karajan-code 4.14.0 → 4.15.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.14.0",
+  "version": "4.15.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/agents/agy-agent.js

@@ -37,6 +37,7 @@ export class AgyAgent extends BaseAgent {
       onOutput: task.onOutput,
       silenceTimeoutMs: task.silenceTimeoutMs,
       timeout: task.timeoutMs,
+      cwd: task.cwd,
     });
     const parsed = extractAgyOutput(res.stdout);
     const ok = res.exitCode === 0 && parsed?.status === "SUCCESS";

package/src/agents/claude-agent.js

@@ -374,7 +374,8 @@ export class ClaudeAgent extends BaseAgent {
         onOutput: streamFilter,
         silenceTimeoutMs: task.silenceTimeoutMs,
         timeout: task.timeoutMs,
-        env: task.env
+        env: task.env,
+        cwd: task.cwd
       }));
       const raw = pickOutput(res);
       const output = extractTextFromStreamJson(raw);
@@ -384,7 +385,7 @@ export class ClaudeAgent extends BaseAgent {
 
     // Without streaming, use json output to get structured response via stderr
     args.push("--output-format", "json");
-    const res = await this.runCommand(resolveBin("claude"), args, cleanExecaOpts({ env: task.env }));
+    const res = await this.runCommand(resolveBin("claude"), args, cleanExecaOpts({ env: task.env, cwd: task.cwd }));
     const raw = pickOutput(res);
     const output = extractTextFromStreamJson(raw);
     const usage = extractUsageFromStreamJson(raw);

package/src/agents/codex-agent.js

@@ -85,7 +85,9 @@ export class CodexAgent extends BaseAgent {
       onOutput: task.onOutput,
       silenceTimeoutMs: task.silenceTimeoutMs,
       timeout: task.timeoutMs,
-      input: task.prompt
+      input: task.prompt,
+      // TOR-A (KJC-TSK-0723): tournament lanes run the coder INSIDE the lane.
+      cwd: task.cwd
     });
     const usage = extractCodexTokens(res.stdout);
     return { ok: res.exitCode === 0, output: res.stdout, error: res.stderr, exitCode: res.exitCode, ...usage };

package/src/agents/kimi-agent.js

@@ -38,6 +38,7 @@ export class KimiAgent extends BaseAgent {
       onOutput: task.onOutput,
       silenceTimeoutMs: task.silenceTimeoutMs,
       timeout: task.timeoutMs,
+      cwd: task.cwd,
     });
     return { ok: res.exitCode === 0, output: res.stdout, error: res.stderr, exitCode: res.exitCode };
   }

package/src/cli/advanced-commands.js

@@ -27,7 +27,7 @@ export const META_COMMANDS = ["advanced", "help"];
  * so a newly-registered command can never silently vanish from `kj advanced`.
  */
 export const ADVANCED_GROUPS = [
-  { title: "Pipeline (piezas sueltas)", commands: ["autorun", "code", "review", "solomon", "agent", "scan"] },
+  { title: "Pipeline (piezas sueltas)", commands: ["autorun", "code", "review", "solomon", "agent", "scan", "tournament"] },
   { title: "Análisis pre-run", commands: ["discover", "triage", "researcher", "architect", "onboard", "brief"] },
   { title: "Búsqueda / RAG", commands: ["rag", "qmd", "watch"] },
   { title: "Calidad / auditoría", commands: ["audit", "check", "mutate", "webperf", "sonar", "privacy", "release"] },

package/src/cli/register-pipeline.js

@@ -3,6 +3,8 @@ import { ollamaStartCommand, ollamaStopCommand, ollamaStatusCommand, ollamaPullC
 import { configCommand } from "../commands/config.js";
 import { codeCommand } from "../commands/code.js";
 import { reviewCommand } from "../commands/review.js";
+import { tournamentCommand } from "../commands/tournament.js";
+import { resolveTaskInput } from "../utils/task-file.js";
 import { reviewGateCommand, solomonCommand } from "../commands/review-gate.js";
 import { scanCommand } from "../commands/scan.js";
 import { installToolsCommand } from "../commands/install-tools.js";
@@ -144,7 +146,6 @@ export function registerPipeline(program, { pkgVersion }) {
             effectiveTask = plan.task;
           }
         }
-        const { resolveTaskInput } = await import("../utils/task-file.js");
         const resolvedTask = await resolveTaskInput({ task: effectiveTask, taskFile: flags.taskFile, projectDir: config.projectDir, logger });
         const res = await runCommandHandler({ task: resolvedTask, config, logger, flags });
         // KJC-TSK-0674 (issue #1289): an aborted run (spec-review cancel,
@@ -163,7 +164,6 @@ export function registerPipeline(program, { pkgVersion }) {
     .option("--skip-spec-review", "Bypass the spec-reviewer pre-pipeline audit")
     .action(async (task, flags) => {
       const code = await withConfig(pkgVersion, "autorun", flags, async ({ config, logger }) => {
-        const { resolveTaskInput } = await import("../utils/task-file.js");
         const { autorunCommand } = await import("../commands/autorun.js");
         const resolvedTask = await resolveTaskInput({ task, taskFile: flags.taskFile, projectDir: config.projectDir, logger });
         const res = await autorunCommand({ task: resolvedTask, config, logger, flags });
@@ -181,7 +181,6 @@ export function registerPipeline(program, { pkgVersion }) {
     .option("--coder-model <name>")
     .action(async (task, flags) => {
       await withConfig(pkgVersion, "code", flags, async ({ config, logger }) => {
-        const { resolveTaskInput } = await import("../utils/task-file.js");
         const resolvedTask = await resolveTaskInput({ task, taskFile: flags.taskFile, projectDir: config.projectDir, logger });
         await codeCommand({ task: resolvedTask, config, logger });
       });
@@ -199,6 +198,30 @@ export function registerPipeline(program, { pkgVersion }) {
       });
     });
 
+  // KJC-TSK-0723 (TOR-A) — the governed tournament: same task, N coders,
+  // isolated lanes; the method picks the winner (TOR-B/C), not vibes.
+  program
+    .command("tournament")
+    .description("Fan the SAME task out to N coders in isolated worktree lanes and collect per-lane evidence (diff, suite, log)")
+    .argument("[task]", "Task description (REQUIRED — provide as argument or via --task-file)")
+    .option("--task-file <path>", "Read the task from a file (e.g. .md)")
+    .option("--coders <csv>", "Comma-separated coder agents (minimum 2), e.g. claude,codex,agy")
+    .option("--score <id>", "Score an EXISTING tournament from its artifacts (deterministic, zero LLM)")
+    .option("--judge <id>", "Cross-AI judge ranks the finalists (scoreboard in sight; solomon on tie/dispute)")
+    .option("--crown <id>", "Commit the judged winner in its lane THROUGH the real review gate")
+    .option("--card <ref>", "With --crown: card reference for the commit message (card-first gates)")
+    .option("--json", "With --score/--judge/--crown: emit stable JSON")
+    .action(async (task, flags) => {
+      await withConfig(pkgVersion, "tournament", flags, async ({ config, logger }) => {
+        if (flags.score || flags.judge || flags.crown) {
+          await tournamentCommand({ task: "", config, logger, flags });
+          return;
+        }
+        const resolvedTask = await resolveTaskInput({ task, taskFile: flags.taskFile, projectDir: config.projectDir, logger });
+        await tournamentCommand({ task: resolvedTask, config, logger, flags });
+      });
+    });
+
   program
     .command("review")
     .description("Run only reviewer (--staged/--check: v4 cross-AI gate with recorded verdict)")
@@ -220,7 +243,6 @@ export function registerPipeline(program, { pkgVersion }) {
           await reviewGateCommand({ config, logger, flags: { ...flags, task } });
           return;
         }
-        const { resolveTaskInput } = await import("../utils/task-file.js");
         const resolvedTask = await resolveTaskInput({ task, taskFile: flags.taskFile, projectDir: config.projectDir, logger });
         await reviewCommand({ task: resolvedTask, config, logger, baseRef: flags.baseRef });
       });

package/src/commands/harden.js

@@ -184,7 +184,7 @@ export async function hardenCommand({
   const verb = dryRun ? "would install" : "installed";
   logger.info?.(`kj harden (${profile}) — ${verb} ${result.hooks.length} hook(s) → ${result.hooksPath}`);
   for (const h of result.hooks) logger.info?.(`  • ${h.hook}: ${h.action}`);
-  for (const c of out.configs) logger.info?.(`  • ${c.file}: ${c.action}`);
+  for (const c of out.configs) logger.info?.(`  • ${c.file}: ${c.action}${c.note ? ` (${c.note})` : ""}`);
   for (const w of out.workflows) logger.info?.(`  • ${w.file}: ${w.action}`);
   for (const g of out.guidelines) logger.info?.(`  • ${g.file}: ${g.action}`);
   if (!dryRun) logger.info?.("core.hooksPath set. Verify later with `kj check`.");

package/src/commands/tournament.js

@@ -0,0 +1,85 @@
+/**
+ * `kj tournament` (KJC-TSK-0723, TOR-A) — fan the SAME task out to N coders
+ * in N isolated worktree lanes and collect the evidence. The deterministic
+ * scoreboard (TOR-B) and the governed judgement/merge (TOR-C) build on the
+ * artifacts this command leaves under .kj/tournaments/<id>/.
+ */
+import path from "node:path";
+import { runTournament } from "../tournament/run.js";
+import { scoreTournament } from "../tournament/scoreboard.js";
+import { judgeTournament } from "../tournament/judge.js";
+import { crownWinner } from "../tournament/crown.js";
+
+// The id feeds a path — same traversal class codex caught in TOR-A's coder
+// names: strict slug, no separators, before any filesystem use.
+function tournamentDirFor(config, rawId) {
+  const id = String(rawId);
+  if (!/^[a-z0-9][a-z0-9-]{0,63}$/i.test(id)) {
+    throw new Error(`tournament: id inválido "${id}" — usa el id que imprimió el torneo (p. ej. tor-abc123)`);
+  }
+  return path.join(config?.projectDir || process.cwd(), ".kj", "tournaments", id);
+}
+
+export async function tournamentCommand({
+  task, config, logger = console, flags = {},
+  runTournamentFn = runTournament, scoreTournamentFn = scoreTournament,
+  judgeTournamentFn = judgeTournament, crownWinnerFn = crownWinner,
+}) {
+  // TOR-C: `--judge <id>` ranks the finalists; `--crown <id>` commits the
+  // winner through the real gate in its lane.
+  if (flags.judge) {
+    const judgement = await judgeTournamentFn({ tournamentDir: tournamentDirFor(config, flags.judge), config, logger });
+    if (flags.json) logger?.info?.(JSON.stringify(judgement));
+    else logger?.info?.(`  siguiente: kj tournament --crown ${flags.judge}${judgement.escalated ? " (ganador vía solomon)" : ""}`);
+    return judgement;
+  }
+  if (flags.crown) {
+    const crown = await crownWinnerFn({
+      tournamentDir: tournamentDirFor(config, flags.crown), config, logger, cardRef: flags.card || null,
+    });
+    if (flags.json) logger?.info?.(JSON.stringify(crown));
+    return crown;
+  }
+
+  // TOR-B: `--score <id>` scores an EXISTING tournament from its artifacts.
+  if (flags.score) {
+    const tournamentDir = tournamentDirFor(config, flags.score);
+    const board = await scoreTournamentFn({ tournamentDir });
+    if (flags.json) {
+      logger?.info?.(JSON.stringify(board));
+      return board;
+    }
+    logger?.info?.(`scoreboard ${board.id} — regla: ${board.rule}`);
+    for (const r of board.rows) {
+      if (!r.finalist) {
+        logger?.info?.(`  ${r.coder.padEnd(10)} eliminado (${r.eliminated_by})`);
+        continue;
+      }
+      const mut = typeof r.mutation?.score === "number" ? `${r.mutation.score}%` : "n/a";
+      logger?.info?.(`  ${r.coder.padEnd(10)} FINALISTA  loc:${String(r.loc.net).padStart(5)}  tests:${r.loc.testsTouched}  mutation:${mut}`);
+    }
+    logger?.info?.(`  ranking: ${board.ranking.join(" > ") || "(sin finalistas)"}`);
+    return board;
+  }
+
+  if (!task || !String(task).trim()) {
+    throw new Error("tournament: falta la tarea — kj tournament \"<tarea>\" --coders claude,codex");
+  }
+  const coders = String(flags.coders || "")
+    .split(",")
+    .map((c) => c.trim())
+    .filter(Boolean);
+  if (coders.length < 2) {
+    throw new Error("tournament: hacen falta al menos 2 en --coders — p. ej. --coders claude,codex,agy (con uno no hay torneo)");
+  }
+
+  const res = await runTournamentFn({ task, coders, config, logger });
+
+  const completed = res.lanes.filter((l) => l.status === "completed");
+  const green = completed.filter((l) => l.suite?.ok);
+  logger?.info?.("");
+  logger?.info?.(`torneo ${res.id}: ${completed.length}/${res.lanes.length} carriles completados, ${green.length} con suite verde`);
+  logger?.info?.(`  evidencia: ${res.dir}`);
+  logger?.info?.("  siguiente: el scoreboard determinista (TOR-B) puntuará los carriles; de momento compara los diff.patch a mano.");
+  return res;
+}

package/src/harden/config-engine.js

@@ -15,6 +15,24 @@ import { CONFIGS_BY_LANGUAGE, UNIVERSAL_CONFIGS } from "./config-templates.js";
 
 const BLOCK_VERSION = 1;
 
+// KJC-BUG-0137 (issue #1357): is the tool a config demands actually installed?
+// Declared dependency or a resolvable bin both count; an unreadable
+// package.json is no evidence of the tool.
+function hasTool(dirs, tool) {
+  for (const d of dirs) {
+    if (existsSync(join(d, "node_modules", ".bin", tool))) return true;
+    const pkgPath = join(d, "package.json");
+    if (!existsSync(pkgPath)) continue;
+    try {
+      const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+      if (pkg.devDependencies?.[tool] || pkg.dependencies?.[tool]) return true;
+    } catch {
+      /* unreadable ⇒ keep looking */
+    }
+  }
+  return false;
+}
+
 function writeFile(target, content) {
   mkdirSync(dirname(target), { recursive: true });
   writeFileSync(target, content);
@@ -47,6 +65,15 @@ function seedInto(targetDir, configs, dryRun, prefix, results, altDirs = [target
         results.push({ file, action: "covered", by: variant });
         continue;
       }
+      // KJC-BUG-0137: no tool ⇒ no config — report the actionable gap instead.
+      if (cfg.requires && !hasTool(altDirs, cfg.requires)) {
+        results.push({
+          file,
+          action: "omitted",
+          note: `${cfg.requires} is not installed — npm i -D ${cfg.requires}, then re-run kj harden`,
+        });
+        continue;
+      }
     }
 
     if (cfg.json) {

package/src/harden/config-templates.js

@@ -95,10 +95,15 @@ export const UNIVERSAL_CONFIGS = [
   { file: "commitlint.config.js", blockId: "commitlint", style: "slash", body: COMMITLINT_BODY },
 ];
 
-/** `json:true` ⇒ seed-only (no comment syntax for a marker). */
+/**
+ * `json:true` ⇒ seed-only (no comment syntax for a marker). `requires` names
+ * the tool the config is for: absent from the project ⇒ the config is omitted
+ * with the install command in the report (KJC-BUG-0137) — a config without its
+ * tool is decorative, and kj never generates a demand it didn't satisfy.
+ */
 export const JS_CONFIGS = [
-  { file: "eslint.config.js", blockId: "eslint", style: "slash", body: ESLINT_BODY },
-  { file: ".prettierrc.json", json: true, body: PRETTIER_BODY },
+  { file: "eslint.config.js", blockId: "eslint", style: "slash", body: ESLINT_BODY, requires: "eslint" },
+  { file: ".prettierrc.json", json: true, body: PRETTIER_BODY, requires: "prettier" },
 ];
 export const PY_CONFIGS = [{ file: "ruff.toml", blockId: "ruff", style: "hash", body: RUFF_BODY }];
 export const GO_CONFIGS = [{ file: ".golangci.yml", blockId: "golangci", style: "hash", body: GOLANGCI_BODY }];

package/src/harden/workflow-engine.js

@@ -34,6 +34,16 @@ export function detectPackageManager(projectDir) {
   return "npm";
 }
 
+// KJC-BUG-0137: the JS quality workflow only carries a lint step when the
+// project HAS a lint script — and then it enforces (no --if-present).
+function hasLintScript(projectDir) {
+  try {
+    return Boolean(JSON.parse(readFileSync(join(projectDir, "package.json"), "utf8")).scripts?.lint);
+  } catch {
+    return false;
+  }
+}
+
 export function installWorkflows({
   projectDir = process.cwd(),
   language = null,
@@ -43,7 +53,7 @@ export function installWorkflows({
 } = {}) {
   const dir = join(projectDir, WORKFLOWS_DIR);
   const pm = detectPackageManager(projectDir);
-  const quality = qualityWorkflowFor(language, pm);
+  const quality = qualityWorkflowFor(language, pm, hasLintScript(projectDir));
   const extras = extraWorkflowsFor({ profile, publishable: isPublishableNpm(projectDir), pm });
   const mut = mutation ? mutationWorkflowFor(language, pm) : null;
   const all = [...WORKFLOWS, ...(quality ? [quality] : []), ...extras, ...(mut ? [mut] : [])];

package/src/harden/workflow-templates.js

@@ -8,6 +8,20 @@
 
 // Blocks AI self-attribution in PR commit messages. Pure bash + grep, no Node.
 // Pins github.base_ref to an env var (never interpolated into the run block).
+// KJC-BUG-0136 (issue #1374): actions pinned to full commit SHAs — a
+// mutable tag lets its owner run arbitrary code inside EVERY hardened
+// repo's CI, with access to the workflow's secrets; 5 of this project's 7
+// audit findings came from files kj itself generated. The version rides in
+// a comment (the practice kj audit demands). To bump one:
+//   gh api repos/<owner>/<repo>/commits/<tag> --jq .sha
+export const PINNED_ACTIONS = {
+  checkout: "actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4",
+  setupNode: "actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4",
+  setupPython: "actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5",
+  setupGo: "actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5",
+  setupPhp: "shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2",
+};
+
 export const NO_AI_ATTRIBUTION_WORKFLOW = [
   "name: Block AI attribution",
   "on:",
@@ -19,7 +33,7 @@ export const NO_AI_ATTRIBUTION_WORKFLOW = [
   "  scan:",
   "    runs-on: ubuntu-latest",
   "    steps:",
-  "      - uses: actions/checkout@v4",
+  `      - uses: ${PINNED_ACTIONS.checkout}`,
   "        with:",
   "          fetch-depth: 0",
   "      - name: Scan commit messages for AI attribution",
@@ -50,34 +64,35 @@ const header = (steps) =>
     "  quality:",
     "    runs-on: ubuntu-latest",
     "    steps:",
-    "      - uses: actions/checkout@v4",
+    `      - uses: ${PINNED_ACTIONS.checkout}`,
     ...steps,
   ].join("\n");
 
 // Per-package-manager commands (KJC-BUG-0131, issue #1330): `npm ci` in a
 // pnpm/yarn repo dies with EUSAGE (no package-lock.json). corepack ships with
 // Node 22 and resolves the right pnpm/yarn from `packageManager` — no
-// third-party action. pnpm passes flags AFTER the script name to the script
-// itself, so --if-present must go BEFORE it; yarn has no --if-present at all,
-// so lint runs through `npm run` (scripts don't touch the lockfile).
-const PM_COMMANDS = {
-  npm: { setup: [], install: "npm ci", lint: "npm run -s lint --if-present", test: "npm test" },
+// third-party action. Yarn scripts run through `npm run` (scripts don't touch
+// the lockfile). Lint ENFORCES — never --if-present: a step that passes when
+// its script is missing protects nothing (KJC-BUG-0137, issue #1357); the
+// engine omits the step instead when the project has no lint script.
+export const PM_COMMANDS = {
+  npm: { setup: [], install: "npm ci", lint: "npm run -s lint", test: "npm test" },
   pnpm: {
     setup: ["      - run: corepack enable"],
     install: "pnpm install --frozen-lockfile",
-    lint: "pnpm run --if-present -s lint",
+    lint: "pnpm run -s lint",
     test: "pnpm test",
   },
   yarn: {
     setup: ["      - run: corepack enable"],
     install: "yarn install --frozen-lockfile",
-    lint: "npm run -s lint --if-present",
+    lint: "npm run -s lint",
     test: "yarn test",
   },
 };
 
 const nodeSetupSteps = (pm) => [
-  "      - uses: actions/setup-node@v4",
+  `      - uses: ${PINNED_ACTIONS.setupNode}`,
   "        with:",
   "          node-version: 22",
   ...(PM_COMMANDS[pm] || PM_COMMANDS.npm).setup,
@@ -86,7 +101,7 @@ const nodeSetupSteps = (pm) => [
 
 const QUALITY_BY_LANGUAGE = {
   python: header([
-    "      - uses: actions/setup-python@v5",
+    `      - uses: ${PINNED_ACTIONS.setupPython}`,
     "        with:",
     "          python-version: '3.12'",
     "      - run: pip install ruff pytest",
@@ -94,14 +109,14 @@ const QUALITY_BY_LANGUAGE = {
     "      - run: pytest",
   ]),
   go: header([
-    "      - uses: actions/setup-go@v5",
+    `      - uses: ${PINNED_ACTIONS.setupGo}`,
     "        with:",
     "          go-version: stable",
     "      - run: go vet ./...",
     "      - run: go test ./...",
   ]),
   php: header([
-    "      - uses: shivammathur/setup-php@v2",
+    `      - uses: ${PINNED_ACTIONS.setupPhp}`,
     "        with:",
     "          php-version: '8.3'",
     "      - run: composer install --no-interaction --no-progress",
@@ -109,12 +124,16 @@ const QUALITY_BY_LANGUAGE = {
     "      - run: vendor/bin/phpunit",
   ]),
 };
-/** Stack-aware Quality workflow entry, or null for an unknown language. */
-export function qualityWorkflowFor(language, pm = "npm") {
+/**
+ * Stack-aware Quality workflow entry, or null for an unknown language.
+ * `lint:false` drops the JS lint step entirely (project has no lint script,
+ * KJC-BUG-0137) — mirroring the local hook, which also omits it.
+ */
+export function qualityWorkflowFor(language, pm = "npm", lint = true) {
   const c = PM_COMMANDS[pm] || PM_COMMANDS.npm;
   const body =
     language === "javascript" || language === "typescript"
-      ? header([...nodeSetupSteps(pm), `      - run: ${c.lint}`, `      - run: ${c.test}`])
+      ? header([...nodeSetupSteps(pm), ...(lint ? [`      - run: ${c.lint}`] : []), `      - run: ${c.test}`])
       : QUALITY_BY_LANGUAGE[language];
   return body ? { file: "kj-quality.yml", blockId: "wf-quality", body } : null;
 }
@@ -132,7 +151,7 @@ export const SHRINK_BUDGET_WORKFLOW = [
   "    runs-on: ubuntu-latest",
   '    env: { LOC_LIMIT: "200" }',
   "    steps:",
-  "      - uses: actions/checkout@v4",
+  `      - uses: ${PINNED_ACTIONS.checkout}`,
   "        with:",
   "          fetch-depth: 0",
   "      - name: Net LOC delta within budget",
@@ -161,7 +180,7 @@ export const packSmokeWorkflow = (pm = "npm") =>
     "  pack-smoke:",
     "    runs-on: ubuntu-latest",
     "    steps:",
-    "      - uses: actions/checkout@v4",
+    `      - uses: ${PINNED_ACTIONS.checkout}`,
     ...nodeSetupSteps(pm),
     "      - name: Pack and install the tarball clean",
     "        run: |",
@@ -179,13 +198,13 @@ export const packSmokeWorkflow = (pm = "npm") =>
 const MUTATION_TOOLCHAIN = {
   javascript: "node", // resolved per package manager in mutationWorkflowFor
   python: [
-    "      - uses: actions/setup-python@v5",
+    `      - uses: ${PINNED_ACTIONS.setupPython}`,
     "        with:",
     "          python-version: '3.12'",
     "      - run: pip install mutmut pytest",
   ],
   php: [
-    "      - uses: shivammathur/setup-php@v2",
+    `      - uses: ${PINNED_ACTIONS.setupPhp}`,
     "        with:",
     "          php-version: '8.3'",
     "      - run: composer install --no-interaction --no-progress",
@@ -211,10 +230,10 @@ export function mutationWorkflowFor(language, pm = "npm") {
     "  mutation:",
     "    runs-on: ubuntu-latest",
     "    steps:",
-    "      - uses: actions/checkout@v4",
+    `      - uses: ${PINNED_ACTIONS.checkout}`,
     "        with:",
     "          fetch-depth: 0",
-    "      - uses: actions/setup-node@v4",
+    `      - uses: ${PINNED_ACTIONS.setupNode}`,
     "        with:",
     "          node-version: 22",
     ...toolchain,

package/src/prompts/diff-clip.js

@@ -0,0 +1,27 @@
+/**
+ * diff-clip — KJC-BUG-0134 (issue #1381). A bare [TRUNCATED] marker inside
+ * the diff body reads as file content: reviewers blamed whichever file the
+ * cut landed in and rejected complete, untouched code (each false positive
+ * costs a solomon round). The clip is DECLARED as the pipeline's own, kept
+ * OUTSIDE the diff body, cut on a line boundary, and the reviewer is told
+ * the diff is partial so it never reasons about the completeness of files
+ * it cannot fully see. Shared by every prompt that hands a diff to an AI.
+ */
+
+export const DIFF_CLIP_CHARS = 12000;
+
+/** @returns {{body: string, note: string|null}} note is null when no clip happened. */
+export function clipDiff(diff, limit = DIFF_CLIP_CHARS) {
+  if (!diff) return { body: "", note: null };
+  if (diff.length <= limit) return { body: diff, note: null };
+  const hard = diff.slice(0, limit);
+  const nl = hard.lastIndexOf("\n");
+  const body = nl > 0 ? hard.slice(0, nl) : hard;
+  const omittedLines = diff.slice(body.length).split("\n").filter(Boolean).length;
+  const note = [
+    `NOTE FROM THE KJ PIPELINE (not part of the diff): the diff above was clipped by kj at ~${limit} characters — ${omittedLines} more line(s) exist but are NOT shown.`,
+    "The cut is kj's, not the author's: no file in the working tree is truncated.",
+    "Do not raise issues about incomplete or cut-off content, and do not reason about the completeness of files you cannot fully see. Review only what is visible.",
+  ].join(" ");
+  return { body, note };
+}

package/src/prompts/reviewer.js

@@ -2,6 +2,8 @@ import { buildRtkInstructions } from "./rtk-snippet.js";
 import { loadAvailableSkills, buildSkillSection } from "../skills/skill-loader.js";
 import { getLanguageInstruction } from "../utils/locale.js";
 import { section, buildPromptLayout, joinLayout, STABLE, VOLATILE } from "./prompt-layout.js";
+import { clipDiff } from "./diff-clip.js";
+import { buildSplitSignal } from "./split-signal.js";
 
 const SUBAGENT_PREAMBLE = [
   "IMPORTANT: You are running as a Karajan sub-agent.",
@@ -34,7 +36,9 @@ const SERENA_INSTRUCTIONS = [
  * and always different) goes last.
  */
 export async function buildReviewerPromptLayout({ task, diff, reviewRules, mode, serenaEnabled = false, rtkAvailable = false, productContext = null, domainContext = null, projectDir = null, language = "en", provider = null }) {
-  const truncatedDiff = diff.length > 12000 ? `${diff.slice(0, 12000)}\n\n[TRUNCATED]` : diff;
+  const { body: clippedDiff, note: clipNote } = clipDiff(diff);
+  // KJC-BUG-0138: full diff on purpose — the moved-to side survives clipping.
+  const splitSignal = buildSplitSignal(diff);
 
   const langInstruction = getLanguageInstruction(language);
   const rtkSnippet = buildRtkInstructions({ rtkAvailable });
@@ -60,7 +64,9 @@ export async function buildReviewerPromptLayout({ task, diff, reviewRules, mode,
     section(`Review rules:\n${reviewRules}`, STABLE),
     section(skillSection, STABLE),
     section(`Task context:\n${task}`, VOLATILE),
-    section(`Git diff:\n${truncatedDiff}`, VOLATILE),
+    section(`Git diff:\n${clippedDiff}`, VOLATILE),
+    section(clipNote, VOLATILE),
+    section(splitSignal, VOLATILE),
   ]);
 }
 

package/src/prompts/split-signal.js

@@ -0,0 +1,82 @@
+/**
+ * split-signal — KJC-BUG-0138 (issue #1364). A file split is not a coverage
+ * deletion, but the reviewer doesn't correlate a file losing content with new
+ * files gaining it (4/13 pure-refactor PRs falsely rejected). Deterministic
+ * pre-analysis, zero LLM: significant removed lines reappearing verbatim among
+ * another file's ADDITIONS in the same diff are moves — when ≥ MIN_RATIO of a
+ * file's removals move, the reviewer gets the correlation as a pipeline note.
+ * Exact `--- a/` / `+++ b/` headers only (BUG-0132: `++content` ≠ header).
+ */
+
+const MIN_REMOVED = 10; // fewer significant removals ⇒ too small to misread
+const MIN_RATIO = 0.5; // below this, the removal is mostly a real removal
+
+// Braces/punctuation reappear by accident — only letter-bearing lines count.
+function significant(text) {
+  const t = text.trim();
+  return t.length >= 10 && /[a-zA-Z]/.test(t);
+}
+
+/** @returns {string|null} pipeline note, or null when nothing moved. Feed the
+ * PRE-CLIPPING diff: the added side must inform even when clipped away. */
+export function buildSplitSignal(diff) {
+  if (!diff) return null;
+  const removedByFile = new Map();
+  const addedByFile = new Map();
+  let src = null;
+  let dst = null;
+  for (const raw of diff.split("\n")) {
+    if (raw.startsWith("--- ")) {
+      src = raw.startsWith("--- a/") ? raw.slice(6) : null;
+      continue;
+    }
+    if (raw.startsWith("+++ ")) {
+      dst = raw.startsWith("+++ b/") ? raw.slice(6) : null;
+      continue;
+    }
+    if (raw.startsWith("+") && dst && significant(raw.slice(1))) {
+      const counts = addedByFile.get(dst) ?? new Map();
+      const t = raw.slice(1).trim();
+      counts.set(t, (counts.get(t) ?? 0) + 1);
+      addedByFile.set(dst, counts);
+    } else if (raw.startsWith("-") && src && significant(raw.slice(1))) {
+      const lines = removedByFile.get(src) ?? [];
+      lines.push(raw.slice(1).trim());
+      removedByFile.set(src, lines);
+    }
+  }
+
+  const findings = [];
+  for (const [file, removed] of removedByFile) {
+    if (removed.length < MIN_REMOVED) continue;
+    const dests = new Map();
+    let moved = 0;
+    for (const text of removed) {
+      for (const [other, counts] of addedByFile) {
+        if (other === file) continue; // in-place edits are not moves
+        const n = counts.get(text) ?? 0;
+        if (n > 0) {
+          counts.set(text, n - 1); // each added line vouches for ONE removal
+          dests.set(other, (dests.get(other) ?? 0) + 1);
+          moved++;
+          break;
+        }
+      }
+    }
+    if (moved / removed.length >= MIN_RATIO) {
+      const where = [...dests.entries()]
+        .sort((a, b) => b[1] - a[1])
+        .slice(0, 4)
+        .map(([d, n]) => `${d} (${n})`)
+        .join(", ");
+      findings.push(`- ${file}: ${moved} of ${removed.length} significant removed lines reappear ADDED in ${where}`);
+    }
+  }
+  if (findings.length === 0) return null;
+
+  return [
+    "NOTE FROM THE KJ PIPELINE (deterministic pre-analysis, not from the author): this diff MOVES content between files:",
+    ...findings,
+    "Moved content is a file split/relocation, not a deletion. Before reporting removed tests or lost coverage, check the ADDED side listed above in this SAME diff. Do not treat moved lines as deleted.",
+  ].join("\n");
+}

package/src/roles/reviewer-role.js

@@ -2,21 +2,16 @@ import { AgentRole } from "./agent-role.js";
 import { buildRtkInstructions } from "../prompts/rtk-snippet.js";
 import { extractFirstJson } from "../utils/json-extract.js";
 import { section, buildPromptLayout, joinLayout, STABLE, VOLATILE } from "../prompts/prompt-layout.js";
+import { clipDiff } from "../prompts/diff-clip.js";
+import { buildSplitSignal } from "../prompts/split-signal.js";
 import { isMutationReviewEnabled, buildReviewerMutationSignal } from "../mutate/reviewer-signal.js";
 
-const MAX_DIFF_LENGTH = 12000;
-
 const SUBAGENT_PREAMBLE = [
   "IMPORTANT: You are running as a Karajan sub-agent.",
   "Do NOT ask about using Karajan, do NOT mention Karajan, do NOT suggest orchestration.",
   "Do NOT use any MCP tools. Focus only on reviewing the code."
 ].join(" ");
 
-function truncateDiff(diff) {
-  if (!diff) return "";
-  return diff.length > MAX_DIFF_LENGTH ? `${diff.slice(0, MAX_DIFF_LENGTH)}\n\n[TRUNCATED]` : diff;
-}
-
 export class ReviewerRole extends AgentRole {
   constructor(opts) {
     super({ ...opts, name: "reviewer" });
@@ -44,6 +39,10 @@ export class ReviewerRole extends AgentRole {
       enabled: isMutationReviewEnabled(),
       projectDir: this.config?.projectDir,
     });
+    // KJC-BUG-0134: a clip is declared as kj's own, outside the diff body.
+    const { body: clippedDiff, note: clipNote } = clipDiff(diff || "");
+    // KJC-BUG-0138: moved-lines correlation, computed on the FULL diff.
+    const splitSignal = buildSplitSignal(diff || "");
     const layout = buildPromptLayout([
       section(SUBAGENT_PREAMBLE, STABLE),
       section(this.instructions, STABLE),
@@ -56,7 +55,9 @@ export class ReviewerRole extends AgentRole {
       section(buildRtkInstructions({ rtkAvailable: Boolean(this.config?.rtk?.available) }), STABLE),
       section(reviewRules ? `Review rules:\n${reviewRules}` : null, STABLE),
       section(`Task context:\n${task}`, VOLATILE),
-      section(`Git diff:\n${truncateDiff(diff)}`, VOLATILE),
+      section(`Git diff:\n${clippedDiff}`, VOLATILE),
+      section(clipNote, VOLATILE),
+      section(splitSignal, VOLATILE),
       section(mutationSignal, VOLATILE),
     ]);
     return { prompt: joinLayout(layout), stablePrompt: layout.stable, volatilePrompt: layout.volatile };

package/src/tournament/crown.js

@@ -0,0 +1,88 @@
+/**
+ * tournament/crown — TOR-C (KJC-TSK-0725, epic KJC-PCS-0073). The last act:
+ * the tournament winner enters main THROUGH THE NORMAL DOOR, not around it.
+ *
+ * In the winner's still-alive lane: stage everything, run the real cross-AI
+ * review over the EXACT staged diff (verdict bound to its sha256, stored by
+ * the same verdict-store every commit uses), then commit — where the
+ * pre-commit gate validates that verdict like any other commit's. A
+ * rejected review ABORTS the coronation with the reasons: winning the
+ * tournament earns you a candidacy, not a bypass. Losers keep their full
+ * dossier under the tournament dir; their lanes are never removed here.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { runOneShotReview } from "../review/one-shot-review.js";
+
+const execFileAsync = promisify(execFile);
+
+const defaultExec = async (cmd, args, { cwd }) => {
+  const res = await execFileAsync(cmd, args, { cwd, maxBuffer: 64 * 1024 * 1024 });
+  return { exitCode: 0, stdout: res.stdout || "" };
+};
+
+async function defaultReview({ lane, task, config, logger }) {
+  const { stdout: diff } = await execFileAsync("git", ["diff", "--cached"], { cwd: lane, maxBuffer: 64 * 1024 * 1024 });
+  try {
+    const record = await runOneShotReview({
+      diff,
+      task: `Tournament winner review. Original task:\n${task}`,
+      config: { ...config, projectDir: lane },
+      logger,
+      projectDir: lane,
+    });
+    return { ok: record.verdict === "approved", ...record };
+  } catch (err) {
+    return { ok: false, verdict: "error", error: err.message };
+  }
+}
+
+/**
+ * Crown the judged winner: governed review + commit in its lane.
+ * @returns {Promise<{winner: string, branch: string, commit: string, verdict: object}>}
+ */
+export async function crownWinner({ tournamentDir, config = {}, logger = console, cardRef = null, deps = {} }) {
+  const { execFn = defaultExec, reviewFn = defaultReview } = deps;
+
+  const judgementPath = path.join(tournamentDir, "judgement.json");
+  if (!fs.existsSync(judgementPath)) {
+    throw new Error("tournament: no hay judgement.json — corre primero kj tournament --judge <id>");
+  }
+  const judgement = JSON.parse(fs.readFileSync(judgementPath, "utf8"));
+  const summary = JSON.parse(fs.readFileSync(path.join(tournamentDir, "summary.json"), "utf8"));
+  const winner = judgement.winner;
+  const meta = JSON.parse(fs.readFileSync(path.join(tournamentDir, winner, "meta.json"), "utf8"));
+  const lane = meta.lane;
+  if (!lane || !fs.existsSync(lane)) {
+    throw new Error(`tournament: el carril del ganador (${winner}) ya no existe — corona justo después de juzgar, antes de limpiar carriles`);
+  }
+
+  logger?.info?.(`coronando a ${winner} en ${meta.branch} — por la puerta normal, no por un atajo`);
+  await execFn("git", ["add", "-A"], { cwd: lane });
+
+  const verdict = await reviewFn({ lane, task: summary.task, config, logger });
+  if (!verdict?.ok) {
+    const issues = (verdict?.issues || []).map((i) => `  - ${i.description}`).join("\n");
+    throw new Error(
+      `tournament: la review RECHAZÓ al ganador (${winner}) — ganar el torneo da candidatura, no bypass.\n${issues || verdict?.error || ""}`
+    );
+  }
+
+  const ref = cardRef ? ` (${cardRef})` : "";
+  const msg = `feat(tournament): crown ${winner} — ${String(summary.task).slice(0, 50).toLowerCase()}${ref} [${summary.id}]`;
+  await execFn("git", ["commit", "-m", msg], { cwd: lane });
+  const { stdout } = await execFn("git", ["rev-parse", "HEAD"], { cwd: lane });
+  const commit = stdout.trim();
+
+  const crown = {
+    winner, branch: meta.branch, commit,
+    verdict: { verdict: verdict.verdict, reviewer: verdict.reviewer, diffHash: verdict.diffHash },
+    crowned_at: new Date().toISOString(),
+  };
+  fs.writeFileSync(path.join(tournamentDir, "crown.json"), JSON.stringify(crown, null, 2));
+  logger?.info?.(`✓ coronado: ${winner} · commit ${commit.slice(0, 9)} en ${meta.branch} — la rama queda lista para PR`);
+  logger?.info?.("  los perdedores conservan su expediente en el dir del torneo; limpia carriles con kj worktree done cuando quieras");
+  return { winner, branch: meta.branch, commit, verdict: crown.verdict };
+}

package/src/tournament/judge.js

@@ -0,0 +1,151 @@
+/**
+ * tournament/judge — TOR-C (KJC-TSK-0725, epic KJC-PCS-0073).
+ *
+ * The scoreboard (TOR-B) ELIMINATES; the judge CHOOSES among survivors —
+ * a cross-AI reviewer ranking the finalists with the deterministic table
+ * in sight, so the LLM judges what metrics cannot see (design, readability,
+ * over-engineering) without overruling what they can. Two hard rules:
+ * a participant coder never judges its own tournament (nor does the host),
+ * and a WINNER disagreement with the scoreboard — or a declared tie —
+ * escalates to solomon carrying BOTH positions. Only first place crowns:
+ * lower-order differences are informative and never escalate (the card's
+ * "discrepancia fuerte" — over-escalating would make solomon the judge). Diffs travel WHOLE or the limit is
+ * DECLARED in the prompt (the [TRUNCATED]-blamed-on-the-file lesson,
+ * BUG-0134): the judge must never mistake our clipping for the coder's code.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { createAgent } from "../agents/index.js";
+import { resolveRole } from "../config/role-resolver.js";
+import { detectHostAgent } from "../utils/agent-detect.js";
+import { candidateStatus } from "../review/reviewer-fallback.js";
+
+const MAX_DIFF_CHARS = 60_000;
+
+/** The configured reviewer unless it competed or hosts; else the first clean candidate. */
+export function pickJudge({ configured, participants = [], host = null, statuses = [] }) {
+  const dirty = new Set([...participants, host].filter(Boolean));
+  if (configured && !dirty.has(configured)) return configured;
+  const clean = statuses.find((s) => s.installed && s.authenticated && !s.adapterPending && !dirty.has(s.name));
+  return clean ? clean.name : null;
+}
+
+async function defaultJudge({ config, participants }) {
+  const configured = resolveRole(config, "reviewer").provider;
+  const statuses = await candidateStatus();
+  return pickJudge({ configured, participants, host: detectHostAgent(), statuses });
+}
+
+async function defaultAgent({ judge, prompt, config, logger }) {
+  return createAgent(judge, config, logger).reviewTask({ prompt, role: "reviewer" });
+}
+
+function finalistBlock(board, torDir, coder) {
+  const row = board.rows.find((r) => r.coder === coder);
+  let diff = fs.readFileSync(path.join(torDir, coder, "diff.patch"), "utf8");
+  let clipped = false;
+  if (diff.length > MAX_DIFF_CHARS) {
+    diff = diff.slice(0, MAX_DIFF_CHARS);
+    clipped = true;
+  }
+  return [
+    `### Finalista: ${coder}`,
+    `Scoreboard: ${JSON.stringify(row)}`,
+    clipped
+      ? `NOTA DEL SISTEMA: el diff se muestra RECORTADO a ${MAX_DIFF_CHARS} caracteres por límite del prompt — el recorte es NUESTRO, no un defecto del código; júzgalo por lo visible y dilo en tus razones.`
+      : "",
+    "```diff", diff, "```",
+  ].filter(Boolean).join("\n");
+}
+
+/**
+ * Judge a scored tournament: rank finalists, escalate on tie/disagreement.
+ * @returns {Promise<{winner: string, judge: string|null, escalated: boolean, walkover?: boolean}>}
+ */
+export async function judgeTournament({ tournamentDir, config = {}, logger = console, deps = {} }) {
+  const { judgeFn = defaultJudge, agentFn = defaultAgent, solomonFn = null } = deps;
+  const board = JSON.parse(fs.readFileSync(path.join(tournamentDir, "scoreboard.json"), "utf8"));
+  const finalists = board.rows.filter((r) => r.finalist).map((r) => r.coder);
+  const participants = board.rows.map((r) => r.coder);
+
+  if (finalists.length === 0) throw new Error("tournament: sin finalistas (todas las suites rojas) — no hay nada que juzgar");
+  if (finalists.length === 1) {
+    const judgement = { winner: finalists[0], judge: null, escalated: false, walkover: true, board_ranking: board.ranking };
+    fs.writeFileSync(path.join(tournamentDir, "judgement.json"), JSON.stringify(judgement, null, 2));
+    logger?.info?.(`torneo ${board.id}: ganador por walkover — ${finalists[0]} (único finalista)`);
+    return judgement;
+  }
+
+  const judge = await judgeFn({ config, participants });
+  if (!judge) {
+    throw new Error(
+      "tournament: sin juez limpio — todos los agentes disponibles compitieron o son el host. " +
+      "Un participante jamás juzga su propio torneo: quita un coder o añade un agente."
+    );
+  }
+
+  const prompt = [
+    "Eres el JUEZ de un torneo de código: varios coders resolvieron la MISMA tarea de forma independiente.",
+    "La fase determinista ya eliminó a los que suspendieron la suite. Tu trabajo: ordenar a los finalistas",
+    "por calidad de solución (diseño, legibilidad, ausencia de sobre-ingeniería), con el scoreboard a la vista.",
+    `Regla del scoreboard: ${board.rule}`,
+    `Ranking del scoreboard: ${board.ranking.join(" > ")}`,
+    `TAREA ORIGINAL:\n${board.task}`,
+    ...finalists.map((c) => finalistBlock(board, tournamentDir, c)),
+    'Responde SOLO con JSON: {"ranking": ["coder", ...], "reasons": {"coder": "por qué"}, "tie": false}',
+    "Declara tie:true únicamente si de verdad no puedes distinguirlos.",
+  ].join("\n\n");
+
+  logger?.info?.(`torneo ${board.id}: juez=${judge} sobre ${finalists.length} finalistas`);
+  const res = await agentFn({ judge, prompt, config, logger });
+  if (!res?.ok) throw new Error(`tournament: el juez ${judge} falló: ${res?.error || "sin salida"}`);
+  let verdict;
+  try {
+    verdict = JSON.parse(String(res.output).replace(/^[^{]*/, "").replace(/[^}]*$/, ""));
+  } catch {
+    throw new Error(`tournament: el juez ${judge} no devolvió un veredicto parseable`);
+  }
+  // An LLM verdict is untrusted input: the ranking must name FINALISTS and
+  // nobody else — a hallucinated coder must fail loud, never get crowned.
+  const isFinalist = (c) => finalists.includes(c);
+  if (!Array.isArray(verdict.ranking) || verdict.ranking.length === 0 || !verdict.ranking.every(isFinalist)) {
+    throw new Error(`tournament: ranking del juez inválido (${JSON.stringify(verdict.ranking)}) — debe nombrar solo finalistas: ${finalists.join(", ")}`);
+  }
+
+  // Only FIRST place crowns a winner: a judge that reorders lower positions
+  // but agrees on who wins is agreement, not a dispute for solomon.
+  const judgeTop = verdict.ranking?.[0];
+  const boardTop = board.ranking[0];
+  const disagreement = judgeTop !== boardTop;
+  const escalated = Boolean(verdict.tie || disagreement);
+
+  let winner = judgeTop;
+  let solomon = null;
+  if (escalated) {
+    if (!solomonFn) {
+      throw new Error(
+        `tournament: ${verdict.tie ? "empate declarado" : `discrepancia juez(${judgeTop}) vs scoreboard(${boardTop})`} y sin árbitro configurado`
+      );
+    }
+    solomon = await solomonFn({
+      judgeRanking: verdict.ranking,
+      boardRanking: board.ranking,
+      reasons: verdict.reasons,
+      tie: Boolean(verdict.tie),
+    });
+    if (!isFinalist(solomon?.winner)) {
+      throw new Error(`tournament: solomon devolvió un ganador inválido (${solomon?.winner}) — debe ser finalista`);
+    }
+    winner = solomon.winner;
+  }
+
+  const judgement = {
+    winner, judge, escalated,
+    judge_ranking: verdict.ranking, judge_reasons: verdict.reasons || {},
+    board_ranking: board.ranking, solomon,
+    judged_at: new Date().toISOString(),
+  };
+  fs.writeFileSync(path.join(tournamentDir, "judgement.json"), JSON.stringify(judgement, null, 2));
+  logger?.info?.(`torneo ${board.id}: ganador=${winner}${escalated ? " (vía solomon)" : " (juez y scoreboard de acuerdo)"}`);
+  return judgement;
+}

package/src/tournament/run.js

@@ -0,0 +1,142 @@
+/**
+ * tournament/run — TOR-A (KJC-TSK-0723, epic KJC-PCS-0073).
+ *
+ * Orca's pitch is "fan one prompt across N agents, compare, merge the
+ * winner" — with a human eyeballing diffs. Karajan's tournament keeps the
+ * fan-out and replaces the eyeballing with the method: this module runs the
+ * SAME task through N coders, each in its own isolated worktree lane (the
+ * PAR machinery), and collects per-lane evidence (diff, suite result, agent
+ * log, metadata) for the deterministic scoreboard (TOR-B) and the governed
+ * judgement/merge (TOR-C). No commits here: lanes stay as working trees.
+ *
+ * A COMPOSER, not a new pipeline: lanes = `git worktree` under
+ * .kj/worktrees (same dir as kj worktree / headless lanes); agents = the
+ * registered adapters with the PAR idiom (laneConfig.projectDir = lane,
+ * task.cwd = lane); suite = the package manager the repo actually uses.
+ * Every dependency is injectable; one lane's failure never sinks another.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { createAgent } from "../agents/index.js";
+import { bootstrapWorktree } from "../hu/worktree-bootstrap.js";
+import { detectPackageManager } from "../harden/workflow-engine.js";
+import { PM_COMMANDS } from "../harden/workflow-templates.js";
+
+const execFileAsync = promisify(execFile);
+const WORKTREE_DIR = ".kj/worktrees"; // shared with kj worktree + headless lanes
+const TOURNAMENT_DIR = ".kj/tournaments";
+const SUITE_TIMEOUT_MS = 15 * 60 * 1000;
+
+const defaultGit = (args, cwd) => execFileAsync("git", args, { cwd, maxBuffer: 64 * 1024 * 1024 });
+
+async function defaultRunSuite({ lanePath }) {
+  const pm = detectPackageManager(lanePath);
+  const testCmd = (PM_COMMANDS[pm] || PM_COMMANDS.npm).test.split(" ");
+  try {
+    const res = await execFileAsync(testCmd[0], testCmd.slice(1), {
+      cwd: lanePath, timeout: SUITE_TIMEOUT_MS, maxBuffer: 64 * 1024 * 1024,
+    });
+    return { ok: true, exitCode: 0, output: res.stdout || "" };
+  } catch (err) {
+    return { ok: false, exitCode: err.code ?? 1, output: `${err.stdout || ""}\n${err.stderr || ""}` };
+  }
+}
+
+/**
+ * Fan the task out to every coder and collect per-lane results.
+ * @returns {Promise<{id: string, dir: string, lanes: Array<object>}>}
+ */
+export async function runTournament({ task, coders = [], config = {}, logger = console, deps = {} }) {
+  const {
+    createAgentFn = createAgent,
+    gitFn = defaultGit,
+    bootstrapFn = bootstrapWorktree,
+    runSuiteFn = defaultRunSuite,
+  } = deps;
+  if (!task || !String(task).trim()) throw new Error("tournament: falta la tarea");
+  if (!Array.isArray(coders) || coders.length < 2) {
+    throw new Error("tournament: hacen falta al menos 2 coders (--coders a,b) — con uno no hay torneo");
+  }
+  // Coder names feed lane/result PATHS: a strict slug (no separators, no
+  // leading dot, no traversal) before any filesystem use — codex's catch.
+  const CODER_RE = /^[a-z0-9][a-z0-9_-]{0,23}$/i;
+  for (const c of coders) {
+    if (!CODER_RE.test(String(c))) {
+      throw new Error(`tournament: nombre de coder inválido "${c}" — solo letras, dígitos, guiones (sin rutas)`);
+    }
+  }
+
+  const projectDir = config.projectDir || process.cwd();
+  const id = `tor-${Date.now().toString(36)}`;
+  const resultsRoot = path.join(projectDir, TOURNAMENT_DIR, id);
+  fs.mkdirSync(resultsRoot, { recursive: true });
+  logger?.info?.(`kj tournament ${id}: ${coders.length} coders → ${coders.join(", ")}`);
+
+  const settled = await Promise.allSettled(coders.map((coder) => runLane({
+    coder, task, id, projectDir, resultsRoot, config, logger,
+    createAgentFn, gitFn, bootstrapFn, runSuiteFn,
+  })));
+
+  const lanes = settled.map((s, i) =>
+    s.status === "fulfilled"
+      ? s.value
+      : { coder: coders[i], status: "failed", error: String(s.reason?.message || s.reason), dir: path.join(resultsRoot, coders[i]) },
+  );
+
+  const summary = { id, task: String(task), created_at: new Date().toISOString(), lanes };
+  fs.writeFileSync(path.join(resultsRoot, "summary.json"), JSON.stringify(summary, null, 2));
+  for (const lane of lanes) {
+    let state = `FAILED: ${lane.error}`;
+    if (lane.status === "completed") state = lane.suite?.ok ? "suite verde" : "suite ROJA";
+    logger?.info?.(`  ${lane.coder.padEnd(10)} ${lane.status.padEnd(10)} ${state}`);
+  }
+  return { id, dir: resultsRoot, lanes };
+}
+
+async function runLane({ coder, task, id, projectDir, resultsRoot, config, logger, createAgentFn, gitFn, bootstrapFn, runSuiteFn }) {
+  const slug = `${id}-${coder}`;
+  const lanePath = path.join(projectDir, WORKTREE_DIR, slug);
+  const branch = `tor/${slug}`;
+  const laneDir = path.join(resultsRoot, coder);
+  fs.mkdirSync(laneDir, { recursive: true });
+
+  await gitFn(["worktree", "add", "-b", branch, lanePath], projectDir);
+  await bootstrapFn({ worktreePath: lanePath, setupCommand: config?.session?.worktree_setup || null });
+
+  // The PAR idiom: the lane IS the project for this agent. A tournament
+  // coder MUST be able to write files — found live in the first real run:
+  // codex without auto_approve produced an honest but useless EMPTY diff.
+  const laneConfig = {
+    ...config,
+    projectDir: lanePath,
+    coder_options: { ...config?.coder_options, auto_approve: true },
+  };
+  const prompt =
+    `You are one of ${"several"} coders solving the SAME task independently. ` +
+    `Work ONLY inside this directory (your isolated worktree). Implement the task with tests. Do not commit.\n\nTASK:\n${task}`;
+  const started = Date.now();
+  const result = await createAgentFn(coder, laneConfig, logger).runTask({ prompt, role: "coder", cwd: lanePath });
+  fs.writeFileSync(path.join(laneDir, "agent.log"), String(result?.output ?? ""));
+  if (!result?.ok) throw new Error(`coder ${coder} failed: ${result?.error || "no output"}`);
+
+  // Intent-to-add first: plain `git diff` is blind to UNTRACKED files, and
+  // new files are the most common coder output — codex's catch.
+  await gitFn(["add", "-N", "."], lanePath);
+  const diff = await gitFn(["diff"], lanePath);
+  fs.writeFileSync(path.join(laneDir, "diff.patch"), diff.stdout || "");
+
+  const suite = await runSuiteFn({ lanePath });
+  fs.writeFileSync(path.join(laneDir, "suite.log"), suite.output || "");
+
+  const meta = {
+    coder, branch, lane: lanePath, tournament: id,
+    duration_ms: Date.now() - started,
+    diff_bytes: (diff.stdout || "").length,
+    suite: { ok: suite.ok, exitCode: suite.exitCode },
+  };
+  fs.writeFileSync(path.join(laneDir, "meta.json"), JSON.stringify(meta, null, 2));
+
+  return { coder, status: "completed", branch, lane: lanePath, dir: laneDir, suite: { ok: suite.ok, exitCode: suite.exitCode } };
+}

package/src/tournament/scoreboard.js

@@ -0,0 +1,124 @@
+/**
+ * tournament/scoreboard — TOR-B (KJC-TSK-0724, epic KJC-PCS-0073).
+ *
+ * The deterministic half of "merge the winner": pure metrics computed from
+ * the artifacts TOR-A leaves under .kj/tournaments/<id>/ (suite verdict,
+ * net LOC, tests touched — parsed from diff.patch), plus injectable
+ * external metrics (mutation via `kj mutate` in the still-alive lane;
+ * sonar reserved) that degrade HONESTLY to null-with-note when their tool
+ * is unavailable — a fake zero would poison the ranking. Red suites are
+ * eliminated, never finalists. The ranking rule is lexicographic and
+ * PRINTED with the result: no opaque composite scores, no hidden weights.
+ * Zero LLM in this whole phase.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+const TESTS_RE = /(^|\/)(tests?|__tests__|spec)\/|\.(test|spec)\.[a-z]+$/;
+const MUTATE_TIMEOUT_MS = 10 * 60 * 1000;
+
+// EXACT unified-diff header forms — an added line whose content starts with
+// "++" produces "+++<content>" and must still COUNT (codex's catch): only
+// `+++ b/…`, `+++ /dev/null`, `--- a/…`, `--- /dev/null` are headers.
+const ADD_HEADER_RE = /^\+\+\+ (b\/|\/dev\/null)/;
+const DEL_HEADER_RE = /^--- (a\/|\/dev\/null)/;
+
+/** Pure unified-diff stats: files, additions/deletions/net, tests touched. */
+export function parseDiffStats(patch) {
+  const files = [];
+  let additions = 0;
+  let deletions = 0;
+  for (const line of String(patch || "").split("\n")) {
+    if (ADD_HEADER_RE.test(line)) {
+      if (line.startsWith("+++ b/")) files.push(line.slice(6).trim());
+    } else if (DEL_HEADER_RE.test(line)) {
+      // deletion-side header — never a counted line
+    } else if (line.startsWith("+")) additions++;
+    else if (line.startsWith("-")) deletions++;
+  }
+  const testsTouched = files.filter((f) => TESTS_RE.test(f)).length;
+  return { files, additions, deletions, net: additions - deletions, testsTouched };
+}
+
+export async function defaultMutate({ lane }) {
+  // Mutation runs IN the live worktree lane — codex's catch: guard the path
+  // explicitly so a gone/relative lane yields a DISTINCT note instead of
+  // silently degrading the ranking.
+  if (!lane || !path.isAbsolute(lane) || !fs.existsSync(lane)) {
+    return { score: null, note: "lane no longer exists — score after the fan-out, before cleaning lanes" };
+  }
+  try {
+    const res = await execFileAsync("kj", ["mutate", "--json"], { cwd: lane, timeout: MUTATE_TIMEOUT_MS, maxBuffer: 16 * 1024 * 1024 });
+    const parsed = JSON.parse(res.stdout);
+    return { score: parsed.score ?? null, killed: parsed.killed ?? null, survived: parsed.survived ?? null };
+  } catch {
+    return null; // kj unavailable / no mutants / timeout — honest n/a
+  }
+}
+
+// Sonar-per-lane needs the running-server collector; reserved as a future
+// step (see card). Injectable so TOR-C or tests can supply real findings.
+const defaultSonar = async () => null;
+
+/**
+ * Score every lane of a tournament from its artifacts.
+ * @returns {Promise<{id: string, rows: Array<object>, ranking: string[], rule: string}>}
+ */
+export async function scoreTournament({ tournamentDir, deps = {} }) {
+  const { mutateFn = defaultMutate, sonarFn = defaultSonar } = deps;
+  const summary = JSON.parse(fs.readFileSync(path.join(tournamentDir, "summary.json"), "utf8"));
+
+  const rows = [];
+  for (const lane of summary.lanes) {
+    if (lane.status !== "completed") {
+      rows.push({ coder: lane.coder, finalist: false, eliminated_by: "failed", error: lane.error || null });
+      continue;
+    }
+    const laneDir = lane.dir || path.join(tournamentDir, lane.coder);
+    const meta = JSON.parse(fs.readFileSync(path.join(laneDir, "meta.json"), "utf8"));
+    const loc = parseDiffStats(fs.readFileSync(path.join(laneDir, "diff.patch"), "utf8"));
+
+    let mutation = { score: null, note: "not available" };
+    try {
+      const m = await mutateFn({ coder: lane.coder, lane: meta.lane, laneDir });
+      if (m && typeof m.score === "number") mutation = { ...m, note: null };
+      else if (m?.note) mutation = { score: null, note: m.note };
+    } catch { /* honest n/a — never a fake zero */ }
+    const sonar = await sonarFn({ coder: lane.coder, lane: meta.lane, files: loc.files }).catch(() => null);
+
+    const suiteOk = Boolean(meta.suite?.ok);
+    rows.push({
+      coder: lane.coder,
+      finalist: suiteOk,
+      eliminated_by: suiteOk ? null : "suite",
+      suite: meta.suite,
+      loc,
+      mutation,
+      sonar,
+    });
+  }
+
+  const anyMutation = rows.some((r) => typeof r.mutation?.score === "number");
+  const rule = anyMutation
+    ? "finalistas = suite verde; orden: mutation desc SOLO entre carriles que la tienen (null jamás penaliza — codex's catch), luego LOC neto asc"
+    : "finalistas = suite verde; orden: LOC neto asc (mutation no disponible)";
+
+  const ranking = rows
+    .filter((r) => r.finalist)
+    .sort((a, b) => {
+      const ma = a.mutation?.score;
+      const mb = b.mutation?.score;
+      // Mutation only compares when BOTH lanes have a real score — a null
+      // (tool unavailable) must stay a note, never become a hidden penalty.
+      if (typeof ma === "number" && typeof mb === "number" && mb !== ma) return mb - ma;
+      return a.loc.net - b.loc.net;
+    })
+    .map((r) => r.coder);
+
+  const board = { id: summary.id, task: summary.task, rule, ranking, rows, scored_at: new Date().toISOString() };
+  fs.writeFileSync(path.join(tournamentDir, "scoreboard.json"), JSON.stringify(board, null, 2));
+  return board;
+}