karajan-code 4.17.0 → 4.19.0

package/README.md

@@ -75,6 +75,16 @@ Karajan **governs** any agent with git gates — the false green is structurally
 
 Synchronous blocking hooks exist today only in Claude Code. That makes the supported setup explicit: **to guarantee a harness that controls the LLM, use Claude Code as the host** — Claude writes, Codex reviews (a review subprocess needs no hooks), and a third CLI arbitrates when available. On any other host Karajan still governs at the full git-gate level and tells you which level is active — it never pretends a supervision it cannot enforce.
 
+With a declared `.karajan/policy.yml`, the policy layer enforces at three tiers, and which tier applies depends on the host:
+
+| Tier | Where | Requires | What it guarantees |
+|---|---|---|---|
+| **A — tool time** | Sentinel PreToolUse → `kj policy eval --strict` | Claude Code as host (synchronous hooks) | The rule fires BEFORE the damage; the acting agent's role travels in `KJ_POLICY_ROLE` |
+| **B — commit time** | `kj review --staged` / pre-commit → deny + evidentiary exceptions | Any host (the gate lives in git) | The violating diff never enters, no matter who wrote it or what host ran it |
+| **C — merge time** | `kj-policy.yml` CI workflow → `kj policy check --range --strict` | GitHub Actions (seeded by `kj harden`) | Covers a tampered local hook: the PR diff is re-checked against the same policy, merge-blocking |
+
+Tier B is the guarantee floor — hosts without hooks lose A, never B; C re-verifies both. Security-class rules and consumer defaults are non-exemptable at every tier: no escape, no arbitration, no grant.
+
 ## Headless mode
 
 The classic multiagent pipeline lives on for CI and automation: `kj run "<task>"` orchestrates coder/reviewer/tester subprocess roles unattended, with the same gates. Agents and CI pass `--non-interactive` (or `KJ_NON_INTERACTIVE=1`): safe gates auto-answer, FAIL findings stop the run with a real exit code. `kj advanced` lists the full surface. [Headless mode docs](https://karajancode.com/docs/v4/headless/).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.17.0",
+  "version": "4.19.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",
@@ -37,7 +37,8 @@
   "workspaces": [
     "packages/ai-trash",
     "packages/core",
-    "packages/hu-board"
+    "packages/hu-board",
+    "packages/governance"
   ],
   "imports": {
     "#utils/*": "./src/utils/*",
@@ -100,6 +101,7 @@
   },
   "dependencies": {
     "@babel/parser": "^7.29.7",
+    "@karajan-family/governance": "^0.1.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "better-sqlite3": "^12.10.0",
     "chokidar": "^5.0.0",

package/scripts/dual-publish.mjs

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+/**
+ * dual-publish (MIG-A, KJC-TSK-0751, épica KJC-PCS-0077, ADR 0004) — el
+ * MISMO contenido sale bajo dos nombres npm durante la migración al scope:
+ * karajan-code (legacy, publish normal) y @karajan-family/code (scoped).
+ *
+ * Uso:
+ *   node scripts/dual-publish.mjs --pack-only          # genera+verifica el tarball scoped
+ *   node scripts/dual-publish.mjs --publish --otp=XXX  # publica el scoped (tras publicar el legacy)
+ *
+ * El swap del name es EN SITIO con restauración en finally: un crash a mitad
+ * no deja el manifest renombrado. La verificación es el MISMO verify-pack
+ * (name-agnóstico desde la parte 1): empaqueta, instala aislado y corre kj.
+ * El PRIMER publish del scoped lo hace el usuario (cuenta karajan-family,
+ * security key); los siguientes van con la sesión normal.
+ */
+import { readFileSync, writeFileSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { join, dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const LEGACY_NAME = "karajan-code";
+export const SCOPED_NAME = "@karajan-family/code";
+
+/**
+ * Ejecuta `fn` con el manifest renombrado al scoped (+ publishConfig public,
+ * obligatorio para scoped) y lo RESTAURA byte a byte pase lo que pase.
+ */
+export async function withScopedName(repoRoot, fn) {
+  const pkgPath = join(repoRoot, "package.json");
+  const original = readFileSync(pkgPath, "utf8");
+  const pkg = JSON.parse(original);
+  if (pkg.name !== LEGACY_NAME) {
+    throw new Error(`dual-publish: el manifest dice "${pkg.name}" y solo se renombra desde ${LEGACY_NAME} — jamás a ciegas`);
+  }
+  // publishConfig se MERGEA, no se pisa (catch de codex): un registry/tag
+  // preexistente debe sobrevivir al publish scoped.
+  writeFileSync(pkgPath, `${JSON.stringify({ ...pkg, name: SCOPED_NAME, publishConfig: { ...pkg.publishConfig, access: "public" } }, null, 2)}\n`, "utf8");
+  try {
+    return await fn();
+  } finally {
+    writeFileSync(pkgPath, original, "utf8");
+  }
+}
+
+// argv[1] normalizado (catch de codex): node lo absolutiza hoy, pero el
+// guard no debe depender de ese detalle de implementación.
+const isMain = process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1]);
+if (isMain) {
+  const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
+  const args = process.argv.slice(2);
+  const publish = args.includes("--publish");
+  const otp = args.find((a) => a.startsWith("--otp="))?.slice(6);
+  await withScopedName(repoRoot, async () => {
+    console.log(`dual-publish: manifest → ${SCOPED_NAME} (temporal)`);
+    // La E2E real: empaqueta el scoped, instálalo aislado y corre kj.
+    execFileSync("node", [join(repoRoot, "scripts", "verify-pack.mjs")], { cwd: repoRoot, stdio: "inherit" });
+    if (publish) {
+      const pubArgs = ["publish", "--ignore-scripts", ...(otp ? [`--otp=${otp}`] : [])];
+      console.log(`dual-publish: npm ${pubArgs.join(" ").replace(/--otp=\S+/, "--otp=***")}`);
+      execFileSync("npm", pubArgs, { cwd: repoRoot, stdio: "inherit" });
+    } else {
+      console.log("dual-publish: --pack-only — verificado y SIN publicar (usa --publish en la release)");
+    }
+  });
+  console.log(`dual-publish: manifest restaurado a ${LEGACY_NAME} ✓`);
+}

package/scripts/verify-pack.mjs

@@ -27,6 +27,9 @@ import { fileURLToPath } from "node:url";
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const pkg = JSON.parse(fs.readFileSync(path.join(repoRoot, "package.json"), "utf8"));
 const expectedVersion = pkg.version;
+// MIG-A (KJC-TSK-0751): el nombre sale del manifest — el MISMO verify-pack
+// valida el tarball unscoped y el @karajan-family/* del dual-publish.
+const pkgName = pkg.name;
 
 // Subprocess env: strip CLAUDECODE (Claude Code blocks nested non-interactive
 // runs otherwise) and force a non-interactive, quiet npm.
@@ -54,13 +57,13 @@ let gTmp = null;
 let pnpmTmp = null;
 let qsTmp = null;
 try {
-  console.log(`verify-pack: packing karajan-code@${expectedVersion}…`);
+  console.log(`verify-pack: packing ${pkgName}@${expectedVersion}…`);
   // --json gives us the exact filename without parsing human output.
   const packOut = run("npm", ["pack", "--json", "--silent"], { cwd: repoRoot });
   const filename = JSON.parse(packOut)[0]?.filename;
   if (!filename) fail("npm pack did not report a filename", packOut);
-  // npm normalizes scoped names in --json but karajan-code is unscoped;
-  // the file lands in cwd under the reported name.
+  // npm --json reports the exact filename (scoped names normalized to
+  // scope-name-x.y.z.tgz); the file lands in cwd under that name.
   tgzPath = path.join(repoRoot, filename);
   if (!fs.existsSync(tgzPath)) fail(`packed tarball not found at ${tgzPath}`);
 
@@ -93,7 +96,7 @@ try {
   const { scanPaths, loadPrivacyList } = await import(
     path.join(repoRoot, "src", "privacy", "scan.js")
   );
-  const shippedDir = path.join(tmpDir, "node_modules", "karajan-code");
+  const shippedDir = path.join(tmpDir, "node_modules", ...pkgName.split("/"));
   const pFindings = scanPaths([shippedDir], { list: loadPrivacyList() });
   const pBlocks = pFindings.filter((f) => f.severity === "block");
   if (pBlocks.length > 0) {
@@ -265,7 +268,7 @@ try {
     );
   }
 
-  console.log(`\n✓ verify-pack: karajan-code@${expectedVersion} installs clean and runs.`);
+  console.log(`\n✓ verify-pack: ${pkgName}@${expectedVersion} installs clean and runs.`);
 } finally {
   if (tgzPath && fs.existsSync(tgzPath)) fs.rmSync(tgzPath, { force: true });
   if (tmpDir && fs.existsSync(tmpDir)) fs.rmSync(tmpDir, { recursive: true, force: true });

package/src/agents/claude-agent.js

@@ -365,6 +365,11 @@ export class ClaudeAgent extends BaseAgent {
   async _runTaskExec(task, model, _role) {
     const args = buildPromptArgs(task);
     if (model) args.push("--model", model);
+    // PL-C (KJC-TSK-0735): el rol del subproceso viaja en KJ_POLICY_ROLE —
+    // si su harness corre hooks (claude -p), el tier A evalúa la policy con
+    // el rol que ACTÚA. El rol del ORQUESTADOR es autoritativo: task.env no
+    // puede spoofearlo (catch de codex: sería un bypass de reglas por rol).
+    const roleEnv = task.role ? { ...task.env, KJ_POLICY_ROLE: task.role } : task.env;
 
     // Use stream-json when onOutput is provided to get real-time feedback
     if (task.onOutput) {
@@ -374,7 +379,7 @@ export class ClaudeAgent extends BaseAgent {
         onOutput: streamFilter,
         silenceTimeoutMs: task.silenceTimeoutMs,
         timeout: task.timeoutMs,
-        env: task.env,
+        env: roleEnv,
         cwd: task.cwd
       }));
       const raw = pickOutput(res);
@@ -385,7 +390,7 @@ export class ClaudeAgent extends BaseAgent {
 
     // Without streaming, use json output to get structured response via stderr
     args.push("--output-format", "json");
-    const res = await this.runCommand(resolveBin("claude"), args, cleanExecaOpts({ env: task.env, cwd: task.cwd }));
+    const res = await this.runCommand(resolveBin("claude"), args, cleanExecaOpts({ env: roleEnv, cwd: task.cwd }));
     const raw = pickOutput(res);
     const output = extractTextFromStreamJson(raw);
     const usage = extractUsageFromStreamJson(raw);

package/src/checks/guarantee-level.js

@@ -0,0 +1,38 @@
+/**
+ * Guarantee level en runtime (KJC-TSK-0756, hallazgo de campo de Pedro):
+ * la doctrina "kj jamás finge una supervisión que no puede aplicar" vivía
+ * solo en el README — ahora kj doctor la DECLARA para el host actual, con
+ * el porqué. El acoplamiento a Claude es UNA capa (tier A: hooks síncronos
+ * bloqueantes, que hoy solo ese harness expone) y es decisión de ADR
+ * (v4.13), no accidente; el tier B (git gates) es el suelo agnóstico.
+ */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { detectHostAgent } from "../utils/agent-detect.js";
+
+/** Pure: computes the three tiers from observable facts. */
+export function guaranteeLevel({ host, harnessWired, policyDeclared, policyWorkflow }) {
+  const tierA = host === "claude" && harnessWired
+    ? { active: true, reason: "Claude Code expone hooks síncronos bloqueantes y el harness del Sentinel está instalado (kj harden)" }
+    : host === "claude"
+      ? { active: false, reason: "host Claude sin harness instalado — corre kj harden para activar la supervisión en el turno" }
+      : { active: false, reason: `el host ${host ?? "desconocido"} no expone hooks síncronos bloqueantes — no se finge la supervisión; el tier B sigue siendo el suelo de garantía` };
+  const tierB = { active: true, reason: "los gates viven en el repositorio, no en el harness: cualquier host, el diff violador no entra" };
+  const tierC = policyDeclared && policyWorkflow
+    ? { active: true, reason: "kj-policy.yml re-verifica el PR contra la policy declarada (merge-blocking)" }
+    : policyDeclared
+      ? { active: false, reason: "hay policy declarada pero sin workflow de CI — corre kj harden para sembrar kj-policy.yml" }
+      : { active: false, reason: "sin .karajan/policy.yml declarada — el tier C solo existe donde hay policy que verificar" };
+  return { host: host ?? null, tierA, tierB, tierC };
+}
+
+/** Facts from disk + env; injectable for tests. */
+export function collectGuaranteeFacts({ projectDir = process.cwd(), deps = {} } = {}) {
+  const { detectHost = detectHostAgent, exists = existsSync } = deps;
+  return guaranteeLevel({
+    host: detectHost(),
+    harnessWired: exists(join(projectDir, ".karajan", "harness", "pretooluse-sentinel.mjs")),
+    policyDeclared: exists(join(projectDir, ".karajan", "policy.yml")),
+    policyWorkflow: exists(join(projectDir, ".github", "workflows", "kj-policy.yml")),
+  });
+}

package/src/cli/register-meta.js

@@ -27,6 +27,7 @@ import { huCommand } from "../commands/hu.js";
 import { worktreeCommand } from "../commands/worktree.js";
 import { addAdr, listAdrs } from "../environment/adr.js";
 import { formatAdvancedIndex } from "../commands/advanced.js";
+import { policyAddCommand } from "../policy/add.js";
 import { withConfig } from "./_shared.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
@@ -285,7 +286,7 @@ export function registerMeta(program, { pkgVersion }) {
     });
 
   // KJC-TSK-0733 PL-A — policy as code: motor determinista en modo warn.
-  const policyCmd = program.command("policy").description("Policy as code (.karajan/policy.yml, vocabulario cerrado) — PL-A: modo warn");
+  const policyCmd = program.command("policy").description("Policy as code (.karajan/policy.yml, vocabulario cerrado): eval/check deterministas, grant con caducidad, anchor del decision log — deny en commit y CI");
   policyCmd.command("eval")
     .description("Evalúa UNA tool call: imprime {decision, rule_id, reason}; --strict devuelve exit 2 en deny (contrato para adaptadores de hooks)")
     .option("--role <role>", "Rol del agente", "coder")
@@ -298,9 +299,39 @@ export function registerMeta(program, { pkgVersion }) {
         process.exitCode = await policyCommand({ action: "eval", config, flags });
       });
     });
+  policyCmd.command("grant")
+    .description("Concede una excepción PERMANENTE con caducidad a una regla NO-security: quién (identidad), regla exacta, justificación y hasta cuándo — GOV-B")
+    .option("--rule <rule_id>", "Regla exacta (p.ej. roles.coder.write.deny)")
+    .option("--until <iso>", "Caducidad ISO-8601 (p.ej. 2026-09-01T00:00:00Z)")
+    .option("--reason <text>", "Justificación escrita en el momento")
+    .action(async (flags) => {
+      await withConfig(pkgVersion, "policy-grant", flags, async ({ config }) => {
+        const { policyCommand } = await import("../commands/policy.js");
+        process.exitCode = await policyCommand({ action: "grant", config, flags });
+      });
+    });
+  policyCmd.command("add")
+    .description("Traduce una regla hablada al vocabulario cerrado de policy.yml — propone el diff y SOLO escribe con --yes (PL-C)")
+    .argument("<text...>", "La regla en lenguaje natural")
+    .option("--yes", "Aplicar el diff propuesto")
+    .action(async (textParts, flags) => {
+      await withConfig(pkgVersion, "policy-add", flags, async ({ config, logger }) => {
+        process.exitCode = await policyAddCommand({ text: textParts.join(" "), config, flags, logger });
+      });
+    });
+  policyCmd.command("anchor")
+    .description("Verifica la cadena del decision log y sella su head-hash en .karajan/policy-anchor.json (trackeado) — anclaje temporal en la historia de git, GOV-C2")
+    .action(async (flags) => {
+      await withConfig(pkgVersion, "policy-anchor", flags, async ({ config }) => {
+        const { policyCommand } = await import("../commands/policy.js");
+        process.exitCode = await policyCommand({ action: "anchor", config, flags });
+      });
+    });
   policyCmd.command("check")
-    .description("Comprueba el diff STAGED contra la policy (write-deny + invariantes) — siempre warn en PL-A; exit 1 solo si policy.yml es inválido")
+    .description("Comprueba el diff (staged, o base...head con --range) contra la policy — warn por defecto; --strict devuelve exit 2 si hay violación enforcement=deny (tier C, merge-blocking)")
     .option("--role <role>", "Rol del agente", "coder")
+    .option("--range <ref>", "Evalúa un rango git (p.ej. origin/main...HEAD) en vez del staged (CI)")
+    .option("--strict", "Exit 2 si hay violación con enforcement=deny")
     .option("--json", "Machine-readable")
     .action(async (flags) => {
       await withConfig(pkgVersion, "policy-check", flags, async ({ config }) => {

package/src/cli/register-roles-skills.js

@@ -1,5 +1,5 @@
 import { rolesCommand } from "../commands/roles.js";
-import { agentsCommand } from "../commands/agents.js";
+import { agentsCommand, ASSIGNABLE_ROLES, VALID_PROVIDERS } from "../commands/agents.js";
 import { withConfig } from "./_shared.js";
 
 /**
@@ -30,6 +30,22 @@ export function registerRolesSkills(program, { pkgVersion }) {
     .command("agents [subcommand] [role] [provider]")
     .description("List or change AI agent assignments per role (e.g. kj agents set coder gemini)")
     .option("--global", "Persist change to kj.config.yml (default for CLI)")
+    // KJC-TSK-0755: el --help enumera valores REALES (de las constantes, no
+    // duplicados a mano) — la firma genérica obligaba a preguntar.
+    .addHelpText("after", [
+      "",
+      "Subcommands:",
+      "  list (default)   Show the provider assigned to each role",
+      "  set              Change one: kj agents set <role> <provider>",
+      "",
+      `Roles:     ${ASSIGNABLE_ROLES.join(", ")}`,
+      `Providers: ${VALID_PROVIDERS.join(", ")}  (kj doctor shows which are installed)`,
+      "",
+      "Examples:",
+      "  kj agents                          # current assignments",
+      "  kj agents set reviewer codex",
+      "  kj agents set solomon agy --global",
+    ].join("\n"))
     .action(async (subcommand, role, provider, flags) => {
       await withConfig(pkgVersion, "agents", {}, async ({ config }) => {
         await agentsCommand({ config, subcommand: subcommand || "list", role, provider, global: flags.global });

package/src/commands/agents.js

@@ -1,12 +1,14 @@
 import { loadConfig, writeConfig, getConfigPath, getProjectConfigPath, loadProjectConfig, resolveRole } from "../config.js";
 import { checkBinary, KNOWN_AGENTS } from "../utils/agent-detect.js";
 
-const ASSIGNABLE_ROLES = [
+// Exportados para que el --help se autoalimente de las constantes reales
+// (KJC-TSK-0755, hallazgo de campo: la firma genérica obligaba a preguntar).
+export const ASSIGNABLE_ROLES = [
   "coder", "reviewer", "planner", "refactorer", "triage",
   "researcher", "tester", "security", "solomon"
 ];
 
-const VALID_PROVIDERS = KNOWN_AGENTS.map((a) => a.name);
+export const VALID_PROVIDERS = KNOWN_AGENTS.map((a) => a.name);
 
 export function listAgents(config, sessionOverrides = {}, projectConfig = null) {
   return ASSIGNABLE_ROLES.map((role) => {

package/src/commands/doctor.js

@@ -13,6 +13,7 @@
 
 import readline from "node:readline";
 import { runChecks as runCheckPipeline, toLegacyShape } from "../checks/runner.js";
+import { collectGuaranteeFacts } from "../checks/guarantee-level.js";
 import { STATUS } from "../checks/types.js";
 import { getSystemChecks } from "../checks/system.js";
 import { getConfigFileChecks } from "../checks/config-files.js";
@@ -140,16 +141,31 @@ export async function runChecks({ config }) {
  */
 export async function doctorCommand({ config, checkOnly = false, yes = false, json = false, verbose = false, projectOnly = false }) {
   const report = await runDoctor({ config, checkOnly, yes, projectOnly });
+  // KJC-TSK-0756 (campo, Pedro): el guarantee level del host actual se
+  // DECLARA en runtime — la doctrina no vive solo en el README.
+  report.guarantee = collectGuaranteeFacts({ projectDir: config?.projectDir || process.cwd() });
 
   if (json) {
     console.log(JSON.stringify(report, null, 2));
   } else {
     printHuman(report, { verbose });
+    printGuaranteeLevel(report.guarantee);
   }
 
   return hasBlockingFailure(report) ? 1 : 0;
 }
 
+// KJC-TSK-0756: la seccion de guarantee level — consola es el medio del
+// doctor (excepcion no-console de commands).
+function printGuaranteeLevel(g) {
+  const mark = (t) => (t.active ? "ACTIVE " : "OFF    ");
+  console.log();
+  console.log(`Guarantee level (host: ${g.host ?? "desconocido"}) — kj jamas finge una supervision que no puede aplicar:`);
+  console.log(`  ${mark(g.tierA)} A tool-time (Sentinel en el turno): ${g.tierA.reason}`);
+  console.log(`  ${mark(g.tierB)} B commit-time (git gates, el SUELO): ${g.tierB.reason}`);
+  console.log(`  ${mark(g.tierC)} C merge-time (re-check en CI): ${g.tierC.reason}`);
+}
+
 function hasBlockingFailure(report) {
   return report.checks.some((c) => c.status === STATUS.FAIL || c.status === STATUS.TIMEOUT);
 }

package/src/commands/policy.js

@@ -8,20 +8,28 @@
  */
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { createHash } from "node:crypto";
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 import { checkStagedDiff, evalToolCall, loadPolicy } from "../policy/engine.js";
+import { loadStandingExceptions, recordPolicyException } from "../policy/exceptions.js";
+import { verifyDecisionChain } from "@karajan-family/governance";
 
 const execFileAsync = promisify(execFile);
 
-async function stagedFacts(projectDir, gitFn) {
+async function stagedFacts(projectDir, gitFn, range = null) {
   const run =
     gitFn ||
     (async (args) => (await execFileAsync("git", args, { cwd: projectDir, maxBuffer: 16 * 1024 * 1024 })).stdout);
-  const files = (await run(["diff", "--cached", "--name-only"]))
+  // PL-C (KJC-TSK-0735): en CI no hay staged — con --range se evalúa
+  // base...head, el MISMO motor sobre el diff del PR (tier C del ADR 0001).
+  const base = range ? ["diff", range] : ["diff", "--cached"];
+  const files = (await run([...base, "--name-only"]))
     .split("\n")
     .map((s) => s.trim())
     .filter(Boolean);
   let net = 0;
-  for (const line of (await run(["diff", "--cached", "--numstat"])).split("\n")) {
+  for (const line of (await run([...base, "--numstat"])).split("\n")) {
     const [a, r] = line.trim().split(/\s+/);
     if (a && a !== "-") net += Number(a) || 0;
     if (r && r !== "-") net -= Number(r) || 0;
@@ -38,6 +46,83 @@ export async function policyCommand({ action, config = {}, flags = {}, logger =
     return 1;
   }
 
+  // GOV-C2 (KJC-TSK-0749): anclaje temporal sin blockchain — verificar la
+  // cadena ENTERA y sellar su head-hash en un fichero TRACKEADO por git:
+  // reescribir el log de ayer exige reescribir el repo de ayer. Un anchor
+  // previo con más entradas que el log actual = truncado ⇒ no se re-sella.
+  if (action === "anchor") {
+    let raw;
+    try {
+      raw = readFileSync(join(projectDir, ".karajan", "policy-decisions.jsonl"), "utf8");
+    } catch {
+      logger.info?.("policy anchor: sin decisiones que anclar — el log nace con el primer deny/excepción/commit-allow");
+      return 0;
+    }
+    const lines = raw.split("\n").filter((l) => l.trim());
+    // Fichero vacío o solo whitespace = sin decisiones (catch de codex:
+    // lines.at(-1) undefined reventaba el hash en vez de salir limpio).
+    if (lines.length === 0) {
+      logger.info?.("policy anchor: sin decisiones que anclar — el log nace con el primer deny/excepción/commit-allow");
+      return 0;
+    }
+    const chain = verifyDecisionChain(lines);
+    if (!chain.ok) {
+      logger.error?.(`✗ policy anchor: cadena rota en la entrada ${chain.at} (${chain.reason}) — el log ha sido manipulado; NO se sella`);
+      return 1;
+    }
+    const anchorFile = join(projectDir, ".karajan", "policy-anchor.json");
+    try {
+      const prev = JSON.parse(readFileSync(anchorFile, "utf8"));
+      if (Number.isFinite(prev.length) && prev.length > chain.length) {
+        logger.error?.(`✗ policy anchor: el log retrocede (anchor previo=${prev.length} entradas, actual=${chain.length}) — truncado tras el último sello; NO se re-sella`);
+        return 1;
+      }
+    } catch { /* sin anchor previo (o ilegible): primer sello */ }
+    const head = createHash("sha256").update(lines.at(-1), "utf8").digest("hex");
+    writeFileSync(anchorFile, `${JSON.stringify({ head, length: chain.length, ts: new Date().toISOString() }, null, 2)}\n`, "utf8");
+    logger.info?.(`✓ policy anchor: cadena íntegra (${chain.length} decisiones) — head ${head.slice(0, 12)} sellado en .karajan/policy-anchor.json; committéalo para anclarlo en la historia de git`);
+    return 0;
+  }
+
+  // GOV-B (KJC-TSK-0746): conceder una excepción PERMANENTE con el modelo
+  // probatorio completo — quién (identidad), regla exacta, justificación en
+  // el momento y caducidad obligatoria. Los defaults.* del consumidor son
+  // inexcepcionables: no se conceden ni desde aquí.
+  if (action === "grant") {
+    const { rule, until, reason } = flags;
+    if (!rule || !until || !reason?.trim()) {
+      logger.error?.("policy grant: --rule, --until (ISO) y --reason son obligatorios — una excepción sin quién/por qué/hasta cuándo no es una excepción, es un agujero");
+      return 1;
+    }
+    // Inexcepcionable = inexcepcionable TAMBIÉN al conceder (catch de codex):
+    // defaults.*, cualquier cap con class security, y una policy inválida
+    // (sin policy legible no se puede probar que la regla NO es security).
+    const m = /^roles\.([^.]+)\.(write|shell)/.exec(rule);
+    if (rule.startsWith("defaults.") || errors.length > 0 || (m && policy.roles?.[m[1]]?.[m[2]]?.class === "security")) {
+      logger.error?.(`policy grant: "${rule}" es inexcepcionable (default del proyecto o clase security) o la policy no es verificable — no se concede, ni con razón`);
+      return 1;
+    }
+    try {
+      // GOV-E (KJC-TSK-0750, idea del lector): la renovación es SEÑAL — una
+      // regla re-concedida N veces es la política real pidiendo que la
+      // cambien por su cauce. Se cuenta contra TODAS las permanentes previas
+      // (vencidas incluidas: precisamente esas son la sedimentación).
+      const previous = loadStandingExceptions(projectDir).standing.filter((e) => e.rule_id === rule).length;
+      const rec = recordPolicyException({
+        projectDir,
+        entry: { rule_id: rule, justification: reason.trim(), scopeKind: "permanente", expiresAt: until },
+      });
+      logger.info?.(`✓ excepción permanente registrada: [${rec.rule_id}] hasta ${rec.expiresAt} — concedida por ${rec.who?.git ?? "?"} (${rec.who?.grade ?? "?"})`);
+      if (previous >= 1) {
+        logger.warn?.(`⚠ ${previous + 1}ª concesión sobre esta regla — una excepción que se renueva ya no es una excepción: considera cambiar la política por su cauce (PR a .karajan/policy.yml)`);
+      }
+      return 0;
+    } catch (err) {
+      logger.error?.(`policy grant: ${err.message}`);
+      return 1;
+    }
+  }
+
   if (action === "eval") {
     let input;
     try {
@@ -51,20 +136,29 @@ export async function policyCommand({ action, config = {}, flags = {}, logger =
     return verdict.decision === "deny" && flags.strict ? 2 : 0;
   }
 
-  // check — sobre el diff staged (único modo en PL-A), SIEMPRE warn.
-  const facts = await stagedFacts(projectDir, deps.gitFn);
+  // check — staged por defecto, base...head con --range (CI). Warn salvo
+  // --strict (PL-C): con --strict, una violación enforcement=deny devuelve
+  // exit 2 nombrando la regla — el contrato merge-blocking del tier C.
+  const facts = await stagedFacts(projectDir, deps.gitFn, flags.range || null);
   const violations = checkStagedDiff(policy, { role: flags.role || "coder", ...facts });
+  const hard = flags.strict ? violations.filter((v) => v.enforcement === "deny") : [];
   if (flags.json) {
-    logger.info?.(JSON.stringify({ mode: "warn", violations }));
-    return 0;
+    logger.info?.(JSON.stringify({ mode: flags.strict ? "strict" : "warn", violations }));
+    return hard.length > 0 ? 2 : 0;
   }
   if (violations.length === 0) {
     logger.info?.("policy check: limpio");
     return 0;
   }
   for (const v of violations) {
-    logger.warn?.(`⚠ policy [${v.rule_id}] ${v.reason}${v.file ? ` (${v.file})` : ""}`);
+    const where = v.file ? ` (${v.file})` : "";
+    const mark = flags.strict && v.enforcement === "deny" ? "✗" : "⚠";
+    logger.warn?.(`${mark} policy [${v.rule_id}] ${v.reason}${where}`);
+  }
+  if (hard.length > 0) {
+    logger.error?.(`policy check: ${hard.length} violación(es) con enforcement=deny — el merge no procede (--strict)`);
+    return 2;
   }
-  logger.warn?.(`policy check: ${violations.length} aviso(s) — modo warn (PL-A): no bloquea; PL-B le dará dientes`);
+  logger.warn?.(`policy check: ${violations.length} aviso(s) — check es modo warn, no bloquea; los deny los aplican kj review --staged y el pre-commit (PL-B)`);
   return 0;
 }