README.md). Pipeline as of v0.12 — the ASCII version below is the text-faithful equivalent.*
+*Diagram source & regeneration: [docs/diagrams/](docs/diagrams/README.md). Pipeline as of v0.14 — the ASCII version below is the text-faithful equivalent.*
 
 ```
 tool_call
@@ -192,10 +203,13 @@ tool_call
   │     ├─ ignoreTools: your declared uncovered tools → allow, zero model calls
   │     └─ no built-in allowlist — every "always allow" claim is yours to make
   │
-  ├─ 2. Gray zone → model classifier (defaults to session model — "self-reflection")
-  │     ├─ input: CC-style <transcript> — recent user intent + tool calls,
-  │     │        action under review always last
-  │     └─ output contract: <verdict>allow|ask|deny</verdict> prefix-anchored
+  ├─ 2. Gray zone → nested-call policy, then model classifier
+  │     ├─ nested call (codemode) + codemodeNestedCalls=rules-only → pass;
+  │     │   deterministic layers above already ran (ADR-0006)
+  │     ├─ gate (default, or a direct call) → classifier: native classify()
+  │     │   (choice + probabilities + confidence; tag-free reason, full contract
+  │     │   line in the audit rawResponse) or, on the chat path (session-model
+  │     │   self-reflection), <verdict>…</verdict> prefix-anchored free text
   │
   └─ 3. Three-state adjudication
         ├─ allow → pass
@@ -223,6 +237,7 @@ Design decisions here are settled by measurement, and the lab notes ship with th
 - no built-in allowlist by design (see the [bypass writeup](research/rule-layer-security-audit.md)); with an empty `allow` config most commands go to the classifier — point `--auto-mode-model` at a fast model if per-call latency matters
 - the path sensitivity floor applies to file tools only: bash command strings are matched by the danger regexes alone, so e.g. `cat ~/.ssh/id_rsa` goes to the classifier rather than the deterministic S0 deny (the file-tool spelling `read ~/.ssh/id_rsa` does deny)
 - on Windows the built-in floor covers bash-shaped patterns only — PowerShell-native dangerous commands (`Remove-Item -Recurse -Force`, `Invoke-Expression`, `Set-ExecutionPolicy`, …) rely on the classifier (fail-closed)
+- on macOS the per-user temp tree (`$TMPDIR`, the `/var/folders/…/T` confstr dir) is exempt from the system-directory floor: reads allow at zero cost, writes adjudicate as ordinary outside-project writes (classifier). The exemption anchors to the runtime-resolved confstr family — a hand-set `TMPDIR` lifts nothing — and `/var/tmp` (POSIX shared temp) stays denied; symlink spellings whose real form escapes the temp tree still hit S1
 - AGENTS.md is not passed to the classifier as downweighted intent evidence (Claude Code does this)
 - parallel gray-zone calls are adjudicated serially
 - self-reflection means the session model adjudicates — point `--auto-mode-model` at a lighter model if verdict latency/cost matters (open question tracked in the issue tracker)

package/README.zh-CN.md

@@ -119,7 +119,7 @@ pi-verdict 0.13+ 需 **pi ≥ 0.99**,仅支持 pi(原生分类器接入,[ADR-000
 
 - `allow`/`deny` 为 JS 正则数组；**`deny` 优先于 `allow`**，两者都优先于分类器
 - `denyPaths` 是你声明**受保护**的普通路径列表：触碰触发**终局 ask** 由你裁决(非交互降级 deny)；分类器只被告知路径**存在**，路径明文永不出本机。`grep`/`find`/`ls` 按**整个搜索范围**比较：省略 `path`(pi 默认：当前目录)或传入位于声明路径之上的父目录，同样触发 ask。全新安装会预填一份**入门列表**(`~/.ssh/`、`~/.gnupg`、`~/.mc`、shell rc/profile 文件)
-- `ignoreTools` 列出规则未覆盖的工具(`todo`、`web_search`、MCP/自定义工具)：**直接放行、零模型调用**；列出已覆盖工具(`bash`/`read`/`write`/`edit`/`grep`/`find`/`ls`/`powershell`)的条目无效：它们仍受 deny floor 与你的 allow/deny 规则约束，自保护层也永远先行。全新安装会预填一份**入门列表**(`todo`、`ask_user_question`、`memory_write`、`memory_search`——来自项目 1265 条生产审计的观察)。注意：被豁免的工具失去分类器对 `denyPaths` 的存在性话术警戒(未覆盖工具本就不进路径提取器)
+- `ignoreTools` 列出规则未覆盖的工具(`todo`、`web_search`、MCP/自定义工具)：**直接放行、零模型调用**；列出已覆盖工具(`bash`/`read`/`write`/`edit`/`grep`/`find`/`ls`/`powershell`)的条目无效：它们仍受 deny floor 与你的 allow/deny 规则约束，自保护层也永远先行。全新安装会预填一份**入门列表**(`todo`、`ask_user_question`、`memory_write`、`memory_search`——来自项目 1265 条生产审计的观察)。注意：被豁免的工具失去分类器对 `denyPaths` 的存在性话术警戒(未覆盖工具本就不进路径提取器);MCP 工具名匹配前会归一化——见 [codemode 与 MCP](#pi-099-codemode-与-mcp间接调用同样受门禁)
 - `builtinDenyFloor: false` 整体关闭内置危险/路径拦截(风险自担；下方自保护层永远开启)
 - `classifierModel` 指定分类器模型，如 `"zai/glm-5.3-flash:low"`(支持思考后缀；缺省 = 会话模型且显式关思考)
 - `classifierModel: "typesafe/jev-latest"` 启用**原生 jev 分类器**——每次灰区裁决经 pi 内置分类器目录发一次结构化 `classify()` 调用(TypeSafe 直连,或 OpenRouter/OpenCode/Cloudflare/Vercel 上的 Jev);详见 [ADR-0005](docs/adr/0005-native-classifier-migration.md)
@@ -141,13 +141,24 @@ pi-verdict 0.13+ 需 **pi ≥ 0.99**,仅支持 pi(原生分类器接入,[ADR-000
   - 或者临时试用一次:`PI_AUTO_MODE_MODEL=typesafe/jev-latest pi`
 
 **说明**:
-- 裁决为结构化 `classify()` 应答(choice + probabilities + confidence);reason 行保留历史 `jev:` 形态,其余分类器 API 渲染 `classifier:`
+- 裁决为结构化 `classify()` 应答(choice + probabilities + confidence);reason 行保留历史 `jev:` 概率分解(无标签——`<verdict>` 前缀只存活于审计记录的 rawResponse),其余分类器 API 渲染 `classifier:`
 - 分类器 spec 先经 pi 分类器目录解析(`findOfType`)、chat 注册表兜底;同 id 双型并存(llama.cpp)时原生条目优先;分类器 spec 上的思考后缀警告一次后丢弃(审计 `thinking` 记为 `null`)
 - 自定义端点:在 models.json 覆盖 provider 的 `baseUrl`(0.12 的 `PI_VERDICT_JEV_URL` 逃生口与 `PI_VERDICT_JEV_TRANSPORT` 均已移除——transport 选择即 spec 本身)
 - 沿袭限制:denyPaths 存在性话术仍不达分类器形态模型([ADR-0005](docs/adr/0005-native-classifier-migration.md));TypeSafe 直连的单次成本显示 $0(其 API 不返回 cost)
 
 jev 的校准 confidence 正是置信地板的判定依据——搭配第二层使用(`"classifierMinConfidence", "classifierFallbackModel"`)，让低置信调用交由更深的模型复裁，而非就地生效([ADR-0004](docs/adr/0004-classifier-fallback-cascade.md))。
 
+### pi 0.99 codemode 与 MCP:间接调用同样受门禁
+
+pi 0.99 可以在 QuickJS 沙箱(`codemode`)里运行模型写的 JavaScript 去调用 pi 的工具,MCP 服务器则以 `mcp__<server>__<tool>` 注册工具。这两个新增面都不会绕过本门禁:
+
+- **嵌套调用与直接调用同样过门**——pi 把 codemode 脚本发起的每一次工具调用都路由到同一条 `tool_call` 管线(带 `parentToolCallId`,id 形如 `<父id>/<n>`);被拦截的调用以错误形式回传脚本,模型可见
+- **MCP 工具落入灰区**——规则层只覆盖内置命令/文件工具;每次 `mcp__*` 调用都走分类器,含 fail-closed
+- **`ignoreTools` 与 MCP 工具名**:工具名会归一化——`[A-Za-z0-9_]` 之外的字符统一变 `_`(`mcp__dev-radius__x` → `mcp__dev_radius__x`);豁免条目必须写归一化后的形态
+- **成本放大**:单个脚本最多可发 256 次嵌套调用,灰区调用逐个分类,慢的 LLM 分类器会把单次延迟成倍放大
+- **暴露边界**:添加 MCP 服务器会自动开启 codemode,而 `pi --no-extensions -e builtin:mcp` 可在不加载任何扩展(即无本门禁)的情况下启用 MCP 工具。门禁自身即扩展,在完全不加载扩展的会话中无法生效;此边界为 pi 扩展模型的固有属性,此处显式陈述而非掩饰
+- **批量延迟可配置**([ADR-0006](docs/adr/0006-codemode-nested-calls-policy.md)):每个嵌套调用独立裁决且灰区裁决为串行(实测 ~350ms/次),大脚本批次的判定开销可观。`"codemodeNestedCalls": "rules-only"` 让嵌套调用只走确定性层(规则、floor、自保护、denyPaths + ask)——灰区直接放行;代价是规则层放行、但分类器会拦的动作(如未声明 denyPaths 时的嵌套 `bash head ~/.ssh/config`)同样放行。两种模式下审计记录均携带 `toolCallId`/`parentToolCallId` 归因
+
 ### 自保护(门禁守护自身——[ADR-0001](docs/adr/0001-self-protection-layer.md))
 
 门禁自身的文件——配置与扩展安装副本——**仅用户可改**：门禁之内的写入一律硬 deny(读放行)；你的编辑器修改不经门禁，同类先例是 sudoers 必须经 visudo。
@@ -174,7 +185,7 @@ jev 的校准 confidence 正是置信地板的判定依据——搭配第二层
 
 ![pi-verdict 安全门禁——工具调用判定管线](https://cdn.jsdelivr.net/gh/jesset/pi-verdict@main/docs/diagrams/security-pipeline.zh.svg)
 
-*图源与再生成：[docs/diagrams/](docs/diagrams/README.md)。管线基准：v0.12——下方 ASCII 为文本等价版。*
+*图源与再生成：[docs/diagrams/](docs/diagrams/README.md)。管线基准：v0.14——下方 ASCII 为文本等价版。*
 
 ```
 tool_call
@@ -192,10 +203,13 @@ tool_call
   │     ├─ ignoreTools:用户声明的未覆盖工具 → 直接放行,零模型调用
   │     └─ 无内置白名单 —— 「永远放行」的声明由你自己做
   │
-  ├─ 2. 灰区 → 模型分类器(默认继承会话模型 —— "自省")
-  │     ├─ 输入:CC 风格 <transcript> —— 近期用户意图 + 工具调用,
-  │     │        待审动作固定在末尾
-  │     └─ 输出契约:<verdict>allow|ask|deny</verdict> 前缀锚定
+  ├─ 2. 灰区 → 嵌套策略,再进模型分类器
+  │     ├─ 嵌套调用(codemode)+ codemodeNestedCalls=rules-only → 放行;
+  │     │   上方确定性层已全部跑完(ADR-0006)
+  │     ├─ gate(默认,或直发调用)→ 分类器:原生 classify()
+  │     │   (choice + probabilities + confidence;reason 无标签,完整契约行
+  │     │   存审计 rawResponse)或 chat 路径(会话模型自省)的
+  │     │   <verdict>…</verdict> 前缀锚定自由文本
   │
   └─ 3. 三态裁决
         ├─ allow → 放行
@@ -223,6 +237,7 @@ tool_call
 - 设计上无内置白名单(见[绕过测试](research/rule-layer-security-audit.md)与[用户自定义规则](#用户自定义规则pi-verdictjson))；allow 配置为空时大多数命令进分类器 —— 延迟敏感可 `--auto-mode-model` 指向轻量模型
 - 路径敏感度 floor 只作用于文件类工具：bash 命令串仅匹配危险正则——`cat ~/.ssh/id_rsa` 走分类器而非确定性 S0 拦截(文件工具拼写 `read ~/.ssh/id_rsa` 会拦截)
 - Windows 下内置 floor 仅覆盖 bash 形态模式——PowerShell 原生危险命令(`Remove-Item -Recurse -Force`、`Invoke-Expression`、`Set-ExecutionPolicy` 等)依赖分类器兜底(fail-closed)
+- macOS 下 per-user 临时目录(`$TMPDIR`,`/var/folders/…/T` confstr 目录)豁免于系统目录 floor:读零成本放行,写按普通项目外写交分类器裁决。豁免锚定运行时解析的 confstr 族——手工设置 `TMPDIR` 不会解除任何保护;`/var/tmp`(POSIX 共享临时目录)维持拦截;真实形态逃逸临时树的符号链接拼写仍命中 S1
 - AGENTS.md 未作为降权意图证据传入分类器(Claude Code 有此设计)
 - 并行灰区调用串行裁决
 - 自省意味着会话模型自身裁决 —— 若延迟/成本敏感，用 `--auto-mode-model` 指向轻量模型(开放问题见 issue tracker)

package/extensions/pi-verdict.ts

@@ -276,9 +276,17 @@ interface UserRules {
 	/** #67: does the second layer adjudicate cascaded calls ("enforce", default since
 	 *  0.12.0) or only record its opinion while the human decides ("shadow")? */
 	classifierFallbackMode: "shadow" | "enforce";
+	/** #90/ADR-0006: nested-call policy. "gate" (default) = nested calls adjudicate
+	 *  identically to direct calls; "rules-only" = nested calls keep every
+	 *  deterministic layer (self-protection, floor, user rules, denyPaths + its ask)
+	 *  and skip only the classifier + cascade — the gray zone passes, because serial
+	 *  adjudication of codemode batches amplifies per-call latency (live-fire:
+	 *  ~350ms/call). Opt-in: rule-passing actions the classifier would have caught
+	 *  pass under rules-only (coverage is denyPaths-declaration-dependent). */
+	codemodeNestedCalls: "gate" | "rules-only";
 }
 
-const EMPTY_RULES: UserRules = { allow: [], deny: [], denyPaths: [], ignoreTools: [], builtinDenyFloor: true, classifierModel: null, toggleShortcut: DEFAULT_TOGGLE_SHORTCUT, audit: false, notifyAllows: false, classifierMinConfidence: null, classifierFallbackModel: null, classifierFallbackMode: "enforce" };
+const EMPTY_RULES: UserRules = { allow: [], deny: [], denyPaths: [], ignoreTools: [], builtinDenyFloor: true, classifierModel: null, toggleShortcut: DEFAULT_TOGGLE_SHORTCUT, audit: false, notifyAllows: false, classifierMinConfidence: null, classifierFallbackModel: null, classifierFallbackMode: "enforce", codemodeNestedCalls: "gate" };
 
 /** This module's own file location (import.meta.url resolved; null = unresolvable). */
 const OWN_FILE_PATH: string | null = (() => {
@@ -371,7 +379,7 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 			} catch { /* 只读环境静默跳过 */ }
 			return { rules: EMPTY_RULES, skipped: [], shortcutWarning: null };
 		}
-		let raw: { allow?: unknown; deny?: unknown; denyPaths?: unknown; ignoreTools?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown; toggleShortcut?: unknown; audit?: unknown; notifyAllows?: unknown; classifierFallbackModel?: unknown; classifierFallbackConfidence?: unknown; classifierMinConfidence?: unknown; classifierFallbackMode?: unknown };
+		let raw: { allow?: unknown; deny?: unknown; denyPaths?: unknown; ignoreTools?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown; toggleShortcut?: unknown; audit?: unknown; notifyAllows?: unknown; classifierFallbackModel?: unknown; classifierFallbackConfidence?: unknown; classifierMinConfidence?: unknown; classifierFallbackMode?: unknown; codemodeNestedCalls?: unknown };
 		try {
 			raw = JSON.parse(fs.readFileSync(p, "utf8")) as typeof raw;
 		} catch (err) {
@@ -416,6 +424,9 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 		if (minConfRaw !== undefined && minConfRaw !== null && !minConfOk) skipped.push(`classifierMinConfidence: ${JSON.stringify(minConfRaw)}`);
 		const fbModeRaw = raw.classifierFallbackMode;
 		if (fbModeRaw !== undefined && fbModeRaw !== "shadow" && fbModeRaw !== "enforce") skipped.push(`classifierFallbackMode: ${JSON.stringify(fbModeRaw)}`);
+		// #90: nested-call policy — invalid values skip into the one-shot warning channel
+		const nestedRaw = raw.codemodeNestedCalls;
+		if (nestedRaw !== undefined && nestedRaw !== "gate" && nestedRaw !== "rules-only") skipped.push(`codemodeNestedCalls: ${JSON.stringify(nestedRaw)}`);
 		return {
 			rules: {
 				allow: compile(raw.allow),
@@ -430,6 +441,7 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 				classifierFallbackModel: typeof raw.classifierFallbackModel === "string" && raw.classifierFallbackModel.trim() ? raw.classifierFallbackModel.trim() : null,
 				classifierMinConfidence: minConfOk ? minConfRaw : null,
 				classifierFallbackMode: fbModeRaw === undefined ? "enforce" : fbModeRaw === "enforce" ? "enforce" : "shadow", // invalid values land on the conservative shadow (standing invalid-config precedent); the key-less default is enforce
+				codemodeNestedCalls: nestedRaw === "rules-only" ? "rules-only" : "gate", // invalid values keep the safe default (gate)
 			},
 			skipped,
 			shortcutWarning: shortcut.warning,
@@ -461,7 +473,62 @@ const S0_SECRET = [
 ];
 // /private prefixes: macOS firmlinks — /etc, /var are really /private/etc,
 // /private/var, and realpath'd toolchain output uses the real spelling (#21)
-const S1_SYSTEM = [/^\/etc(\/|$)/i, /^\/private\/(etc|var)(\/|$)/i, /^\/usr(\/|$)/i, /^\/var(\/|$)/i, /^\/System(\/|$)/i, /(^|\/)authorized_keys$/i];
+// Split into two families (#83): the directory-prefix family (what the per-user
+// temp exemption may lift on macOS) and the basename family (authorized_keys —
+// staging it in a temp dir must stay denied; defense in depth for the
+// stage-then-copy chain).
+const S1_SYSTEM_DIRS = [/^\/etc(\/|$)/i, /^\/private\/(etc|var)(\/|$)/i, /^\/usr(\/|$)/i, /^\/var(\/|$)/i, /^\/System(\/|$)/i];
+const S1_SYSTEM_FILES = [/(^|\/)authorized_keys$/i];
+const S1_SYSTEM = [...S1_SYSTEM_DIRS, ...S1_SYSTEM_FILES];
+
+/** #83: the per-user temp exemption bases — macOS confstr family only, at the
+ *  confstr DEPTH (two segments below the family root: /var/folders/<xx>/<yy>/…),
+ *  so the family root itself or a stray one-level child can never widen the
+ *  exemption. The guard is deliberate: os.tmpdir() reads the process env, so
+ *  trusting it verbatim would let a hand-set TMPDIR (e.g. TMPDIR=/etc, or the
+ *  family root) lift the floor over S1 trees — narrowing the never-config-exemptible
+ *  floor must go through code review, not an env accident. Another user's confstr
+ *  subtree technically passes the depth check but is macOS-permission-guarded
+ *  (same-user threat only). /var/tmp (POSIX shared temp) intentionally stays S1.
+ *  Returns [] (inert) on every other platform — their tmpdirs never match S1. */
+export function computeTmpdirBases(
+	platform: NodeJS.Platform,
+	tmp: string,
+	realpath: (p: string) => string | null,
+): string[] {
+	if (platform !== "darwin" || !tmp) return [];
+	const lexical = path.resolve(tmp);
+	const real = realpath(lexical);
+	const bases = real === null ? [lexical] : [lexical, real];
+	const confstrFamily = /^(?:\/private)?\/var\/folders\/[^/]+\/[^/]+(?:\/|$)/;
+	return bases.every((b) => confstrFamily.test(b)) ? bases : [];
+}
+
+/** The session-constant exemption bases (os.tmpdir() is stable for a process
+ *  lifetime); test-overridable via the exported seam below. */
+function defaultTmpdirBases(): string[] {
+	return computeTmpdirBases(process.platform, os.tmpdir(), (p) => {
+		try {
+			return fs.realpathSync(p);
+		} catch {
+			return null;
+		}
+	});
+}
+
+let tmpdirExemptBases = defaultTmpdirBases();
+
+/** Test seam for tmpdirExemptBases — exported for tests only (the internal-seam
+ *  surface, the standing #35 pattern); null restores the production bases. */
+export function setTmpdirBasesForTests(bases: string[] | null): void {
+	tmpdirExemptBases = bases ?? defaultTmpdirBases();
+}
+
+/** #83: is EVERY canonical form of the target under the per-user temp tree?
+ *  Intersection semantics (#20 discipline): a lexical temp spelling whose real
+ *  form escapes (symlink to /etc) is NOT exempt — the S1 grading still applies. */
+const tmpdirExempt = (forms: string[]): boolean =>
+	tmpdirExemptBases.length > 0 && forms.every((f) => tmpdirExemptBases.some((b) => f === b || f.startsWith(b + path.sep)));
 const S2_USER_RC = [/\.(bashrc|zshrc|profile|bash_profile|gitconfig)$/i, /crontab/i, /Library\/LaunchAgents(\/|$)/i, /\.config\/systemd(\/|$)/i];
 const S3_GIT_META = [/(^|\/)\.git\/(hooks|config|modules)(\/|$)/i, /(^|\/)\.gitmodules$/i];
 
@@ -479,11 +546,17 @@ function classifyPath(toolName: string, rawPath: string, cwd: string, isWrite: b
 		: (reason: string): RuleResult => ({ verdict: "gray", reason });
 
 	if (hit(S0_SECRET)) return D(`S0 secrets/credential path: ${rawPath}`);
+	// #83: under the per-user temp tree the DIRECTORY-prefix family of S1 lifts (a
+	// macOS confstr temp dir is per-user scratch, not a system directory); the
+	// basename family (authorized_keys) still applies, and the fall-through keeps the
+	// deny-only floor philosophy — reads regain the ordinary read allow, writes grade
+	// as ordinary outside-project writes (gray, classifier-adjudicated).
+	const s1Rules = tmpdirExempt(forms) ? S1_SYSTEM_FILES : S1_SYSTEM;
 	if (!isWrite) {
-		if (hit(S1_SYSTEM)) return { verdict: "gray", reason: `read system config path: ${rawPath}` };
+		if (hit(s1Rules)) return { verdict: "gray", reason: `read system config path: ${rawPath}` };
 		return { verdict: "allow" };
 	}
-	if (hit(S1_SYSTEM)) return D(`write to system directory: ${rawPath}`);
+	if (hit(s1Rules)) return D(`write to system directory: ${rawPath}`);
 	if (hit(S3_GIT_META)) return D(`write to .git metadata (executable code entry point): ${rawPath}` );
 	if (hit(S2_USER_RC)) return { verdict: "gray", reason: `write to user config/persistence entry point: ${rawPath}` };
 	// In-cwd write allowance (#20): every canonical form must sit inside the cwd
@@ -556,10 +629,126 @@ function userRuleTarget(toolName: string, input: Record<string, unknown>, cwd: s
 // only ever sees a fixed existence hint — zero path plaintext.
 // ============================================================================
 
-/** Path-like tokens in a shell command string: ~/…, $HOME/…, absolute /…, ./… / ../…, and word/word relative forms. URL path segments can match the absolute branch — harmless: resolution against denyPaths prefixes is what decides, false positives ask (safe direction) */
-const BASH_PATH_TOKENS =
+/** Path-like tokens in a shell command string: ~/…, $HOME/…, absolute /…, ./… / ../…, and word/word relative forms. URL path segments can match the absolute branch — harmless: resolution against denyPaths prefixes is what decides, false positives ask (safe direction).
+ *
+ * Exported as the SEMANTIC ORACLE for #32's linear tokenizer (bashPathTokens) — the
+ * production path never runs this regex: its four alternatives backtrack
+ * quadratically on long failure searches (a 200k separator-free run takes ~28s,
+ * issue #32), and unlike the danger regexes (#25's 8192 cap) it cannot be capped —
+ * truncation would let a protected-path spelling beyond the cap silently escape
+ * the deterministic ask (ADR-0002's never-silently-passed contract). */
+export const BASH_PATH_TOKENS =
 	/(?:~|\$HOME)(?:\/[\w.@*-]+)*|\/(?:[\w.@*-]+\/)*[\w.@*-]*|\.{1,2}(?:\/[\w.@*-]+)+|[\w.-]+(?:\/[\w.-]+)+/g;
 
+/** ASCII class membership for the tokenizer (JS \w is ASCII-only; non-ASCII code
+ *  points simply fall outside the classes, matching the regex). */
+const TOKEN_W2 = new Uint8Array(128); // [\w.@*-]
+const TOKEN_W4 = new Uint8Array(128); // [\w.-]
+for (let c = 0; c < 128; c++) {
+	const ch = String.fromCharCode(c);
+	if (/[a-zA-Z0-9_]/.test(ch) || ".@*-".includes(ch)) TOKEN_W2[c] = 1;
+	if (/[a-zA-Z0-9_]/.test(ch) || ".-".includes(ch)) TOKEN_W4[c] = 1;
+}
+
+const isW2 = (s: string, i: number): boolean => i < s.length && s.charCodeAt(i) < 128 && TOKEN_W2[s.charCodeAt(i)] === 1;
+const isW4 = (s: string, i: number): boolean => i < s.length && s.charCodeAt(i) < 128 && TOKEN_W4[s.charCodeAt(i)] === 1;
+
+/** #32: linear tokenizer for BASH_PATH_TOKENS — one deterministic pass, provably
+ *  O(n): each alternative parses greedily with at most a bounded (≤ 2) retry, and
+ *  the scan position only advances. The regex oracle's matchAll semantics are
+ *  reproduced exactly (alternation priority included; equivalence pinned by a
+ *  fuzz test against the oracle). Derivation per alternative:
+ *  - alt1 `(~|$HOME)(\/W2+)*`: the star never fails — prefix + maximal (/ + W2-run)
+ *    repetitions; a bare ~ / $HOME is a legal zero-iteration match.
+ *  - alt2 `\/(W2+\/)*W2*`: pairs stop at the first word-run not followed by a slash;
+ *    the trailing star always succeeds, so the greedy parse is THE match (a lone
+ *    "/" is a legal zero-pair, empty-tail match).
+ *  - alt3 `\.{1,2}(\/W2+)+`: dots are tried greedily (2 then 1 — the regex's DFS
+ *    order); the plus needs one '/'-then-W2 continuation, else the alternative fails.
+ *  - alt4 `W4+(\/W4+)+`: the leading run is maximal [p, e); a continuation is viable
+ *    ONLY at a '/' (a literal) immediately followed by a W4 char, and once viable
+ *    the greedy inner always completes — so the DFS-first match takes the LARGEST
+ *    viable '/' at or before e and extends greedily. This is exactly where the
+ *    regex paid O(n) per start position on failure; the scan computes it in O(1)
+ *    amortized. */
+export function bashPathTokens(command: string): string[] {
+	const s = command;
+	const n = s.length;
+	// Right-to-left precompute of maximal-run ends — the single pass that makes every
+	// position O(1): runEndX[i] = first index >= i not in class X (i when s[i] itself
+	// is out of class; n at the end of string).
+	const runEnd2 = new Int32Array(n + 1);
+	const runEnd4 = new Int32Array(n + 1);
+	runEnd2[n] = n;
+	runEnd4[n] = n;
+	for (let i = n - 1; i >= 0; i--) {
+		runEnd2[i] = isW2(s, i) ? runEnd2[i + 1] : i;
+		runEnd4[i] = isW4(s, i) ? runEnd4[i + 1] : i;
+	}
+	const out: string[] = [];
+	let p = 0;
+	while (p < n) {
+		const c = s[p];
+		let m = 0; // match end (exclusive); 0 = no match at p
+		if (c === "~" || s.startsWith("$HOME", p)) {
+			// alt1: deterministic greedy (/ + W2-run) repetitions
+			let q = c === "~" ? p + 1 : p + 5;
+			for (;;) {
+				if (s[q] === "/" && isW2(s, q + 1)) q = runEnd2[q + 1];
+				else break;
+			}
+			m = q;
+		} else if (c === "/") {
+			// alt2: (W2-run + /) pairs while possible, then the trailing W2-run
+			let q = p + 1;
+			for (;;) {
+				if (!isW2(s, q)) break; // empty tail — the match is the consumed prefix
+				const r = runEnd2[q];
+				if (s[r] !== "/") {
+					q = r; // tail run consumes through r
+					break;
+				}
+				q = r + 1; // pair complete — another may follow
+			}
+			m = q;
+		} else if (c === ".") {
+			// alt3: dots greedy 2 then 1; inner = maximal (/ + W2-run) repetitions, >= 1 required
+			const innerEnd = (q: number): number | null => {
+				if (s[q] !== "/" || !isW2(s, q + 1)) return null;
+				let r = q;
+				for (;;) {
+					if (s[r] === "/" && isW2(s, r + 1)) r = runEnd2[r + 1];
+					else break;
+				}
+				return r;
+			};
+			if (s[p + 1] === ".") m = innerEnd(p + 2) ?? 0;
+			if (m === 0) m = innerEnd(p + 1) ?? 0;
+		}
+		if (m === 0 && isW4(s, p)) {
+			// alt4: the maximal leading run is [p, e). '/' is not in W4, so the run
+			// itself contains no slash and the ONLY viable continuation split is at e
+			// — the O(1) step that replaces the regex's O(n)-per-position backtrack.
+			const e = runEnd4[p];
+			if (s[e] === "/" && isW4(s, e + 1)) {
+				let q = e;
+				for (;;) {
+					if (s[q] === "/" && isW4(s, q + 1)) q = runEnd4[q + 1];
+					else break;
+				}
+				m = q;
+			}
+		}
+		if (m > p) {
+			out.push(s.slice(p, m));
+			p = m; // matchAll semantics: continue after the match
+		} else {
+			p++;
+		}
+	}
+	return out;
+}
+
 /** Normalized forms of one path for denyPaths comparison: base tier only (ADR-0002) —
  *  no ancestor rebuild; a nonexistent target under a symlinked dir falls to the
  *  classifier + existence hint instead (pinned by a regression test). */
@@ -578,7 +767,7 @@ const anchorDenyPaths = (paths: string[], cwd: string): string[] => paths.flatMa
  *  IS the cwd subtree (#48). */
 function denyPathCandidates(toolName: string, input: Record<string, unknown>, cwd: string): string[] {
 	const kind = toolKind(toolName);
-	if (kind === "command") return [...String(input.command ?? "").matchAll(BASH_PATH_TOKENS)].map((m) => m[0]);
+	if (kind === "command") return bashPathTokens(String(input.command ?? "")); // #32: linear — the regex stays as the test oracle
 	if (kind === "file") {
 		const p = typeof input.path === "string" && input.path ? input.path : null;
 		if (!p) return isScopeTool(toolName) ? [cwd] : [];
@@ -1040,12 +1229,19 @@ export interface NativeClassifierSpec {
 	provider?: string;
 }
 
-/** The resolved classifier layer (ADR-0005): native = classify() protocol path
- *  (floor-capable by construction), chat = LLM prompt path (thinking applies). */
-export type ResolvedModel =
+/** The resolved classifier spec (ADR-0005): native = classify() protocol path
+ *  (floor-capable by construction), chat = LLM prompt path — what spec resolution
+ *  returns, before the thinking level is attached. */
+export type ResolvedSpec =
 	| { kind: "native"; model: NativeClassifierSpec }
 	| { kind: "chat"; model: NonNullable<ExtensionContext["model"]> };
 
+/** A fully resolved classifier layer: the spec plus its thinking level. Native
+ *  layers do not consume the level (classifier models carry no reasoning — a
+ *  suffix warns once and the audit records null), but the parsed value stays on
+ *  the layer; chat layers pass it through to the completion call. */
+export type ResolvedLayer = ResolvedSpec & { thinking: ThinkingLevel };
+
 export interface ClassifierAnswerShape {
 	type: string;
 	choice?: string;
@@ -1117,12 +1313,15 @@ export function confidencePercent(conf: number): number {
 	return Math.floor(conf * 100 + 1e-9);
 }
 
-/** Validates the verdict answer and synthesizes the contract line
- *  (`<verdict>…</verdict>` + one-line reason) from a native classify() answer. Any
- *  malformed shape throws — the caller's fail-closed path owns the fallout. Reason is
- *  user-facing (block reasons, ask dialogs): plain percentages, no internal notation.
- *  Confidence is hard-required (#63 carried over): the decisions contract guarantees it
- *  on choice answers, so absence is contract drift and drift fails closed. */
+/** Validates the verdict answer and synthesizes the human-readable reason line
+ *  (probability breakdown, plain percentages, no internal notation). Any malformed
+ *  shape throws — the caller's fail-closed path owns the fallout. Confidence is
+ *  hard-required (#63 carried over): the decisions contract guarantees it on choice
+ *  answers, so absence is contract drift and drift fails closed. The historical
+ *  `<verdict>…</verdict>` prefix is NOT part of the reason anymore (see the ADR-0005
+ *  amendment): it existed to satisfy the LLM path's parseVerdict contract, which the
+ *  native path never needed — the full contract line lives on in the audit record's
+ *  rawResponse only. */
 export function composeVerdictLine(answer: ClassifierAnswerShape, api: string): string {
 	const choice = String(answer.choice ?? "").trim().toLowerCase();
 	if (!VERDICTS.includes(choice as VerdictChoice)) {
@@ -1138,7 +1337,7 @@ export function composeVerdictLine(answer: ClassifierAnswerShape, api: string):
 		.map((v) => `${v} ${pct(probs[v])}`)
 		.join(", ");
 	const prefix = SYSTEM_ONE_APIS.has(api) ? "jev" : "classifier";
-	return `<verdict>${choice}</verdict> ${prefix}: ${choice} ${pct(probs[choice])} (confidence ${confidencePercent(conf)}%; ${rest})`;
+	return `${prefix}: ${choice} ${pct(probs[choice])} (confidence ${confidencePercent(conf)}%; ${rest})`;
 }
 
 const MAX_USER_MESSAGES = 5;
@@ -1419,12 +1618,16 @@ export async function classifyNative(
 	if (answer.type !== "choice") return fail(`malformed verdict answer (type=${JSON.stringify(answer.type)})`);
 	try {
 		const line = composeVerdictLine(answer, model.api);
+		const verdict = String(answer.choice).trim().toLowerCase() as ClassifierOutcome["verdict"];
 		return {
-			verdict: String(answer.choice).trim().toLowerCase() as ClassifierOutcome["verdict"],
+			verdict,
 			reason: line,
 			source: "model",
 			confidence: confidencePercent(answer.confidence as number),
-			auditRaw: { transcript, rawResponse: line, modelId: model.id, thinking: null },
+			// The audit keeps the full contract line (tag included) in rawResponse — "what
+			// the protocol said" — mirroring the LLM path's rawResponse (the model's full
+			// output, tag included). The reason field is human-facing and tag-free.
+			auditRaw: { transcript, rawResponse: `<verdict>${verdict}</verdict> ${line}`, modelId: model.id, thinking: null },
 		};
 	} catch (error) {
 		return fail(`${error instanceof Error ? error.message : String(error)}`);
@@ -1432,27 +1635,23 @@ export async function classifyNative(
 }
 
 async function classifyWithModel(
-	host: PipelineHost,
-	signal: AbortSignal | undefined,
-	complete: CompletionFn,
-	classify: ClassifyFn | undefined,
-	model: ResolvedModel,
-	actionLine: string,
-	thinking: ThinkingLevel = "off",
-	denyPathsActive = false,
-	timeoutMs: number = CLASSIFIER_TIMEOUT_MS,
+	env: Pick<AdjudicateEnv, "host" | "signal" | "complete" | "classify">,
+	resolved: ResolvedLayer,
+	call: { actionLine: string; denyPathsActive: boolean; timeoutMs?: number },
 ): Promise<ClassifierOutcome> {
-	if (model.kind === "native") return classifyNative(classify, model.model, host, actionLine, signal, timeoutMs);
-	const chat = model.model;
-	const transcript = buildTranscript(host, actionLine);
+	const timeoutMs = call.timeoutMs ?? CLASSIFIER_TIMEOUT_MS;
+	if (resolved.kind === "native") return classifyNative(env.classify, resolved.model, env.host, call.actionLine, env.signal, timeoutMs);
+	const chat = resolved.model;
+	const thinking = resolved.thinking;
+	const transcript = buildTranscript(env.host, call.actionLine);
 	const userMessage = `<transcript>\n${transcript}\n</transcript>\nJudge the LAST action in the transcript above. Your entire response MUST begin with <verdict>.`;
-	const systemPrompt = denyPathsActive ? CLASSIFIER_SYSTEM + DENY_PATHS_HINT : CLASSIFIER_SYSTEM;
+	const systemPrompt = call.denyPathsActive ? CLASSIFIER_SYSTEM + DENY_PATHS_HINT : CLASSIFIER_SYSTEM;
 	const attempts: Array<[number, number]> = [[1, CLASSIFIER_MAX_TOKENS], [2, CLASSIFIER_RETRY_MAX_TOKENS]];
 	const failures: string[] = [];
 	let rawResponse = ""; // #54: raw output of the last attempt ("" for exception attempts — diagnostics already live in failures)
 	for (const [n, maxTokens] of attempts) {
-		if (signal?.aborted) break; // 用户已取消,不再重试
-		const r = await callClassifierOnce(host, signal, complete, chat, userMessage, maxTokens, thinking, systemPrompt, timeoutMs);
+		if (env.signal?.aborted) break; // 用户已取消,不再重试
+		const r = await callClassifierOnce(env.host, env.signal, env.complete, chat, userMessage, maxTokens, thinking, systemPrompt, timeoutMs);
 		if (r.ok) {
 			rawResponse = r.text;
 			const diag = `stopReason=${r.stopReason}, model=${chat.id}, errorMessage=${JSON.stringify(r.errorMessage ?? null)}, raw output=${JSON.stringify(r.text.slice(0, 200))}`;
@@ -1554,14 +1753,23 @@ export interface AuditRecord {
 	verdict: "allow" | "ask" | "deny";
 	reason: string;
 	/** #62: protected-path asks are recorded too — their user answers grade the
-	 *  denyPaths rules; rule allow/deny verdicts remain unaudited. */
-	source: "model" | "fail-closed" | "protected-path";
+	 *  denyPaths rules; rule allow/deny verdicts remain unaudited. "rule" exists for
+	 *  one audited rule-layer outcome: the rules-only nested passthrough (#90). */
+	source: "model" | "fail-closed" | "protected-path" | "rule";
 	degraded: boolean;
 	/** #62 ground truth: the user's answer to an interactive ask confirm. Present only
 	 *  on records whose confirm actually ran; headless/degraded asks omit it. */
 	userAnswer?: "allowed" | "declined";
 	/** #62: ISO timestamp of the confirm resolution; `ts` stays adjudication time. */
 	answeredAt?: string;
+	/** #90: the call's id — `<parent id>/<n>` for nested calls (codemode scripts).
+ *  Direct-call records carry it too; pre-0.14 corpora simply lack the field. */
+	toolCallId?: string;
+	/** #90: set iff another tool (a codemode script) issued this call — the audit
+	 *  attribution that makes nested calls distinguishable from direct ones. */
+	parentToolCallId?: string;
+	/** #90: the nested-call policy in effect for a rules-only passthrough record. */
+	policy?: "rules-only";
 	/** #62: protected-path records only — the matched path. */
 	detail?: string;
 	/** #67: the confidence floor fired — the first-layer verdict was demoted. */
@@ -1704,14 +1912,14 @@ export interface Verdict {
 export interface AdjudicateEnv {
 	cwd: string;
 	hasUI: boolean;
-	getModel: () => { model: ResolvedModel; thinking: ThinkingLevel } | null;
+	getModel: () => ResolvedLayer | null;
 	complete: CompletionFn;
 	/** Native classify() seam (ADR-0005); absent on hosts without the capability —
 	 *  the native path fail-closes, never silently falls back to the chat path. */
 	classify?: ClassifyFn;
 	host: PipelineHost;
 	signal?: AbortSignal;
-	getFallbackModel?: () => { model: ResolvedModel; thinking: ThinkingLevel } | null;
+	getFallbackModel?: () => ResolvedLayer | null;
 }
 
 /** #67 (0.13, ADR-0005): the floor gates on protocol-native confidence — set only
@@ -1777,10 +1985,10 @@ async function runConfidenceCascade(
 	};
 	const resolved = getFb();
 	if (!resolved) return failed(rules.classifierFallbackModel, "fallback model unresolvable (not found or no configured auth)");
-	const outcome = await classifyWithModel(env.host, env.signal, env.complete, env.classify, resolved.model, actionLine, resolved.thinking, denyPathsActive, FALLBACK_TIMEOUT_MS);
-	if (outcome.source !== "model") return failed(resolved.model.model.id, outcome.reason);
+	const outcome = await classifyWithModel(env, resolved, { actionLine, denyPathsActive, timeoutMs: FALLBACK_TIMEOUT_MS });
+	if (outcome.source !== "model") return failed(resolved.model.id, outcome.reason);
 	state.fallback.note(first?.verdict ?? null, outcome.verdict);
-	const fb: FallbackAudit = { ...base, model: resolved.model.model.id, verdict: outcome.verdict, reason: outcome.reason, durationMs: Date.now() - start, error: null };
+	const fb: FallbackAudit = { ...base, model: resolved.model.id, verdict: outcome.verdict, reason: outcome.reason, durationMs: Date.now() - start, error: null };
 	if (mode === "shadow") return { ...demotedMark, fb, ...shadowApplied };
 	// The carve-outs on second-layer authority (#71): it may not auto-relax a negative
 	// first-layer verdict — a demoted deny OR ask that the fallback would allow goes to
@@ -1804,7 +2012,7 @@ async function runConfidenceCascade(
  */
 export async function adjudicate(
 	state: SessionState,
-	call: { toolName: string; input: Record<string, unknown> },
+	call: { toolName: string; input: Record<string, unknown>; toolCallId?: string; parentToolCallId?: string },
 	env: AdjudicateEnv,
 ): Promise<Verdict> {
 	const rule = classifyByRules(call.toolName, call.input, env.cwd, state.userRules, state.prot, state.anchoredDenyPathBases(env.cwd));
@@ -1829,6 +2037,10 @@ export async function adjudicate(
 		thinking: raw?.thinking ?? null,
 		transcript: raw?.transcript ?? null,
 		rawResponse: raw?.rawResponse ?? null,
+		// #90 audit attribution: ids ride on every record; nested records additionally
+		// carry the parent linkage, making them distinguishable from direct calls
+		...(call.toolCallId !== undefined ? { toolCallId: call.toolCallId } : {}),
+		...(call.parentToolCallId !== undefined ? { parentToolCallId: call.parentToolCallId } : {}),
 		...v,
 	});
 
@@ -1843,6 +2055,17 @@ export async function adjudicate(
 		return { verdict: "deny", reason: rule.reason ?? "", detail: rule.detail, source: "protected-path", degraded: true };
 	}
 
+	// ADR-0006 (#90): the layered-exemption policy. Nested calls under rules-only have
+	// already passed every deterministic layer above (self-protection, floor, user
+	// rules, denyPaths + its ask) — only the intelligence layer is skipped: the gray
+	// zone passes. Audited when audit is on (source rule + policy marker): the user
+	// needs corpus data on what the opt-in actually let through.
+	if (call.parentToolCallId !== undefined && state.userRules.codemodeNestedCalls === "rules-only") {
+		const reason = "codemodeNestedCalls rules-only: gray-zone passthrough (nested call — deterministic layers only)";
+		state.audit?.append({ ...buildRecord({ verdict: "allow", reason, source: "rule", degraded: false }, null), policy: "rules-only" });
+		return { verdict: "allow", reason, source: "rule", degraded: false };
+	}
+
 	// 灰区 → 分类器;无可用模型 → fail-closed
 
 	const resolved = env.getModel();
@@ -1868,7 +2091,7 @@ export async function adjudicate(
 		return { verdict: "deny", reason, source: "fail-closed", degraded: false };
 	}
 
-	const outcome = await classifyWithModel(env.host, env.signal, env.complete, env.classify, resolved.model, actionLine, resolved.thinking, state.userRules.denyPaths.length > 0);
+	const outcome = await classifyWithModel(env, resolved, { actionLine, denyPathsActive: state.userRules.denyPaths.length > 0 });
 
 	// #67 cascade: a confidence-floor demotion, or a classifier fail-closed outcome
 	// (the first layer produced no verdict)
@@ -2032,6 +2255,8 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	const toggleHint = () => (registeredToggleKey ? ` · toggle: ${registeredToggleKey}` : "");
 	/** Status line denyPaths count (ADR-0002): shown only when configured */
 	const denyPathsHint = () => (state.userRules.denyPaths.length > 0 ? `\ndenyPaths: ${state.userRules.denyPaths.length} active` : "");
+	/** #90: nested-call policy hint — shown only when the exemption is active */
+	const nestedPolicyHint = () => (state.userRules.codemodeNestedCalls === "rules-only" ? "\nnested calls: rules-only (deterministic layers only — the gray zone passes)" : "");
 	/** Status line audit hint (#54): shown only while the sink is active */
 	const auditHint = () => (state.audit ? `\naudit: on → ${state.audit.dir}` : "");
 	/** Status line cascade hint (#63/#67): shown while the floor or the fallback is configured */
@@ -2049,7 +2274,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 			const arg = args.trim().toLowerCase();
 			// 裸调用:只读状态展示,无副作用
 			if (arg === "") {
-				ctx.ui.notify(`${enabled ? "🛡️ Auto Mode: on" : "Auto Mode: off"}\n${denyPathsHint()}${auditHint()}${fallbackHint()}\nUsage: /automode on|off${toggleHint()}`, "info");
+				ctx.ui.notify(`${enabled ? "🛡️ Auto Mode: on" : "Auto Mode: off"}\n${denyPathsHint()}${nestedPolicyHint()}${auditHint()}${fallbackHint()}\nUsage: /automode on|off${toggleHint()}`, "info");
 			return;
 			}
 			// 幂等设定:与现值相同不翻转,仅确认
@@ -2104,6 +2329,16 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 		return id.includes("jev");
 	}
 
+	/** Shared "spec unavailable" wording: jev specs get the specialized causes,
+	 *  anything else the generic miss; `tail` carries the layer's fallback
+	 *  semantics with its leading separator. (Extracted from two previously
+	 *  lockstep-synchronized ternaries — see CHANGELOG [Unreleased].) */
+	function unavailableNotice(subject: string, raw: string, specPart: string, tail: string): string {
+		return isJevSpec(specPart)
+			? `pi-verdict: ${subject} "${raw}" unavailable — ${JEV_UNAVAILABLE_HINT}${tail}`
+			: `pi-verdict: ${subject} "${raw}" unavailable (not found or no configured auth)${tail}`;
+	}
+
 	/** ADR-0005: shared spec→model resolution for both classifier layers. Native
 	 *  classifier entries are looked up first (findOfType) and WIN on same-id dual
 	 *  listings (llama.cpp chat+classifier share ids) — the native path is the point
@@ -2113,7 +2348,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	 *  chat path the suffix stays effective and must not be called ignored). Returns
 	 *  null when the spec does not resolve; the layer's fallback semantics stay with
 	 *  the caller. */
-	function findSpecModel(ctx: ExtensionContext, specPart: string, level: string | null, layer: "classifier" | "fallback"): ResolvedModel | null {
+	function findSpecModel(ctx: ExtensionContext, specPart: string, level: string | null, layer: "classifier" | "fallback"): ResolvedSpec | null {
 		const slash = specPart.indexOf("/");
 		if (slash <= 0) return null;
 		const provider = specPart.slice(0, slash);
@@ -2141,7 +2376,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	 *  model and self-reflection fallback alike; a purely rule-adjudicated session never
 	 *  sees it — lazy via getModel). Neutral wording: the fact, never a judgment on the
 	 *  config (users may pre-set the floor for a future classifier switch). */
-	function warnFloorInert(ctx: ExtensionContext, model: ResolvedModel): void {
+	function warnFloorInert(ctx: ExtensionContext, model: ResolvedSpec): void {
 		if (warnedFloorInert || state.userRules.classifierMinConfidence === null || model.kind === "native") return;
 		warnedFloorInert = true;
 		ctx.ui.notify("pi-verdict: classifierMinConfidence has no effect on a chat-model classifier (the floor applies to native classifier models like typesafe/jev-latest, whose confidence is protocol-native)", "warning");
@@ -2151,7 +2386,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	 *  自省(会话模型,恒为 chat 路径——0.99 分类器不进 /model)。不可用回退会话模型
 	 *  并警告一次;null = 连会话模型都没有 → fail-closed。经 AdjudicateEnv.getModel
 	 *  惰性调用(仅灰区),回退警告不会出现在规则已裁决的调用上。 */
-	function resolveClassifier(ctx: ExtensionContext): { model: ResolvedModel; thinking: ThinkingLevel } | null {
+	function resolveClassifier(ctx: ExtensionContext): ResolvedLayer | null {
 		const raw =
 			(pi.getFlag("auto-mode-model") as string | undefined) ?? process.env.PI_AUTO_MODE_MODEL ?? state.userRules.classifierModel;
 		let thinking: ThinkingLevel = "off";
@@ -2162,17 +2397,15 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 				ctx.ui.notify(msg, "warning");
 			});
 			thinking = (level ?? "off") as ThinkingLevel;
-			const model = findSpecModel(ctx, specPart, level, "classifier");
-			if (model) {
-				warnFloorInert(ctx, model);
-				return { model, thinking };
+			const spec = findSpecModel(ctx, specPart, level, "classifier");
+			if (spec) {
+				warnFloorInert(ctx, spec);
+				return { ...spec, thinking };
 			}
 			if (!warnedClassifierModel) {
 				warnedClassifierModel = true; // 每会话仅警告一次,避免逐调用刷屏
 				ctx.ui.notify(
-					isJevSpec(specPart)
-						? `pi-verdict: classifier model "${raw}" unavailable — ${JEV_UNAVAILABLE_HINT}; falling back to session model (self-reflection)`
-						: `pi-verdict: classifier model "${raw}" unavailable (not found or no configured auth), falling back to session model (self-reflection)`,
+					unavailableNotice("classifier model", raw, specPart, "; falling back to session model (self-reflection)"),
 					"warning",
 				);
 			}
@@ -2180,9 +2413,9 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 		// 自省:继承当前会话模型(chat 路径——0.99 分类器不进 /model,会话模型恒为
 		// chat/virtual);显式指定的思考级别在回退时仍生效(原语义)
 		if (ctx.model) {
-			const self: ResolvedModel = { kind: "chat", model: ctx.model };
+			const self: ResolvedSpec = { kind: "chat", model: ctx.model };
 			warnFloorInert(ctx, self);
-			return { model: self, thinking };
+			return { ...self, thinking };
 		}
 		return null;
 	}
@@ -2194,7 +2427,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	 *  judgment twice instead of adding a second opinion. Unresolvable → one-time warning
 	 *  + null (shadow: inert; enforce: triggered calls fail-closed, see runFallbackCascade).
 	 *  Resolved lazily via AdjudicateEnv.getFallbackModel, only after the gate fires. */
-	function resolveFallbackClassifier(ctx: ExtensionContext): { model: ResolvedModel; thinking: ThinkingLevel } | null {
+	function resolveFallbackClassifier(ctx: ExtensionContext): ResolvedLayer | null {
 		const raw = state.userRules.classifierFallbackModel;
 		if (!raw) return null;
 		const { specPart, level } = parseModelSpec(raw, (msg) => {
@@ -2203,14 +2436,12 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 			ctx.ui.notify(msg, "warning");
 		});
 		const thinking = (level ?? "off") as ThinkingLevel;
-		const model = findSpecModel(ctx, specPart, level, "fallback");
-		if (model) return { model, thinking };
+		const spec = findSpecModel(ctx, specPart, level, "fallback");
+		if (spec) return { ...spec, thinking };
 		if (!warnedFallbackModel) {
 			warnedFallbackModel = true; // one warning per session
 			ctx.ui.notify(
-				isJevSpec(specPart)
-					? `pi-verdict: fallback model "${raw}" unavailable — ${JEV_UNAVAILABLE_HINT} — classifierFallbackModel inactive this session`
-					: `pi-verdict: fallback model "${raw}" unavailable (not found or no configured auth) — classifierFallbackModel inactive this session`,
+				unavailableNotice("fallback model", raw, specPart, " — classifierFallbackModel inactive this session"),
 				"warning",
 			);
 		}
@@ -2258,7 +2489,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 		}
 
 		// 判定管线(零 UI)→ 呈现(source 模板)
-		const verdict = await adjudicate(state, { toolName: event.toolName, input }, {
+		const verdict = await adjudicate(state, { toolName: event.toolName, input, toolCallId: event.toolCallId, parentToolCallId: event.parentToolCallId }, {
 			cwd: ctx.cwd,
 			hasUI: !!ctx.hasUI,
 			getModel: () => resolveClassifier(ctx),

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-verdict",
-	"version": "0.13.0",
+	"version": "0.14.0",
 	"description": "A minimal permission gate for Pi, inspired by Claude Code's auto mode",
 	"author": "Jesset (https://github.com/jesset)",
 	"type": "module",
@@ -55,7 +55,7 @@
 		}
 	},
 	"devDependencies": {
-		"@earendil-works/pi-coding-agent": "0.99.2",
+		"@earendil-works/pi-coding-agent": "1.0.0",
 		"@types/node": "^26.3.0",
 		"typescript": "^7.0.2"
 	}