pi-verdict 0.9.0 → 0.10.0

package/README.md

@@ -101,7 +101,10 @@ pi-verdict runs on both [pi](https://github.com/badlogic/pi-mono) and [oh-my-pi]
   "classifierModel": null,
   "toggleShortcut": "ctrl+shift+a",
   "audit": false,
-  "notifyAllows": false
+  "notifyAllows": false,
+  "classifierFallbackModel": null,
+  "classifierFallbackConfidence": 50,
+  "classifierFallbackMode": "shadow"
 }
 ```
 
@@ -109,26 +112,29 @@ pi-verdict runs on both [pi](https://github.com/badlogic/pi-mono) and [oh-my-pi]
 - `denyPaths` are plain paths you declare **protected** — touches trigger a terminal ask you adjudicate (non-interactive → deny); the classifier never learns the paths themselves, only that they exist. `grep`/`find`/`ls` compare their whole **search scope**: an omitted `path` (pi's default: the current directory) or a parent directory of a declared path triggers the ask as well. A fresh install pre-fills a **starter list** (`~/.ssh/`, `~/.gnupg`, `~/.mc`, shell rc/profile files), active from the first session after the initial run (any config change applies to new sessions) — a pre-filled *user declaration*, not a built-in floor: edit or empty it freely, add your own (`~/Documents/private`, …) alongside; existing configs are never rewritten
 - `builtinDenyFloor: false` turns off the built-in danger/path floor (your risk; the self-protection layer below always stays on)
 - `classifierModel` pins the classifier model, e.g. `"zai/glm-5.3-flash:low"` (thinking suffix supported; default: session model with thinking off)
-- `classifierModel: "typesafe/jev-latest"` opts into the bundled **jev decisions adapter** — gray-zone verdicts via TypeSafe's jev on OpenRouter (`/api/alpha/decisions`), reusing your pi OpenRouter login; experimental, see [ADR-0003](docs/adr/0003-jev-decisions-adapter.md)
-- `audit: true` records every **gray-zone adjudication** (the full transcript sent to the classifier, its raw response, the parsed verdict) as JSONL under `~/.pi/agent/verdicts/<sessionId>.jsonl` — one file per session, the 20 most recent kept. Local-only and full-fidelity (protected-path plaintext may appear — it never leaves your machine; [ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) boundary note); the agent can neither read nor write the directory. `/automode` shows the audit state and path while on
+- `classifierModel: "typesafe/jev-latest"` opts into the bundled **jev decisions adapter** — gray-zone verdicts via TypeSafe's jev (OpenRouter by default, or TypeSafe's official API directly with `PI_VERDICT_JEV_TRANSPORT=typesafe`); experimental, see [ADR-0003](docs/adr/0003-jev-decisions-adapter.md)
+- `audit: true` records every **gray-zone adjudication** (the full transcript sent to the classifier, its raw response, the parsed verdict) as JSONL under `~/.pi/agent/verdicts/<sessionId>.jsonl` — one file per session, the 20 most recent kept. Interactive asks also record your answer (`userAnswer` ground truth, written after the confirm resolves), and protected-path asks are recorded too (#62); rule allow/deny stays unaudited. Local-only and full-fidelity (protected-path plaintext may appear — it never leaves your machine; [ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) boundary note); the agent can neither read nor write the directory. `/automode` shows the audit state and path while on
 - `notifyAllows: true` notifies on every **classifier allow** (reason + action line — e.g. jev's probability breakdown); default `false` keeps passes silent. Mechanical passes (your own allow rules, protected-path confirms) never notify; shadow-cache annotations stay debug-only; with both switches on the notification appears once
+- `classifierFallbackModel` (optional, [ADR-0004](docs/adr/0004-classifier-fallback-cascade.md)) adds a **second-layer classifier** consulted only when the first layer is uncertain (ask / fail-closed / jev confidence below `classifierFallbackConfidence`, default 50); `classifierFallbackMode: "shadow"` (default) observes without changing verdicts, `"enforce"` escalates strictness only (a safety ratchet — never relaxes; a failed fallback denies the triggered call). Off unless set — a natural pairing: jev first + a haiku-class fallback
 
 No built-in allowlist — every "always allow" claim is yours ([why](docs/configuration.md#why-no-built-in-allowlist)). Full reference: [docs/configuration.md](docs/configuration.md).
 
 ### Jev decisions backend (experimental — [ADR-0003](docs/adr/0003-jev-decisions-adapter.md))
 
 1. Install a version that ships the adapter (v0.8+): `pi install npm:pi-verdict`
-2. Get your OpenRouter credentials ready (OpenRouter is the only transport for now)
-   - run `/login openrouter` inside pi
-   - or `export OPENROUTER_API_KEY=sk-or-v1...` in your shell
+2. Pick a transport (both serve the same decisions wire contract):
+   - **OpenRouter (default)**: run `/login openrouter` inside pi, or `export OPENROUTER_API_KEY=sk-or-v1...` in your shell
+   - **TypeSafe direct (official v1 API)**: grab a self-service key at console.typesafe.ai, then `export TYPESAFE_API_KEY=apikey_...` and `export PI_VERDICT_JEV_TRANSPORT=typesafe`
 3. Point the classifier at jev (applies to new sessions)
    - persistent: edit `~/.pi/agent/config/pi-verdict.json` outside pi and set `{ "classifierModel": "typesafe/jev-latest" }`
    - or try it once: `PI_AUTO_MODE_MODEL=typesafe/jev-latest pi`
 
 **Limits**:
-- **Provider**: OpenRouter only, for now
+- **Transports**: OpenRouter decisions (default) or TypeSafe direct — on the TypeSafe transport per-call cost shows $0 (its API does not report it)
 - **Hosts**: pi only. On omp the setting warns and falls back to the session model; and it must never be selected as the session model (no text generation — selecting it warns)
-- **Escape hatch**: `PI_VERDICT_JEV_URL` overrides the decisions endpoint (alpha API)
+- **Escape hatch**: `PI_VERDICT_JEV_URL` overrides the active transport's endpoint (OpenRouter's is an alpha API)
+
+jev's calibrated confidence is exactly what the fallback cascade keys on — pair it with a second layer (`"classifierFallbackModel": "anthropic/claude-haiku-4-5"`) to route its low-confidence calls to a deeper model ([ADR-0004](docs/adr/0004-classifier-fallback-cascade.md)).
 
 ### Self-protection (the gate guards itself — [ADR-0001](docs/adr/0001-self-protection-layer.md))
 

package/README.zh-CN.md

@@ -103,7 +103,10 @@ pi-verdict 同时支持 [pi](https://github.com/badlogic/pi-mono) 与 [oh-my-pi]
   "classifierModel": null,
   "toggleShortcut": "ctrl+shift+a",
   "audit": false,
-  "notifyAllows": false
+  "notifyAllows": false,
+  "classifierFallbackModel": null,
+  "classifierFallbackConfidence": 50,
+  "classifierFallbackMode": "shadow"
 }
 ```
 
@@ -111,26 +114,29 @@ pi-verdict 同时支持 [pi](https://github.com/badlogic/pi-mono) 与 [oh-my-pi]
 - `denyPaths` 是你声明**受保护**的普通路径列表:触碰触发**终局 ask** 由你裁决(非交互降级 deny);分类器只被告知路径**存在**,路径明文永不出本机。`grep`/`find`/`ls` 按**整个搜索范围**比较:省略 `path`(pi 默认:当前目录)或传入位于声明路径之上的父目录,同样触发 ask。全新安装会预填一份**入门列表**(`~/.ssh/`、`~/.gnupg`、`~/.mc`、shell rc/profile 文件),自初次运行后的第一个会话起生效(一切配置变更均自新会话生效)——它是预填的*用户声明*而非内置 floor:可随意增删清空,也可与自己的路径(`~/Documents/private`、……)并列;既有配置永不被改写
 - `builtinDenyFloor: false` 整体关闭内置危险/路径拦截(风险自担;下方自保护层永远开启)
 - `classifierModel` 指定分类器模型,如 `"zai/glm-5.3-flash:low"`(支持思考后缀;缺省 = 会话模型且显式关思考)
-- `classifierModel: "typesafe/jev-latest"` 启用随包的 **jev 决策适配器**——灰区裁决经 OpenRouter 的 TypeSafe jev(`/api/alpha/decisions`)完成,复用 pi 的 OpenRouter 登录态;实验性质,详见 [ADR-0003](docs/adr/0003-jev-decisions-adapter.md)
-- `audit: true` 把每次**灰区裁决**(发给分类器的完整转录、其原始响应、解析出的裁决)以 JSONL 记录到 `~/.pi/agent/verdicts/<sessionId>.jsonl`——按会话一分文件,保留最近 20 个。仅存本机且全保真(受保护路径明文可能出现——永不出本机;[ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) 边界注);agent 对该目录读写双拒。开启时 `/automode` 会显示审计状态与路径
+- `classifierModel: "typesafe/jev-latest"` 启用随包的 **jev 决策适配器**——灰区裁决经 TypeSafe jev 完成(默认 OpenRouter,或 `PI_VERDICT_JEV_TRANSPORT=typesafe` 直连官方 API);实验性质,详见 [ADR-0003](docs/adr/0003-jev-decisions-adapter.md)
+- `audit: true` 把每次**灰区裁决**(发给分类器的完整转录、其原始响应、解析出的裁决)以 JSONL 记录到 `~/.pi/agent/verdicts/<sessionId>.jsonl`——按会话一分文件,保留最近 20 个。交互式 ask 还会记录你的应答(`userAnswer` ground truth,确认结束后落盘),protected-path ask 也入审计(#62);规则 allow/deny 仍不入。仅存本机且全保真(受保护路径明文可能出现——永不出本机;[ADR-0002](docs/adr/0002-deny-paths-deterministic-ask.md) 边界注);agent 对该目录读写双拒。开启时 `/automode` 会显示审计状态与路径
 - `notifyAllows: true` 对每次 **classifier 放行**发通知(reason + action 行——如 jev 的概率分解);默认 `false` 保持放行静默。机械放行(你自己的 allow 规则、protected-path 确认)永不通知;shadow 标注仍属 debug;两开关同开时通知只出现一次
+- `classifierFallbackModel`(可选,[ADR-0004](docs/adr/0004-classifier-fallback-cascade.md))添加**第二层分类器**,仅当第一层不确定时征询(ask / fail-closed / jev confidence 低于 `classifierFallbackConfidence`,默认 50);`classifierFallbackMode: "shadow"`(默认)只观察不改判,`"enforce"` 仅升严(安全棘轮——永不放宽;fallback 失败时该次触发调用 deny)。未设置即完全关闭——天然搭配:jev 打头 + haiku 级兜底
 
 没有内置白名单——每一条「永远放行」声明都归你([为什么](docs/configuration.md#why-no-built-in-allowlist))。完整参考:[docs/configuration.md](docs/configuration.md)。
 
 ### Jev 决策后端(实验性——[ADR-0003](docs/adr/0003-jev-decisions-adapter.md))
 
 1. 安装含适配器的版本( v0.8 及以上):  `pi install npm:pi-verdict`
-2. 备好 OpenRouter 凭证（暂时只支持 OpenRouter）
-  - pi 内执行 `/login openrouter`
-  - 或 shell 里 `export OPENROUTER_API_KEY=sk-or-v1...`
+2. 选一条 transport(两条走同一 decisions wire 契约):
+  - **OpenRouter(默认)**: pi 内执行 `/login openrouter`,或 shell 里 `export OPENROUTER_API_KEY=sk-or-v1...`
+  - **TypeSafe 直连(官方 v1 API)**: 在 console.typesafe.ai 自助发 key,然后 `export TYPESAFE_API_KEY=apikey_...` 并 `export PI_VERDICT_JEV_TRANSPORT=typesafe`
 3. 把分类器指到 jev（新会话生效）
   - 持久：在 pi 之外编辑 `~/.pi/agent/config/pi-verdict.json` 并设置 `{ "classifierModel": "typesafe/jev-latest" }`
   - 或者临时试一把：`PI_AUTO_MODE_MODEL=typesafe/jev-latest pi`
 
 **限制**:
-- **Provider**: 暂时只支持 OpenRouter
+- **Transport**: OpenRouter decisions(默认)或 TypeSafe 直连——TypeSafe 侧单次成本显示 $0(其 API 不返回 cost)
 - **宿主**:仅支持pi。omp 上该设置会警告并回退会话模型。也绝不能选作会话主模型(不生成文本,选中即警告)
-- **逃生口**:`PI_VERDICT_JEV_URL` 可覆盖 decisions 端点(alpha 接口)
+- **逃生口**:`PI_VERDICT_JEV_URL` 可覆盖当前 transport 的端点(OpenRouter 侧为 alpha 接口)
+
+jev 的校准 confidence 正是回退级联的触发依据——搭配第二层使用(`"classifierFallbackModel": "anthropic/claude-haiku-4-5"`),把低置信调用交给更深的模型([ADR-0004](docs/adr/0004-classifier-fallback-cascade.md))。
 
 ### 自保护(门禁守护自身——[ADR-0001](docs/adr/0001-self-protection-layer.md))
 

package/extensions/jev-adapter.ts

@@ -2,18 +2,29 @@
  * pi-verdict jev adapter (ADR-0003) — exposes TypeSafe's jev decisions model
  * as a pi provider (`typesafe/jev-latest`) so `classifierModel` can name it.
  *
- * jev is not an LLM: OpenRouter serves it only through the decisions endpoint
- * (`POST /api/alpha/decisions`, request `{model, state, questions}`), which is
- * why the model cannot ride pi's built-in `openrouter` provider. This adapter
- * translates the classifier's completion call into one `choice` question and
- * synthesizes the `<verdict>…</verdict>` contract text from the typed answer.
+ * jev is not an LLM: its decisions API takes `{state, questions}` and returns
+ * typed answers, which is why the model cannot ride pi's chat-completions
+ * providers. Two transports (PI_VERDICT_JEV_TRANSPORT, default `openrouter`),
+ * whose wire contracts are isomorphic except for the model slug
+ * (live-verified 2026-09-19: same `{state, questions}` body; answers carry
+ * choice/probabilities/confidence; usage snake_case, TypeSafe's own API omits
+ * `cost` and mapUsage defaults it to 0):
+ *   - `openrouter`: POST /api/alpha/decisions, model `~typesafe/jev-latest`,
+ *     credentials reuse pi's OpenRouter login with OPENROUTER_API_KEY fallback
+ *     (no second credential channel);
+ *   - `typesafe`: POST api.typesafe.ai/v1/systemone, model `jev-latest` —
+ *     TypeSafe's official v1 API. pi has no typesafe login, so TYPESAFE_API_KEY
+ *     is this transport's only source, still resolved through the provider
+ *     auth pipeline rather than a bare fetch (ADR-0003 amendment).
  *
- * Credentials reuse pi's OpenRouter login (no second credential channel):
- * request-time auth resolves via `ctx.modelRegistry.getProviderAuth("openrouter")`
- * with `OPENROUTER_API_KEY` as fallback. Because `hasConfiguredAuth` reads a
- * sync snapshot built before any extension event fires, the provider is
- * re-registered on `session_start` to re-run the availability check with the
- * stashed resolver (see ADR-0003).
+ * This adapter translates the classifier's completion call into one `choice`
+ * question and synthesizes the `<verdict>…</verdict>` contract text from the
+ * typed answer. The transport is pinned at provider creation (env is
+ * process-constant), so provider metadata, auth, and request routing always
+ * agree. Because `hasConfiguredAuth` reads a sync snapshot built
+ * before any extension event fires, the provider is re-registered on
+ * `session_start` to re-run the availability check with the stashed
+ * resolver (see ADR-0003).
  *
  * Known limitations (ADR-0003): the classifier system prompt — including the
  * denyPaths existence hint — does not reach jev; jev treats state as data and
@@ -36,11 +47,63 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
 export const PROVIDER_ID = "typesafe";
 export const MODEL_ID = "jev-latest";
-/** Wire slug OpenRouter resolves to the newest jev snapshot. */
-export const WIRE_MODEL = "~typesafe/jev-latest";
 export const API_ID = "jev-decisions";
-export const DEFAULT_DECISIONS_URL = "https://openrouter.ai/api/alpha/decisions";
-export const DECISIONS_URL = process.env.PI_VERDICT_JEV_URL?.trim() || DEFAULT_DECISIONS_URL;
+
+export const TRANSPORTS = ["openrouter", "typesafe"] as const;
+export type Transport = (typeof TRANSPORTS)[number];
+
+/** Everything that differs between transports, in one place: the decisions
+ * endpoint, the model slug it expects (OpenRouter wants the `~latest` alias;
+ * TypeSafe's own API wants the bare slug), the provider/auth display names,
+ * the credential sources, and the missing-key error hint. PI_VERDICT_JEV_URL
+ * overrides either endpoint. */
+export interface TransportConfig {
+	/** Decisions endpoint (PI_VERDICT_JEV_URL overrides). */
+	url: string;
+	/** Model slug this endpoint expects. */
+	wireModel: string;
+	providerName: string;
+	authName: string;
+	/** Env var carrying the API key. */
+	keyEnv: "OPENROUTER_API_KEY" | "TYPESAFE_API_KEY";
+	/** Pi provider-auth id when a pi login exists to reuse; absent = env-only. */
+	loginProvider?: "openrouter";
+	/** Completes "no API key resolved (…)". */
+	keyHint: string;
+}
+
+export const TRANSPORT_DEFAULTS: Record<Transport, TransportConfig> = {
+	openrouter: {
+		url: "https://openrouter.ai/api/alpha/decisions",
+		wireModel: "~typesafe/jev-latest",
+		providerName: "TypeSafe (jev via OpenRouter)",
+		authName: "OpenRouter credentials (reused for jev)",
+		keyEnv: "OPENROUTER_API_KEY",
+		loginProvider: "openrouter",
+		keyHint: "openrouter login or OPENROUTER_API_KEY",
+	},
+	typesafe: {
+		url: "https://api.typesafe.ai/v1/systemone",
+		wireModel: "jev-latest",
+		providerName: "TypeSafe (jev direct)",
+		authName: "TYPESAFE_API_KEY",
+		keyEnv: "TYPESAFE_API_KEY",
+		keyHint: "TYPESAFE_API_KEY",
+	},
+};
+
+/** Unknown or unset values fall back to `openrouter` (the historical default). */
+export function activeTransport(): Transport {
+	return process.env.PI_VERDICT_JEV_TRANSPORT?.trim().toLowerCase() === "typesafe" ? "typesafe" : "openrouter";
+}
+
+export function decisionsUrl(transport: Transport = activeTransport()): string {
+	return process.env.PI_VERDICT_JEV_URL?.trim() || TRANSPORT_DEFAULTS[transport].url;
+}
+
+export function wireModel(transport: Transport = activeTransport()): string {
+	return TRANSPORT_DEFAULTS[transport].wireModel;
+}
 
 const VERDICTS = ["allow", "ask", "deny"] as const;
 type Verdict = (typeof VERDICTS)[number];
@@ -84,8 +147,8 @@ export function extractState(context: { messages: unknown[] }): string {
 	return state;
 }
 
-export function buildDecisionsBody(state: string, wireModel: string = WIRE_MODEL): Record<string, unknown> {
-	return { model: wireModel, state, questions: VERDICT_QUESTIONS };
+export function buildDecisionsBody(state: string, model: string = wireModel()): Record<string, unknown> {
+	return { model, state, questions: VERDICT_QUESTIONS };
 }
 
 interface DecisionAnswer {
@@ -98,21 +161,38 @@ interface DecisionAnswer {
  * (`<verdict>…</verdict>` + one-line reason). Any malformed shape throws —
  * the classifier's fail-closed path owns the fallout. The reason is
  * user-facing (block reasons, ask dialogs): plain percentages, no internal
- * notation. */
+ * notation. Confidence is hard-required (#63): the decisions contract
+ * guarantees it on choice answers, so absence is contract drift and drift
+ * fails closed like any malformed shape — the cascade's confidence gate
+ * depends on the segment always being present. */
 export function verdictText(parsed: unknown): string {
 	const answer = (parsed as { answers?: { verdict?: DecisionAnswer } })?.answers?.verdict;
 	const choice = String(answer?.choice ?? "").trim().toLowerCase();
 	if (!VERDICTS.includes(choice as Verdict)) {
 		throw new Error(`jev adapter: malformed verdict answer (choice=${JSON.stringify(answer?.choice) ?? "missing"})`);
 	}
+	const conf = answer?.confidence;
+	if (typeof conf !== "number" || !Number.isFinite(conf)) {
+		throw new Error(`jev adapter: verdict answer missing numeric confidence (confidence=${JSON.stringify(conf) ?? "missing"})`);
+	}
 	const probs = (answer?.probabilities ?? {}) as Record<string, unknown>;
 	const pct = (n: unknown): string => `${Math.round((typeof n === "number" && Number.isFinite(n) ? n : 0) * 100)}%`;
 	const rest = VERDICTS.filter((v) => v !== choice)
 		.map((v) => `${v} ${pct(probs[v])}`)
 		.join(", ");
-	const conf = answer?.confidence;
-	const confText = typeof conf === "number" && Number.isFinite(conf) ? `confidence ${pct(conf)}; ` : "";
-	return `<verdict>${choice}</verdict> jev: ${choice} ${pct(probs[choice])} (${confText}${rest})`;
+	// The confidence segment floors instead of rounding: the cascade gate parses it back
+	// with a strict-below threshold, and overstating a 49.6% as 50% would slip past a 50
+	// gate. The 1e-9 epsilon only absorbs FP representation error (0.29*100 = 28.999…).
+	return `<verdict>${choice}</verdict> jev: ${choice} ${pct(probs[choice])} (confidence ${Math.floor(conf * 100 + 1e-9)}%; ${rest})`;
+}
+
+/** #63: parse the confidence back out of a `verdictText` reason. Returns null for any
+ *  non-jev reason — LLM classifiers emit free text and carry no numeric confidence
+ *  (their gate is ask/fail-closed only). jev reasons always carry the segment
+ *  (hard-required in verdictText). Format pinned by tests/jev-adapter.test.ts. */
+export function parseJevConfidence(reason: string): number | null {
+	const m = /jev: (?:allow|ask|deny) \d+% \(confidence (\d+)%/.exec(reason);
+	return m ? Number(m[1]) : null;
 }
 
 function mapUsage(u: unknown): AssistantMessage["usage"] {
@@ -130,7 +210,7 @@ function mapUsage(u: unknown): AssistantMessage["usage"] {
 	};
 }
 
-function streamDecisions(model: Model<string>, context: Context, options: StreamOptions | SimpleStreamOptions | undefined, fetcher: typeof fetch): AssistantMessageEventStream {
+function streamDecisions(transport: Transport, model: Model<string>, context: Context, options: StreamOptions | SimpleStreamOptions | undefined, fetcher: typeof fetch): AssistantMessageEventStream {
 	const stream = createAssistantMessageEventStream();
 	void (async () => {
 		const output: AssistantMessage = {
@@ -146,11 +226,11 @@ function streamDecisions(model: Model<string>, context: Context, options: Stream
 		try {
 			stream.push({ type: "start", partial: output });
 			const apiKey = options?.apiKey;
-			if (!apiKey) throw new Error("jev adapter: no API key resolved (openrouter login or OPENROUTER_API_KEY)");
-			const response = await fetcher(DECISIONS_URL, {
+			if (!apiKey) throw new Error(`jev adapter: no API key resolved (${TRANSPORT_DEFAULTS[transport].keyHint})`);
+			const response = await fetcher(decisionsUrl(transport), {
 				method: "POST",
 				headers: { authorization: `Bearer ${apiKey}`, "content-type": "application/json" },
-				body: JSON.stringify(buildDecisionsBody(extractState(context))),
+				body: JSON.stringify(buildDecisionsBody(extractState(context), wireModel(transport))),
 				signal: options?.signal,
 			});
 			const text = await response.text();
@@ -181,50 +261,62 @@ function streamDecisions(model: Model<string>, context: Context, options: Stream
 	return stream;
 }
 
-/** Input $0.042/MTok, output free (research/typesafe-jev-classifiermodel.md,
- * verified against live usage.cost). Context ceiling is undocumented upstream;
+/** Input $0.042/MTok, output free (research/typesafe-jev-classifiermodel.md).
+ * OpenRouter settles per-call cost in usage; TypeSafe's own API omits it and
+ * mapUsage defaults it to 0. Context ceiling is undocumented upstream;
  * 30k matches the classifier transcript budget with margin. */
-const JEV_MODEL: Model<typeof API_ID> = {
-	id: MODEL_ID,
-	name: "Jev (latest, decisions)",
-	api: API_ID,
-	provider: PROVIDER_ID,
-	baseUrl: DECISIONS_URL,
-	reasoning: false,
-	input: ["text"],
-	cost: { input: 0.042, output: 0, cacheRead: 0, cacheWrite: 0 },
-	contextWindow: 30_000,
-	maxTokens: 512,
-};
+function jevModel(transport: Transport): Model<typeof API_ID> {
+	return {
+		id: MODEL_ID,
+		name: "Jev (latest, decisions)",
+		api: API_ID,
+		provider: PROVIDER_ID,
+		baseUrl: decisionsUrl(transport),
+		reasoning: false,
+		input: ["text"],
+		cost: { input: 0.042, output: 0, cacheRead: 0, cacheWrite: 0 },
+		contextWindow: 30_000,
+		maxTokens: 512,
+	};
+}
 
 type OpenRouterKeyResolver = () => Promise<string | undefined>;
 
 export function createJevProvider(openRouterKey: OpenRouterKeyResolver | undefined, fetcher: typeof fetch = fetch): Provider {
+	// Transport is pinned at creation: env is constant for the process
+	// lifetime, and pinning keeps provider metadata, auth, and request
+	// routing in agreement (no half-switched state).
+	const transport = activeTransport();
+	const config = TRANSPORT_DEFAULTS[transport];
 	return createProvider({
 		id: PROVIDER_ID,
-		name: "TypeSafe (jev via OpenRouter)",
-		baseUrl: DECISIONS_URL,
+		name: config.providerName,
+		baseUrl: decisionsUrl(transport),
 		auth: {
-			// Ambient-only (no login): credentials come from pi's OpenRouter
-			// login or the env fallback, never from a typesafe-specific store.
+			// Ambient-only (no login): the openrouter transport reuses pi's
+			// OpenRouter login or the env fallback; the typesafe transport has
+			// no pi credential store (pi has no typesafe provider) and reads
+			// TYPESAFE_API_KEY only. Neither path opens a second channel.
 			apiKey: {
-				name: "OpenRouter credentials (reused for jev)",
+				name: config.authName,
 				resolve: async () => {
 					let key: string | undefined;
-					try {
-						key = await openRouterKey?.();
-					} catch {
-						/* getProviderAuth may reject on auth-store errors; env still applies */
+					if (config.loginProvider) {
+						try {
+							key = await openRouterKey?.();
+						} catch {
+							/* getProviderAuth may reject on auth-store errors; env still applies */
+						}
 					}
-					key ||= process.env.OPENROUTER_API_KEY?.trim();
-					return key ? { auth: { apiKey: key }, source: "openrouter" } : undefined;
+					key ||= process.env[config.keyEnv]?.trim();
+					return key ? { auth: { apiKey: key }, source: transport } : undefined;
 				},
 			},
 		},
-		models: [JEV_MODEL],
+		models: [jevModel(transport)],
 		api: {
-			stream: (m, c, o) => streamDecisions(m, c, o, fetcher),
-			streamSimple: (m, c, o) => streamDecisions(m, c, o, fetcher),
+			stream: (m, c, o) => streamDecisions(transport, m, c, o, fetcher),
+			streamSimple: (m, c, o) => streamDecisions(transport, m, c, o, fetcher),
 		},
 	});
 }

package/extensions/pi-verdict.ts

@@ -91,6 +91,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { parseJevConfidence } from "./jev-adapter";
 
 // ============================================================================
 // 规则层:bash
@@ -263,9 +264,15 @@ interface UserRules {
 	audit: boolean;
 	/** Allow visibility (#60): info notification on classifier allows; mechanical passes stay silent. Default off. */
 	notifyAllows: boolean;
+	/** #63: second-layer classifier spec (provider/id[:thinking]); null = the cascade is entirely off */
+	classifierFallbackModel: string | null;
+	/** #63: trigger when the first layer's jev confidence is strictly below this (0–100). Default 50. */
+	classifierFallbackConfidence: number;
+	/** #63: "shadow" (default — observe-only, verdicts unchanged) | "enforce" (safety ratchet: the fallback may only escalate strictness, never relax) */
+	classifierFallbackMode: "shadow" | "enforce";
 }
 
-const EMPTY_RULES: UserRules = { allow: [], deny: [], denyPaths: [], builtinDenyFloor: true, classifierModel: null, toggleShortcut: DEFAULT_TOGGLE_SHORTCUT, audit: false, notifyAllows: false };
+const EMPTY_RULES: UserRules = { allow: [], deny: [], denyPaths: [], builtinDenyFloor: true, classifierModel: null, toggleShortcut: DEFAULT_TOGGLE_SHORTCUT, audit: false, notifyAllows: false, classifierFallbackModel: null, classifierFallbackConfidence: 50, classifierFallbackMode: "shadow" };
 
 /** This module's own file location (import.meta.url resolved; null = unresolvable). */
 const OWN_FILE_PATH: string | null = (() => {
@@ -314,7 +321,7 @@ function userConfigPath(): string {
 }
 
 const USER_CONFIG_TEMPLATE = `${JSON.stringify({
-	_hint: "pi-verdict user rules — full reference: https://github.com/jesset/pi-verdict/blob/main/docs/configuration.md. deny beats allow. denyPaths: protected paths, any touch asks for your confirmation (non-interactive degrades to deny); the pre-filled starter list is your declaration, edit or empty freely. builtinDenyFloor=false disables the built-in danger floor at your own risk (the self-protection layer always stays on). classifierModel pins the classifier (provider/id, e.g. zai/glm-5.3-flash; empty = session model). toggleShortcut sets the master-switch toggle key (null or empty disables). This file is part of the permission gate: agent-side modification is denied — edit it manually outside pi. Changes apply to new sessions.",
+	_hint: "pi-verdict user rules — full reference: https://github.com/jesset/pi-verdict/blob/main/docs/configuration.md. deny beats allow. denyPaths: protected paths, any touch asks for your confirmation (non-interactive degrades to deny); the pre-filled starter list is your declaration, edit or empty freely. builtinDenyFloor=false disables the built-in danger floor at your own risk (the self-protection layer always stays on). classifierModel pins the classifier (provider/id, e.g. zai/glm-5.3-flash; empty = session model). classifierFallbackModel (optional) adds a second-layer classifier consulted only when the first layer is uncertain (ask / fail-closed / jev confidence below classifierFallbackConfidence, default 50); mode shadow (default) observes without changing verdicts, enforce escalates strictness only. toggleShortcut sets the master-switch toggle key (null or empty disables). This file is part of the permission gate: agent-side modification is denied — edit it manually outside pi. Changes apply to new sessions.",
 	allow: ["^ls\\b"],
 	deny: [],
 	denyPaths: [
@@ -330,6 +337,9 @@ const USER_CONFIG_TEMPLATE = `${JSON.stringify({
 	toggleShortcut: DEFAULT_TOGGLE_SHORTCUT,
 	audit: false,
 	notifyAllows: false,
+	classifierFallbackModel: null,
+	classifierFallbackConfidence: 50,
+	classifierFallbackMode: "shadow",
 }, null, 2)}\n`;
 
 /**
@@ -347,7 +357,7 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 			} catch { /* 只读环境静默跳过 */ }
 			return { rules: EMPTY_RULES, skipped: [], shortcutWarning: null };
 		}
-		let raw: { allow?: unknown; deny?: unknown; denyPaths?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown; toggleShortcut?: unknown; audit?: unknown; notifyAllows?: unknown };
+		let raw: { allow?: unknown; deny?: unknown; denyPaths?: unknown; builtinDenyFloor?: unknown; classifierModel?: unknown; toggleShortcut?: unknown; audit?: unknown; notifyAllows?: unknown; classifierFallbackModel?: unknown; classifierFallbackConfidence?: unknown; classifierFallbackMode?: unknown };
 		try {
 			raw = JSON.parse(fs.readFileSync(p, "utf8")) as typeof raw;
 		} catch (err) {
@@ -376,6 +386,12 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 			return [x.trim()];
 		});
 		const shortcut = resolveToggleShortcut(raw.toggleShortcut);
+		// #63: fallback cascade keys — invalid values skip into the one-shot warning channel and default (50 / shadow)
+		const fbConfRaw = raw.classifierFallbackConfidence;
+		const fbConfOk = typeof fbConfRaw === "number" && Number.isFinite(fbConfRaw) && fbConfRaw >= 0 && fbConfRaw <= 100;
+		if (fbConfRaw !== undefined && !fbConfOk) skipped.push(`classifierFallbackConfidence: ${JSON.stringify(fbConfRaw)}`);
+		const fbModeRaw = raw.classifierFallbackMode;
+		if (fbModeRaw !== undefined && fbModeRaw !== "shadow" && fbModeRaw !== "enforce") skipped.push(`classifierFallbackMode: ${JSON.stringify(fbModeRaw)}`);
 		return {
 			rules: {
 				allow: compile(raw.allow),
@@ -386,6 +402,9 @@ function loadUserRules(): { rules: UserRules; skipped: string[]; shortcutWarning
 				toggleShortcut: shortcut.key,
 				audit: raw.audit === true,
 				notifyAllows: raw.notifyAllows === true,
+				classifierFallbackModel: typeof raw.classifierFallbackModel === "string" && raw.classifierFallbackModel.trim() ? raw.classifierFallbackModel.trim() : null,
+				classifierFallbackConfidence: fbConfOk ? fbConfRaw : 50,
+				classifierFallbackMode: fbModeRaw === "enforce" ? "enforce" : "shadow",
 			},
 			skipped,
 			shortcutWarning: shortcut.warning,
@@ -1052,6 +1071,7 @@ interface ClassifierOutcome {
 }
 
 const CLASSIFIER_TIMEOUT_MS = 25_000; // 本网关 CC 分类器分布 p90=19.8s(15s 会误杀 ~15%),research/cache-sim 数据
+const FALLBACK_TIMEOUT_MS = 15_000; // #63: second-layer per-attempt budget — matches the first layer's per-attempt discipline (the two-tier retry can spend it twice)
 const CLASSIFIER_MAX_TOKENS = 512;
 const CLASSIFIER_RETRY_MAX_TOKENS = 1024; // 防御重试档:覆盖无视 reasoning:off 或轻思考仍超预算的模型
 const APIS_WITHOUT_TEMPERATURE = new Set<string>([
@@ -1143,11 +1163,12 @@ async function callClassifierOnce(
 	maxTokens: number,
 	thinking: ThinkingLevel = "off",
 	systemPrompt: string = CLASSIFIER_SYSTEM,
+	timeoutMs: number = CLASSIFIER_TIMEOUT_MS,
 ): Promise<{ ok: true; text: string; stopReason: string; errorMessage?: string } | { ok: false; error: string }> {
 	const fire = async (
 		withTemperature: boolean,
 	): Promise<{ ok: true; text: string; stopReason: string; errorMessage?: string } | { ok: false; error: string }> => {
-		const signals = [AbortSignal.timeout(CLASSIFIER_TIMEOUT_MS)];
+		const signals = [AbortSignal.timeout(timeoutMs)];
 		if (signal) signals.push(signal);
 		try {
 			const response = await complete(
@@ -1216,6 +1237,7 @@ async function classifyWithModel(
 	actionLine: string,
 	thinking: ThinkingLevel = "off",
 	denyPathsActive = false,
+	timeoutMs: number = CLASSIFIER_TIMEOUT_MS,
 ): Promise<ClassifierOutcome> {
 	const transcript = buildTranscript(host, actionLine);
 	const userMessage = `<transcript>\n${transcript}\n</transcript>\nJudge the LAST action in the transcript above. Your entire response MUST begin with <verdict>.`;
@@ -1225,7 +1247,7 @@ async function classifyWithModel(
 	let rawResponse = ""; // #54: raw output of the last attempt ("" for exception attempts — diagnostics already live in failures)
 	for (const [n, maxTokens] of attempts) {
 		if (signal?.aborted) break; // 用户已取消,不再重试
-		const r = await callClassifierOnce(host, signal, complete, model, userMessage, maxTokens, thinking, systemPrompt);
+		const r = await callClassifierOnce(host, signal, complete, model, userMessage, maxTokens, thinking, systemPrompt, timeoutMs);
 		if (r.ok) {
 			rawResponse = r.text;
 			const diag = `stopReason=${r.stopReason}, model=${model.id}, errorMessage=${JSON.stringify(r.errorMessage ?? null)}, raw output=${JSON.stringify(r.text.slice(0, 200))}`;
@@ -1362,6 +1384,46 @@ function shadowTag(probe: ShadowProbe): string {
 	return `(shadow cache: miss:no-entry)`;
 }
 
+// ============================================================================
+// Fallback cascade stats (#63: observe-first, session-memory state; the #7 discipline)
+// ============================================================================
+
+/** #63: ratchet strictness order — the fallback may only escalate, never relax */
+const STRICTNESS_RANK: Record<"allow" | "ask" | "deny", number> = { allow: 0, ask: 1, deny: 2 };
+
+interface FallbackStats {
+	triggered: number; // the gate fired (ask / fail-closed / confidence below threshold)
+	agreed: number; // fallback verdict no stricter than the first layer's
+	escalated: number; // fallback stricter than the first layer (enforce applies it; shadow observes the would-be)
+	errored: number; // fallback unresolvable or its call failed
+}
+
+class FallbackCascade {
+	readonly stats: FallbackStats = { triggered: 0, agreed: 0, escalated: 0, errored: 0 };
+
+	/** Session reset (#7 discipline: session-memory state) */
+	reset(): void {
+		Object.assign(this.stats, { triggered: 0, agreed: 0, escalated: 0, errored: 0 });
+	}
+
+	note(first: "allow" | "ask" | "deny", fb: "allow" | "ask" | "deny" | null): void {
+		this.stats.triggered++;
+		if (fb === null) {
+			this.stats.errored++;
+			return;
+		}
+		if (STRICTNESS_RANK[fb] > STRICTNESS_RANK[first]) this.stats.escalated++;
+		else this.stats.agreed++;
+	}
+
+	/** Summary line for /automode */
+	summary(mode: "shadow" | "enforce"): string {
+		const s = this.stats;
+		if (s.triggered === 0) return "fallback cascade: not triggered this session";
+		return `fallback cascade (${mode}): triggered ${s.triggered} · agreed ${s.agreed} · ${mode === "enforce" ? "escalated" : "would-escalate"} ${s.escalated} · errored ${s.errored}`;
+	}
+}
+
 // ============================================================================
 // Gray-zone verdict audit (#54): opt-in JSONL decision records, observe-only
 // (never an adjudication input)
@@ -1369,7 +1431,26 @@ function shadowTag(probe: ShadowProbe): string {
 
 const AUDIT_KEEP_SESSIONS = 20;
 
-/** One gray-zone adjudication record (#54). Full fidelity on purpose: the file is
+/** #63: second-layer classifier outcome on a triggered call. The record's top-level
+ *  fields keep first-layer semantics for corpus comparability (grill decision); the
+ *  verdict actually applied under enforce lives in `effective` (absent in shadow). */
+export interface FallbackAudit {
+	model: string;
+	mode: "shadow" | "enforce";
+	triggeredBy: "ask" | "confidence" | "fail-closed";
+	/** jev confidence that fired the gate; null unless triggeredBy = "confidence" */
+	confidence: number | null;
+	/** null = the fallback call itself failed (unresolvable model, timeout, parse) */
+	verdict: "allow" | "ask" | "deny" | null;
+	reason: string | null;
+	durationMs: number;
+	error: string | null;
+	/** enforce mode only: the verdict applied after the ratchet */
+	effective?: "allow" | "ask" | "deny";
+}
+
+/** One adjudication record (#54; #62 widened the surface to protected-path asks and
+ *  added the ground-truth fields). Full fidelity on purpose: the file is
  *  local-trust-domain (same as pi-verdict.json, per the ADR-0002 boundary note),
  *  so protected-path plaintext is allowed here — it never leaves the machine nor
  *  flows into agent context. */
@@ -1386,9 +1467,20 @@ export interface AuditRecord {
 	rawResponse: string | null;
 	verdict: "allow" | "ask" | "deny";
 	reason: string;
-	source: "model" | "fail-closed";
+	/** #62: protected-path asks are recorded too — their user answers grade the
+	 *  denyPaths rules; rule allow/deny verdicts remain unaudited. */
+	source: "model" | "fail-closed" | "protected-path";
 	shadow: string;
 	degraded: boolean;
+	/** #62 ground truth: the user's answer to an interactive ask confirm. Present only
+	 *  on records whose confirm actually ran; headless/degraded asks omit it. */
+	userAnswer?: "allowed" | "declined";
+	/** #62: ISO timestamp of the confirm resolution; `ts` stays adjudication time. */
+	answeredAt?: string;
+	/** #62: protected-path records only — the matched path. */
+	detail?: string;
+	/** #63: second-layer outcome when the uncertainty gate fired. */
+	fallback?: FallbackAudit;
 }
 
 /** Audit sink (#54): append-only and fail-soft (the first write failure surfaces
@@ -1458,6 +1550,7 @@ export class AuditLog {
 export class SessionState {
 	readonly prot: ProtectedSet;
 	readonly shadow = new ShadowCache();
+	readonly fallback = new FallbackCascade();
 	userRules: UserRules;
 	audit: AuditLog | null;
 	private denyPathBases: string[] | null = null;
@@ -1482,6 +1575,7 @@ export class SessionState {
 		this.userRules = loaded.rules;
 		this.denyPathBases = anchorDenyPaths(loaded.rules.denyPaths, cwd); // anchored to the session cwd, once (ADR-0002)
 		this.shadow.reset();
+		this.fallback.reset();
 		this.audit = this.makeAudit(loaded.rules);
 		return { skipped: loaded.skipped, shortcutWarning: loaded.shortcutWarning };
 	}
@@ -1513,10 +1607,16 @@ export interface Verdict {
 	source: VerdictSource;
 	degraded: boolean;
 	shadow?: string;
+	/** #62: pending audit record for an interactive ask — adjudicate defers the append so
+	 *  the handler can attach the user's answer after the confirm resolves. The handler
+	 *  owns the single finalize: append with userAnswer/answeredAt, or without them when
+	 *  presentation throws. Unset for every non-interactive verdict. */
+	pendingAudit?: AuditRecord;
 }
 
 /** 逐调用环境:呈现无关的宿主能力。model 经 getModel 惰性求值——保持「仅灰区才
- *  解析」的原行为(回退警告不会出现在规则已裁决的调用上);null → fail-closed。 */
+ *  解析」的原行为(回退警告不会出现在规则已裁决的调用上);null → fail-closed。
+ *  getFallbackModel(#63)更惰性:仅在门控触发后才解析。 */
 export interface AdjudicateEnv {
 	cwd: string;
 	hasUI: boolean;
@@ -1524,6 +1624,69 @@ export interface AdjudicateEnv {
 	complete: CompletionFn;
 	host: PipelineHost;
 	signal?: AbortSignal;
+	getFallbackModel?: () => { model: NonNullable<ExtensionContext["model"]>; thinking: ThinkingLevel } | null;
+}
+
+/** #63: should the second layer be consulted for this first-layer outcome? Precedence:
+ *  fail-closed → ask → jev confidence strictly below the threshold. LLM reasons carry
+ *  no numeric confidence (parseJevConfidence → null) — their gate is ask/fail-closed only. */
+function fallbackTrigger(outcome: ClassifierOutcome, rules: UserRules): { triggeredBy: "ask" | "confidence" | "fail-closed"; confidence: number | null } | null {
+	if (!rules.classifierFallbackModel) return null;
+	if (outcome.source === "fail-closed") return { triggeredBy: "fail-closed", confidence: null };
+	if (outcome.verdict === "ask") return { triggeredBy: "ask", confidence: null };
+	const conf = parseJevConfidence(outcome.reason);
+	if (conf !== null && conf < rules.classifierFallbackConfidence) return { triggeredBy: "confidence", confidence: conf };
+	return null;
+}
+
+interface CascadeResult {
+	/** audit material; absent when no trigger fired */
+	fb?: FallbackAudit;
+	/** enforce-mode override; absent = keep the first-layer verdict (shadow never overrides) */
+	effective?: { verdict: "allow" | "ask" | "deny"; reason: string; source: "classifier" | "fail-closed" };
+}
+
+/** #63: run the second layer on a triggered call. Safety ratchet: the fallback may
+ *  only escalate strictness, never relax. A failed fallback (unresolvable model or
+ *  failed call) denies in enforce — an explicitly configured second layer must not
+ *  silently degrade the gate to single-layer (grill decision); in shadow a failure
+ *  is recorded and never changes the verdict. */
+async function runFallbackCascade(
+	state: SessionState,
+	env: AdjudicateEnv,
+	first: "allow" | "ask" | "deny",
+	trigger: { triggeredBy: "ask" | "confidence" | "fail-closed"; confidence: number | null },
+	denyPathsActive: boolean,
+	actionLine: string,
+): Promise<CascadeResult> {
+	const rules = state.userRules;
+	if (!rules.classifierFallbackModel || !env.getFallbackModel) return {};
+	const mode = rules.classifierFallbackMode;
+	const start = Date.now();
+	const base = { mode, triggeredBy: trigger.triggeredBy, confidence: trigger.confidence };
+	// A failed fallback (unresolvable model or failed call) records the error and, under
+	// enforce, denies the triggered call; `fallback.effective` carries the applied "deny"
+	// so failure rows read through the same sub-object as every other enforce row
+	const failed = (model: string, error: string): CascadeResult => {
+		state.fallback.note(first, null);
+		const fb: FallbackAudit = { ...base, model, verdict: null, reason: null, durationMs: Date.now() - start, error };
+		return mode === "enforce" ? { fb: { ...fb, effective: "deny" }, effective: { verdict: "deny", reason: "fallback classifier unavailable (fail-closed)", source: "fail-closed" } } : { fb };
+	};
+	const resolved = env.getFallbackModel();
+	if (!resolved) return failed(rules.classifierFallbackModel, "fallback model unresolvable (not found or no configured auth)");
+	const outcome = await classifyWithModel(env.host, env.signal, env.complete, resolved.model, actionLine, resolved.thinking, denyPathsActive, FALLBACK_TIMEOUT_MS);
+	const durationMs = Date.now() - start;
+	if (outcome.source !== "model") return failed(resolved.model.id, outcome.reason);
+	state.fallback.note(first, outcome.verdict);
+	const fb: FallbackAudit = { ...base, model: resolved.model.id, verdict: outcome.verdict, reason: outcome.reason, durationMs, error: null };
+	if (mode === "enforce") {
+		const effective = STRICTNESS_RANK[outcome.verdict] > STRICTNESS_RANK[first] ? outcome.verdict : first;
+		if (effective !== first) {
+			return { fb: { ...fb, effective }, effective: { verdict: outcome.verdict, reason: `${outcome.reason} (second-opinion classifier escalated ${first} to ${outcome.verdict})`, source: "classifier" } };
+		}
+		return { fb: { ...fb, effective } };
+	}
+	return { fb };
 }
 
 /**
@@ -1541,38 +1704,52 @@ export async function adjudicate(
 	const rule = classifyByRules(call.toolName, call.input, env.cwd, state.userRules, state.prot, state.anchoredDenyPathBases(env.cwd));
 	if (rule.verdict === "allow") return { verdict: "allow", reason: rule.reason ?? "", source: "rule", degraded: false };
 	if (rule.verdict === "deny") return { verdict: "deny", reason: rule.reason ?? "", source: "rule", degraded: false };
+
+	// #62: the audit surface widens to protected-path asks (their user answers grade the
+	// denyPaths rules); rule allow/deny stay unaudited (no corpus value, #54). Record
+	// building is split from appending: an interactive ask returns via pendingAudit and the
+	// handler appends after the confirm resolves (with the ground truth); everything else
+	// appends immediately. Recording stays observe-only — it never changes a verdict; write
+	// failures stay fail-soft in the sink and surface once via drainWarning.
+	const actionLine = toolCallLine(call.toolName, call.input);
+	const buildRecord = (v: Pick<AuditRecord, "verdict" | "reason" | "source" | "degraded">, raw: ClassifierOutcome["auditRaw"] | null, shadow: string): AuditRecord => ({
+		ts: new Date().toISOString(),
+		sessionId: env.host.getSessionId(),
+		cwd: env.cwd,
+		model: raw?.modelId ?? null,
+		tool: call.toolName,
+		input: call.input,
+		actionLine,
+		thinking: raw?.thinking ?? null,
+		transcript: raw?.transcript ?? null,
+		rawResponse: raw?.rawResponse ?? null,
+		shadow,
+		...v,
+	});
+
 	if (rule.verdict === "ask") {
 		// denyPaths 命中 → ask 终局(ADR-0002):声明者本人裁决例外;无 UI 降级为 deny
-		return { verdict: env.hasUI ? "ask" : "deny", reason: rule.reason ?? "", detail: rule.detail, source: "protected-path", degraded: !env.hasUI };
+		if (env.hasUI) {
+			const ppRecord: AuditRecord = { ...buildRecord({ verdict: "ask", reason: rule.reason ?? "", source: "protected-path", degraded: false }, null, "-"), detail: rule.detail };
+			return { verdict: "ask", reason: rule.reason ?? "", detail: rule.detail, source: "protected-path", degraded: false, ...(state.audit ? { pendingAudit: ppRecord } : {}) };
+		}
+		// headless: the ask degrades to deny — recorded like the gray-zone rule (the effective post-degradation verdict is what lands in the record)
+		state.audit?.append({ ...buildRecord({ verdict: "deny", reason: rule.reason ?? "", source: "protected-path", degraded: true }, null, "-"), detail: rule.detail });
+		return { verdict: "deny", reason: rule.reason ?? "", detail: rule.detail, source: "protected-path", degraded: true };
 	}
 
 	// 灰区 → 分类器;无可用模型 → fail-closed
-	// #54: gray-zone only (rule-layer verdicts carry no transcript corpus —
-	// brief decision); observe-only — recording never changes a verdict, and
-	// write failures are swallowed fail-soft by the sink and surfaced once via drainWarning
-	const actionLine = toolCallLine(call.toolName, call.input);
-	const audit = (v: Pick<AuditRecord, "verdict" | "reason" | "source" | "degraded">, raw: ClassifierOutcome["auditRaw"] | null, shadow: string): void => {
-		if (!state.audit) return;
-		state.audit.append({
-			ts: new Date().toISOString(),
-			sessionId: env.host.getSessionId(),
-			cwd: env.cwd,
-			model: raw?.modelId ?? null,
-			tool: call.toolName,
-			input: call.input,
-			actionLine,
-			thinking: raw?.thinking ?? null,
-			transcript: raw?.transcript ?? null,
-			rawResponse: raw?.rawResponse ?? null,
-			shadow,
-			...v,
-		});
-	};
 
 	const resolved = env.getModel();
 	if (!resolved) {
 		const reason = "no classifier model available (fail-closed)";
-		audit({ verdict: "deny", reason, source: "fail-closed", degraded: false }, null, "-");
+		// #63: no-model fail-closed triggers the cascade as well — the ratchet has no
+		// exception for first-layer absence (grill decision: enforce can never relax this
+		// deny; in shadow it is observability only)
+		const cascade = await runFallbackCascade(state, env, "deny", { triggeredBy: "fail-closed", confidence: null }, state.userRules.denyPaths.length > 0, actionLine);
+		const fcRecord = buildRecord({ verdict: "deny", reason, source: "fail-closed", degraded: false }, null, "-");
+		if (cascade.fb) fcRecord.fallback = cascade.fb;
+		state.audit?.append(fcRecord);
 		return { verdict: "deny", reason, source: "fail-closed", degraded: false };
 	}
 
@@ -1591,12 +1768,31 @@ export async function adjudicate(
 	}
 
 	const shadow = shadowTag(probe);
-	const askDegraded = !env.hasUI && outcome.verdict === "ask";
-	audit({ verdict: askDegraded ? "deny" : outcome.verdict, reason: outcome.reason, source: outcome.source, degraded: askDegraded }, outcome.auditRaw ?? null, shadow);
-	if (outcome.verdict === "allow") return { verdict: "allow", reason: outcome.reason, source: "classifier", degraded: false, shadow };
-	if (outcome.verdict === "deny") return { verdict: "deny", reason: outcome.reason, source: "classifier", degraded: false, shadow };
+
+	// #63 cascade: consult the second layer when the gate fires; `effective` is the
+	// ratchet result the returned verdict follows (shadow never overrides)
+	const trigger = fallbackTrigger(outcome, state.userRules);
+	const cascade = trigger ? await runFallbackCascade(state, env, outcome.verdict, trigger, state.userRules.denyPaths.length > 0, actionLine) : {};
+	const effVerdict = cascade.effective?.verdict ?? outcome.verdict;
+	const effReason = cascade.effective?.reason ?? outcome.reason;
+	const effSource = cascade.effective?.source ?? "classifier";
+
+	// #62: record top-level keeps FIRST-layer semantics (grill decision — corpus
+	// comparability); the enforced outcome lives in fallback.effective and evaluators
+	// must read enforce rows accordingly
+	const firstAskDegraded = !env.hasUI && outcome.verdict === "ask";
+	const grayRecord = buildRecord({ verdict: firstAskDegraded ? "deny" : outcome.verdict, reason: outcome.reason, source: outcome.source, degraded: firstAskDegraded }, outcome.auditRaw ?? null, shadow);
+	if (cascade.fb) grayRecord.fallback = cascade.fb;
+	// #62: an interactive ask defers the append to the handler finalize (ground truth);
+	// a headless degraded ask and every other outcome append immediately as before
+	if (effVerdict === "ask" && env.hasUI) {
+		return { verdict: "ask", reason: effReason, source: effSource, degraded: false, shadow, ...(state.audit ? { pendingAudit: grayRecord } : {}) };
+	}
+	state.audit?.append(grayRecord);
+	if (effVerdict === "allow") return { verdict: "allow", reason: effReason, source: effSource, degraded: false, shadow };
+	if (effVerdict === "deny") return { verdict: "deny", reason: effReason, source: effSource, degraded: false, shadow };
 	// ask:无 UI 降级为 deny(ask 降级,CONTEXT.md 词条)
-	return { verdict: env.hasUI ? "ask" : "deny", reason: outcome.reason, source: "classifier", degraded: !env.hasUI, shadow };
+	return { verdict: "deny", reason: effReason, source: effSource, degraded: !env.hasUI, shadow };
 }
 
 // ============================================================================
@@ -1727,6 +1923,8 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	const denyPathsHint = () => (state.userRules.denyPaths.length > 0 ? `\ndenyPaths: ${state.userRules.denyPaths.length} active` : "");
 	/** Status line audit hint (#54): shown only while the sink is active */
 	const auditHint = () => (state.audit ? `\naudit: on → ${state.audit.dir}` : "");
+	/** Status line fallback hint (#63): shown only while the cascade is configured */
+	const fallbackHint = () => (state.userRules.classifierFallbackModel ? `\n${state.fallback.summary(state.userRules.classifierFallbackMode)}` : "");
 
 	pi.registerCommand("automode", {
 		description: "Show Auto Mode status and shadow-cache stats, or set it: /automode on|off",
@@ -1734,7 +1932,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 			const arg = args.trim().toLowerCase();
 			// 裸调用:只读状态展示,无副作用(含影子缓存统计行)
 			if (arg === "") {
-				ctx.ui.notify(`${enabled ? "🛡️ Auto Mode: on" : "Auto Mode: off"}\n${state.shadow.summary()}${denyPathsHint()}${auditHint()}\nUsage: /automode on|off${toggleHint()}`, "info");
+				ctx.ui.notify(`${enabled ? "🛡️ Auto Mode: on" : "Auto Mode: off"}\n${state.shadow.summary()}${denyPathsHint()}${auditHint()}${fallbackHint()}\nUsage: /automode on|off${toggleHint()}`, "info");
 			return;
 			}
 			// 幂等设定:与现值相同不翻转,仅确认
@@ -1745,7 +1943,7 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 				const head = next
 					? `🛡️ Auto Mode enabled${changed ? "" : " (unchanged)"}: tool calls adjudicated by rules + classifier`
 					: `Auto Mode disabled${changed ? "" : " (unchanged)"}: tool calls execute directly`;
-				ctx.ui.notify(`${head}\n${state.shadow.summary()}`, "info");
+				ctx.ui.notify(`${head}\n${state.shadow.summary()}${fallbackHint()}`, "info");
 				return;
 			}
 			// 未知参数:严格拒绝并列出用法(大小写已归一化)
@@ -1757,17 +1955,16 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 	/** 思考级别集(pi 原生 EXTENDED_THINKING_LEVELS;后缀语法对齐 pi --model provider/id:thinking) */
 	const THINKING_LEVELS = new Set(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
 
-	/** 解析 "provider/id:thinking" → { specPart, level }。无效后缀 → 忽略并警告一次 */
-	function parseModelSpec(raw: string, ctx: ExtensionContext): { specPart: string; level: string | null } {
+	/** Parse "provider/id:thinking" → { specPart, level }. An invalid suffix is ignored and
+	 *  reported through warnOnce — the one-shot latch is the caller's, so the two layers'
+	 *  warnings never suppress each other (#63 review fix). */
+	function parseModelSpec(raw: string, warnOnce: (msg: string) => void): { specPart: string; level: string | null } {
 		const slash = raw.lastIndexOf("/");
 		const colon = raw.lastIndexOf(":");
 		if (colon > slash + 1 && THINKING_LEVELS.has(raw.slice(colon + 1))) {
 			return { specPart: raw.slice(0, colon), level: raw.slice(colon + 1) };
 		}
-		if (colon > slash + 1 && !warnedClassifierModel) {
-			warnedClassifierModel = true;
-			ctx.ui.notify(`pi-verdict: invalid thinking-level suffix "${raw.slice(colon + 1)}" (valid: ${[...THINKING_LEVELS].join("/")}), ignored`, "warning");
-		}
+		if (colon > slash + 1) warnOnce(`pi-verdict: invalid thinking-level suffix "${raw.slice(colon + 1)}" (valid: ${[...THINKING_LEVELS].join("/")}), ignored`);
 		return { specPart: raw, level: null };
 	}
 
@@ -1780,7 +1977,11 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 			(pi.getFlag("auto-mode-model") as string | undefined) ?? process.env.PI_AUTO_MODE_MODEL ?? state.userRules.classifierModel;
 		let thinking: ThinkingLevel = "off";
 		if (raw) {
-			const { specPart, level } = parseModelSpec(raw, ctx);
+			const { specPart, level } = parseModelSpec(raw, (msg) => {
+				if (warnedClassifierModel) return;
+				warnedClassifierModel = true;
+				ctx.ui.notify(msg, "warning");
+			});
 			thinking = (level ?? "off") as ThinkingLevel;
 			const slash = specPart.indexOf("/");
 			if (slash > 0) {
@@ -1796,6 +1997,34 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 		return ctx.model ? { model: ctx.model, thinking } : null;
 	}
 
+	let warnedFallbackSuffix = false;
+	let warnedFallbackModel = false;
+	/** #63: second-layer resolution — config-only (no flag/env precedence) and NO
+	 *  session-model fallback: silently inheriting the session model would bill the same
+	 *  judgment twice instead of adding a second opinion. Unresolvable → one-time warning
+	 *  + null (shadow: inert; enforce: triggered calls fail-closed, see runFallbackCascade).
+	 *  Resolved lazily via AdjudicateEnv.getFallbackModel, only after the gate fires. */
+	function resolveFallbackClassifier(ctx: ExtensionContext): { model: NonNullable<ExtensionContext["model"]>; thinking: ThinkingLevel } | null {
+		const raw = state.userRules.classifierFallbackModel;
+		if (!raw) return null;
+		const { specPart, level } = parseModelSpec(raw, (msg) => {
+			if (warnedFallbackSuffix) return;
+			warnedFallbackSuffix = true;
+			ctx.ui.notify(msg, "warning");
+		});
+		const thinking = (level ?? "off") as ThinkingLevel;
+		const slash = specPart.indexOf("/");
+		if (slash > 0) {
+			const model = ctx.modelRegistry.find(specPart.slice(0, slash), specPart.slice(slash + 1));
+			if (model && ctx.modelRegistry.hasConfiguredAuth(model)) return { model, thinking };
+		}
+		if (!warnedFallbackModel) {
+			warnedFallbackModel = true; // one warning per session
+			ctx.ui.notify(`pi-verdict: fallback model "${raw}" unavailable (not found or no configured auth) — classifierFallbackModel inactive this session`, "warning");
+		}
+		return null;
+	}
+
 	function describeAction(toolName: string, input: Record<string, unknown>): string {
 		return toolCallLine(toolName, input);
 	}
@@ -1844,9 +2073,26 @@ export default function autoMode(pi: ExtensionAPI, deps: AutoModeDeps = {}) {
 			complete: completionFor(ctx.modelRegistry, deps.compatLoader),
 			host: ctx.sessionManager,
 			signal: ctx.signal,
+			getFallbackModel: () => resolveFallbackClassifier(ctx),
 		});
 		const auditWarning = state.audit?.drainWarning(); // #54: fail-soft one-shot warning
 		if (auditWarning) ctx.ui.notify(`pi-verdict: ${auditWarning}`, "warning");
-		return presentVerdict(verdict, action, ctx);
+		// #62: an interactive ask's record is finalized here — exactly one append after the
+		// confirm, carrying the user's answer; a presentVerdict throw still lands the record
+		// (without the answer) and the error propagates unchanged. `undefined` = allowed.
+		let presented: { block: true; reason: string } | undefined;
+		try {
+			presented = await presentVerdict(verdict, action, ctx);
+		} catch (err) {
+			if (verdict.pendingAudit) state.audit?.append(verdict.pendingAudit);
+			throw err;
+		}
+		if (verdict.pendingAudit) {
+			state.audit?.append({ ...verdict.pendingAudit, userAnswer: presented === undefined ? "allowed" : "declined", answeredAt: new Date().toISOString() });
+			verdict.pendingAudit = undefined;
+			const lateWarning = state.audit?.drainWarning();
+			if (lateWarning) ctx.ui.notify(`pi-verdict: ${lateWarning}`, "warning");
+		}
+		return presented;
 	});
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-verdict",
-	"version": "0.9.0",
+	"version": "0.10.0",
 	"description": "A minimal permission gate for Pi in the style of Claude Code's auto mode",
 	"author": "Jesset (https://github.com/jesset)",
 	"type": "module",