pi-verdict 0.8.0 → 0.9.1

package/README.md

@@ -99,7 +99,9 @@ pi-verdict runs on both [pi](https://github.com/badlogic/pi-mono) and [oh-my-pi]
   ],
   "builtinDenyFloor": true,
   "classifierModel": null,
-  "toggleShortcut": "ctrl+shift+a"
+  "toggleShortcut": "ctrl+shift+a",
+  "audit": false,
+  "notifyAllows": false
 }
 ```
 
@@ -107,24 +109,26 @@ pi-verdict runs on both [pi](https://github.com/badlogic/pi-mono) and [oh-my-pi]
 - `denyPaths` are plain paths you declare **protected** — touches trigger a terminal ask you adjudicate (non-interactive → deny); the classifier never learns the paths themselves, only that they exist. `grep`/`find`/`ls` compare their whole **search scope**: an omitted `path` (pi's default: the current directory) or a parent directory of a declared path triggers the ask as well. A fresh install pre-fills a **starter list** (`~/.ssh/`, `~/.gnupg`, `~/.mc`, shell rc/profile files), active from the first session after the initial run (any config change applies to new sessions) — a pre-filled *user declaration*, not a built-in floor: edit or empty it freely, add your own (`~/Documents/private`, …) alongside; existing configs are never rewritten
 - `builtinDenyFloor: false` turns off the built-in danger/path floor (your risk; the self-protection layer below always stays on)
 - `classifierModel` pins the classifier model, e.g. `"zai/glm-5.3-flash:low"` (thinking suffix supported; default: session model with thinking off)
-- `classifierModel: "typesafe/jev-latest"` opts into the bundled **jev decisions adapter** — gray-zone verdicts via TypeSafe's jev on OpenRouter (`/api/alpha/decisions`), reusing your pi OpenRouter login; experimental, see [ADR-0003](docs/adr/0003-jev-decisions-adapter.md)
+- `classifierModel: "typesafe/jev-latest"` opts into the bundled **jev decisions adapter** — gray-zone verdicts via TypeSafe's jev (OpenRouter by default, or TypeSafe's official API directly with `PI_VERDICT_JEV_TRANSPORT=typesafe`); experimental, see [ADR-0003](docs/adr/0003-jev-decisions-adapter.md)
+- `audit: true` records every **gray-zone adjudication** (the full transcript sent to the classifier, its raw response, the parsed verdict) as JSONL under `~/.pi/agent/verdicts/<sessionId>.jsonl` — one file per session, the 20 most recent kept. Local-only and full-fidelity (protected-path plaintext may appear — it never leaves your machine; [ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) boundary note); the agent can neither read nor write the directory. `/automode` shows the audit state and path while on
+- `notifyAllows: true` notifies on every **classifier allow** (reason + action line — e.g. jev's probability breakdown); default `false` keeps passes silent. Mechanical passes (your own allow rules, protected-path confirms) never notify; shadow-cache annotations stay debug-only; with both switches on the notification appears once
 
 No built-in allowlist — every "always allow" claim is yours ([why](docs/configuration.md#why-no-built-in-allowlist)). Full reference: [docs/configuration.md](docs/configuration.md).
 
 ### Jev decisions backend (experimental — [ADR-0003](docs/adr/0003-jev-decisions-adapter.md))
 
 1. Install a version that ships the adapter (v0.8+): `pi install npm:pi-verdict`
-2. Get your OpenRouter credentials ready (OpenRouter is the only transport for now)
-   - run `/login openrouter` inside pi
-   - or `export OPENROUTER_API_KEY=sk-or-v1...` in your shell
+2. Pick a transport (both serve the same decisions wire contract):
+   - **OpenRouter (default)**: run `/login openrouter` inside pi, or `export OPENROUTER_API_KEY=sk-or-v1...` in your shell
+   - **TypeSafe direct (official v1 API)**: grab a self-service key at console.typesafe.ai, then `export TYPESAFE_API_KEY=apikey_...` and `export PI_VERDICT_JEV_TRANSPORT=typesafe`
 3. Point the classifier at jev (applies to new sessions)
    - persistent: edit `~/.pi/agent/config/pi-verdict.json` outside pi and set `{ "classifierModel": "typesafe/jev-latest" }`
    - or try it once: `PI_AUTO_MODE_MODEL=typesafe/jev-latest pi`
 
 **Limits**:
-- **Provider**: OpenRouter only, for now
+- **Transports**: OpenRouter decisions (default) or TypeSafe direct — on the TypeSafe transport per-call cost shows $0 (its API does not report it)
 - **Hosts**: pi only. On omp the setting warns and falls back to the session model; and it must never be selected as the session model (no text generation — selecting it warns)
-- **Escape hatch**: `PI_VERDICT_JEV_URL` overrides the decisions endpoint (alpha API)
+- **Escape hatch**: `PI_VERDICT_JEV_URL` overrides the active transport's endpoint (OpenRouter's is an alpha API)
 
 ### Self-protection (the gate guards itself — [ADR-0001](docs/adr/0001-self-protection-layer.md))
 

package/README.zh-CN.md

@@ -101,7 +101,9 @@ pi-verdict 同时支持 [pi](https://github.com/badlogic/pi-mono) 与 [oh-my-pi]
   ],
   "builtinDenyFloor": true,
   "classifierModel": null,
-  "toggleShortcut": "ctrl+shift+a"
+  "toggleShortcut": "ctrl+shift+a",
+  "audit": false,
+  "notifyAllows": false
 }
 ```
 
@@ -109,24 +111,26 @@ pi-verdict 同时支持 [pi](https://github.com/badlogic/pi-mono) 与 [oh-my-pi]
 - `denyPaths` 是你声明**受保护**的普通路径列表:触碰触发**终局 ask** 由你裁决(非交互降级 deny);分类器只被告知路径**存在**,路径明文永不出本机。`grep`/`find`/`ls` 按**整个搜索范围**比较:省略 `path`(pi 默认:当前目录)或传入位于声明路径之上的父目录,同样触发 ask。全新安装会预填一份**入门列表**(`~/.ssh/`、`~/.gnupg`、`~/.mc`、shell rc/profile 文件),自初次运行后的第一个会话起生效(一切配置变更均自新会话生效)——它是预填的*用户声明*而非内置 floor:可随意增删清空,也可与自己的路径(`~/Documents/private`、……)并列;既有配置永不被改写
 - `builtinDenyFloor: false` 整体关闭内置危险/路径拦截(风险自担;下方自保护层永远开启)
 - `classifierModel` 指定分类器模型,如 `"zai/glm-5.3-flash:low"`(支持思考后缀;缺省 = 会话模型且显式关思考)
-- `classifierModel: "typesafe/jev-latest"` 启用随包的 **jev 决策适配器**——灰区裁决经 OpenRouter 的 TypeSafe jev(`/api/alpha/decisions`)完成,复用 pi 的 OpenRouter 登录态;实验性质,详见 [ADR-0003](docs/adr/0003-jev-decisions-adapter.md)
+- `classifierModel: "typesafe/jev-latest"` 启用随包的 **jev 决策适配器**——灰区裁决经 TypeSafe jev 完成(默认 OpenRouter,或 `PI_VERDICT_JEV_TRANSPORT=typesafe` 直连官方 API);实验性质,详见 [ADR-0003](docs/adr/0003-jev-decisions-adapter.md)
+- `audit: true` 把每次**灰区裁决**(发给分类器的完整转录、其原始响应、解析出的裁决)以 JSONL 记录到 `~/.pi/agent/verdicts/<sessionId>.jsonl`——按会话一分文件,保留最近 20 个。仅存本机且全保真(受保护路径明文可能出现——永不出本机;[ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) 边界注);agent 对该目录读写双拒。开启时 `/automode` 会显示审计状态与路径
+- `notifyAllows: true` 对每次 **classifier 放行**发通知(reason + action 行——如 jev 的概率分解);默认 `false` 保持放行静默。机械放行(你自己的 allow 规则、protected-path 确认)永不通知;shadow 标注仍属 debug;两开关同开时通知只出现一次
 
 没有内置白名单——每一条「永远放行」声明都归你([为什么](docs/configuration.md#why-no-built-in-allowlist))。完整参考:[docs/configuration.md](docs/configuration.md)。
 
 ### Jev 决策后端(实验性——[ADR-0003](docs/adr/0003-jev-decisions-adapter.md))
 
 1. 安装含适配器的版本( v0.8 及以上):  `pi install npm:pi-verdict`
-2. 备好 OpenRouter 凭证（暂时只支持 OpenRouter）
-  - pi 内执行 `/login openrouter`
-  - 或 shell 里 `export OPENROUTER_API_KEY=sk-or-v1...`
+2. 选一条 transport(两条走同一 decisions wire 契约):
+  - **OpenRouter(默认)**: pi 内执行 `/login openrouter`,或 shell 里 `export OPENROUTER_API_KEY=sk-or-v1...`
+  - **TypeSafe 直连(官方 v1 API)**: 在 console.typesafe.ai 自助发 key,然后 `export TYPESAFE_API_KEY=apikey_...` 并 `export PI_VERDICT_JEV_TRANSPORT=typesafe`
 3. 把分类器指到 jev（新会话生效）
   - 持久：在 pi 之外编辑 `~/.pi/agent/config/pi-verdict.json` 并设置 `{ "classifierModel": "typesafe/jev-latest" }`
   - 或者临时试一把：`PI_AUTO_MODE_MODEL=typesafe/jev-latest pi`
 
 **限制**:
-- **Provider**: 暂时只支持 OpenRouter
+- **Transport**: OpenRouter decisions(默认)或 TypeSafe 直连——TypeSafe 侧单次成本显示 $0(其 API 不返回 cost)
 - **宿主**:仅支持pi。omp 上该设置会警告并回退会话模型。也绝不能选作会话主模型(不生成文本,选中即警告)
-- **逃生口**:`PI_VERDICT_JEV_URL` 可覆盖 decisions 端点(alpha 接口)
+- **逃生口**:`PI_VERDICT_JEV_URL` 可覆盖当前 transport 的端点(OpenRouter 侧为 alpha 接口)
 
 ### 自保护(门禁守护自身——[ADR-0001](docs/adr/0001-self-protection-layer.md))
 

package/extensions/jev-adapter.ts

@@ -2,18 +2,29 @@
  * pi-verdict jev adapter (ADR-0003) — exposes TypeSafe's jev decisions model
  * as a pi provider (`typesafe/jev-latest`) so `classifierModel` can name it.
  *
- * jev is not an LLM: OpenRouter serves it only through the decisions endpoint
- * (`POST /api/alpha/decisions`, request `{model, state, questions}`), which is
- * why the model cannot ride pi's built-in `openrouter` provider. This adapter
- * translates the classifier's completion call into one `choice` question and
- * synthesizes the `<verdict>…</verdict>` contract text from the typed answer.
+ * jev is not an LLM: its decisions API takes `{state, questions}` and returns
+ * typed answers, which is why the model cannot ride pi's chat-completions
+ * providers. Two transports (PI_VERDICT_JEV_TRANSPORT, default `openrouter`),
+ * whose wire contracts are isomorphic except for the model slug
+ * (live-verified 2026-09-19: same `{state, questions}` body; answers carry
+ * choice/probabilities/confidence; usage snake_case, TypeSafe's own API omits
+ * `cost` and mapUsage defaults it to 0):
+ *   - `openrouter`: POST /api/alpha/decisions, model `~typesafe/jev-latest`,
+ *     credentials reuse pi's OpenRouter login with OPENROUTER_API_KEY fallback
+ *     (no second credential channel);
+ *   - `typesafe`: POST api.typesafe.ai/v1/systemone, model `jev-latest` —
+ *     TypeSafe's official v1 API. pi has no typesafe login, so TYPESAFE_API_KEY
+ *     is this transport's only source, still resolved through the provider
+ *     auth pipeline rather than a bare fetch (ADR-0003 amendment).
  *
- * Credentials reuse pi's OpenRouter login (no second credential channel):
- * request-time auth resolves via `ctx.modelRegistry.getProviderAuth("openrouter")`
- * with `OPENROUTER_API_KEY` as fallback. Because `hasConfiguredAuth` reads a
- * sync snapshot built before any extension event fires, the provider is
- * re-registered on `session_start` to re-run the availability check with the
- * stashed resolver (see ADR-0003).
+ * This adapter translates the classifier's completion call into one `choice`
+ * question and synthesizes the `<verdict>…</verdict>` contract text from the
+ * typed answer. The transport is pinned at provider creation (env is
+ * process-constant), so provider metadata, auth, and request routing always
+ * agree. Because `hasConfiguredAuth` reads a sync snapshot built
+ * before any extension event fires, the provider is re-registered on
+ * `session_start` to re-run the availability check with the stashed
+ * resolver (see ADR-0003).
  *
  * Known limitations (ADR-0003): the classifier system prompt — including the
  * denyPaths existence hint — does not reach jev; jev treats state as data and
@@ -36,11 +47,63 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
 export const PROVIDER_ID = "typesafe";
 export const MODEL_ID = "jev-latest";
-/** Wire slug OpenRouter resolves to the newest jev snapshot. */
-export const WIRE_MODEL = "~typesafe/jev-latest";
 export const API_ID = "jev-decisions";
-export const DEFAULT_DECISIONS_URL = "https://openrouter.ai/api/alpha/decisions";
-export const DECISIONS_URL = process.env.PI_VERDICT_JEV_URL?.trim() || DEFAULT_DECISIONS_URL;
+
+export const TRANSPORTS = ["openrouter", "typesafe"] as const;
+export type Transport = (typeof TRANSPORTS)[number];
+
+/** Everything that differs between transports, in one place: the decisions
+ * endpoint, the model slug it expects (OpenRouter wants the `~latest` alias;
+ * TypeSafe's own API wants the bare slug), the provider/auth display names,
+ * the credential sources, and the missing-key error hint. PI_VERDICT_JEV_URL
+ * overrides either endpoint. */
+export interface TransportConfig {
+	/** Decisions endpoint (PI_VERDICT_JEV_URL overrides). */
+	url: string;
+	/** Model slug this endpoint expects. */
+	wireModel: string;
+	providerName: string;
+	authName: string;
+	/** Env var carrying the API key. */
+	keyEnv: "OPENROUTER_API_KEY" | "TYPESAFE_API_KEY";
+	/** Pi provider-auth id when a pi login exists to reuse; absent = env-only. */
+	loginProvider?: "openrouter";
+	/** Completes "no API key resolved (…)". */
+	keyHint: string;
+}
+
+export const TRANSPORT_DEFAULTS: Record<Transport, TransportConfig> = {
+	openrouter: {
+		url: "https://openrouter.ai/api/alpha/decisions",
+		wireModel: "~typesafe/jev-latest",
+		providerName: "TypeSafe (jev via OpenRouter)",
+		authName: "OpenRouter credentials (reused for jev)",
+		keyEnv: "OPENROUTER_API_KEY",
+		loginProvider: "openrouter",
+		keyHint: "openrouter login or OPENROUTER_API_KEY",
+	},
+	typesafe: {
+		url: "https://api.typesafe.ai/v1/systemone",
+		wireModel: "jev-latest",
+		providerName: "TypeSafe (jev direct)",
+		authName: "TYPESAFE_API_KEY",
+		keyEnv: "TYPESAFE_API_KEY",
+		keyHint: "TYPESAFE_API_KEY",
+	},
+};
+
+/** Unknown or unset values fall back to `openrouter` (the historical default). */
+export function activeTransport(): Transport {
+	return process.env.PI_VERDICT_JEV_TRANSPORT?.trim().toLowerCase() === "typesafe" ? "typesafe" : "openrouter";
+}
+
+export function decisionsUrl(transport: Transport = activeTransport()): string {
+	return process.env.PI_VERDICT_JEV_URL?.trim() || TRANSPORT_DEFAULTS[transport].url;
+}
+
+export function wireModel(transport: Transport = activeTransport()): string {
+	return TRANSPORT_DEFAULTS[transport].wireModel;
+}
 
 const VERDICTS = ["allow", "ask", "deny"] as const;
 type Verdict = (typeof VERDICTS)[number];
@@ -84,8 +147,8 @@ export function extractState(context: { messages: unknown[] }): string {
 	return state;
 }
 
-export function buildDecisionsBody(state: string, wireModel: string = WIRE_MODEL): Record<string, unknown> {
-	return { model: wireModel, state, questions: VERDICT_QUESTIONS };
+export function buildDecisionsBody(state: string, model: string = wireModel()): Record<string, unknown> {
+	return { model, state, questions: VERDICT_QUESTIONS };
 }
 
 interface DecisionAnswer {
@@ -130,7 +193,7 @@ function mapUsage(u: unknown): AssistantMessage["usage"] {
 	};
 }
 
-function streamDecisions(model: Model<string>, context: Context, options: StreamOptions | SimpleStreamOptions | undefined, fetcher: typeof fetch): AssistantMessageEventStream {
+function streamDecisions(transport: Transport, model: Model<string>, context: Context, options: StreamOptions | SimpleStreamOptions | undefined, fetcher: typeof fetch): AssistantMessageEventStream {
 	const stream = createAssistantMessageEventStream();
 	void (async () => {
 		const output: AssistantMessage = {
@@ -146,11 +209,11 @@ function streamDecisions(model: Model<string>, context: Context, options: Stream
 		try {
 			stream.push({ type: "start", partial: output });
 			const apiKey = options?.apiKey;
-			if (!apiKey) throw new Error("jev adapter: no API key resolved (openrouter login or OPENROUTER_API_KEY)");
-			const response = await fetcher(DECISIONS_URL, {
+			if (!apiKey) throw new Error(`jev adapter: no API key resolved (${TRANSPORT_DEFAULTS[transport].keyHint})`);
+			const response = await fetcher(decisionsUrl(transport), {
 				method: "POST",
 				headers: { authorization: `Bearer ${apiKey}`, "content-type": "application/json" },
-				body: JSON.stringify(buildDecisionsBody(extractState(context))),
+				body: JSON.stringify(buildDecisionsBody(extractState(context), wireModel(transport))),
 				signal: options?.signal,
 			});
 			const text = await response.text();
@@ -181,50 +244,62 @@ function streamDecisions(model: Model<string>, context: Context, options: Stream
 	return stream;
 }
 
-/** Input $0.042/MTok, output free (research/typesafe-jev-classifiermodel.md,
- * verified against live usage.cost). Context ceiling is undocumented upstream;
+/** Input $0.042/MTok, output free (research/typesafe-jev-classifiermodel.md).
+ * OpenRouter settles per-call cost in usage; TypeSafe's own API omits it and
+ * mapUsage defaults it to 0. Context ceiling is undocumented upstream;
  * 30k matches the classifier transcript budget with margin. */
-const JEV_MODEL: Model<typeof API_ID> = {
-	id: MODEL_ID,
-	name: "Jev (latest, decisions)",
-	api: API_ID,
-	provider: PROVIDER_ID,
-	baseUrl: DECISIONS_URL,
-	reasoning: false,
-	input: ["text"],
-	cost: { input: 0.042, output: 0, cacheRead: 0, cacheWrite: 0 },
-	contextWindow: 30_000,
-	maxTokens: 512,
-};
+function jevModel(transport: Transport): Model<typeof API_ID> {
+	return {
+		id: MODEL_ID,
+		name: "Jev (latest, decisions)",
+		api: API_ID,
+		provider: PROVIDER_ID,
+		baseUrl: decisionsUrl(transport),
+		reasoning: false,
+		input: ["text"],
+		cost: { input: 0.042, output: 0, cacheRead: 0, cacheWrite: 0 },
+		contextWindow: 30_000,
+		maxTokens: 512,
+	};
+}
 
 type OpenRouterKeyResolver = () => Promise<string | undefined>;
 
 export function createJevProvider(openRouterKey: OpenRouterKeyResolver | undefined, fetcher: typeof fetch = fetch): Provider {
+	// Transport is pinned at creation: env is constant for the process
+	// lifetime, and pinning keeps provider metadata, auth, and request
+	// routing in agreement (no half-switched state).
+	const transport = activeTransport();
+	const config = TRANSPORT_DEFAULTS[transport];
 	return createProvider({
 		id: PROVIDER_ID,
-		name: "TypeSafe (jev via OpenRouter)",
-		baseUrl: DECISIONS_URL,
+		name: config.providerName,
+		baseUrl: decisionsUrl(transport),
 		auth: {
-			// Ambient-only (no login): credentials come from pi's OpenRouter
-			// login or the env fallback, never from a typesafe-specific store.
+			// Ambient-only (no login): the openrouter transport reuses pi's
+			// OpenRouter login or the env fallback; the typesafe transport has
+			// no pi credential store (pi has no typesafe provider) and reads
+			// TYPESAFE_API_KEY only. Neither path opens a second channel.
 			apiKey: {
-				name: "OpenRouter credentials (reused for jev)",
+				name: config.authName,
 				resolve: async () => {
 					let key: string | undefined;
-					try {
-						key = await openRouterKey?.();
-					} catch {
-						/* getProviderAuth may reject on auth-store errors; env still applies */
+					if (config.loginProvider) {
+						try {
+							key = await openRouterKey?.();
+						} catch {
+							/* getProviderAuth may reject on auth-store errors; env still applies */
+						}
 					}
-					key ||= process.env.OPENROUTER_API_KEY?.trim();
-					return key ? { auth: { apiKey: key }, source: "openrouter" } : undefined;
+					key ||= process.env[config.keyEnv]?.trim();
+					return key ? { auth: { apiKey: key }, source: transport } : undefined;
 				},
 			},
 		},
-		models: [JEV_MODEL],
+		models: [jevModel(transport)],
 		api: {
-			stream: (m, c, o) => streamDecisions(m, c, o, fetcher),
-			streamSimple: (m, c, o) => streamDecisions(m, c, o, fetcher),
+			stream: (m, c, o) => streamDecisions(transport, m, c, o, fetcher),
+			streamSimple: (m, c, o) => streamDecisions(transport, m, c, o, fetcher),
 		},
 	});
 }

package/extensions/pi-verdict.ts

@@ -259,9 +259,13 @@ interface UserRules {
 	classifierModel: string | null;
 	/** 主开关 toggle 快捷键键位(#15);null = 禁用;缺省 DEFAULT_TOGGLE_SHORTCUT */
 	toggleShortcut: string | null;
+	/** Opt-in gray-zone adjudication audit (#54): per-session JSONL under <agentDir>/verdicts/ */
+	audit: boolean;
+	/** Allow visibility (#60): info notification on classifier allows; mechanical passes stay silent. Default off. */
+	notifyAllows: boolean;
 }
 
-const EMPTY_RULES: UserRules = { allow: [], deny: [], denyPaths: [], builtinDenyFloor: true, classifierModel: null, toggleShortcut: DEFAULT_TOGGLE_SHORTCUT };
+const EMPTY_RULES: UserRules = { allow: [], deny: [], denyPaths: [], builtinDenyFloor: true, classifierModel: null, toggleShortcut: DEFAULT_TOGGLE_SHORTCUT, audit: false, notifyAllows: false };
 
 /** This module's own file location (import.meta.url resolved; null = unresolvable). */
 const OWN_FILE_PATH: string | null = (() => {
@@ -324,6 +328,8 @@ const USER_CONFIG_TEMPLATE = `${JSON.stringify({
 	builtinDenyFloor: true,
 	classifierModel: null,
 	toggleShortcut: DEFAULT_TOGGLE_SHORTCUT,
+	audit: false,
+	notifyAllows: false,
 }, null, 2)}\n`;
 
 /**
@@ -341,7 +347,7 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 			} catch { /* 只读环境静默跳过 */ }
 			return { rules: EMPTY_RULES, skipped: [], shortcutWarning: null };
 		}
-		let raw: { allow?: unknown; deny?: unknown; denyPaths?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown; toggleShortcut?: unknown };
+		let raw: { allow?: unknown; deny?: unknown; denyPaths?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown; toggleShortcut?: unknown; audit?: unknown; notifyAllows?: unknown };
 		try {
 			raw = JSON.parse(fs.readFileSync(p, "utf8")) as typeof raw;
 		} catch (err) {
@@ -378,6 +384,8 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 				builtinDenyFloor: raw.builtinDenyFloor !== false,
 				classifierModel: typeof raw.classifierModel === "string" && raw.classifierModel.trim() ? raw.classifierModel.trim() : null,
 				toggleShortcut: shortcut.key,
+				audit: raw.audit === true,
+				notifyAllows: raw.notifyAllows === true,
 			},
 			skipped,
 			shortcutWarning: shortcut.warning,
@@ -577,6 +585,8 @@ interface ProtectedSet {
 	exact: string[];
 	/** 受保护目录前缀(npm 包安装形态:整个包目录) */
 	prefixes: string[];
+	/** 读拒绝前缀(#54):verdicts 审计目录——记录含不可信原始输出,禁回流 agent context */
+	readPrefixes: string[];
 	/** bash/powershell 命令串危险特征(子串匹配,可绕——变更检测兜底) */
 	bashPatterns: RegExp[];
 	/** 变更检测基线(词法路径 + 类别;session_start 时快照全文) */
@@ -713,7 +723,28 @@ export function buildProtectedSet(agentDir: string, ownFile: string | null): Pro
 		bashPatterns.push(new RegExp(`(?:${[...alts].join("|")})`));
 	}
 
-	return { exact: [...exact], prefixes: [...prefixes], bashPatterns, watchBases };
+	// #54 verdicts dir: gate-owned audit storage. Writes ride the normal prefixes;
+	// reads are denied separately — records carry raw model output (including
+	// fail-closed failures) that must not flow back into agent context. Deliberately
+	// NOT added to watchBases: the log legitimately grows every adjudication, so a
+	// snapshot diff would false-positive as tampering.
+	const verdictsForms = baseForms(path.join(agentDir, "verdicts"));
+	for (const f of verdictsForms) prefixes.add(f);
+	const home = os.homedir();
+	const vAlts = new Set<string>(verdictsForms.map(escapeRegExp));
+	for (const f of verdictsForms) {
+		if (f.startsWith(home + path.sep)) {
+			const rel = f.slice(home.length + 1);
+			vAlts.add(escapeRegExp("~/" + rel));
+			vAlts.add("\\$HOME/" + escapeRegExp(rel));
+		}
+		for (const base of baseForms(agentDir)) {
+			if (f.startsWith(base + path.sep)) vAlts.add("\\$PI_CODING_AGENT_DIR/" + escapeRegExp(f.slice(base.length + 1)));
+		}
+	}
+	bashPatterns.push(new RegExp(`(?:${[...vAlts].join("|")})`));
+
+	return { exact: [...exact], prefixes: [...prefixes], readPrefixes: verdictsForms, bashPatterns, watchBases };
 }
 
 /** Does the resolved write path hit the protected set (realpath guards against
@@ -730,6 +761,20 @@ export function isProtectedWritePath(rawPath: string, cwd: string, prot: Protect
 	return false;
 }
 
+/** Read-deny for the verdicts dir (#54): audit records contain raw fail-closed
+ *  model output — untrusted text that must not flow back into agent context.
+ *  Unlike write protection (prefixes) this is read semantics, hence a separate set. */
+export function isProtectedReadPath(rawPath: string | undefined, cwd: string, prot: ProtectedSet): boolean {
+	if (prot.readPrefixes.length === 0) return false;
+	const target = rawPath ?? cwd; // #48: absent path → cwd is the effective target
+	for (const c of rebuiltForms(path.resolve(cwd, expandHome(target)))) {
+		for (const p of prot.readPrefixes) {
+			if (c === p || c.startsWith(p + path.sep)) return true;
+		}
+	}
+	return false;
+}
+
 /** 自保护层裁决(第 0 层,先于一切):触碰门禁自身文件 → 不可豁免的 deny;其余 null 交后续层 */
 function selfProtectCheck(toolName: string, input: Record<string, unknown>, cwd: string, prot: ProtectedSet): RuleResult | null {
 	switch (toolName) {
@@ -739,6 +784,14 @@ function selfProtectCheck(toolName: string, input: Record<string, unknown>, cwd:
 				return { verdict: "deny", reason: `self-protection layer (ADR-0001): ${input.path} is part of the permission gate itself; agent-side modification is denied — edit it manually outside pi if intended` };
 			}
 			return null;
+		case "read":
+		case "grep":
+		case "find":
+		case "ls":
+			if (isProtectedReadPath(typeof input.path === "string" ? input.path : undefined, cwd, prot)) {
+				return { verdict: "deny", reason: `self-protection layer (#54): ${typeof input.path === "string" ? input.path : cwd} holds the gate's verdict audit records — agent reads are denied (untrusted raw model output inside); view them outside pi` };
+			}
+			return null;
 		case "bash":
 		case "powershell": {
 			const cmd = String(input.command ?? "");
@@ -994,6 +1047,8 @@ interface ClassifierOutcome {
 	verdict: "allow" | "ask" | "deny";
 	reason: string;
 	source: "model" | "fail-closed";
+	/** #54 audit material: the transcript actually sent and the last attempt's raw output (attached on both model and fail-closed outcomes) */
+	auditRaw?: { transcript: string; rawResponse: string; modelId: string; thinking: ThinkingLevel };
 }
 
 const CLASSIFIER_TIMEOUT_MS = 25_000; // 本网关 CC 分类器分布 p90=19.8s(15s 会误杀 ~15%),research/cache-sim 数据
@@ -1003,6 +1058,22 @@ const APIS_WITHOUT_TEMPERATURE = new Set<string>([
 	"openai-codex-responses",
 ]);
 
+// Models whose provider rejected a temperature-bearing request ("`temperature`
+// is deprecated for this model" — current-gen Anthropic models, #47). Filled
+// adaptively and cached for the extension's lifetime: pi's model registry has
+// no sampling-capability metadata and the reject/accept split follows neither
+// `api` nor `reasoning`, so the provider's own error is the only reliable
+// signal. Later calls for a cached model omit the parameter upfront.
+const TEMPERATURE_REJECTED_MODELS = new Set<string>();
+
+/** The provider rejected the request over the `temperature` parameter itself (#47). */
+function temperatureRejection(
+	r: { ok: true; stopReason: string; errorMessage?: string } | { ok: false; error: string },
+): boolean {
+	if (r.ok) return (r.stopReason === "error" || r.stopReason === "aborted") && /temperature/i.test(r.errorMessage ?? "");
+	return /temperature/i.test(r.error);
+}
+
 /**
  * Minimal structural shape of a completion call (#35). pi exposes it as
  * ModelRegistry.complete; omp 18 does not, but the pi-ai compat module exports
@@ -1056,7 +1127,13 @@ function completionFor(registry: { complete?: unknown }, compatLoader?: CompatLo
 /** 分类器思考级别(pi 原生词表;后缀语法对齐 pi --model provider/id:thinking) */
 type ThinkingLevel = "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
 
-/** 单次分类器调用:显式 reasoning:"off"(见下方注释),失败返回错误串而非抛出 */
+/**
+ * Single classifier attempt: reasoning "off" by default (see options below);
+ * failures return an error string instead of throwing. A provider rejection
+ * over `temperature` strips the parameter and retries once at the same tier
+ * (#47) — models that accept it keep the temperature 0 determinism pin,
+ * models that deprecate it self-heal instead of fail-closing every call.
+ */
 async function callClassifierOnce(
 	host: PipelineHost,
 	signal: AbortSignal | undefined,
@@ -1067,50 +1144,62 @@ async function callClassifierOnce(
 	thinking: ThinkingLevel = "off",
 	systemPrompt: string = CLASSIFIER_SYSTEM,
 ): Promise<{ ok: true; text: string; stopReason: string; errorMessage?: string } | { ok: false; error: string }> {
-	const signals = [AbortSignal.timeout(CLASSIFIER_TIMEOUT_MS)];
-	if (signal) signals.push(signal);
-	try {
-		const response = await complete(
-			model,
-			{
-				systemPrompt,
-				messages: [{ role: "user", content: userMessage, timestamp: Date.now() }],
-			},
-			{
-				signal: AbortSignal.any(signals),
-				maxTokens,
-				...(APIS_WITHOUT_TEMPERATURE.has(model.api) ? {} : { temperature: 0 }),
-				// Thinking params go out in both hosts' native dialects (#35):
-				// pi's registry.complete consumes thinkingEnabled/effort (the
-				// API-native fields, per the blackhole findings in
-				// research/thinking-param-blackhole.md); omp's compat complete
-				// consumes reasoning/disableReasoning. Both sides ignore unknown
-				// option fields, so dual-send lets each host pick its own.
-				// pi off = explicitly disabled (verified to send
-				// thinking:{"type":"disabled"}; GLM downgrades to effort-low light
-				// thinking); suffix levels arrive via adaptive effort (minimal→low).
-				// omp off = disableReasoning (without it, an absent `reasoning`
-				// leaves the model default undefined); level vocabularies share the
-				// ThinkingLevel word list, reasoning passes through as-is.
-				...(thinking === "off"
-					? { thinkingEnabled: false, disableReasoning: true }
-					: {
-							thinkingEnabled: true,
-							effort: thinking === "minimal" ? ("low" as const) : thinking,
-							reasoning: thinking === "minimal" ? ("low" as const) : thinking,
-						}),
-				cacheRetention: "short",
-				sessionId: host.getSessionId(),
-			},
-		);
-		const text = response.content
-			.filter((b) => b.type === "text")
-			.map((b) => b.text)
-			.join("");
-		return { ok: true, text, stopReason: response.stopReason ?? "unknown", errorMessage: response.errorMessage };
-	} catch (err) {
-		return { ok: false, error: err instanceof Error ? err.message : String(err) };
+	const fire = async (
+		withTemperature: boolean,
+	): Promise<{ ok: true; text: string; stopReason: string; errorMessage?: string } | { ok: false; error: string }> => {
+		const signals = [AbortSignal.timeout(CLASSIFIER_TIMEOUT_MS)];
+		if (signal) signals.push(signal);
+		try {
+			const response = await complete(
+				model,
+				{
+					systemPrompt,
+					messages: [{ role: "user", content: userMessage, timestamp: Date.now() }],
+				},
+				{
+					signal: AbortSignal.any(signals),
+					maxTokens,
+					...(withTemperature ? { temperature: 0 } : {}),
+					// Thinking params go out in both hosts' native dialects (#35):
+					// pi's registry.complete consumes thinkingEnabled/effort (the
+					// API-native fields, per the blackhole findings in
+					// research/thinking-param-blackhole.md); omp's compat complete
+					// consumes reasoning/disableReasoning. Both sides ignore unknown
+					// option fields, so dual-send lets each host pick its own.
+					// pi off = explicitly disabled (verified to send
+					// thinking:{"type":"disabled"}; GLM downgrades to effort-low light
+					// thinking); suffix levels arrive via adaptive effort (minimal→low).
+					// omp off = disableReasoning (without it, an absent `reasoning`
+					// leaves the model default undefined); level vocabularies share the
+					// ThinkingLevel word list, reasoning passes through as-is.
+					...(thinking === "off"
+						? { thinkingEnabled: false, disableReasoning: true }
+						: {
+								thinkingEnabled: true,
+								effort: thinking === "minimal" ? ("low" as const) : thinking,
+								reasoning: thinking === "minimal" ? ("low" as const) : thinking,
+							}),
+					cacheRetention: "short",
+					sessionId: host.getSessionId(),
+				},
+			);
+			const text = response.content
+				.filter((b) => b.type === "text")
+				.map((b) => b.text)
+				.join("");
+			return { ok: true, text, stopReason: response.stopReason ?? "unknown", errorMessage: response.errorMessage };
+		} catch (err) {
+			return { ok: false, error: err instanceof Error ? err.message : String(err) };
+		}
+	};
+	const modelKey = `${model.api}|${model.id}`;
+	const withTemperature = !APIS_WITHOUT_TEMPERATURE.has(model.api) && !TEMPERATURE_REJECTED_MODELS.has(modelKey);
+	const first = await fire(withTemperature);
+	if (withTemperature && temperatureRejection(first)) {
+		TEMPERATURE_REJECTED_MODELS.add(modelKey);
+		return fire(false);
 	}
+	return first;
 }
 
 /**
@@ -1133,14 +1222,16 @@ async function classifyWithModel(
 	const systemPrompt = denyPathsActive ? CLASSIFIER_SYSTEM + DENY_PATHS_HINT : CLASSIFIER_SYSTEM;
 	const attempts: Array<[number, number]> = [[1, CLASSIFIER_MAX_TOKENS], [2, CLASSIFIER_RETRY_MAX_TOKENS]];
 	const failures: string[] = [];
+	let rawResponse = ""; // #54: raw output of the last attempt ("" for exception attempts — diagnostics already live in failures)
 	for (const [n, maxTokens] of attempts) {
 		if (signal?.aborted) break; // 用户已取消,不再重试
 		const r = await callClassifierOnce(host, signal, complete, model, userMessage, maxTokens, thinking, systemPrompt);
 		if (r.ok) {
+			rawResponse = r.text;
 			const diag = `stopReason=${r.stopReason}, model=${model.id}, errorMessage=${JSON.stringify(r.errorMessage ?? null)}, raw output=${JSON.stringify(r.text.slice(0, 200))}`;
 			if (r.stopReason !== "error" && r.stopReason !== "aborted") {
 				const parsed = parseVerdict(r.text);
-				if (parsed) return { ...parsed, source: "model" };
+				if (parsed) return { ...parsed, source: "model", auditRaw: { transcript, rawResponse, modelId: model.id, thinking } };
 				failures.push(`attempt ${n} (${maxTokens}t) contract violation: ${diag}`);
 			} else {
 				failures.push(`attempt ${n} (${maxTokens}t) aborted/errored: ${diag}`);
@@ -1149,7 +1240,7 @@ async function classifyWithModel(
 			failures.push(`attempt ${n} (${maxTokens}t) exception: ${r.error}`);
 		}
 	}
-	return { verdict: "deny", reason: `classifier failure (fail-closed): ${failures.join("; ")}`, source: "fail-closed" };
+	return { verdict: "deny", reason: `classifier failure (fail-closed): ${failures.join("; ")}`, source: "fail-closed", auditRaw: { transcript, rawResponse, modelId: model.id, thinking } };
 }
 
 // ============================================================================
@@ -1271,6 +1362,90 @@ function shadowTag(probe: ShadowProbe): string {
 	return `(shadow cache: miss:no-entry)`;
 }
 
+// ============================================================================
+// Gray-zone verdict audit (#54): opt-in JSONL decision records, observe-only
+// (never an adjudication input)
+// ============================================================================
+
+const AUDIT_KEEP_SESSIONS = 20;
+
+/** One gray-zone adjudication record (#54). Full fidelity on purpose: the file is
+ *  local-trust-domain (same as pi-verdict.json, per the ADR-0002 boundary note),
+ *  so protected-path plaintext is allowed here — it never leaves the machine nor
+ *  flows into agent context. */
+export interface AuditRecord {
+	ts: string;
+	sessionId: string;
+	cwd: string;
+	model: string | null;
+	tool: string;
+	input: unknown;
+	actionLine: string;
+	thinking: string | null;
+	transcript: string | null;
+	rawResponse: string | null;
+	verdict: "allow" | "ask" | "deny";
+	reason: string;
+	source: "model" | "fail-closed";
+	shadow: string;
+	degraded: boolean;
+}
+
+/** Audit sink (#54): append-only and fail-soft (the first write failure surfaces
+ *  once via drainWarning; verdicts are never affected). The dir is created
+ *  lazily — audit on with no gray-zone call all session leaves zero filesystem trace. */
+export class AuditLog {
+	private warning: string | null = null;
+	private warned = false;
+	constructor(readonly dir: string) {}
+
+	append(record: AuditRecord): void {
+		// sessionId comes from the host with no shape guarantee: narrow to a safe filename charset
+		const file = path.join(this.dir, `${record.sessionId.replace(/[^a-zA-Z0-9_-]/g, "_")}.jsonl`);
+		try {
+			fs.mkdirSync(this.dir, { recursive: true });
+			fs.appendFileSync(file, JSON.stringify(record) + "\n");
+		} catch (err) {
+			if (!this.warned) {
+				this.warned = true;
+				this.warning = `audit log write failed (${err instanceof Error ? err.message : String(err)}) — verdict records are NOT being persisted to ${this.dir}; adjudication is unaffected`;
+			}
+		}
+	}
+
+	/** One-shot drain: the extension handler polls after every tool_call; first failure warns, the rest stay silent */
+	drainWarning(): string | null {
+		const w = this.warning;
+		this.warning = null;
+		return w;
+	}
+
+	/** Keep the most recent AUDIT_KEEP_SESSIONS session files (called at session_start, best-effort) */
+	prune(): void {
+		let files: string[];
+		try {
+			files = fs.readdirSync(this.dir).filter((f) => f.endsWith(".jsonl"));
+		} catch {
+			return;
+		}
+		if (files.length <= AUDIT_KEEP_SESSIONS) return;
+		const byMtime = files
+			.map((f) => {
+				let m = 0;
+				try {
+					m = fs.statSync(path.join(this.dir, f)).mtimeMs;
+				} catch {}
+				return { f, m };
+			})
+			.sort((a, b) => b.m - a.m);
+		for (const { f } of byMtime.slice(AUDIT_KEEP_SESSIONS)) {
+			try {
+				fs.unlinkSync(path.join(this.dir, f));
+			} catch {}
+		}
+	}
+}
+
 // ============================================================================
 // 会话态:判定管线的会话期状态(复位清单集中一处)
 // ============================================================================
@@ -1284,11 +1459,20 @@ export class SessionState {
 	readonly prot: ProtectedSet;
 	readonly shadow = new ShadowCache();
 	userRules: UserRules;
+	audit: AuditLog | null;
 	private denyPathBases: string[] | null = null;
+	private readonly agentDir: string | null;
 
-	constructor(prot: ProtectedSet, userRules: UserRules = loadUserRules().rules) {
+	constructor(prot: ProtectedSet, userRules: UserRules = loadUserRules().rules, agentDir: string | null = null) {
 		this.prot = prot;
 		this.userRules = userRules;
+		this.agentDir = agentDir;
+		this.audit = this.makeAudit(userRules);
+	}
+
+	/** #54: the audit flag follows the rules (applies to new sessions); the dir is anchored to the install path */
+	private makeAudit(rules: UserRules): AuditLog | null {
+		return rules.audit && this.agentDir ? new AuditLog(path.join(this.agentDir, "verdicts")) : null;
 	}
 
 	/** 会话重置:重载用户规则(配置改动新会话生效)+ 按会话 cwd 重锚 denyPaths
@@ -1298,6 +1482,7 @@ export class SessionState {
 		this.userRules = loaded.rules;
 		this.denyPathBases = anchorDenyPaths(loaded.rules.denyPaths, cwd); // anchored to the session cwd, once (ADR-0002)
 		this.shadow.reset();
+		this.audit = this.makeAudit(loaded.rules);
 		return { skipped: loaded.skipped, shortcutWarning: loaded.shortcutWarning };
 	}
 
@@ -1362,15 +1547,41 @@ export async function adjudicate(
 	}
 
 	// 灰区 → 分类器;无可用模型 → fail-closed
+	// #54: gray-zone only (rule-layer verdicts carry no transcript corpus —
+	// brief decision); observe-only — recording never changes a verdict, and
+	// write failures are swallowed fail-soft by the sink and surfaced once via drainWarning
+	const actionLine = toolCallLine(call.toolName, call.input);
+	const audit = (v: Pick<AuditRecord, "verdict" | "reason" | "source" | "degraded">, raw: ClassifierOutcome["auditRaw"] | null, shadow: string): void => {
+		if (!state.audit) return;
+		state.audit.append({
+			ts: new Date().toISOString(),
+			sessionId: env.host.getSessionId(),
+			cwd: env.cwd,
+			model: raw?.modelId ?? null,
+			tool: call.toolName,
+			input: call.input,
+			actionLine,
+			thinking: raw?.thinking ?? null,
+			transcript: raw?.transcript ?? null,
+			rawResponse: raw?.rawResponse ?? null,
+			shadow,
+			...v,
+		});
+	};
+
 	const resolved = env.getModel();
-	if (!resolved) return { verdict: "deny", reason: "no classifier model available (fail-closed)", source: "fail-closed", degraded: false };
+	if (!resolved) {
+		const reason = "no classifier model available (fail-closed)";
+		audit({ verdict: "deny", reason, source: "fail-closed", degraded: false }, null, "-");
+		return { verdict: "deny", reason, source: "fail-closed", degraded: false };
+	}
 
 	// 影子缓存(observe-only):前置查询 would-be 命中,不改变任何裁决
 	const cmdKey = shadowCommandKey(call.toolName, call.input, env.cwd);
 	const ctxKey = shadowContextKey(env.host);
 	const probe = state.shadow.probe(cmdKey, ctxKey);
 
-	const outcome = await classifyWithModel(env.host, env.signal, env.complete, resolved.model, toolCallLine(call.toolName, call.input), resolved.thinking, state.userRules.denyPaths.length > 0);
+	const outcome = await classifyWithModel(env.host, env.signal, env.complete, resolved.model, actionLine, resolved.thinking, state.userRules.denyPaths.length > 0);
 
 	// 影子回记:真实模型 allow/deny 入缓存;ask 与 fail-closed 不入(#5 定案);
 	// 命中且本次为可缓存裁决时,对比反事实一致性
@@ -1380,6 +1591,8 @@ export async function adjudicate(
 	}
 
 	const shadow = shadowTag(probe);
+	const askDegraded = !env.hasUI && outcome.verdict === "ask";
+	audit({ verdict: askDegraded ? "deny" : outcome.verdict, reason: outcome.reason, source: outcome.source, degraded: askDegraded }, outcome.auditRaw ?? null, shadow);
 	if (outcome.verdict === "allow") return { verdict: "allow", reason: outcome.reason, source: "classifier", degraded: false, shadow };
 	if (outcome.verdict === "deny") return { verdict: "deny", reason: outcome.reason, source: "classifier", degraded: false, shadow };
 	// ask:无 UI 降级为 deny(ask 降级,CONTEXT.md 词条)
@@ -1390,6 +1603,14 @@ export async function adjudicate(
 // 扩展主体
 // ============================================================================
 
+/** Agent-facing block reason (#53): the text must be self-sufficient — structural
+ * error signaling does not reach several provider lanes, and verbatim rule/classifier
+ * reasons can be empty or too terse for the acting model to recognize as a block. */
+function blockedReason(tag: string, detail: string): string {
+	const clean = detail.trim().replace(/\.+$/, "");
+	return `[auto-mode ${tag} block] BLOCKED — this action did NOT run. Reason: ${clean || "(no further reason given)"}. Report the block to the user; never claim it succeeded or completed.`;
+}
+
 /** Optional dependency injection for tests (#35): fake the compat fallback loader. */
 export interface AutoModeDeps {
 	compatLoader?: CompatLoader;
@@ -1403,14 +1624,14 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	let enabled = pi.getFlag("auto-mode") !== false;
 	const debug = pi.getFlag("auto-mode-debug") === true || process.env.PI_AUTO_MODE_DEBUG === "1";
 	// 会话态与门禁完整性监视:复位清单各归 SessionState.reset / IntegrityWatch.startSession
-	const state = new SessionState(buildProtectedSet(agentDirPath(), OWN_FILE_PATH));
+	const state = new SessionState(buildProtectedSet(agentDirPath(), OWN_FILE_PATH), undefined, agentDirPath());
 	const integrity = new IntegrityWatch(state.prot.watchBases);
 
 	/** 篡改处置呈现:还原 + fail-closed 的本地通知(含文件清单与原因) */
 	function presentTamper(changed: Array<{ file: string; kind: WatchKind }>, ctx: ExtensionContext, cause: string): { block: true; reason: string } {
 		const r = integrity.restoreAndFailClose(changed, cause);
 		ctx.ui.notify(`🛡️ pi-verdict TAMPER DETECTED${cause ? ` (${cause})` : ""}: ${r.files} modified bypassing the gate; restored from session snapshot where possible. Fail-closed for the rest of this session — review the file(s) and restart the session.`, "warning");
-		return { block: true, reason: r.reason };
+		return { block: true, reason: blockedReason("tamper", r.reason) };
 	}
 
 	/** Verdict → UI(本扩展唯一的裁决呈现点):按 source × degraded 查模板,文案与
@@ -1418,10 +1639,16 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	 *  (ADR-0002 story 11:通知与 block reason 回流 agent context)。 */
 	async function presentVerdict(v: Verdict, action: string, ctx: ExtensionContext): Promise<{ block: true; reason: string } | undefined> {
 		if (v.verdict === "allow") {
+			// #60 (CONTEXT.md 通知): classifier allows surface via notifyAllows OR
+			// debug — exactly one notification either way; the shadow suffix stays
+			// debug-only; mechanical passes (rule echo, protected-path confirm) stay
+			// debug-only — notifications carry judgment, the audit log carries completeness
 			if (debug) {
 				if (v.source === "rule") ctx.ui.notify(`🛡️ allow (rule): ${action}`, "info");
 				else if (v.source === "protected-path") ctx.ui.notify("🛡️ allow (protected-path confirm)", "info");
 				else ctx.ui.notify(`🛡️ allow (classifier): ${v.reason}\n  ${action}${v.shadow ? " " + v.shadow : ""}`, "info");
+			} else if (state.userRules.notifyAllows && v.source === "classifier") {
+				ctx.ui.notify(`🛡️ allow (classifier): ${v.reason}\n  ${action}`, "info");
 			}
 			return undefined;
 		}
@@ -1429,18 +1656,18 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 			if (v.source === "protected-path") {
 				// 无 action 行:action 串可内嵌被触路径,通知不得携带受保护路径明文
 				ctx.ui.notify(`🛡️ Auto Mode blocked (non-interactive, protected-path ask→deny): ${v.reason}`, "warning");
-				return { block: true, reason: `[auto-mode] protected-path ask degraded to block in non-interactive mode: ${v.reason}` };
+				return { block: true, reason: blockedReason("protected-path", `ask degraded to block in non-interactive mode: ${v.reason}`) };
 			}
 			if (v.source === "fail-closed") {
 				ctx.ui.notify(`🛡️ Auto Mode blocked: ${v.reason}\n  ${action}`, "warning");
-				return { block: true, reason: `[auto-mode] ${v.reason}` };
+				return { block: true, reason: blockedReason("fail-closed", v.reason) };
 			}
 			if (v.source === "rule") {
 				ctx.ui.notify(`🛡️ Auto Mode blocked: ${v.reason}\n  ${action}`, "warning");
-				return { block: true, reason: `[auto-mode rule block] ${v.reason}` };
+				return { block: true, reason: blockedReason("rule", v.reason) };
 			}
 			ctx.ui.notify(`🛡️ Auto Mode blocked: ${v.reason}\n  ${action}${debug && v.shadow ? " " + v.shadow : ""}`, "warning");
-			return { block: true, reason: `[auto-mode classifier block] ${v.reason}` };
+			return { block: true, reason: blockedReason("classifier", v.reason) };
 		}
 		// ask → 人工确认;非交互已在管线内降级,能走到这里的必有 UI
 		if (v.source === "protected-path") {
@@ -1450,10 +1677,10 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 				if (debug) ctx.ui.notify("🛡️ allow (protected-path confirm)", "info");
 				return undefined;
 			}
-			return { block: true, reason: "[auto-mode] user declined protected-path access" };
+			return { block: true, reason: blockedReason("user-declined", "user declined protected-path access") };
 		}
 		const ok = await ctx.ui.confirm("🛡️ Auto Mode confirmation", `${action}\n\nClassifier opinion: ${v.reason}\n\nAllow execution?`);
-		return ok ? undefined : { block: true, reason: "[auto-mode] user declined" };
+		return ok ? undefined : { block: true, reason: blockedReason("user-declined", "user declined") };
 	}
 
 	function refreshStatus(ctx: ExtensionContext) {
@@ -1473,6 +1700,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	pi.on("session_start", async (_event, ctx) => {
 		const report = state.reset(ctx.cwd);
 		integrity.startSession();
+		state.audit?.prune(); // #54: converge to the AUDIT_KEEP_SESSIONS most recent files at session start
 		if (report.skipped.length > 0) {
 			ctx.ui.notify(`pi-verdict: skipped ${report.skipped.length} invalid config value(s) in config (${userConfigPath()}): ${report.skipped.join(", ")}`, "warning");
 		}
@@ -1497,6 +1725,8 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	const toggleHint = () => (registeredToggleKey ? ` · toggle: ${registeredToggleKey}` : "");
 	/** Status line denyPaths count (ADR-0002): shown only when configured */
 	const denyPathsHint = () => (state.userRules.denyPaths.length > 0 ? `\ndenyPaths: ${state.userRules.denyPaths.length} active` : "");
+	/** Status line audit hint (#54): shown only while the sink is active */
+	const auditHint = () => (state.audit ? `\naudit: on → ${state.audit.dir}` : "");
 
 	pi.registerCommand("automode", {
 		description: "Show Auto Mode status and shadow-cache stats, or set it: /automode on|off",
@@ -1504,7 +1734,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 			const arg = args.trim().toLowerCase();
 			// 裸调用:只读状态展示,无副作用(含影子缓存统计行)
 			if (arg === "") {
-				ctx.ui.notify(`${enabled ? "🛡️ Auto Mode: on" : "Auto Mode: off"}\n${state.shadow.summary()}${denyPathsHint()}\nUsage: /automode on|off${toggleHint()}`, "info");
+				ctx.ui.notify(`${enabled ? "🛡️ Auto Mode: on" : "Auto Mode: off"}\n${state.shadow.summary()}${denyPathsHint()}${auditHint()}\nUsage: /automode on|off${toggleHint()}`, "info");
 			return;
 			}
 			// 幂等设定:与现值相同不翻转,仅确认
@@ -1579,7 +1809,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 		// 第 0 层前置:变更检测(ADR-0001)——篡改后本会话恒 deny(fail-closed)
 		if (integrity.tampered) {
 			ctx.ui.notify(`🛡️ Auto Mode blocked: self-protection fail-closed (tamper detected this session; restart to reset)\n  ${action}`, "warning");
-			return { block: true, reason: "[auto-mode] self-protection: fail-closed until session restart (protected file was tampered with)" };
+			return { block: true, reason: blockedReason("tamper", "self-protection: fail-closed until session restart (protected file was tampered with)") };
 		}
 		const changed = integrity.detect();
 		if (changed.length > 0) {
@@ -1615,6 +1845,8 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 			host: ctx.sessionManager,
 			signal: ctx.signal,
 		});
+		const auditWarning = state.audit?.drainWarning(); // #54: fail-soft one-shot warning
+		if (auditWarning) ctx.ui.notify(`pi-verdict: ${auditWarning}`, "warning");
 		return presentVerdict(verdict, action, ctx);
 	});
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-verdict",
-	"version": "0.8.0",
+	"version": "0.9.1",
 	"description": "A minimal permission gate for Pi in the style of Claude Code's auto mode",
 	"author": "Jesset (https://github.com/jesset)",
 	"type": "module",
@@ -24,7 +24,12 @@
 		"security",
 		"tool-call",
 		"classifier",
-		"ai-agent"
+		"ai-agent",
+		"jev",
+		"typesafe",
+		"system-one",
+		"decisions",
+		"openrouter"
 	],
 	"repository": {
 		"type": "git",