- add pnpm workspace scaffold with shared TypeScript config - register an ai-bash-judge authorizer with pi-permission-system - log permission request details and deterministic policy verdicts - record review entries and defer to the next authorizer