feat(permission): integrate auto-review and hard guards

pi-permission-system/src/index.ts

@@ -39,9 +39,12 @@ import {
 import { GateRunner } from "./handlers/gates/runner";
 import { SkillInputGatePipeline } from "./handlers/gates/skill-input-gate-pipeline";
 import { ToolCallGatePipeline } from "./handlers/gates/tool-call-gate-pipeline";
+import { installBuiltinAutoReview } from "./auto-review/runtime";
 import { createFailClosedToolCall } from "./handlers/tool-call-boundary";
 import { pathFlavorForPlatform } from "./path/path-flavor";
 import { PermissionManager } from "./permission-manager";
+import { HardGuardPolicyLoader } from "./hard-guard-loader";
+import { getHardGuardConfigPath } from "./config-paths";
 import { PermissionResolver } from "./permission-resolver";
 import { PermissionSession } from "./permission-session";
 import { LocalPermissionsService } from "./permissions-service";
@@ -163,7 +166,15 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
   // access-path → path-values unwrap. Constructed here (before `session`) so
   // the forwarded-request server's ServingPolicy can resolve against it; the
   // service and gates below share this one instance.
-  const resolver = new PermissionResolver(permissionManager, sessionRules);
+  const hardGuardManager = new PermissionManager({
+    policyLoader: new HardGuardPolicyLoader(getHardGuardConfigPath(agentDir)),
+    flavor: hostFlavor,
+  });
+  const resolver = new PermissionResolver(
+    permissionManager,
+    sessionRules,
+    hardGuardManager,
+  );
 
   // Serving a forwarded request is resolution: resolve the child-fixed
   // ForwardedAccessIntent (ADR 0008) directly against the serving node's
@@ -233,6 +244,14 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     authorizerRegistry,
   );
 
+  const autoReview = installBuiltinAutoReview({
+    pi,
+    service: permissionsService,
+    config: configStore,
+    logger,
+    agentDir,
+  });
+
   // Subscribe to @gotgenes/pi-subagents' child lifecycle events so child
   // sessions register/unregister without the core calling us (ADR 0002).
   const unsubSubagentLifecycle = subscribeSubagentLifecycle(
@@ -298,13 +317,21 @@ export default function piPermissionSystemExtension(pi: ExtensionAPI): void {
     gateRunner,
   );
 
-  pi.on("session_start", (event, ctx) =>
-    lifecycle.handleSessionStart(event, ctx),
-  );
+  pi.on("session_start", async (event, ctx) => {
+    await lifecycle.handleSessionStart(event, ctx);
+    autoReview.handleSessionStart(ctx);
+  });
   pi.on("resources_discover", (event, ctx) =>
     lifecycle.handleResourcesDiscover(event, ctx),
   );
-  pi.on("session_shutdown", () => lifecycle.handleSessionShutdown());
+  pi.on("turn_start", () => autoReview.handleTurnStart());
+  pi.on("agent_settled", () => {
+    void autoReview.handleAgentSettled();
+  });
+  pi.on("session_shutdown", async () => {
+    autoReview.handleSessionShutdown();
+    await lifecycle.handleSessionShutdown();
+  });
   pi.on("before_agent_start", (event, ctx) => agentPrep.handle(event, ctx));
   pi.on("input", (event, ctx) => gates.handleInput(event, ctx));
   pi.on(