karajan-code 4.20.1 → 4.22.0

package/src/claims/cross-check.js

@@ -0,0 +1,81 @@
+/**
+ * Crossing what was said against what actually ran (CLM-A, KJC-TSK-0801).
+ *
+ * The transcript is the register of sources: every command, query and read left
+ * its output there, so nothing has to be annotated by hand. A datum that appears
+ * in some output is BACKED; one that appears nowhere came out of the model's
+ * memory (UNBACKED); one whose own source says otherwise is DENIED — and that
+ * is the only verdict that blocks, because it is a proven hallucination and not
+ * a suspicion.
+ *
+ * What cannot be decided is NOT_CHECKABLE, never an accusation: a guard that
+ * cries wolf gets switched off (KJC-PCS-0082).
+ */
+import { extractClaims } from "./extract.js";
+
+export const BACKED = "backed";
+export const UNBACKED = "unbacked";
+export const DENIED = "denied";
+export const NOT_CHECKABLE = "not_checkable";
+
+const norm = (s) => String(s ?? "").toLowerCase();
+const escape = (s) => s.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/**
+ * Numbers must match as WHOLE tokens: searching "4" as a substring finds it inside "24.6 kB"
+ * and backs a figure nobody measured. Found while running this over a real message — the
+ * synthetic tests had passed. Ids, paths and versions are distinctive enough as substrings.
+ */
+function appearsIn(output, claim) {
+  const needle = norm(claim.value);
+  if (claim.kind === "path" || claim.kind === "card" || claim.kind === "version") return output.includes(needle);
+  return new RegExp(`(?<![\\w.])${escape(needle)}(?![\\w.])`).test(output);
+}
+
+/** "no cards", "[]", "0 results" — a source that positively states emptiness. */
+const SAYS_EMPTY = /(^|\W)(\[\]|\bnone\b|\bno results?\b|\bempty\b|\b0 (results?|items?|matches|cards?|files?)\b)/i;
+
+/**
+ * @param {{text: string, outputs: string[], userSaid?: string}} input
+ *   outputs: tool outputs of the turn, in order. userSaid: what the user wrote (also a source).
+ * @returns {{claims: Array<object>, denied: Array<object>, unbacked: Array<object>}}
+ */
+export function crossCheck({ text, outputs = [], userSaid = "" }) {
+  const haystack = [...outputs.map(norm), norm(userSaid)];
+  const claims = extractClaims(text).map((claim) => ({ ...claim, status: verdictFor(claim, haystack) }));
+  return {
+    claims,
+    denied: claims.filter((c) => c.status === DENIED),
+    unbacked: claims.filter((c) => c.status === UNBACKED),
+  };
+}
+
+function verdictFor(claim, haystack) {
+  if (haystack.some((h) => appearsIn(h, claim))) return BACKED;
+
+  // A count stated as non-zero while every source that mentions the same noun says empty:
+  // that is the "four cards are waiting" case, and it is the one that blocks.
+  if (claim.kind === "count" && Number(claim.value) > 0) {
+    const noun = nounAfterCount(claim.sentence, claim.value);
+    if (noun) {
+      const mentions = haystack.filter((h) => h.includes(norm(noun)));
+      if (mentions.length && mentions.every((h) => SAYS_EMPTY.test(h))) return DENIED;
+    }
+    // Small numbers are prose as often as data ("las dos capas", "3 reglas"): not worth accusing.
+    if (Number(claim.value) <= 3) return NOT_CHECKABLE;
+  }
+  return UNBACKED;
+}
+
+function nounAfterCount(sentence, value) {
+  const m = new RegExp(`${value}\\s+([a-zá-ú]{4,})`, "i").exec(sentence);
+  return m ? m[1] : null;
+}
+
+/** One human line per problem; the message is what makes a guard usable. */
+export function formatClaimReport({ denied, unbacked }) {
+  const lines = [];
+  for (const c of denied) lines.push(`✗ "${c.value}" (${c.kind}) is DENIED by the output that should back it — ${c.sentence.slice(0, 100)}`);
+  for (const c of unbacked) lines.push(`? "${c.value}" (${c.kind}) has no backing in this turn — verify it or say it is from memory`);
+  return lines.join("\n");
+}

package/src/claims/extract.js

@@ -0,0 +1,56 @@
+/**
+ * Hard data in what the AI says (CLM-A, KJC-TSK-0801, ADR "claims with evidence").
+ *
+ * A model states an invented figure with the same confidence as a measured one,
+ * and that figure travels to a PR, a card, another session or the user, where
+ * nobody checks it again. This module pulls the CHECKABLE data out of a text —
+ * counts, versions, file paths, card ids, commit SHAs — so it can be crossed
+ * against what actually ran. Prose is left alone: only data is verifiable.
+ *
+ * Deterministic and free: no model in the loop. Verifying must be cheaper than
+ * inventing, or nobody will verify.
+ */
+
+/** Sentences that ALREADY admit they are unverified are respected, never reported. */
+const HEDGES = /\b(de memoria|sin (comprobar|verificar)|no (lo )?he (comprobado|verificado)|creo que|puede que|quizá|quizás|probablemente|from memory|unverified|not checked|i think|probably)\b/i;
+
+// Most specific first: a number already claimed as a PR or a version is not also a bare count.
+// A number with no unit next to it (an OTP, a phone) is deliberately NOT a claim: it is not
+// verifiable from prose, and some of them are secrets that must never travel into a report.
+const PATTERNS = [
+  { kind: "card", re: /\b([A-Z]{3}-(?:TSK|BUG|PCS|SPR|PLA|PRP)-\d{4})\b/g, value: (m) => m[1] },
+  { kind: "path", re: /\b((?:[\w.-]+\/){1,}[\w.-]+\.\w{1,5})\b/g, value: (m) => m[1] },
+  { kind: "version", re: /\bv?(\d+\.\d+\.\d+(?:-[\w.]+)?)\b/g, value: (m) => m[1] },
+  { kind: "pr", re: /(?:^|[\s(])#(\d{2,6})\b/g, value: (m) => m[1] },
+  { kind: "sha", re: /\b([0-9a-f]{7,40})\b/g, value: (m) => m[1] },
+  // A number that means something: "1004 ficheros", "8 ocurrencias", "53 tests".
+  { kind: "count", re: /\b(\d[\d.,]*)\s+(?=[a-záéíóúñ]{3,})/gi, value: (m) => m[1].replaceAll(".", "").replaceAll(",", "") },
+];
+
+/** Splits into sentences so a hedge only covers what it is attached to. */
+const sentences = (text) => String(text || "").split(/(?<=[.!?\n])\s+/).filter(Boolean);
+
+/**
+ * @param {string} text
+ * @returns {Array<{kind: string, value: string, sentence: string}>} unique claims, in order.
+ */
+export function extractClaims(text) {
+  const out = [];
+  const seen = new Set();
+  for (const sentence of sentences(text)) {
+    if (HEDGES.test(sentence)) continue; // saying "I did not check" is the behaviour to encourage
+    const claimedHere = new Set();
+    for (const { kind, re, value } of PATTERNS) {
+      for (const m of sentence.matchAll(re)) {
+        const v = value(m);
+        if (claimedHere.has(v)) continue; // already claimed as something more specific
+        claimedHere.add(v);
+        const key = `${kind}:${v}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        out.push({ kind, value: v, sentence: sentence.trim() });
+      }
+    }
+  }
+  return out;
+}

package/src/claims/turn.js

@@ -0,0 +1,54 @@
+/**
+ * Reading one turn out of the transcript (CLM-B, KJC-TSK-0802).
+ *
+ * The transcript is the register of sources: what the AI finally said, what the
+ * user asked, and every tool output in between. Nothing is annotated by hand —
+ * this just reads what the session already wrote.
+ *
+ * A turn = from the user's last real message to the end. A "user" entry whose
+ * content is a tool_result is NOT the user talking: it is the machine answering.
+ */
+import { readFileSync } from "node:fs";
+
+const MAX_OUTPUT = 20_000; // a single huge output must not eat the whole check
+const blocks = (entry) => {
+  const c = entry?.message?.content;
+  return Array.isArray(c) ? c : typeof c === "string" ? [{ type: "text", text: c }] : [];
+};
+const isToolResult = (entry) => blocks(entry).some((b) => b.type === "tool_result");
+const textOf = (value) =>
+  typeof value === "string" ? value : Array.isArray(value) ? value.map((b) => b?.text ?? "").join("\n") : String(value ?? "");
+
+/** Parses the JSONL, ignoring lines that are not valid JSON (a partial write must not throw). */
+export function readEntries(path) {
+  const out = [];
+  for (const line of readFileSync(path, "utf8").split("\n")) {
+    if (!line.trim()) continue;
+    try { out.push(JSON.parse(line)); } catch { /* a half-written line is not a reason to fail */ }
+  }
+  return out;
+}
+
+/**
+ * @param {string} path transcript_path given by the hook
+ * @returns {{text: string, outputs: string[], userSaid: string}}
+ *   text: what the AI says at the end of the turn (its final prose, no thinking).
+ */
+export function readTurn(path) {
+  const entries = readEntries(path);
+  const startedAt = entries.findLastIndex((e) => e.type === "user" && !isToolResult(e));
+  const turn = startedAt >= 0 ? entries.slice(startedAt) : entries;
+
+  const userSaid = startedAt >= 0 ? textOf(entries[startedAt]?.message?.content) : "";
+  const outputs = [];
+  for (const entry of turn) {
+    for (const b of blocks(entry)) {
+      if (b.type === "tool_result") outputs.push(textOf(b.content).slice(0, MAX_OUTPUT));
+    }
+  }
+  // The final message is the last assistant entry that actually says something
+  // (one with tool_use only is the AI working, not the AI reporting).
+  const finals = turn.filter((e) => e.type === "assistant" && blocks(e).some((b) => b.type === "text" && b.text?.trim()));
+  const text = finals.length ? blocks(finals.at(-1)).filter((b) => b.type === "text").map((b) => b.text).join("\n") : "";
+  return { text, outputs, userSaid };
+}

package/src/cli/advanced-commands.js

@@ -30,8 +30,8 @@ export const ADVANCED_GROUPS = [
   { title: "Pipeline (piezas sueltas)", commands: ["autorun", "code", "review", "solomon", "agent", "scan", "tournament"] },
   { title: "Análisis pre-run", commands: ["discover", "triage", "researcher", "architect", "onboard", "brief"] },
   { title: "Búsqueda / RAG", commands: ["rag", "qmd", "watch"] },
-  { title: "Calidad / auditoría", commands: ["audit", "check", "mutate", "webperf", "sonar", "privacy", "release", "policy"] },
-  { title: "Sesión / board", commands: ["resume", "report", "board", "hu", "adr", "worktree", "undo", "standby", "sentinel"] },
+  { title: "Calidad / auditoría", commands: ["audit", "check", "mutate", "webperf", "sonar", "privacy", "release", "policy", "claims"] },
+  { title: "Sesión / board", commands: ["resume", "report", "board", "hu", "adr", "worktree", "undo", "standby", "sentinel", "identity"] },
   { title: "Infra / setup", commands: ["install-tools", "ollama", "skills", "roles", "agents", "env"] },
   { title: "Mantenimiento", commands: ["clean", "sync", "telemetry", "report-issue"] },
 ];

package/src/cli/register-meta.js

@@ -4,6 +4,9 @@ import { researcherCommand } from "../commands/researcher.js";
 import { architectCommand } from "../commands/architect.js";
 import { onboardCommand } from "../commands/onboard.js";
 import { startCommand } from "../commands/start.js";
+import { identityCommand } from "../commands/identity.js";
+import { policyCommand } from "../commands/policy.js";
+import { claimsCommand } from "../commands/claims.js";
 import { ragIndexCommand, ragQueryCommand, ragInstallHooksCommand, ragEvalCommand } from "../commands/rag.js";
 import { qmdQueryCommand } from "../commands/qmd.js";
 import { ragMcpCommand } from "../commands/rag-mcp.js";
@@ -120,6 +123,30 @@ export function registerMeta(program, { pkgVersion }) {
       });
     });
 
+  // IDN-A (KJC-TSK-0762, epic KJC-PCS-0079): identity lock per clone.
+  const identityCmd = program
+    .command("identity")
+    .description("Identity lock: which gh account and git email this clone is worked with (.karajan/identity.local.yml, never tracked)");
+  identityCmd
+    .command("show", { isDefault: true })
+    .description("Declared identity vs the active one (exit 2 on mismatch or when undeclared)")
+    .action(async (flags) => {
+      await withConfig(pkgVersion, "identity-show", flags, async ({ config }) => {
+        process.exitCode = await identityCommand({ action: "show", config, flags });
+      });
+    });
+  identityCmd
+    .command("set")
+    .description("Declare this clone's identity from the active gh session and git config (or --gh/--email)")
+    .option("--gh <user>", "gh account to bind")
+    .option("--email <email>", "git email to bind")
+    .option("--yes", "Do not ask for confirmation")
+    .action(async (flags) => {
+      await withConfig(pkgVersion, "identity-set", flags, async ({ config }) => {
+        process.exitCode = await identityCommand({ action: "set", config, flags });
+      });
+    });
+
   program
     .command("start")
     .description("Single entry point: assess the project and recommend the next step")
@@ -286,6 +313,14 @@ export function registerMeta(program, { pkgVersion }) {
     });
 
   // KJC-TSK-0733 PL-A — policy as code: motor determinista en modo warn.
+  // CLM-B (KJC-TSK-0802): the data the AI states, checked against what actually ran.
+  program.command("claims").description("Afirmaciones con fuente: comprueba los datos que la IA afirma en un turno contra las salidas de ese turno (ADR claims-with-evidence)")
+    .command("check")
+    .description("Cruza el mensaje final del turno con sus salidas — exit 2 solo si un dato está DESMENTIDO por su propia fuente; falla abierto si no puede leer el transcript")
+    .requiredOption("--transcript <path>", "Ruta del transcript de la sesión (la que pasa el hook)")
+    .option("--json", "Machine-readable")
+    .action(async (flags) => { process.exitCode = await claimsCommand({ flags }); });
+
   const policyCmd = program.command("policy").description("Policy as code (.karajan/policy.yml, vocabulario cerrado): eval/check deterministas, grant con caducidad, anchor del decision log — deny en commit y CI");
   policyCmd.command("eval")
     .description("Evalúa UNA tool call: imprime {decision, rule_id, reason}; --strict devuelve exit 2 en deny (contrato para adaptadores de hooks)")
@@ -295,7 +330,6 @@ export function registerMeta(program, { pkgVersion }) {
     .option("--strict", "Exit 2 si deny")
     .action(async (flags) => {
       await withConfig(pkgVersion, "policy-eval", flags, async ({ config }) => {
-        const { policyCommand } = await import("../commands/policy.js");
         process.exitCode = await policyCommand({ action: "eval", config, flags });
       });
     });
@@ -306,7 +340,6 @@ export function registerMeta(program, { pkgVersion }) {
     .option("--reason <text>", "Justificación escrita en el momento")
     .action(async (flags) => {
       await withConfig(pkgVersion, "policy-grant", flags, async ({ config }) => {
-        const { policyCommand } = await import("../commands/policy.js");
         process.exitCode = await policyCommand({ action: "grant", config, flags });
       });
     });
@@ -323,10 +356,27 @@ export function registerMeta(program, { pkgVersion }) {
     .description("Verifica la cadena del decision log y sella su head-hash en .karajan/policy-anchor.json (trackeado) — anclaje temporal en la historia de git, GOV-C2")
     .action(async (flags) => {
       await withConfig(pkgVersion, "policy-anchor", flags, async ({ config }) => {
-        const { policyCommand } = await import("../commands/policy.js");
         process.exitCode = await policyCommand({ action: "anchor", config, flags });
       });
     });
+  policyCmd.command("seal")
+    .description("Sella en el decision log un escape KJ_ALLOW_* usado en tool-time (exempt, chokepoint=tool, identidad declarada del clon) — lo invoca el Sentinel, GOV-F")
+    .requiredOption("--escape <name>", "Escape usado (p.ej. KJ_ALLOW_BOARD)")
+    .option("--tool <tool>", "Tool que lo usó (Bash, Edit…)")
+    .action(async (flags) => {
+      await withConfig(pkgVersion, "policy-seal", flags, async ({ config }) => {
+        process.exitCode = await policyCommand({ action: "seal", config, flags });
+      });
+    });
+  policyCmd.command("report")
+    .description("Informe determinista del decision log y las concesiones: avisos/denegaciones/exenciones por regla, denegaciones abiertas, concesiones vivas/vencidas/renovadas y señales — cadena rota = exit 1 (PL-E)")
+    .option("--soon <days>", "Días para considerar una concesión 'próxima a vencer'", "7")
+    .option("--json", "Machine-readable")
+    .action(async (flags) => {
+      await withConfig(pkgVersion, "policy-report", flags, async ({ config }) => {
+        process.exitCode = await policyCommand({ action: "report", config, flags });
+      });
+    });
   policyCmd.command("check")
     .description("Comprueba el diff (staged, o base...head con --range) contra la policy — warn por defecto; --strict devuelve exit 2 si hay violación enforcement=deny (tier C, merge-blocking)")
     .option("--role <role>", "Rol del agente", "coder")
@@ -335,7 +385,6 @@ export function registerMeta(program, { pkgVersion }) {
     .option("--json", "Machine-readable")
     .action(async (flags) => {
       await withConfig(pkgVersion, "policy-check", flags, async ({ config }) => {
-        const { policyCommand } = await import("../commands/policy.js");
         process.exitCode = await policyCommand({ action: "check", config, flags });
       });
     });
@@ -574,9 +623,10 @@ export function registerMeta(program, { pkgVersion }) {
 
   program
     .command("board [action]")
-    .description("Manage HU Board (start|stop|status|open|cleanup)")
+    .description("Manage HU Board (start|stop|status|open|cleanup) — SIN acción arranca un servidor persistente en segundo plano (equivale a `start`)")
     .option("--port <number>", "Port (default: 4000)", "4000")
     .option("--bind <host>", "Bind host (default: 127.0.0.1; use 0.0.0.0 to expose on LAN — token auth auto-enforced)")
+    .option("--force", "Arranca aunque hu_board.enabled sea false en kj.config.yml")
     .action(async (action = "start", opts) => {
       await withConfig(pkgVersion, "board", opts, async ({ config, logger }) => {
         // KJC-TSK-0684 (issue #1287): an external board is the source of
@@ -587,6 +637,21 @@ export function registerMeta(program, { pkgVersion }) {
           console.log(`⚠ this project's board lives in ${name} (state_backend: external) — kj does not run a parallel HU Board here.`);
           return;
         }
+        // KJC-BUG-0152 (issue #1427): `kj board` with no action starts a persistent server.
+        // Doing that while hu_board.enabled is false contradicts kj doctor, which reports the
+        // board as skipped — two commands saying opposite things about the same config. The
+        // system works or fails loudly; it never does the opposite of what the config says.
+        // Only `start` is gated (the bare command defaults to it): stop, status, cleanup and open
+        // never bring a server up, and blocking them would take away the way to tidy up.
+        if (config?.hu_board?.enabled === false && !opts.force && action === "start") {
+          logger.error(
+            `hu_board.enabled es false en kj.config.yml — no arranco el HU Board (kj doctor ya lo reporta como omitido).\n` +
+            `  Para arrancarlo igualmente: kj board ${action} --force\n` +
+            `  Para dejarlo activado siempre: pon hu_board.enabled: true en kj.config.yml`
+          );
+          process.exitCode = 1;
+          return;
+        }
         const port = Number(opts.port) || config.hu_board?.port || 4000;
         const bind = opts.bind || config.hu_board?.bind || "127.0.0.1";
         await boardCommand({ action, port, bind, logger });

package/src/commands/claims.js

@@ -0,0 +1,41 @@
+/**
+ * `kj claims check --transcript <path>` (CLM-B, KJC-TSK-0802) — checks the data
+ * the AI states in a turn against what actually ran in that same turn.
+ *
+ * Deterministic and free: no model in the loop. Exit 2 only when a datum is
+ * DENIED by its own source — a proven hallucination. Everything else is
+ * reported, per the accepted ADR: inform always, block almost never.
+ *
+ * It fails OPEN. A verifier that cannot read the transcript says so and gets out
+ * of the way: a broken check must never hold a session hostage.
+ */
+import { readTurn } from "../claims/turn.js";
+import { crossCheck, formatClaimReport } from "../claims/cross-check.js";
+
+export async function claimsCommand({ flags = {}, logger = console, readTurnFn = readTurn } = {}) {
+  const path = flags.transcript;
+  if (!path) {
+    logger.error("kj claims check: --transcript <path> is required");
+    return 1;
+  }
+  let turn;
+  try {
+    turn = readTurnFn(path);
+  } catch (err) {
+    // Not observable: the transcript could not be read. Never reported as clean.
+    const note = `kj claims: transcript not readable (${err.message}) — nothing checked`;
+    if (flags.json) logger.log(JSON.stringify({ ok: true, checked: false, reason: note }));
+    else logger.error(note);
+    return 0;
+  }
+
+  const result = crossCheck(turn);
+  if (flags.json) {
+    logger.log(JSON.stringify({ ok: true, checked: true, denied: result.denied, unbacked: result.unbacked, claims: result.claims.length }));
+  } else if (result.denied.length || result.unbacked.length) {
+    logger.error(formatClaimReport(result));
+  } else {
+    logger.log(`kj claims: ${result.claims.length} dato(s) comprobado(s), todos con respaldo en este turno`);
+  }
+  return result.denied.length ? 2 : 0;
+}

package/src/commands/harden.js

@@ -23,6 +23,7 @@ import { installSentinelHooks } from "../harden/sentinel-hooks.js";
 import { detectStackRoots } from "../harden/stack-roots.js";
 import { installWorkflows } from "../harden/workflow-engine.js";
 import { detectTestFramework } from "../utils/project-detect.js";
+import { ensureIdentity } from "../identity/bootstrap.js";
 
 const JS_TEST_CMD = {
   vitest: "npx vitest run",
@@ -191,5 +192,12 @@ export async function hardenCommand({
   for (const w of out.workflows) logger.info?.(`  • ${w.file}: ${w.action}`);
   for (const g of out.guidelines) logger.info?.(`  • ${g.file}: ${g.action}`);
   if (!dryRun) logger.info?.("core.hooksPath set. Verify later with `kj check`.");
+  // IDN-A (KJC-TSK-0762): a hardened clone declares who works it. Captured
+  // only with a human confirming; headless runs get the pending command.
+  if (!dryRun) {
+    const id = await ensureIdentity({ projectDir, logger });
+    out.identity = id.declared ? id.identity : null;
+    if (id.pending) out.identityPending = id.pending;
+  }
   return out;
 }

package/src/commands/identity.js

@@ -0,0 +1,60 @@
+/**
+ * `kj identity show|set` (IDN-A, KJC-TSK-0762, epic KJC-PCS-0079).
+ *
+ *   show  — declared identity vs what is ACTIVE now; exit 2 on mismatch or
+ *           when nothing is declared (scriptable: the gate and hooks reuse it).
+ *   set   — capture the effective gh account + git email (or --gh/--email),
+ *           confirm on a TTY, write .karajan/identity.local.yml. Never invents:
+ *           no session and no flags → exit 1.
+ */
+
+import { readIdentity, writeIdentity } from "../identity/store.js";
+import { activeGhUser, effectiveGitEmail } from "../identity/detect.js";
+import { compareIdentity } from "../identity/compare.js";
+import { createWizard, isTTY } from "../utils/wizard.js";
+
+export async function identityCommand({ action = "show", config, flags = {}, deps = {} }) {
+  const projectDir = config?.projectDir || process.cwd();
+  const log = deps.log || console.log;
+  const tty = deps.isTTY || isTTY;
+  const detectOpts = { hostsPath: deps.hostsPath, gitFn: deps.gitFn };
+  const effective = {
+    gh_user: activeGhUser(detectOpts.hostsPath ? { hostsPath: detectOpts.hostsPath } : {}),
+    git_email: effectiveGitEmail(projectDir, detectOpts.gitFn ? { gitFn: detectOpts.gitFn } : {}),
+  };
+
+  if (action === "set") {
+    const candidate = { gh_user: flags.gh || effective.gh_user, git_email: flags.email || effective.git_email };
+    if (!candidate.gh_user || !candidate.git_email) {
+      log(`kj identity: cannot declare — gh account: ${candidate.gh_user ?? "no session"}, git email: ${candidate.git_email ?? "none"}. Log in / set git config, or pass --gh <user> --email <email>.`);
+      return 1;
+    }
+    if (tty() && !flags.yes) {
+      const wizard = (deps.makeWizard || createWizard)();
+      try {
+        const ok = await wizard.confirm(`Bind this clone to gh ${candidate.gh_user} / git ${candidate.git_email}?`, true);
+        if (!ok) { log("kj identity: not declared."); return 1; }
+      } finally { wizard.close(); }
+    } else if (!flags.gh || !flags.email) {
+      // Proven live on day one: the active gh session had been flipped by
+      // ANOTHER session, and --yes bound the clone to the wrong account.
+      // Binding without confirmation is allowed, but never silent.
+      log("kj identity: WARNING — binding the ACTIVE session as-is without confirmation (another session may have switched it); prefer --gh/--email explicitly and verify with `kj identity show`.");
+    }
+    writeIdentity(projectDir, candidate);
+    log(`kj identity: declared gh ${candidate.gh_user} / git ${candidate.git_email} → .karajan/identity.local.yml (ignored by git).`);
+    return 0;
+  }
+
+  const declared = readIdentity(projectDir);
+  const result = compareIdentity(declared, effective);
+  if (!declared) {
+    log("kj identity: no identity declared for this clone — run `kj identity set`.");
+    return 2;
+  }
+  const mark = (field) => (result.mismatches.some((m) => m.field === field) ? "DISTINTA" : "ACTIVA");
+  log(`gh_user    ${declared.gh_user}  [${mark("gh_user")}: ${effective.gh_user ?? "no session"}]`);
+  log(`git_email  ${declared.git_email}  [${mark("git_email")}: ${effective.git_email ?? "none"}]`);
+  for (const m of result.mismatches) log(`  → ${m.remedy}`);
+  return result.ok ? 0 : 2;
+}

package/src/commands/init.js

@@ -862,7 +862,7 @@ export async function initCommand({ logger, flags = {} }) {
       await installAiTrashHook(logger);
     } else {
       logger.warn("ai-trash kj-trash binary not found — destructive ops unprotected.");
-      logger.warn("  Install karajan-code globally (npm i -g karajan-code) so kj-trash is on PATH.");
+      logger.warn("  Install karajan-code globally (npm i -g @karajan-family/code) so kj-trash is on PATH.");
     }
   }
 

package/src/commands/policy.js

@@ -12,7 +12,10 @@ import { createHash } from "node:crypto";
 import { readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { checkStagedDiff, evalToolCall, loadPolicy } from "../policy/engine.js";
-import { loadStandingExceptions, recordPolicyException } from "../policy/exceptions.js";
+import { loadExceptionRecords, loadStandingExceptions, recordPolicyException } from "../policy/exceptions.js";
+import { buildPolicyReport } from "../policy/report.js";
+import { policyFileHash, recordGateDecision } from "../policy/decisions.js";
+import { readIdentity } from "../identity/store.js";
 import { verifyDecisionChain } from "@karajan-family/governance";
 
 const execFileAsync = promisify(execFile);
@@ -123,6 +126,39 @@ export async function policyCommand({ action, config = {}, flags = {}, logger =
     }
   }
 
+  // PL-E (KJC-TSK-0767): el informe — evidencia de proceso determinista
+  // sobre los dos jsonl. Cadena rota = exit 1: un informe sobre un log
+  // manipulado no es un informe. El resto es informativo (exit 0).
+  if (action === "report") {
+    let decisionLines = [];
+    try {
+      decisionLines = readFileSync(join(projectDir, ".karajan", "policy-decisions.jsonl"), "utf8").split("\n").filter((l) => l.trim());
+    } catch { /* sin decisiones aún: el informe lo dice con ceros */ }
+    const exc = loadExceptionRecords(projectDir);
+    const soonDays = Number(flags.soon ?? 7);
+    const report = buildPolicyReport({ decisionLines, exceptionRecords: exc.records, policy, soonDays: Number.isFinite(soonDays) ? soonDays : 7 });
+    if (flags.json) {
+      logger.info?.(JSON.stringify({ ...report, exceptions_discarded: exc.discarded }));
+      return report.chain.ok ? 0 : 1;
+    }
+    const { chain, decisions: d, rules, grants: g } = report;
+    if (chain.ok) logger.info?.(`✓ decision log: cadena íntegra (${chain.length} decisiones)`);
+    else logger.error?.(`✗ decision log: cadena rota en la entrada ${chain.at} (${chain.reason}) — el log ha sido manipulado`);
+    if (d.discarded > 0 || exc.discarded > 0) logger.warn?.(`⚠ líneas corruptas descartadas: ${d.discarded} en decisiones, ${exc.discarded} en excepciones`);
+    const cps = Object.entries(d.chokepoints).map(([k, v]) => `${k} ${v}`).join(" · ") || "ninguno";
+    logger.info?.(`decisiones: allow ${d.allow} · deny ${d.deny} · exempt ${d.exempt} · abiertas ${d.open} (chokepoints: ${cps})`);
+    logger.info?.(rules.length > 0 ? "reglas (ordenadas por fricción):" : "reglas: ninguna ha avisado ni denegado todavía");
+    for (const r of rules) {
+      const meta = [r.enforcement && `enforcement=${r.enforcement}`, r.class && `class=${r.class}`].filter(Boolean).join(" ");
+      logger.info?.(`  [${r.rule_id}] ${meta} — warn ${r.warns} · deny ${r.denies} · exempt ${r.exempts} · abiertas ${r.open}`);
+    }
+    logger.info?.(`concesiones: vivas ${g.alive.length} (próximas a vencer ${g.soon.length}) · vencidas ${g.expired.length} · puntuales ${g.point}`);
+    for (const e of g.alive) logger.info?.(`  [${e.rule_id}] hasta ${e.expiresAt} — ${e.who?.git ?? "?"}: ${e.justification ?? "sin justificación"}`);
+    logger.info?.(report.signals.length > 0 ? "señales:" : "señales: ninguna");
+    for (const s of report.signals) logger.warn?.(`  ⚠ ${s}`);
+    return chain.ok ? 0 : 1;
+  }
+
   if (action === "eval") {
     let input;
     try {
@@ -131,9 +167,54 @@ export async function policyCommand({ action, config = {}, flags = {}, logger =
       logger.error?.("policy eval: --input debe ser JSON válido");
       return 1;
     }
-    const verdict = evalToolCall(policy, { role: flags.role || "coder", tool: flags.tool, input, root: projectDir });
+    const role = flags.role || "coder";
+    const verdict = evalToolCall(policy, { role, tool: flags.tool, input, root: projectDir });
+    const strictDeny = verdict.decision === "deny" && Boolean(flags.strict);
+    // GOV-F (KJC-TSK-0768): el deny de tool-time (contrato --strict del
+    // Sentinel) entra en la MISMA cadena que las decisiones de commit — con
+    // el hash del tool_input como artefacto. Un sello fallido se dice ANTES
+    // del veredicto (la última línea de stdout sigue siendo el JSON que el
+    // Sentinel parsea) y el deny se mantiene: jamás un allow por fallo de registro.
+    if (strictDeny) {
+      try {
+        recordGateDecision(projectDir, {
+          decision: "deny", chokepoint: "tool", rule_ids: [verdict.rule_id], role, tool: flags.tool ?? null,
+          ...(verdict.class ? { class: verdict.class } : {}),
+          // El hash es del payload CRUDO recibido (--input tal cual), no de su
+          // re-serialización: el mismo JSON con otro orden o espacios es otro
+          // artefacto para la auditoría (catch de codex).
+          policy_hash: policyFileHash(projectDir), artifact_hash: createHash("sha256").update(String(flags.input ?? ""), "utf8").digest("hex"),
+        });
+      } catch (err) {
+        logger.error?.(`policy eval: deny NO sellado en el decision log (${err.message}) — el deny se mantiene`);
+      }
+    }
     logger.info?.(JSON.stringify(verdict));
-    return verdict.decision === "deny" && flags.strict ? 2 : 0;
+    return strictDeny ? 2 : 0;
+  }
+
+  // GOV-F (KJC-TSK-0768): un escape KJ_ALLOW_* usado en tool-time es una
+  // excepción consciente — se sella como exempt chokepoint=tool con la
+  // identidad DECLARADA del clon (identity.local.yml), para que el informe
+  // y el anchor la vean. Lo llama el Sentinel; cualquiera puede auditarlo.
+  if (action === "seal") {
+    if (!flags.escape) {
+      logger.error?.("policy seal: --escape <KJ_ALLOW_X> es obligatorio — un escape sin nombre no es auditable");
+      return 1;
+    }
+    try {
+      const who = readIdentity(projectDir);
+      const rec = recordGateDecision(projectDir, {
+        decision: "exempt", chokepoint: "tool", escape: flags.escape, tool: flags.tool ?? null,
+        who: who ? { gh: who.gh_user ?? null, git: who.git_email ?? null, grade: "declarada" } : null,
+        policy_hash: policyFileHash(projectDir),
+      });
+      logger.info?.(`✓ escape ${rec.escape} sellado (chokepoint tool${rec.tool ? `, ${rec.tool}` : ""})`);
+      return 0;
+    } catch (err) {
+      logger.error?.(`policy seal: ${err.message}`);
+      return 1;
+    }
   }
 
   // check — staged por defecto, base...head con --range (CI). Warn salvo

package/src/commands/review-gate.js

@@ -289,8 +289,10 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
     console.log(res.ok
       ? `✓ verdict ok — approved by ${res.verdict.reviewer} (diff ${res.verdict.diffHash.slice(0, 12)})`
       : `✗ ${res.reason}`);
-    // GOV-C: el allow del chokepoint de COMMIT es evidencia — se sella.
-    if (res.ok) seal("allow");
+    // GOV-C: el allow del chokepoint de COMMIT es evidencia — se sella. PL-E
+    // (KJC-TSK-0767): con las reglas que AVISARON, para que "nace avisando y
+    // gana dientes" se decida con datos (kj policy report), no a ciegas.
+    if (res.ok) seal("allow", gate.warns.length > 0 ? { warn_rule_ids: gate.warns.map((w) => w.rule_id) } : {});
     process.exitCode = res.ok ? 0 : 1;
     return res;
   }

package/src/environment/playbook.js

@@ -52,7 +52,8 @@ const playbookBody = (stateBackend, boardName) => `# Karajan method (v4)
 
 You are the orchestrator; Karajan governs. A task is DONE when its
 done-statement is literally true, the full suite is green, and every commit
-carries a cross-AI verdict.
+carries a cross-AI verdict. A card closed? Point your user at the board
+(\`kj board start\` → http://localhost:4000/#governance): that is where to look.
 
 Invariants (the git gates enforce these — they are not suggestions):