fix(core): restore permission decision diagnostics - #56271

Issue for this PR

Closes #56247

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Restores V2 Info-level permission evaluation, ask and reply diagnostics. Authorization is unchanged; resources, rulesets, metadata, hook messages and feedback stay private.

Evaluations separate the effective and pre-hook decisions. The zero-based rule index (-1 for default) includes agent/session rules and consulted saved approvals. Asks/replies share session/request identifiers.

How did you verify your code works?

Current head: 4bb78ffad818f4148f7212e3d78a023f520f0de7 (November 4). The latest dev synchronization, validation and remaining limits are recorded in this follow-up. That updated full core run was not fully green: it recorded 7,193 passes, 36 skips and 10 failures; its baseline controls and focused rerun are disclosed in the follow-up. The zero-failure results for bfa44c2 below are historical and must not be read as results for this head. No project tests were rerun for this description clarification, and hosted workflows still require maintainer approval.

bfa44c2 merges dev at 6bac3b9, retaining Logger, upstream Schema, metadata sanitization and its encoding regression.

On macOS, Bun 1.4.2 and task-local Bash 5.3.20, with isolated HOME and temporary directories:

• Full core suite: 6,671 pass, 43 existing skips, 0 failures.
• Permission tests: 116 pass; randomized ten-repeat run alongside the full suite: 1,160 pass.
• Core bun typecheck, root bun run check (34 tasks), Prettier and git diff --check: pass. Lint: 1,306 non-blocking warnings, none in the changed files.

Two initial config-discovery failures disappeared after moving TMPDIR outside personal ancestor directories, without source changes, retry flags or timeout increases. These are local results, not hosted CI.

Screenshots / recordings

No UI change. Historical boundary capture: real permission service, SQLite and file logger; synthetic fixtures, no live model or HTTP/TUI end-to-end run. Eight identical decisions: zero diagnostics before, sixteen after, no private sentinel leakage.

Before	After

5.8-second comparison · Runnable reproduction and original logs

Captured on 101ec31; not recaptured for this refresh.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

Visual

Release illustration only, not a screenshot or runtime recording. The real historical before/after evidence and its source SHA remain above.

<svg xmlns="http://www.w3.org/2000/svg" width="240" height="72" viewBox="0 0 240 72" fill="none" role="img" aria-label="Permission decisions emit privacy-safe diagnostics">
  <style>
    @keyframes pulse { 0%,100% { opacity:.35 } 50% { opacity:1 } }
    .signal { animation:pulse 2s ease-in-out infinite }
    @media (prefers-reduced-motion:reduce) { .signal { animation:none;opacity:1 } }
  </style>
  <g stroke="currentColor" stroke-width="1.5">
    <rect x="9" y="15" width="76" height="42" rx="8" opacity=".6"/>
    <path d="M90 36h34m-6-5 6 5-6 5" opacity=".65"/>
    <rect x="131" y="10" width="100" height="52" rx="8" opacity=".6"/>
    <path class="signal" d="M143 24h74m-74 12h56m-56 12h66"/>
  </g>
  <text x="47" y="34" text-anchor="middle" fill="currentColor" font-family="monospace" font-size="10">permission</text>
  <text x="47" y="46" text-anchor="middle" fill="currentColor" font-family="monospace" font-size="8" opacity=".65">evaluate / reply</text>
</svg>

AI assistance

Implementation, tests and this description used AI assistance. Automated self-review does not replace independent maintainer review. The verification above retains its original source head and dates; this description-only update does not claim a new project-test run.