karajan-code 4.13.0 → 4.15.0

package/README.md

@@ -22,7 +22,7 @@
 
 ---
 
-Your AI agent (Claude Code, Codex, Gemini CLI, Cursor…) writes the code. **Karajan governs how it happens**: it installs a method your agent follows on every task, and enforces it with git gates that make a false green structurally impossible.
+Your AI agent (Claude Code, Codex, Copilot, Antigravity, Cursor…) writes the code. **Karajan governs how it happens**: it installs a method your agent follows on every task, and enforces it with git gates that make a false green structurally impossible.
 
 - **RAG before assuming** — `kj rag query` answers what your codebase does; no agent guesses. The install wires it as a native MCP tool (`kj_rag_query`) so querying the index is the agent's cheapest path. Works out of the box: local Ollama, or the built-in ONNX embedder when nothing can be installed; cloud embedders require an explicit sensitivity declaration and PII-redact every chunk. A distilled engineering canon rides along: `kj rag query --library` serves pattern cards (when it applies, when it does NOT, the canonical citation) so plans name a greenfield alternative instead of following the legacy line by inertia.
 - **Card first, on YOUR board** — every piece of work is tracked before it starts: kj's HU Board (`kj hu add|move|list`), the Planning Game, or the board the project already uses (Linear, Trello, Jira, GitHub Issues) via your agent's own MCP/tools. Declared, verified at install, never optional — Karajan does not run without a board. ADRs live in git (`kj adr add|list`).
@@ -34,6 +34,7 @@ Your AI agent (Claude Code, Codex, Gemini CLI, Cursor…) writes the code. **Kar
 - **Nothing personal ships** — every outbound boundary audits before it leaves the machine: the pre-commit rejects a staged diff carrying your denylisted personal data, hardcoded platform tokens (`ghp_`, `sk-`, `AKIA`…) block outright, `verify-pack`-style tarball scans guard the publish, and `kj privacy scan <dir>` audits any build output. Your denylist lives in `~/.karajan/privacy.yml` — the install asks and writes it for you.
 - **Installing IS activating** — `kj env install` performs the enforcement itself (git hooks, verdict gate, tool gate) instead of trusting the agent to run setup steps, and ends by printing the method into the very conversation that installed it. A commit outside the method is rejected, not narrated.
 - **The turn cannot end red — the Sentinel** — a deterministic supervisor (zero LLM) wired into the harness's synchronous hooks records the method state of the session as tools run, and a Stop hook blocks the agent from ending its turn while method violations are open. The program rules, the agent thinks. See [guarantee levels](#guarantee-levels-governed-vs-supervised).
+- **The review panel never runs dry** — nine built-in agents (Claude Code, Codex, GitHub Copilot, Antigravity `agy` — the gemini successor —, Kimi Code, Qwen, OpenCode, Aider, Gemini legacy), and when the configured reviewer exhausts its quota, `kj review` switches to an authenticated candidate with a LOUD notice — or hands you the menu of candidates with their tier (free / subscription / local) and the exact login command. Never a silent failure, never the brain reviewing itself.
 
 This repo runs under its own environment: every commit to karajan-code carries a cross-AI verdict.
 

package/docs/README.es.md

@@ -14,7 +14,7 @@
 
 ---
 
-Tu agente de IA (Claude Code, Codex, Gemini CLI, Cursor…) escribe el código. **Karajan gobierna cómo ocurre**: instala un método que tu agente sigue en cada tarea y lo hace cumplir con gates de git que hacen el falso verde estructuralmente imposible.
+Tu agente de IA (Claude Code, Codex, Copilot, Antigravity, Cursor…) escribe el código. **Karajan gobierna cómo ocurre**: instala un método que tu agente sigue en cada tarea y lo hace cumplir con gates de git que hacen el falso verde estructuralmente imposible.
 
 - **RAG antes de suponer** — `kj rag query` responde qué hace tu código; ningún agente adivina. La instalación lo cablea como herramienta MCP nativa (`kj_rag_query`), de modo que consultar el índice sea el camino más barato del agente. Funciona de serie: Ollama local, o el embedder ONNX integrado cuando no se puede instalar nada; los embedders cloud exigen declarar la sensibilidad y redactan PII de cada chunk. Y viaja con un canon de ingeniería destilado: `kj rag query --library` sirve fichas de patrón (cuándo aplica, cuándo NO, la cita canónica) para que los planes nombren una alternativa greenfield en vez de seguir la línea del legacy por inercia.
 - **Card primero, en TU board** — todo trabajo se registra antes de empezar: el HU Board de kj (`kj hu add|move|list`), el Planning Game, o el board que el proyecto ya use (Linear, Trello, Jira, GitHub Issues) vía los MCP/tools de tu agente. Declarado, verificado en la instalación, jamás opcional — Karajan no funciona sin board. Los ADRs viven en git (`kj adr add|list`).
@@ -26,6 +26,7 @@ Tu agente de IA (Claude Code, Codex, Gemini CLI, Cursor…) escribe el código.
 - **Nada personal se publica** — cada boundary de salida se audita antes de dejar la máquina: el pre-commit rechaza un diff con tus datos vetados, los tokens de plataforma hardcodeados (`ghp_`, `sk-`, `AKIA`…) bloquean directamente, el scan del tarball guarda el publish, y `kj privacy scan <dir>` audita cualquier build. Tu denylist vive en `~/.karajan/privacy.yml` — la instalación pregunta y la escribe por ti.
 - **Instalar ES activar** — `kj env install` ejecuta él mismo el enforcement (hooks de git, gate de veredicto, tool gate) en vez de confiar en que el agente corra pasos de setup, y termina imprimiendo el método en la propia conversación que instaló. Un commit fuera del método se rechaza, no se narra.
 - **El turno no puede terminar en rojo — el Sentinel** — un supervisor determinista (cero LLM) cableado a los hooks síncronos del harness registra el estado del método de la sesión según corren las herramientas, y un hook Stop bloquea que el agente termine su turno mientras haya violaciones abiertas. El programa manda, el agente piensa. Ver [niveles de garantía](#niveles-de-garantía-gobernado-vs-supervisado).
+- **El panel de revisión nunca se seca** — nueve agentes integrados (Claude Code, Codex, GitHub Copilot, Antigravity `agy` — el sucesor de gemini —, Kimi Code, Qwen, OpenCode, Aider, Gemini legacy), y cuando al reviewer configurado se le agota la cuota, `kj review` cambia a un candidato autenticado AVISANDO en alto — o te entrega el menú de candidatos con su tier (gratis / suscripción / local) y el comando de login exacto. Jamás un fallo mudo, jamás el brain revisándose a sí mismo.
 
 Este repo corre bajo su propio entorno: cada commit de karajan-code lleva un veredicto de IA cruzada.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.13.0",
+  "version": "4.15.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",
@@ -76,8 +76,8 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
-    "lint": "eslint src/",
-    "lint:fix": "eslint src/ --fix",
+    "lint": "eslint src/ packages/",
+    "lint:fix": "eslint src/ packages/ --fix",
     "lint:syntax": "((command -v rg >/dev/null 2>&1 && rg --files src tests | rg '\\.js$') || find src tests -type f -name '*.js') | while IFS= read -r f; do node --check \"$f\"; done",
     "format:check": "prettier --check .",
     "format:fix": "prettier --write .",

package/packages/ai-trash/src/cli.js

@@ -113,7 +113,9 @@ async function cmdPurge(root, id, out, err) {
 async function cmdEmpty(root, flags, out) {
   await ensureRoot(root);
   const m = await loadManifest(root);
-  let dropped = [];
+  // Assigned in every branch below (the trailing else covers the default),
+  // so an initializer would never be read (no-useless-assignment).
+  let dropped;
   if (flags["older-than-days"]) {
     const days = Number(flags["older-than-days"]);
     if (!Number.isFinite(days) || days < 0) throw new Error("--older-than-days must be >= 0");

package/packages/hu-board/public/utils/formatters.js

@@ -117,7 +117,7 @@ function humaniseProjectName(id) {
   if (!id || typeof id !== 'string') return id || '';
   const tail = id.split(/[/_]/).filter(Boolean).pop() || id;
   const words = tail
-    .split(/[\s\-]+/)
+    .split(/[\s-]+/)
     .map((w) => w.replace(/[^\p{L}\p{N}]/gu, ''))
     .filter((w) => w.length > 0);
   if (words.length === 0) return id;

package/packages/hu-board/src/cleanup-zombies.js

@@ -23,7 +23,6 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { homedir } from 'node:os';
 import {
   getDb,
   getKjHome,

package/packages/hu-board/src/command-runner.js

@@ -18,7 +18,6 @@
 
 import { mkdirSync, openSync } from "node:fs";
 import { join, dirname } from "node:path";
-import { homedir } from "node:os";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { randomUUID } from "node:crypto";

package/packages/hu-board/src/config-yaml.js

@@ -30,7 +30,6 @@
 
 import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, renameSync } from 'node:fs';
 import { join, dirname } from 'node:path';
-import { tmpdir } from 'node:os';
 import yaml from 'js-yaml';
 import { getKjHome } from './db.js';
 
@@ -448,7 +447,7 @@ export function readConfig({ scope = 'global' } = {}) {
       parsed = yaml.load(readFileSync(p, 'utf8'), { json: true }) || {};
       exists = true;
     } catch (err) {
-      throw new Error(`No se pudo parsear ${p}: ${err.message}`);
+      throw new Error(`No se pudo parsear ${p}: ${err.message}`, { cause: err });
     }
   }
   const fields = EDITABLE_FIELDS.map((f) => {

package/packages/hu-board/src/ephemeral-cleaner.js

@@ -150,8 +150,6 @@ export function cleanupEphemeralProjects({
   const candidates = findEphemeralProjects(allProjects, { ...opts, now: now() });
   if (candidates.length === 0) return [];
 
-  const countStories = db.prepare("SELECT COUNT(*) AS n FROM stories WHERE project_id = ?");
-  const countSessions = db.prepare("SELECT COUNT(*) AS n FROM sessions WHERE project_id = ?");
   const delStories = db.prepare("DELETE FROM stories WHERE project_id = ?");
   const delSessions = db.prepare("DELETE FROM sessions WHERE project_id = ?");
   const delProject = db.prepare("DELETE FROM projects WHERE id = ?");

package/packages/hu-board/src/plan-mutations.js

@@ -16,7 +16,6 @@
  */
 import { readFileSync, existsSync, readdirSync, mkdirSync, openSync } from 'node:fs';
 import { join, dirname } from 'node:path';
-import { homedir } from 'node:os';
 import { writeJsonAtomicSync } from 'karajan-core/atomic-write';
 import { spawn } from 'node:child_process';
 import { trackRun, untrack } from './run-tracker.js';

package/packages/hu-board/src/preflight.js

@@ -28,7 +28,7 @@
  */
 
 import { execSync } from 'node:child_process';
-import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { getHuBoardPlansDirs } from './db.js';
 

package/packages/hu-board/src/routes/api.js

@@ -21,7 +21,6 @@ export async function readPlanCached(p) {
   planFileCache.set(p, { mtimeMs, plan });
   return plan;
 }
-import os from 'node:os';
 import path from 'node:path';
 import { spawn as spawnChild } from 'node:child_process';
 import {
@@ -36,7 +35,6 @@ import {
   getKjHome,
   getHuBoardRunsDir,
   getHuBoardPlansDir,
-  getHuBoardLegacyPlansDir,
   getHuBoardPlansDirs,
   getStoryRow,
   listPlanIdsForProject,
@@ -93,19 +91,6 @@ function huStoriesDir() {
   return path.join(getKjHome(), 'hu-stories');
 }
 
-/**
- * Best-effort removal of the hu-stories/<id>/ directory.
- */
-async function removeBatchDir(batchId) {
-  try {
-    const dir = path.join(huStoriesDir(), batchId);
-    await fsp.rm(dir, { recursive: true, force: true });
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 /**
  * GET /api/dashboard - Global dashboard statistics.
  */

package/packages/hu-board/src/server.js

@@ -4,7 +4,6 @@ import rateLimit from 'express-rate-limit';
 import { join, dirname } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { writeFileSync, rmSync, mkdirSync, realpathSync } from 'node:fs';
-import { homedir } from 'node:os';
 import { initDb, closeDb } from './db.js';
 import { fullScan, startWatcher } from './sync.js';
 import apiRoutes from './routes/api.js';

package/packages/hu-board/src/sync.js

@@ -1,5 +1,5 @@
 import { watch } from 'chokidar';
-import { readFileSync, readdirSync, existsSync, statSync, rmSync } from 'node:fs';
+import { readFileSync, readdirSync, existsSync, rmSync } from 'node:fs';
 import { dirname, join, basename } from 'node:path';
 import { homedir } from 'node:os';
 import {

package/packages/hu-board/src/token-store.js

@@ -12,7 +12,6 @@
 
 import { randomBytes } from "node:crypto";
 import { mkdirSync, readFileSync, writeFileSync, chmodSync, existsSync } from "node:fs";
-import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 
 const TOKEN_BYTES = 32;

package/packages/hu-board/src/zombie-reaper.js

@@ -45,7 +45,6 @@
 
 import fs from "node:fs";
 import path from "node:path";
-import os from "node:os";
 
 const DEFAULT_CODING_HOURS = 6;
 const DEFAULT_PAUSED_HOURS = 24;

package/src/agents/agy-agent.js

@@ -0,0 +1,62 @@
+import { BaseAgent } from "./base-agent.js";
+import { resolveBin } from "./resolve-bin.js";
+
+/**
+ * Antigravity CLI (`agy`) — KJC-TSK-0729 fase 2b: the ninth built-in agent.
+ * Google's official successor to the retired gemini CLI (dead 2026-06-18),
+ * covered by the user's Google AI Pro/Ultra subscription — the natural
+ * third AI for solomon arbitration, back at last.
+ *
+ * Verified live against agy 1.1.10:
+ *  - `-p <prompt>` runs print mode; `--output-format json` emits ONE JSON
+ *    object: {status: "SUCCESS", response, usage}. Non-SUCCESS status can
+ *    arrive with exit 0, so ok checks BOTH.
+ *  - `--disable-slash-commands` keeps prompt content (diffs can contain
+ *    "/lines") from expanding as slash commands in print mode.
+ *  - Permission prompts are denied in print mode unless
+ *    `--dangerously-skip-permissions` (coder mode only).
+ *  - Auth lives under ~/.gemini/antigravity-cli (device/browser login).
+ */
+export class AgyAgent extends BaseAgent {
+  async runTask(task) {
+    return this._exec(task, this.getRoleModel(task.role || "coder"), ["--dangerously-skip-permissions"]);
+  }
+
+  async reviewTask(task) {
+    return this._exec(
+      { ...task, prompt: `Do NOT use any tools. Answer directly from this prompt only.\n\n${task.prompt}` },
+      this.getRoleModel(task.role || "reviewer"),
+      [],
+    );
+  }
+
+  async _exec(task, model, extraArgs) {
+    const args = ["-p", task.prompt, "--output-format", "json", "--disable-slash-commands", ...extraArgs];
+    if (model) args.push("--model", model);
+    const res = await this.runCommand(resolveBin("agy"), args, {
+      onOutput: task.onOutput,
+      silenceTimeoutMs: task.silenceTimeoutMs,
+      timeout: task.timeoutMs,
+      cwd: task.cwd,
+    });
+    const parsed = extractAgyOutput(res.stdout);
+    const ok = res.exitCode === 0 && parsed?.status === "SUCCESS";
+    return {
+      ok,
+      output: parsed?.response ?? res.stdout,
+      error: ok ? res.stderr : parsed?.error || res.stderr || `agy status: ${parsed?.status || "unparseable"}`,
+      exitCode: res.exitCode,
+    };
+  }
+}
+
+/** Parse agy's single-object JSON print output ({status, response}), null if not JSON. */
+export function extractAgyOutput(stdout) {
+  if (!stdout) return null;
+  try {
+    const obj = JSON.parse(stdout.trim());
+    return typeof obj === "object" && obj !== null ? obj : null;
+  } catch {
+    return null;
+  }
+}

package/src/agents/claude-agent.js

@@ -374,7 +374,8 @@ export class ClaudeAgent extends BaseAgent {
         onOutput: streamFilter,
         silenceTimeoutMs: task.silenceTimeoutMs,
         timeout: task.timeoutMs,
-        env: task.env
+        env: task.env,
+        cwd: task.cwd
       }));
       const raw = pickOutput(res);
       const output = extractTextFromStreamJson(raw);
@@ -384,7 +385,7 @@ export class ClaudeAgent extends BaseAgent {
 
     // Without streaming, use json output to get structured response via stderr
     args.push("--output-format", "json");
-    const res = await this.runCommand(resolveBin("claude"), args, cleanExecaOpts({ env: task.env }));
+    const res = await this.runCommand(resolveBin("claude"), args, cleanExecaOpts({ env: task.env, cwd: task.cwd }));
     const raw = pickOutput(res);
     const output = extractTextFromStreamJson(raw);
     const usage = extractUsageFromStreamJson(raw);

package/src/agents/codex-agent.js

@@ -85,7 +85,9 @@ export class CodexAgent extends BaseAgent {
       onOutput: task.onOutput,
       silenceTimeoutMs: task.silenceTimeoutMs,
       timeout: task.timeoutMs,
-      input: task.prompt
+      input: task.prompt,
+      // TOR-A (KJC-TSK-0723): tournament lanes run the coder INSIDE the lane.
+      cwd: task.cwd
     });
     const usage = extractCodexTokens(res.stdout);
     return { ok: res.exitCode === 0, output: res.stdout, error: res.stderr, exitCode: res.exitCode, ...usage };

package/src/agents/index.js

@@ -5,6 +5,8 @@ import { AiderAgent } from "./aider-agent.js";
 import { OpenCodeAgent } from "./opencode-agent.js";
 import { QwenAgent } from "./qwen-agent.js";
 import { CopilotAgent } from "./copilot-agent.js";
+import { KimiAgent } from "./kimi-agent.js";
+import { AgyAgent } from "./agy-agent.js";
 
 const agentRegistry = new Map();
 
@@ -53,3 +55,5 @@ registerAgent("aider", AiderAgent, { bin: "aider", installUrl: "https://aider.ch
 registerAgent("opencode", OpenCodeAgent, { bin: "opencode", installUrl: "https://opencode.ai" });
 registerAgent("qwen", QwenAgent, { bin: "qwen", installUrl: "https://github.com/QwenLM/qwen-code" });
 registerAgent("copilot", CopilotAgent, { bin: "copilot", installUrl: "https://docs.github.com/copilot/how-tos/use-copilot-agents/use-copilot-cli" });
+registerAgent("kimi", KimiAgent, { bin: "kimi", installUrl: "https://github.com/MoonshotAI/kimi-code" });
+registerAgent("agy", AgyAgent, { bin: "agy", installUrl: "https://antigravity.google" });

package/src/agents/kimi-agent.js

@@ -0,0 +1,45 @@
+import { BaseAgent } from "./base-agent.js";
+import { resolveBin } from "./resolve-bin.js";
+
+/**
+ * Kimi Code (Moonshot, binary `kimi`) — KJC-TSK-0729 fase 2: the eighth
+ * built-in agent and the free-tier reserve of the reviewer/solomon panel.
+ *
+ * Verified live against kimi-code 0.27.0:
+ *  - `-p <prompt>` runs one prompt non-interactively and prints the
+ *    response (text output by default) — the prompt travels as an argument,
+ *    same E2BIG caveat as claude/copilot (KJC-BUG-0121) for huge diffs.
+ *  - `-m <model>` picks a model alias; `-y` auto-approves actions.
+ *  - Auth is the device-code login (`kimi login`), no env keys involved;
+ *    "No model configured" on a logged machine means the login did not
+ *    populate the managed provider (re-run `kimi login`).
+ */
+export class KimiAgent extends BaseAgent {
+  async runTask(task) {
+    // Coder mode IS an agentic run: file edits and shell need approval.
+    return this._exec(task, this.getRoleModel(task.role || "coder"), ["-y"]);
+  }
+
+  async reviewTask(task) {
+    // Review/arbitration answers from the prompt alone — no auto-approval,
+    // and an explicit no-tools instruction so a headless run never stalls
+    // waiting for a permission prompt nobody can answer.
+    return this._exec(
+      { ...task, prompt: `Do NOT use any tools. Answer directly from this prompt only.\n\n${task.prompt}` },
+      this.getRoleModel(task.role || "reviewer"),
+      [],
+    );
+  }
+
+  async _exec(task, model, extraArgs) {
+    const args = ["-p", task.prompt, ...extraArgs];
+    if (model) args.push("-m", model);
+    const res = await this.runCommand(resolveBin("kimi"), args, {
+      onOutput: task.onOutput,
+      silenceTimeoutMs: task.silenceTimeoutMs,
+      timeout: task.timeoutMs,
+      cwd: task.cwd,
+    });
+    return { ok: res.exitCode === 0, output: res.stdout, error: res.stderr, exitCode: res.exitCode };
+  }
+}

package/src/checks/ai-surface.js

@@ -50,8 +50,11 @@ export function collectAiSurface({ projectDir = process.cwd(), home = os.homedir
  * Diff the current surface against the last-seen snapshot and persist the
  * new state. First run records the baseline silently.
  */
-export function checkAiSurface({ projectDir = process.cwd(), home = os.homedir(), statePath = path.join(os.homedir(), ".karajan", "ai-surface.json") } = {}) {
-  const surface = collectAiSurface({ projectDir, home });
+export function checkAiSurface({ projectDir = process.cwd(), home = os.homedir(), statePath = path.join(os.homedir(), ".karajan", "ai-surface.json"), extraSurface = [] } = {}) {
+  // KJC-TSK-0728: extraSurface carries entries the (async) caller collected
+  // outside config files — e.g. observed agent CLIs as "grok (cli)" — so
+  // they ride the same snapshot and the same "NEW since last check" drift.
+  const surface = [...new Set([...collectAiSurface({ projectDir, home }), ...extraSurface])].sort();
   let state = {};
   try { state = JSON.parse(readFileSync(statePath, "utf8")); } catch { /* first run or corrupt → baseline */ }
   const prev = Array.isArray(state[projectDir]) ? state[projectDir] : null;

package/src/checks/binaries.js

@@ -12,7 +12,7 @@
  * the install command and can offer to run it).
  */
 
-import { checkBinary, KNOWN_AGENTS } from "../utils/agent-detect.js";
+import { checkBinary, KNOWN_AGENTS, detectObservedAgents } from "../utils/agent-detect.js";
 import { runCommand } from "../utils/process.js";
 import { withDocLink } from "../utils/doc-links.js";
 import { getInstallHint, appliesToStack } from "../utils/install-hints.js";
@@ -38,6 +38,33 @@ function createAgentCheck(agent) {
   };
 }
 
+/**
+ * KJC-TSK-0728 — ONE aggregate line for the observation census (agent CLIs
+ * kj sees but does not drive). Only FOUND CLIs are listed; the missing ones
+ * make no noise, and the check never fails. `detector` is injectable for
+ * tests.
+ */
+export function createObservedAgentsCheck({ detector = detectObservedAgents } = {}) {
+  return {
+    name: "agents:observed",
+    label: "Agent CLIs observed (not driven)",
+    strategy: STRATEGY.MANUAL,
+    async detect() {
+      let found = [];
+      try {
+        found = (await detector()).filter((a) => a.available);
+      } catch { /* census is best-effort */ }
+      return {
+        ok: true,
+        severity: "info",
+        detail: found.length
+          ? found.map((a) => `${a.name} (${(a.version || "").split(" ").at(-1) || "?"})`).join(", ")
+          : "none detected",
+      };
+    },
+  };
+}
+
 /**
  * Check the presence of a core binary (node, npm, git).
  */
@@ -165,6 +192,7 @@ export function getBinaryChecks() {
   for (const agent of KNOWN_AGENTS) {
     checks.push(createAgentCheck(agent));
   }
+  checks.push(createObservedAgentsCheck());
   for (const bin of ["node", "npm", "git"]) {
     checks.push(createCoreBinaryCheck(bin));
   }

package/src/cli/advanced-commands.js

@@ -27,7 +27,7 @@ export const META_COMMANDS = ["advanced", "help"];
  * so a newly-registered command can never silently vanish from `kj advanced`.
  */
 export const ADVANCED_GROUPS = [
-  { title: "Pipeline (piezas sueltas)", commands: ["autorun", "code", "review", "solomon", "agent", "scan"] },
+  { title: "Pipeline (piezas sueltas)", commands: ["autorun", "code", "review", "solomon", "agent", "scan", "tournament"] },
   { title: "Análisis pre-run", commands: ["discover", "triage", "researcher", "architect", "onboard", "brief"] },
   { title: "Búsqueda / RAG", commands: ["rag", "qmd", "watch"] },
   { title: "Calidad / auditoría", commands: ["audit", "check", "mutate", "webperf", "sonar", "privacy", "release"] },

package/src/cli/register-pipeline.js

@@ -3,6 +3,8 @@ import { ollamaStartCommand, ollamaStopCommand, ollamaStatusCommand, ollamaPullC
 import { configCommand } from "../commands/config.js";
 import { codeCommand } from "../commands/code.js";
 import { reviewCommand } from "../commands/review.js";
+import { tournamentCommand } from "../commands/tournament.js";
+import { resolveTaskInput } from "../utils/task-file.js";
 import { reviewGateCommand, solomonCommand } from "../commands/review-gate.js";
 import { scanCommand } from "../commands/scan.js";
 import { installToolsCommand } from "../commands/install-tools.js";
@@ -144,7 +146,6 @@ export function registerPipeline(program, { pkgVersion }) {
             effectiveTask = plan.task;
           }
         }
-        const { resolveTaskInput } = await import("../utils/task-file.js");
         const resolvedTask = await resolveTaskInput({ task: effectiveTask, taskFile: flags.taskFile, projectDir: config.projectDir, logger });
         const res = await runCommandHandler({ task: resolvedTask, config, logger, flags });
         // KJC-TSK-0674 (issue #1289): an aborted run (spec-review cancel,
@@ -163,7 +164,6 @@ export function registerPipeline(program, { pkgVersion }) {
     .option("--skip-spec-review", "Bypass the spec-reviewer pre-pipeline audit")
     .action(async (task, flags) => {
       const code = await withConfig(pkgVersion, "autorun", flags, async ({ config, logger }) => {
-        const { resolveTaskInput } = await import("../utils/task-file.js");
         const { autorunCommand } = await import("../commands/autorun.js");
         const resolvedTask = await resolveTaskInput({ task, taskFile: flags.taskFile, projectDir: config.projectDir, logger });
         const res = await autorunCommand({ task: resolvedTask, config, logger, flags });
@@ -181,7 +181,6 @@ export function registerPipeline(program, { pkgVersion }) {
     .option("--coder-model <name>")
     .action(async (task, flags) => {
       await withConfig(pkgVersion, "code", flags, async ({ config, logger }) => {
-        const { resolveTaskInput } = await import("../utils/task-file.js");
         const resolvedTask = await resolveTaskInput({ task, taskFile: flags.taskFile, projectDir: config.projectDir, logger });
         await codeCommand({ task: resolvedTask, config, logger });
       });
@@ -199,6 +198,30 @@ export function registerPipeline(program, { pkgVersion }) {
       });
     });
 
+  // KJC-TSK-0723 (TOR-A) — the governed tournament: same task, N coders,
+  // isolated lanes; the method picks the winner (TOR-B/C), not vibes.
+  program
+    .command("tournament")
+    .description("Fan the SAME task out to N coders in isolated worktree lanes and collect per-lane evidence (diff, suite, log)")
+    .argument("[task]", "Task description (REQUIRED — provide as argument or via --task-file)")
+    .option("--task-file <path>", "Read the task from a file (e.g. .md)")
+    .option("--coders <csv>", "Comma-separated coder agents (minimum 2), e.g. claude,codex,agy")
+    .option("--score <id>", "Score an EXISTING tournament from its artifacts (deterministic, zero LLM)")
+    .option("--judge <id>", "Cross-AI judge ranks the finalists (scoreboard in sight; solomon on tie/dispute)")
+    .option("--crown <id>", "Commit the judged winner in its lane THROUGH the real review gate")
+    .option("--card <ref>", "With --crown: card reference for the commit message (card-first gates)")
+    .option("--json", "With --score/--judge/--crown: emit stable JSON")
+    .action(async (task, flags) => {
+      await withConfig(pkgVersion, "tournament", flags, async ({ config, logger }) => {
+        if (flags.score || flags.judge || flags.crown) {
+          await tournamentCommand({ task: "", config, logger, flags });
+          return;
+        }
+        const resolvedTask = await resolveTaskInput({ task, taskFile: flags.taskFile, projectDir: config.projectDir, logger });
+        await tournamentCommand({ task: resolvedTask, config, logger, flags });
+      });
+    });
+
   program
     .command("review")
     .description("Run only reviewer (--staged/--check: v4 cross-AI gate with recorded verdict)")
@@ -220,7 +243,6 @@ export function registerPipeline(program, { pkgVersion }) {
           await reviewGateCommand({ config, logger, flags: { ...flags, task } });
           return;
         }
-        const { resolveTaskInput } = await import("../utils/task-file.js");
         const resolvedTask = await resolveTaskInput({ task, taskFile: flags.taskFile, projectDir: config.projectDir, logger });
         await reviewCommand({ task: resolvedTask, config, logger, baseRef: flags.baseRef });
       });

package/src/commands/check.js

@@ -7,6 +7,7 @@
 import { checkHarden } from "../harden/check.js";
 import { collectMethodStats, formatMethodStats } from "../checks/method.js";
 import { checkAiSurface, formatAiSurface } from "../checks/ai-surface.js";
+import { detectObservedAgents } from "../utils/agent-detect.js";
 
 export async function checkCommand({ projectDir = process.cwd(), profile = "standard", json = false, logger = console } = {}) {
   const result = await checkHarden({ projectDir, profile });
@@ -14,8 +15,15 @@ export async function checkCommand({ projectDir = process.cwd(), profile = "stan
   // rides along in check output but never affects the exit code.
   const method = await collectMethodStats({ projectDir }).catch(() => null);
   // KJC-TSK-0694: same deal for the MCP inventory — a nudge, never a gate.
+  // KJC-TSK-0728: observed agent CLIs ride the same snapshot as "(cli)"
+  // entries, so a newly-appeared agent binary trips the same drift question.
   let aiSurface = null;
-  try { aiSurface = checkAiSurface({ projectDir }); } catch { /* inventory is best-effort */ }
+  try {
+    const clis = (await detectObservedAgents().catch(() => []))
+      .filter((a) => a.available)
+      .map((a) => `${a.name} (cli)`);
+    aiSurface = checkAiSurface({ projectDir, extraSurface: clis });
+  } catch { /* inventory is best-effort */ }
 
   if (json) {
     logger.info?.(JSON.stringify({ ...result, method, aiSurface }));

package/src/commands/harden.js

@@ -184,7 +184,7 @@ export async function hardenCommand({
   const verb = dryRun ? "would install" : "installed";
   logger.info?.(`kj harden (${profile}) — ${verb} ${result.hooks.length} hook(s) → ${result.hooksPath}`);
   for (const h of result.hooks) logger.info?.(`  • ${h.hook}: ${h.action}`);
-  for (const c of out.configs) logger.info?.(`  • ${c.file}: ${c.action}`);
+  for (const c of out.configs) logger.info?.(`  • ${c.file}: ${c.action}${c.note ? ` (${c.note})` : ""}`);
   for (const w of out.workflows) logger.info?.(`  • ${w.file}: ${w.action}`);
   for (const g of out.guidelines) logger.info?.(`  • ${g.file}: ${g.action}`);
   if (!dryRun) logger.info?.("core.hooksPath set. Verify later with `kj check`.");