karajan-code 4.14.0 → 4.16.0

package/src/harden/workflow-templates.js

@@ -8,6 +8,20 @@
 
 // Blocks AI self-attribution in PR commit messages. Pure bash + grep, no Node.
 // Pins github.base_ref to an env var (never interpolated into the run block).
+// KJC-BUG-0136 (issue #1374): actions pinned to full commit SHAs — a
+// mutable tag lets its owner run arbitrary code inside EVERY hardened
+// repo's CI, with access to the workflow's secrets; 5 of this project's 7
+// audit findings came from files kj itself generated. The version rides in
+// a comment (the practice kj audit demands). To bump one:
+//   gh api repos/<owner>/<repo>/commits/<tag> --jq .sha
+export const PINNED_ACTIONS = {
+  checkout: "actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4",
+  setupNode: "actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4",
+  setupPython: "actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5",
+  setupGo: "actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5",
+  setupPhp: "shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2",
+};
+
 export const NO_AI_ATTRIBUTION_WORKFLOW = [
   "name: Block AI attribution",
   "on:",
@@ -19,7 +33,7 @@ export const NO_AI_ATTRIBUTION_WORKFLOW = [
   "  scan:",
   "    runs-on: ubuntu-latest",
   "    steps:",
-  "      - uses: actions/checkout@v4",
+  `      - uses: ${PINNED_ACTIONS.checkout}`,
   "        with:",
   "          fetch-depth: 0",
   "      - name: Scan commit messages for AI attribution",
@@ -50,34 +64,35 @@ const header = (steps) =>
     "  quality:",
     "    runs-on: ubuntu-latest",
     "    steps:",
-    "      - uses: actions/checkout@v4",
+    `      - uses: ${PINNED_ACTIONS.checkout}`,
     ...steps,
   ].join("\n");
 
 // Per-package-manager commands (KJC-BUG-0131, issue #1330): `npm ci` in a
 // pnpm/yarn repo dies with EUSAGE (no package-lock.json). corepack ships with
 // Node 22 and resolves the right pnpm/yarn from `packageManager` — no
-// third-party action. pnpm passes flags AFTER the script name to the script
-// itself, so --if-present must go BEFORE it; yarn has no --if-present at all,
-// so lint runs through `npm run` (scripts don't touch the lockfile).
-const PM_COMMANDS = {
-  npm: { setup: [], install: "npm ci", lint: "npm run -s lint --if-present", test: "npm test" },
+// third-party action. Yarn scripts run through `npm run` (scripts don't touch
+// the lockfile). Lint ENFORCES — never --if-present: a step that passes when
+// its script is missing protects nothing (KJC-BUG-0137, issue #1357); the
+// engine omits the step instead when the project has no lint script.
+export const PM_COMMANDS = {
+  npm: { setup: [], install: "npm ci", lint: "npm run -s lint", test: "npm test" },
   pnpm: {
     setup: ["      - run: corepack enable"],
     install: "pnpm install --frozen-lockfile",
-    lint: "pnpm run --if-present -s lint",
+    lint: "pnpm run -s lint",
     test: "pnpm test",
   },
   yarn: {
     setup: ["      - run: corepack enable"],
     install: "yarn install --frozen-lockfile",
-    lint: "npm run -s lint --if-present",
+    lint: "npm run -s lint",
     test: "yarn test",
   },
 };
 
 const nodeSetupSteps = (pm) => [
-  "      - uses: actions/setup-node@v4",
+  `      - uses: ${PINNED_ACTIONS.setupNode}`,
   "        with:",
   "          node-version: 22",
   ...(PM_COMMANDS[pm] || PM_COMMANDS.npm).setup,
@@ -86,7 +101,7 @@ const nodeSetupSteps = (pm) => [
 
 const QUALITY_BY_LANGUAGE = {
   python: header([
-    "      - uses: actions/setup-python@v5",
+    `      - uses: ${PINNED_ACTIONS.setupPython}`,
     "        with:",
     "          python-version: '3.12'",
     "      - run: pip install ruff pytest",
@@ -94,14 +109,14 @@ const QUALITY_BY_LANGUAGE = {
     "      - run: pytest",
   ]),
   go: header([
-    "      - uses: actions/setup-go@v5",
+    `      - uses: ${PINNED_ACTIONS.setupGo}`,
     "        with:",
     "          go-version: stable",
     "      - run: go vet ./...",
     "      - run: go test ./...",
   ]),
   php: header([
-    "      - uses: shivammathur/setup-php@v2",
+    `      - uses: ${PINNED_ACTIONS.setupPhp}`,
     "        with:",
     "          php-version: '8.3'",
     "      - run: composer install --no-interaction --no-progress",
@@ -109,12 +124,16 @@ const QUALITY_BY_LANGUAGE = {
     "      - run: vendor/bin/phpunit",
   ]),
 };
-/** Stack-aware Quality workflow entry, or null for an unknown language. */
-export function qualityWorkflowFor(language, pm = "npm") {
+/**
+ * Stack-aware Quality workflow entry, or null for an unknown language.
+ * `lint:false` drops the JS lint step entirely (project has no lint script,
+ * KJC-BUG-0137) — mirroring the local hook, which also omits it.
+ */
+export function qualityWorkflowFor(language, pm = "npm", lint = true) {
   const c = PM_COMMANDS[pm] || PM_COMMANDS.npm;
   const body =
     language === "javascript" || language === "typescript"
-      ? header([...nodeSetupSteps(pm), `      - run: ${c.lint}`, `      - run: ${c.test}`])
+      ? header([...nodeSetupSteps(pm), ...(lint ? [`      - run: ${c.lint}`] : []), `      - run: ${c.test}`])
       : QUALITY_BY_LANGUAGE[language];
   return body ? { file: "kj-quality.yml", blockId: "wf-quality", body } : null;
 }
@@ -132,7 +151,7 @@ export const SHRINK_BUDGET_WORKFLOW = [
   "    runs-on: ubuntu-latest",
   '    env: { LOC_LIMIT: "200" }',
   "    steps:",
-  "      - uses: actions/checkout@v4",
+  `      - uses: ${PINNED_ACTIONS.checkout}`,
   "        with:",
   "          fetch-depth: 0",
   "      - name: Net LOC delta within budget",
@@ -161,7 +180,7 @@ export const packSmokeWorkflow = (pm = "npm") =>
     "  pack-smoke:",
     "    runs-on: ubuntu-latest",
     "    steps:",
-    "      - uses: actions/checkout@v4",
+    `      - uses: ${PINNED_ACTIONS.checkout}`,
     ...nodeSetupSteps(pm),
     "      - name: Pack and install the tarball clean",
     "        run: |",
@@ -179,13 +198,13 @@ export const packSmokeWorkflow = (pm = "npm") =>
 const MUTATION_TOOLCHAIN = {
   javascript: "node", // resolved per package manager in mutationWorkflowFor
   python: [
-    "      - uses: actions/setup-python@v5",
+    `      - uses: ${PINNED_ACTIONS.setupPython}`,
     "        with:",
     "          python-version: '3.12'",
     "      - run: pip install mutmut pytest",
   ],
   php: [
-    "      - uses: shivammathur/setup-php@v2",
+    `      - uses: ${PINNED_ACTIONS.setupPhp}`,
     "        with:",
     "          php-version: '8.3'",
     "      - run: composer install --no-interaction --no-progress",
@@ -211,10 +230,10 @@ export function mutationWorkflowFor(language, pm = "npm") {
     "  mutation:",
     "    runs-on: ubuntu-latest",
     "    steps:",
-    "      - uses: actions/checkout@v4",
+    `      - uses: ${PINNED_ACTIONS.checkout}`,
     "        with:",
     "          fetch-depth: 0",
-    "      - uses: actions/setup-node@v4",
+    `      - uses: ${PINNED_ACTIONS.setupNode}`,
     "        with:",
     "          node-version: 22",
     ...toolchain,

package/src/orchestrator/direct-actions.js

@@ -26,6 +26,17 @@ const ALLOWED_COMMANDS = [
   "bundle install", "composer install", "dotnet restore"
 ];
 
+// KJC-BUG-0099: a dependency install must not be arbitrary code execution —
+// lifecycle hooks (postinstall & friends) run whatever the dependency ships.
+// The allow-list above names the INTENT; execution appends the ecosystem's
+// script-skipping flag. Ecosystems without package hooks run untouched.
+const HARDEN_FLAGS = {
+  npm: ["--ignore-scripts"],
+  pnpm: ["--ignore-scripts"],
+  yarn: ["--ignore-scripts"],
+  composer: ["--no-scripts", "--no-plugins"],
+};
+
 /**
  * True when `target` resolves to a path inside `base` (or is `base` itself).
  * Uses path.relative instead of a string prefix check: a naive
@@ -64,7 +75,7 @@ async function runCommand({ cmd, cwd }) {
     // Even though `cmd` is allow-listed, defense-in-depth: switched to
     // execFileSync with a tokenised arg array so no shell expansion at all.
     const [program, ...args] = cmd.trim().split(/\s+/);
-    const output = execFileSync(program, args, {
+    const output = execFileSync(program, [...args, ...(HARDEN_FLAGS[program] ?? [])], {
       cwd: cwd || process.cwd(),
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"],

package/src/prompts/diff-clip.js

@@ -0,0 +1,27 @@
+/**
+ * diff-clip — KJC-BUG-0134 (issue #1381). A bare [TRUNCATED] marker inside
+ * the diff body reads as file content: reviewers blamed whichever file the
+ * cut landed in and rejected complete, untouched code (each false positive
+ * costs a solomon round). The clip is DECLARED as the pipeline's own, kept
+ * OUTSIDE the diff body, cut on a line boundary, and the reviewer is told
+ * the diff is partial so it never reasons about the completeness of files
+ * it cannot fully see. Shared by every prompt that hands a diff to an AI.
+ */
+
+export const DIFF_CLIP_CHARS = 12000;
+
+/** @returns {{body: string, note: string|null}} note is null when no clip happened. */
+export function clipDiff(diff, limit = DIFF_CLIP_CHARS) {
+  if (!diff) return { body: "", note: null };
+  if (diff.length <= limit) return { body: diff, note: null };
+  const hard = diff.slice(0, limit);
+  const nl = hard.lastIndexOf("\n");
+  const body = nl > 0 ? hard.slice(0, nl) : hard;
+  const omittedLines = diff.slice(body.length).split("\n").filter(Boolean).length;
+  const note = [
+    `NOTE FROM THE KJ PIPELINE (not part of the diff): the diff above was clipped by kj at ~${limit} characters — ${omittedLines} more line(s) exist but are NOT shown.`,
+    "The cut is kj's, not the author's: no file in the working tree is truncated.",
+    "Do not raise issues about incomplete or cut-off content, and do not reason about the completeness of files you cannot fully see. Review only what is visible.",
+  ].join(" ");
+  return { body, note };
+}

package/src/prompts/reviewer.js

@@ -2,6 +2,8 @@ import { buildRtkInstructions } from "./rtk-snippet.js";
 import { loadAvailableSkills, buildSkillSection } from "../skills/skill-loader.js";
 import { getLanguageInstruction } from "../utils/locale.js";
 import { section, buildPromptLayout, joinLayout, STABLE, VOLATILE } from "./prompt-layout.js";
+import { clipDiff } from "./diff-clip.js";
+import { buildSplitSignal } from "./split-signal.js";
 
 const SUBAGENT_PREAMBLE = [
   "IMPORTANT: You are running as a Karajan sub-agent.",
@@ -34,7 +36,9 @@ const SERENA_INSTRUCTIONS = [
  * and always different) goes last.
  */
 export async function buildReviewerPromptLayout({ task, diff, reviewRules, mode, serenaEnabled = false, rtkAvailable = false, productContext = null, domainContext = null, projectDir = null, language = "en", provider = null }) {
-  const truncatedDiff = diff.length > 12000 ? `${diff.slice(0, 12000)}\n\n[TRUNCATED]` : diff;
+  const { body: clippedDiff, note: clipNote } = clipDiff(diff);
+  // KJC-BUG-0138: full diff on purpose — the moved-to side survives clipping.
+  const splitSignal = buildSplitSignal(diff);
 
   const langInstruction = getLanguageInstruction(language);
   const rtkSnippet = buildRtkInstructions({ rtkAvailable });
@@ -60,7 +64,9 @@ export async function buildReviewerPromptLayout({ task, diff, reviewRules, mode,
     section(`Review rules:\n${reviewRules}`, STABLE),
     section(skillSection, STABLE),
     section(`Task context:\n${task}`, VOLATILE),
-    section(`Git diff:\n${truncatedDiff}`, VOLATILE),
+    section(`Git diff:\n${clippedDiff}`, VOLATILE),
+    section(clipNote, VOLATILE),
+    section(splitSignal, VOLATILE),
   ]);
 }
 

package/src/prompts/split-signal.js

@@ -0,0 +1,82 @@
+/**
+ * split-signal — KJC-BUG-0138 (issue #1364). A file split is not a coverage
+ * deletion, but the reviewer doesn't correlate a file losing content with new
+ * files gaining it (4/13 pure-refactor PRs falsely rejected). Deterministic
+ * pre-analysis, zero LLM: significant removed lines reappearing verbatim among
+ * another file's ADDITIONS in the same diff are moves — when ≥ MIN_RATIO of a
+ * file's removals move, the reviewer gets the correlation as a pipeline note.
+ * Exact `--- a/` / `+++ b/` headers only (BUG-0132: `++content` ≠ header).
+ */
+
+const MIN_REMOVED = 10; // fewer significant removals ⇒ too small to misread
+const MIN_RATIO = 0.5; // below this, the removal is mostly a real removal
+
+// Braces/punctuation reappear by accident — only letter-bearing lines count.
+function significant(text) {
+  const t = text.trim();
+  return t.length >= 10 && /[a-zA-Z]/.test(t);
+}
+
+/** @returns {string|null} pipeline note, or null when nothing moved. Feed the
+ * PRE-CLIPPING diff: the added side must inform even when clipped away. */
+export function buildSplitSignal(diff) {
+  if (!diff) return null;
+  const removedByFile = new Map();
+  const addedByFile = new Map();
+  let src = null;
+  let dst = null;
+  for (const raw of diff.split("\n")) {
+    if (raw.startsWith("--- ")) {
+      src = raw.startsWith("--- a/") ? raw.slice(6) : null;
+      continue;
+    }
+    if (raw.startsWith("+++ ")) {
+      dst = raw.startsWith("+++ b/") ? raw.slice(6) : null;
+      continue;
+    }
+    if (raw.startsWith("+") && dst && significant(raw.slice(1))) {
+      const counts = addedByFile.get(dst) ?? new Map();
+      const t = raw.slice(1).trim();
+      counts.set(t, (counts.get(t) ?? 0) + 1);
+      addedByFile.set(dst, counts);
+    } else if (raw.startsWith("-") && src && significant(raw.slice(1))) {
+      const lines = removedByFile.get(src) ?? [];
+      lines.push(raw.slice(1).trim());
+      removedByFile.set(src, lines);
+    }
+  }
+
+  const findings = [];
+  for (const [file, removed] of removedByFile) {
+    if (removed.length < MIN_REMOVED) continue;
+    const dests = new Map();
+    let moved = 0;
+    for (const text of removed) {
+      for (const [other, counts] of addedByFile) {
+        if (other === file) continue; // in-place edits are not moves
+        const n = counts.get(text) ?? 0;
+        if (n > 0) {
+          counts.set(text, n - 1); // each added line vouches for ONE removal
+          dests.set(other, (dests.get(other) ?? 0) + 1);
+          moved++;
+          break;
+        }
+      }
+    }
+    if (moved / removed.length >= MIN_RATIO) {
+      const where = [...dests.entries()]
+        .sort((a, b) => b[1] - a[1])
+        .slice(0, 4)
+        .map(([d, n]) => `${d} (${n})`)
+        .join(", ");
+      findings.push(`- ${file}: ${moved} of ${removed.length} significant removed lines reappear ADDED in ${where}`);
+    }
+  }
+  if (findings.length === 0) return null;
+
+  return [
+    "NOTE FROM THE KJ PIPELINE (deterministic pre-analysis, not from the author): this diff MOVES content between files:",
+    ...findings,
+    "Moved content is a file split/relocation, not a deletion. Before reporting removed tests or lost coverage, check the ADDED side listed above in this SAME diff. Do not treat moved lines as deleted.",
+  ].join("\n");
+}

package/src/review/card-first.js

@@ -8,6 +8,7 @@
  */
 import { listPlans, loadPlan } from "../plan/plan-store.js";
 import { escapeRegExp } from "../utils/escape-regexp.js";
+import { verifyCardAlive } from "./card-verify.js";
 
 const LIVE_STATUSES = new Set(["pending", "running", "failed"]);
 // Card-shaped reference: LIN-123, bb-002 and multi-segment ids like
@@ -44,7 +45,7 @@ async function findLiveCardInBranch(projectDir, branch) {
   return closedHit;
 }
 
-export async function checkCardFirst({ config = {}, projectDir = process.cwd(), branch, env = process.env }) {
+export async function checkCardFirst({ config = {}, projectDir = process.cwd(), branch, env = process.env, deps = {} }) {
   if (env.KJ_ALLOW_NO_CARD === "1") {
     return { ok: true, mode: "exempt", reason: "KJ_ALLOW_NO_CARD=1 (explicit escape hatch)" };
   }
@@ -73,11 +74,24 @@ export async function checkCardFirst({ config = {}, projectDir = process.cwd(),
       : { ok: true, mode: "warn", reason };
   }
 
-  // planning-game / external: presence check only — liveness lives in the
-  // project's own board, out of local reach.
-  if (CARD_REF_RE.test(branch)) return { ok: true, mode: "pass", ref: branch.match(CARD_REF_RE)[0] };
-  const effective = policy === "auto" ? "warn" : policy;
+  // planning-game / external: presence check, upgraded to LIVENESS against
+  // the real tracker when board.verify_cmd declares an adapter
+  // (KJC-TSK-0732, issue #1371). Unverifiable degrades honestly — the
+  // result names its level so nobody mistakes branch-ref for tracker.
   const boardName = config.board?.name || backend;
+  const effective = policy === "auto" ? "warn" : policy;
+  if (CARD_REF_RE.test(branch)) {
+    const ref = branch.match(CARD_REF_RE)[0];
+    const { verifyFn = verifyCardAlive } = deps;
+    const v = await verifyFn({ ref, verifyCmd: config.board?.verify_cmd, projectDir });
+    if (v.verified === false) {
+      const reason = `branch references ${ref} but ${boardName} reports it "${v.status}" — card-first needs a live card in the tracker (create/reopen it there)`;
+      return effective === "block"
+        ? { ok: false, mode: "block", reason, level: v.level }
+        : { ok: true, mode: "warn", reason, level: v.level };
+    }
+    return { ok: true, mode: "pass", ref, level: v.level, ...(v.note ? { note: v.note } : {}) };
+  }
   const reason = `no card reference in branch "${branch}" — card-first on ${boardName}: create the card there and name the branch after it (e.g. feat/ABC-123-summary)`;
   return effective === "block"
     ? { ok: false, mode: "block", reason }

package/src/review/card-verify.js

@@ -0,0 +1,83 @@
+/**
+ * card-verify — KJC-TSK-0732 (issue #1371). With a declared tracker,
+ * card-first upgrades "the branch names a card" to "the tracker says that
+ * card is ALIVE". Transport-agnostic: `board.verify_cmd` is the USER'S
+ * adapter (their CLI/MCP wrapper — credentials never enter kj) printing
+ * {exists, live, status?} JSON on stdout. Unverifiable NEVER blocks: it
+ * degrades to branch-ref level SAYING SO — a gate must not claim a check
+ * it didn't make, in either direction. Definitive verdicts are cached
+ * briefly; degradations never are, so recovery is immediate.
+ */
+import { exec } from "node:child_process";
+import { createHash } from "node:crypto";
+import { promisify } from "node:util";
+import fs from "node:fs";
+import path from "node:path";
+import { extractFirstJson } from "../utils/json-extract.js";
+
+const execAsync = promisify(exec);
+export const VERIFY_TIMEOUT_MS = 4000;
+const CACHE_TTL_MS = 10 * 60 * 1000;
+// The ref lands inside a shell command (the user's adapter template), so it
+// must be inert BY CONSTRUCTION — card-ref alphabet only, anchored (codex
+// catch: same injection class as the tournament coder names).
+const SAFE_REF_RE = /^[a-z0-9][a-z0-9-]{0,63}$/i;
+
+const defaultExec = async (cmd, { cwd }) =>
+  execAsync(cmd, { cwd, timeout: VERIFY_TIMEOUT_MS, maxBuffer: 1024 * 1024 });
+
+function cachePath(projectDir) {
+  return path.join(projectDir, ".kj", "cache", "card-verify.json");
+}
+
+/** @returns {Promise<{level: "tracker"|"branch-ref", verified: boolean|null, status?: string|null, note?: string}>}
+ *  verified: true = alive · false = definitively not · null = degraded. */
+export async function verifyCardAlive({ ref, verifyCmd, projectDir = process.cwd(), deps = {} }) {
+  const { execFn = defaultExec, now = Date.now } = deps;
+  if (!verifyCmd) {
+    return {
+      level: "branch-ref", verified: null,
+      note: "card-first checked the branch reference only — set board.verify_cmd to verify the card against your tracker",
+    };
+  }
+
+  if (!SAFE_REF_RE.test(String(ref))) {
+    return {
+      level: "branch-ref", verified: null,
+      note: `tracker verification skipped — ref "${String(ref).slice(0, 30)}" is outside the card-ref alphabet`,
+    };
+  }
+  let cache = {};
+  try {
+    cache = JSON.parse(fs.readFileSync(cachePath(projectDir), "utf8"));
+  } catch { /* no cache yet */ }
+  // Keyed by adapter AND ref (reviewer catch): a verdict from one
+  // verify_cmd must never answer for a different one.
+  const key = `${createHash("sha256").update(verifyCmd).digest("hex").slice(0, 12)}:${ref}`;
+  const hit = cache[key];
+  if (hit && now() - hit.at < CACHE_TTL_MS) return hit.result;
+
+  const cmd = verifyCmd.includes("{ref}") ? verifyCmd.replaceAll("{ref}", ref) : `${verifyCmd} ${ref}`;
+  try {
+    const { stdout } = await execFn(cmd, { cwd: projectDir });
+    const parsed = extractFirstJson(String(stdout));
+    if (!parsed || typeof parsed.exists !== "boolean") {
+      throw new Error("adapter must print JSON {exists, live, status} on stdout");
+    }
+    const alive = parsed.exists && parsed.live !== false;
+    const result = alive
+      ? { level: "tracker", verified: true, status: parsed.status ?? null }
+      : { level: "tracker", verified: false, status: parsed.status ?? (parsed.exists ? "not-live" : "not-found") };
+    try {
+      fs.mkdirSync(path.dirname(cachePath(projectDir)), { recursive: true });
+      fs.writeFileSync(cachePath(projectDir), JSON.stringify({ ...cache, [key]: { at: now(), result } }));
+    } catch { /* cache is best-effort — the verdict stands without it */ }
+    return result;
+  } catch (err) {
+    const why = String(err.message || err).split("\n")[0].slice(0, 120);
+    return {
+      level: "branch-ref", verified: null,
+      note: `tracker verification degraded to branch-ref (${why}) — fix board.verify_cmd or its credentials`,
+    };
+  }
+}

package/src/roles/reviewer-role.js

@@ -2,21 +2,16 @@ import { AgentRole } from "./agent-role.js";
 import { buildRtkInstructions } from "../prompts/rtk-snippet.js";
 import { extractFirstJson } from "../utils/json-extract.js";
 import { section, buildPromptLayout, joinLayout, STABLE, VOLATILE } from "../prompts/prompt-layout.js";
+import { clipDiff } from "../prompts/diff-clip.js";
+import { buildSplitSignal } from "../prompts/split-signal.js";
 import { isMutationReviewEnabled, buildReviewerMutationSignal } from "../mutate/reviewer-signal.js";
 
-const MAX_DIFF_LENGTH = 12000;
-
 const SUBAGENT_PREAMBLE = [
   "IMPORTANT: You are running as a Karajan sub-agent.",
   "Do NOT ask about using Karajan, do NOT mention Karajan, do NOT suggest orchestration.",
   "Do NOT use any MCP tools. Focus only on reviewing the code."
 ].join(" ");
 
-function truncateDiff(diff) {
-  if (!diff) return "";
-  return diff.length > MAX_DIFF_LENGTH ? `${diff.slice(0, MAX_DIFF_LENGTH)}\n\n[TRUNCATED]` : diff;
-}
-
 export class ReviewerRole extends AgentRole {
   constructor(opts) {
     super({ ...opts, name: "reviewer" });
@@ -44,6 +39,10 @@ export class ReviewerRole extends AgentRole {
       enabled: isMutationReviewEnabled(),
       projectDir: this.config?.projectDir,
     });
+    // KJC-BUG-0134: a clip is declared as kj's own, outside the diff body.
+    const { body: clippedDiff, note: clipNote } = clipDiff(diff || "");
+    // KJC-BUG-0138: moved-lines correlation, computed on the FULL diff.
+    const splitSignal = buildSplitSignal(diff || "");
     const layout = buildPromptLayout([
       section(SUBAGENT_PREAMBLE, STABLE),
       section(this.instructions, STABLE),
@@ -56,7 +55,9 @@ export class ReviewerRole extends AgentRole {
       section(buildRtkInstructions({ rtkAvailable: Boolean(this.config?.rtk?.available) }), STABLE),
       section(reviewRules ? `Review rules:\n${reviewRules}` : null, STABLE),
       section(`Task context:\n${task}`, VOLATILE),
-      section(`Git diff:\n${truncateDiff(diff)}`, VOLATILE),
+      section(`Git diff:\n${clippedDiff}`, VOLATILE),
+      section(clipNote, VOLATILE),
+      section(splitSignal, VOLATILE),
       section(mutationSignal, VOLATILE),
     ]);
     return { prompt: joinLayout(layout), stablePrompt: layout.stable, volatilePrompt: layout.volatile };

package/src/sonar/scanner.js

@@ -47,13 +47,17 @@ export function buildScannerOpts(projectKey, scanner = {}) {
     opts.push(`-Dsonar.javascript.lcov.reportPaths=${scanner.javascript_lcov_report_paths}`);
   }
   const rules = scanner.disabled_rules || [];
-  rules.forEach((rule, i) => {
-    opts.push(
-      `-Dsonar.issue.ignore.multicriteria=e${i + 1}`,
-      `-Dsonar.issue.ignore.multicriteria.e${i + 1}.ruleKey=${rule}`,
-      `-Dsonar.issue.ignore.multicriteria.e${i + 1}.resourceKey=**/*`
-    );
-  });
+  if (rules.length > 0) {
+    // KJC-BUG-0139: the list property is declared ONCE — one `multicriteria=`
+    // per rule was last-wins, silently un-ignoring every rule but the final one.
+    opts.push(`-Dsonar.issue.ignore.multicriteria=${rules.map((_, i) => `e${i + 1}`).join(",")}`);
+    rules.forEach((rule, i) => {
+      opts.push(
+        `-Dsonar.issue.ignore.multicriteria.e${i + 1}.ruleKey=${rule}`,
+        `-Dsonar.issue.ignore.multicriteria.e${i + 1}.resourceKey=**/*`
+      );
+    });
+  }
   return opts.join(" ");
 }
 

package/src/tournament/crown.js

@@ -0,0 +1,88 @@
+/**
+ * tournament/crown — TOR-C (KJC-TSK-0725, epic KJC-PCS-0073). The last act:
+ * the tournament winner enters main THROUGH THE NORMAL DOOR, not around it.
+ *
+ * In the winner's still-alive lane: stage everything, run the real cross-AI
+ * review over the EXACT staged diff (verdict bound to its sha256, stored by
+ * the same verdict-store every commit uses), then commit — where the
+ * pre-commit gate validates that verdict like any other commit's. A
+ * rejected review ABORTS the coronation with the reasons: winning the
+ * tournament earns you a candidacy, not a bypass. Losers keep their full
+ * dossier under the tournament dir; their lanes are never removed here.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { runOneShotReview } from "../review/one-shot-review.js";
+
+const execFileAsync = promisify(execFile);
+
+const defaultExec = async (cmd, args, { cwd }) => {
+  const res = await execFileAsync(cmd, args, { cwd, maxBuffer: 64 * 1024 * 1024 });
+  return { exitCode: 0, stdout: res.stdout || "" };
+};
+
+async function defaultReview({ lane, task, config, logger }) {
+  const { stdout: diff } = await execFileAsync("git", ["diff", "--cached"], { cwd: lane, maxBuffer: 64 * 1024 * 1024 });
+  try {
+    const record = await runOneShotReview({
+      diff,
+      task: `Tournament winner review. Original task:\n${task}`,
+      config: { ...config, projectDir: lane },
+      logger,
+      projectDir: lane,
+    });
+    return { ok: record.verdict === "approved", ...record };
+  } catch (err) {
+    return { ok: false, verdict: "error", error: err.message };
+  }
+}
+
+/**
+ * Crown the judged winner: governed review + commit in its lane.
+ * @returns {Promise<{winner: string, branch: string, commit: string, verdict: object}>}
+ */
+export async function crownWinner({ tournamentDir, config = {}, logger = console, cardRef = null, deps = {} }) {
+  const { execFn = defaultExec, reviewFn = defaultReview } = deps;
+
+  const judgementPath = path.join(tournamentDir, "judgement.json");
+  if (!fs.existsSync(judgementPath)) {
+    throw new Error("tournament: no hay judgement.json — corre primero kj tournament --judge <id>");
+  }
+  const judgement = JSON.parse(fs.readFileSync(judgementPath, "utf8"));
+  const summary = JSON.parse(fs.readFileSync(path.join(tournamentDir, "summary.json"), "utf8"));
+  const winner = judgement.winner;
+  const meta = JSON.parse(fs.readFileSync(path.join(tournamentDir, winner, "meta.json"), "utf8"));
+  const lane = meta.lane;
+  if (!lane || !fs.existsSync(lane)) {
+    throw new Error(`tournament: el carril del ganador (${winner}) ya no existe — corona justo después de juzgar, antes de limpiar carriles`);
+  }
+
+  logger?.info?.(`coronando a ${winner} en ${meta.branch} — por la puerta normal, no por un atajo`);
+  await execFn("git", ["add", "-A"], { cwd: lane });
+
+  const verdict = await reviewFn({ lane, task: summary.task, config, logger });
+  if (!verdict?.ok) {
+    const issues = (verdict?.issues || []).map((i) => `  - ${i.description}`).join("\n");
+    throw new Error(
+      `tournament: la review RECHAZÓ al ganador (${winner}) — ganar el torneo da candidatura, no bypass.\n${issues || verdict?.error || ""}`
+    );
+  }
+
+  const ref = cardRef ? ` (${cardRef})` : "";
+  const msg = `feat(tournament): crown ${winner} — ${String(summary.task).slice(0, 50).toLowerCase()}${ref} [${summary.id}]`;
+  await execFn("git", ["commit", "-m", msg], { cwd: lane });
+  const { stdout } = await execFn("git", ["rev-parse", "HEAD"], { cwd: lane });
+  const commit = stdout.trim();
+
+  const crown = {
+    winner, branch: meta.branch, commit,
+    verdict: { verdict: verdict.verdict, reviewer: verdict.reviewer, diffHash: verdict.diffHash },
+    crowned_at: new Date().toISOString(),
+  };
+  fs.writeFileSync(path.join(tournamentDir, "crown.json"), JSON.stringify(crown, null, 2));
+  logger?.info?.(`✓ coronado: ${winner} · commit ${commit.slice(0, 9)} en ${meta.branch} — la rama queda lista para PR`);
+  logger?.info?.("  los perdedores conservan su expediente en el dir del torneo; limpia carriles con kj worktree done cuando quieras");
+  return { winner, branch: meta.branch, commit, verdict: crown.verdict };
+}