karajan-code 4.20.1 → 4.22.0

package/src/guards/duplicate-members.js

@@ -0,0 +1,86 @@
+/**
+ * Duplicate class members (KJC-TSK-0796) — a bug JavaScript refuses to report.
+ *
+ * Declaring the same member twice in a class is legal: the LAST one wins and the
+ * first disappears in silence. No runtime error, no lint warning, no compiler
+ * complaint. That is how a `updated()` that loaded the data was lost in GREBLA
+ * and a tab stayed empty in production for 17 days.
+ *
+ * What matters is not that there is a duplicate — it is WHAT WAS LOST: the body
+ * that will never run. That is what the finding says.
+ *
+ * Honest about its limits (the fourth verdict): a file this guard could not read,
+ * or one whose member names are computed at runtime, is reported as NOT OBSERVABLE
+ * — never as clean.
+ */
+import { parse } from "@babel/parser";
+
+const plugins = (file) => [
+  ...(/\.(ts|tsx|mts|cts)$/.test(file) ? ["typescript"] : []),
+  ...(/\.(tsx|jsx)$/.test(file) || !/\.(ts|mts|cts)$/.test(file) ? ["jsx"] : []),
+  "decorators",
+];
+const isClass = (node) => node?.type === "ClassDeclaration" || node?.type === "ClassExpression";
+
+/** Walks every node of the tree; enough for a syntax-only guard (no scope analysis). */
+function walk(node, visit) {
+  if (!node || typeof node.type !== "string") return;
+  visit(node);
+  for (const key of Object.keys(node)) {
+    const child = node[key];
+    if (Array.isArray(child)) child.forEach((c) => walk(c, visit));
+    else if (child && typeof child.type === "string") walk(child, visit);
+  }
+}
+
+const memberName = (member) => {
+  if (member.computed) return null; // `[expr]() {}` — the name is not known until it runs
+  const key = member.key ?? member.id;
+  if (key?.type === "Identifier") return key.name;
+  if (key?.type === "PrivateName") return `#${key.id.name}`;
+  if (key?.type === "StringLiteral" || key?.type === "NumericLiteral") return String(key.value);
+  return null;
+};
+
+/**
+ * @param {string} source
+ * @param {{file?: string}} [where]
+ * @returns {{findings: Array<object>, notObservable: {file: string, reason: string}|null}}
+ *   Each finding: {file, className, member, lostLine, winnerLine, message}.
+ */
+export function findDuplicateMembers(source, { file = "<source>" } = {}) {
+  let tree;
+  try {
+    tree = parse(source, { sourceType: "unambiguous", allowReturnOutsideFunction: true, plugins: plugins(file) });
+  } catch (err) {
+    return { findings: [], notObservable: { file, reason: `could not be parsed (${err.message}) — not read as clean` } };
+  }
+  const findings = [];
+  let computed = 0;
+  walk(tree, (node) => {
+    if (!isClass(node)) return;
+    const className = node.id?.name ?? "(anonymous)";
+    const seen = new Map();
+    for (const member of node.body.body) {
+      // get/set of the same name are legal, and a static member is a different slot from an
+      // instance one — treating either as a duplicate would be the false positive that gets a
+      // guard switched off (the credibility rule of KJC-PCS-0082).
+      // A TypeScript overload signature (TSDeclareMethod) declares the same name on purpose and
+      // carries no body: counting it would flag every overloaded method in the codebase.
+      if (member.type === "StaticBlock" || member.type === "TSDeclareMethod" || member.type === "TSIndexSignature" || member.kind === "get" || member.kind === "set") continue;
+      const name = memberName(member);
+      if (name === null) { computed += 1; continue; }
+      const key = `${member.static ? "static " : ""}${name}`;
+      const line = member.loc.start.line;
+      const first = seen.get(key);
+      if (first === undefined) { seen.set(key, line); continue; }
+      findings.push({
+        file, className, member: key, lostLine: first, winnerLine: line,
+        message: `${file}:${line} — ${className}: the ${key} of line ${first} never runs, the one of line ${line} replaces it`,
+      });
+      seen.set(key, line); // a third copy is reported against the second, not against the first
+    }
+  });
+  const notObservable = computed > 0 && findings.length === 0 ? { file, reason: `${computed} member name(s) computed at runtime — this file cannot be fully checked` } : null;
+  return { findings, notObservable };
+}

package/src/harden/hook-templates.js

@@ -52,11 +52,49 @@ function baseBranchGuard(baseBranch) {
   ];
 }
 
+// IDN-C (KJC-TSK-0764, ADR 0005): identity lock at tier B — the declared clone
+// identity (.karajan/identity.local.yml) governs authorship on commit and the
+// gh session on push, on ANY host. Undeclared = advisory only (old clones keep
+// working); the fail-closed default is the Sentinel's (IDN-B).
+function identityGuard(hook) {
+  const head = [
+    "# Identity lock (IDN-C, ADR 0005) — this clone's declared identity governs.",
+    'if [ "$KJ_ALLOW_IDENTITY" != "1" ] && [ -f .karajan/identity.local.yml ]; then',
+  ];
+  const tail = [
+    "elif [ ! -f .karajan/identity.local.yml ]; then",
+    "  echo 'kj harden: no identity declared for this clone — run kj identity set (advisory)'",
+    "fi",
+  ];
+  if (hook === "pre-commit") {
+    return [
+      ...head,
+      "  kj_declared_email=$(sed -n 's/^git_email:[[:space:]]*//p' .karajan/identity.local.yml | head -n1)",
+      "  kj_author=$(git var GIT_AUTHOR_IDENT | sed 's/.*<\\(.*\\)>.*/\\1/')",
+      "  kj_committer=$(git var GIT_COMMITTER_IDENT | sed 's/.*<\\(.*\\)>.*/\\1/')",
+      '  if [ -n "$kj_declared_email" ] && { [ "$kj_author" != "$kj_declared_email" ] || [ "$kj_committer" != "$kj_declared_email" ]; }; then',
+      '    echo "kj harden: identity lock — committing as $kj_author / $kj_committer but this clone is declared as $kj_declared_email (kj identity show; KJ_ALLOW_IDENTITY=1 to override)"; exit 1',
+      "  fi",
+      ...tail,
+    ];
+  }
+  return [
+    ...head,
+    "  kj_declared_gh=$(sed -n 's/^gh_user:[[:space:]]*//p' .karajan/identity.local.yml | head -n1)",
+    '  kj_hosts="${GH_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/gh}/hosts.yml"',
+    "  kj_active_gh=$(awk '/^github.com:/{f=1;next} f&&/^[^[:space:]]/{f=0} f&&/^[[:space:]]*user:/{sub(/^[[:space:]]*user:[[:space:]]*/,\"\");print;exit}' \"$kj_hosts\" 2>/dev/null)",
+    '  if [ -n "$kj_declared_gh" ] && [ "$kj_active_gh" != "$kj_declared_gh" ]; then',
+    '    echo "kj harden: identity lock — gh session is ${kj_active_gh:-none} but this clone is declared as $kj_declared_gh — run: gh auth switch --user $kj_declared_gh (KJ_ALLOW_IDENTITY=1 to override)"; exit 1',
+    "  fi",
+    ...tail,
+  ];
+}
+
 export function hookBody(hook, cmds = {}, { globalHooksDir = null, baseBranch = null } = {}) {
   const chain = chainToGlobal(hook, globalHooksDir);
   switch (hook) {
     case "pre-commit": {
-      const lines = [...baseBranchGuard(baseBranch), "# Lint + format the working tree with the project's native tools."];
+      const lines = [...baseBranchGuard(baseBranch), ...identityGuard("pre-commit"), "# Lint + format the working tree with the project's native tools."];
       if (cmds.lint) lines.push(`${cmds.lint} || { echo 'kj harden: lint failed'; exit 1; }`);
       if (cmds.format) lines.push(`${cmds.format} || { echo 'kj harden: format check failed'; exit 1; }`);
       if (!cmds.lint && !cmds.format) lines.push("# (no lint/format command detected for this stack)");
@@ -93,6 +131,7 @@ export function hookBody(hook, cmds = {}, { globalHooksDir = null, baseBranch =
         "  echo 'kj harden: git user.name/user.email not set — refusing to push'; exit 1",
         "fi",
         'echo "kj harden: pushing as $(git config user.name) <$(git config user.email)>"',
+        ...identityGuard("pre-push"),
         "# Run the test suite before pushing.",
       ];
       if (cmds.test) lines.push(`${cmds.test} || { echo 'kj harden: tests failed'; exit 1; }`);

package/src/harden/sentinel-hooks.js

@@ -29,7 +29,7 @@ const LIB_BODY = `// kj sentinel shared lib (KJC-TSK-0714) — managed by \`kj h
 // Single source for every sentinel script: state, branch, classification,
 // violations, and escape recording.
 import { readFileSync, writeFileSync } from "node:fs";
-import { execSync } from "node:child_process";
+import { execSync, spawnSync } from "node:child_process";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 const here = dirname(fileURLToPath(import.meta.url));
@@ -66,8 +66,12 @@ export const foreignLane = (targetDir) => {
   const common = _git("rev-parse --path-format=absolute --git-common-dir", targetDir);
   return common && common === _home.common ? top : null;
 };
+// KJC-TSK-0765 board-sync: cards merged in this session but not yet moved in
+// the tracker. The method does not advance until the board is true.
+export const pendingMoves = (s) => (s && Array.isArray(s.pending_moves) ? s.pending_moves : []);
+export const pendingText = (p) => (p.card ? p.card : "card sin identificar") + " (PR #" + p.pr + ") mergeada sin mover en el tracker — muevela a To Validate / Fixed con sus commits (update_card del PG o kj hu move)";
 export const violations = (s, branch) => {
-  const v = [];
+  const v = pendingMoves(s).map(pendingText);
   if (!s || !(s.edited_sources || []).length) return v;
   if (BASE_BRANCHES.has(branch)) v.push("Fuentes editadas en la rama base '" + branch + "' — crea una rama: git checkout -b feat/<CARD-ID>-descripcion");
   else if (branch && !CARD.test(branch)) v.push("La rama '" + branch + "' no referencia ninguna card — usa feat/<CARD-ID>-descripcion (y una card VIVA en el board)");
@@ -81,6 +85,18 @@ export const recordEscape = (sid, escape, tool) => {
   if (!s.escapes.includes(escape)) s.escapes.push(escape);
   (state.escape_events ||= []).push({ escape, tool, sid, ts: Date.now() });
   save(state);
+  // GOV-F (KJC-TSK-0768): el escape es una excepcion consciente — entra en el
+  // decision log hash-encadenado (kj policy seal), no solo en este estado.
+  // Best-effort CON aviso: fail-closed aqui encerraria la sesion justo cuando
+  // kj no carga, que es cuando mas se usa el escape (restaurar con git).
+  try {
+    const args = ["policy", "seal", "--escape", escape];
+    if (tool) args.push("--tool", String(tool));
+    const r = spawnSync("kj", args, { cwd: ROOT, encoding: "utf8" });
+    if (r.error || r.status !== 0) console.error("kj sentinel: escape " + escape + " usado pero NO sellado en el decision log (kj policy seal " + (r.error ? r.error.message : "exit " + r.status) + ") — revisa kj; el escape queda solo en sentinel-state.json");
+  } catch (e) {
+    console.error("kj sentinel: escape " + escape + " usado pero NO sellado en el decision log: " + e.message);
+  }
 };
 `;
 
@@ -89,13 +105,74 @@ const POST_BODY = `#!/usr/bin/env node
 // Records deterministic method facts per session; never blocks, never fails
 // a tool call (PostToolUse, always exit 0).
 import { relative } from "node:path";
-import { CODE, TESTS, ROOT, load, save, session } from "./sentinel-lib.mjs";
-const ESCAPES = ["KJ_ALLOW_WRITE", "KJ_ALLOW_REWRITE", "KJ_ALLOW_NO_CARD", "KJ_ALLOW_NO_TESTS", "KJ_ALLOW_PII", "KJ_ALLOW_POLICY"];
+import { spawnSync } from "node:child_process";
+import { CODE, TESTS, ROOT, CARD, branchOf, load, save, session } from "./sentinel-lib.mjs";
+const ESCAPES = ["KJ_ALLOW_WRITE", "KJ_ALLOW_REWRITE", "KJ_ALLOW_NO_CARD", "KJ_ALLOW_NO_TESTS", "KJ_ALLOW_PII", "KJ_ALLOW_POLICY", "KJ_ALLOW_IDENTITY", "KJ_ALLOW_BOARD"];
 let raw = "";
 process.stdin.on("data", (d) => { raw += d; });
 process.stdin.on("end", () => {
   try {
-    const { session_id: sid = "default", tool_name: tool, tool_input: input = {} } = JSON.parse(raw);
+    const { session_id: sid = "default", tool_name: tool, tool_input: input = {}, tool_response: response = {} } = JSON.parse(raw);
+    // KJC-TSK-0765 board-sync: a merge that gh CONFIRMS leaves its card pending
+    // in the tracker (the PreToolUse gate then refuses to advance until it is
+    // moved). Recorded here, after the fact, so a failed merge never blocks.
+    const text = typeof response === "string" ? response : JSON.stringify(response);
+    // Closing states that count as "registered in the tracker" (PG statuses and
+    // HU Board moves). The pending entry is cleared by the REAL tool call that
+    // moved the card — never by a promise in the agent's prose.
+    const CLOSING = ["to validate", "to-validate", "fixed", "verified", "closed", "done", "done&validated", "validated"];
+    const clearPending = (cardId) => {
+      const state = load();
+      const s = session(state, sid);
+      s.pending_moves = (s.pending_moves || []).filter((p) => p.card !== null && p.card !== cardId);
+      // KJC-TSK-0774: a card closed this turn is what the Stop hook points the
+      // user at when the focus comes back (the board is where to look).
+      if (cardId && !(s.closed_cards ||= []).includes(cardId)) s.closed_cards.push(cardId);
+      save(state);
+    };
+    if (/__update_card$/.test(String(tool)) && /^mcp__/.test(String(tool))) {
+      // The MCP response reaches the hook as {content:[{text:"<json>"}]}: once
+      // stringified, the inner quotes are ESCAPED — match both forms (found live:
+      // the first real update_card did not clear its pending entry).
+      const cid = /\\\\?"cardId\\\\?"\\s*:\\s*\\\\?"([A-Za-z0-9-]+)\\\\?"/.exec(text);
+      const st = /\\\\?"status\\\\?"\\s*:\\s*\\\\?"([^"\\\\]+)\\\\?"/.exec(text);
+      if (cid && st && CLOSING.includes(st[1].toLowerCase())) clearPending(cid[1].toUpperCase());
+      process.exit(0);
+    }
+    if (tool === "Bash") {
+      const cmdText = String(input.command || "");
+      // gh prints "merged pull request #N" only on a TTY: under a tool call the
+      // success line is ABSENT (found live on the first dogfood merge). The
+      // authoritative signal is the PR state itself: one gh pr view per merge.
+      const mergeCmd = /\\bgh\\s+pr\\s+merge(\\s+(\\d+))?/.exec(cmdText);
+      const said = /merged pull request #(\\d+)/i.exec(text);
+      let mergedPr = said ? Number(said[1]) : null;
+      // KJC-BUG-0148: the card belongs to the PR's HEAD branch, not to whatever
+      // branch the working tree happens to be on (found live: a merge issued
+      // from another card's lane pinned the pending move on the wrong card).
+      let headRef = null;
+      if (mergeCmd || said) {
+        const n = said ? said[1] : mergeCmd[2];
+        const args = ["pr", "view", ...(n ? [n] : []), "--json", "number,state,headRefName"];
+        const r = spawnSync("gh", args, { cwd: ROOT, encoding: "utf8" });
+        try {
+          const v = JSON.parse(r.status === 0 ? r.stdout : "null");
+          if (v && v.state === "MERGED") { mergedPr = Number(v.number); headRef = v.headRefName || null; }
+        } catch { /* unknown = not confirmed (or confirmed only by the printed line) */ }
+      }
+      if (mergedPr !== null) {
+        const state = load();
+        const s = session(state, sid);
+        const ref = CARD.exec(headRef || branchOf() || "");
+        (s.pending_moves ||= []).push({ card: ref ? ref[0].toUpperCase() : null, pr: mergedPr, at: Date.now(), ...(headRef ? {} : { head: "unknown" }) });
+        save(state);
+      }
+      const moved = /kj\\s+hu\\s+move\\s+([A-Za-z0-9-]+)\\s+([a-z&-]+)/i.exec(String(input.command || ""));
+      // "not found" counts as failure (KJC-BUG-0154): a move that moved nothing must not
+      // clear a pending — that would discard a LEGITIMATE one without touching the tracker.
+      if (moved && CLOSING.includes(moved[2].toLowerCase()) && !/error|fail|not found/i.test(text)) clearPending(moved[1].toUpperCase());
+      process.exit(0);
+    }
     const file = input.file_path || input.notebook_path;
     if (!["Write", "Edit", "MultiEdit", "NotebookEdit"].includes(tool) || !file) process.exit(0);
     const state = load();
@@ -124,7 +201,19 @@ const STOP_BODY = `#!/usr/bin/env node
 // after 3 unresolved blocks — a sentinel bug never bricks the session — and
 // the fail-open is recorded in the state. \`--status\` prints, never blocks.
 import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import { load, save, branchOf, violations, ROOT } from "./sentinel-lib.mjs";
+// KJC-TSK-0774: when the turn ends green with cards closed, remind the user
+// where to look — the board URL if it runs (pid file alive), else how to start it.
+const boardHint = () => {
+  const home = process.env.KARAJAN_HOME || process.env.KJ_HOME || join(homedir(), ".karajan");
+  try {
+    process.kill(Number(readFileSync(join(home, "hu-board.pid"), "utf8").trim()), 0);
+    return "http://localhost:" + (process.env.KJ_BOARD_PORT || "4000") + "/#governance";
+  } catch { return "no esta arrancado: kj board start (luego http://localhost:4000/#governance)"; }
+};
 if (process.argv.includes("--status")) {
   const st = load();
   const branch = branchOf();
@@ -168,9 +257,14 @@ process.stdin.on("end", () => {
     const v = violations(s, branchOf());
     if (!v.length) {
       s.blocks = 0;
+      const notes = [];
+      if ((s.escapes || []).length) notes.push("kj sentinel: esta sesion uso " + s.escapes.length + " escape(s): " + s.escapes.join(", ") + " — decision registrada; detalle en kj sentinel status.");
+      if ((s.closed_cards || []).length) {
+        notes.push("kj sentinel: card(s) cerrada(s) en este turno: " + s.closed_cards.join(", ") + " — el board las muestra: " + boardHint());
+        s.closed_cards = [];
+      }
       save(state);
-      if ((s.escapes || []).length)
-        console.log(JSON.stringify({ systemMessage: "kj sentinel: esta sesion uso " + s.escapes.length + " escape(s): " + s.escapes.join(", ") + " — decision registrada; detalle en kj sentinel status." }));
+      if (notes.length) console.log(JSON.stringify({ systemMessage: notes.join("\\n") }));
       process.exit(0);
     }
     s.blocks = (s.blocks || 0) + 1;
@@ -194,10 +288,11 @@ const PRETOOL_BODY = `#!/usr/bin/env node
 // before the damage, not in the post-mortem. Exit 2 blocks (stderr says the
 // remediation); read-only tools are never wired here; every honored escape
 // is recorded as an auditable event. Fails OPEN on anything unexpected.
-import { dirname, relative, resolve } from "node:path";
-import { existsSync, realpathSync, statSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";
-import { CODE, TESTS, ROOT, BASE_BRANCHES, CARD, branchOf, foreignLane, load, violations, recordEscape } from "./sentinel-lib.mjs";
+import { homedir } from "node:os";
+import { CODE, TESTS, ROOT, BASE_BRANCHES, CARD, branchOf, foreignLane, load, violations, recordEscape, pendingMoves, pendingText } from "./sentinel-lib.mjs";
 const EDIT_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
 const PUBLISH = /\\bnpm\\s+publish\\b|\\bfirebase\\s+deploy\\b|\\bgh\\s+release\\s+create\\b/;
 const PUSH = /\\bgit\\s+push\\b/;
@@ -259,12 +354,139 @@ process.stdin.on("end", () => {
         if (tok === name + "=1") found = true;
       }
       if (!found) return false;
-      for (const c of CMD_TEXT) {
-        if (c === ";" || c === "|" || c === "&" || c === ESC_NL || c === ESC_BT) return false;
-        if (c === "$" || c === "(" || c === ")") return false;
+      // KJC-BUG-0147: lo que va ENTRE COMILLAS no encadena comandos — un
+      // mensaje "fix(x): ... (KJC-TSK-1)" es un comando simple. Dentro de
+      // comillas dobles $ y backtick siguen expandiendo (se rechazan); en
+      // comillas simples todo es literal. Y si el escape esta pero se ignora,
+      // SE DICE: un escape ignorado en silencio era el bug.
+      const bad = escSimple();
+      if (bad === null) return true;
+      if (!escNoted.has(name)) {
+        escNoted.add(name);
+        console.error("kj sentinel: " + name + "=1 presente pero IGNORADO — el escape solo vale en un comando simple y este contiene " + JSON.stringify(bad) + " fuera de comillas simples (sin ; | & $ ( ) backtick ni salto de linea: parte el comando o usa -F fichero)");
       }
-      return true;
+      return false;
     };
+    const escNoted = new Set();
+    const escSimple = () => {
+      let q = null;
+      for (let i = 0; i < CMD_TEXT.length; i += 1) {
+        const c = CMD_TEXT[i];
+        if (q === "'") { if (c === "'") q = null; continue; }
+        if (q === '"') {
+          if (c === '"') q = null;
+          else if (c === "$" || c === ESC_BT) return c;
+          else if (c === "\\\\") i += 1;
+          continue;
+        }
+        if (c === "\\\\") { i += 1; continue; }
+        if (c === "'" || c === '"') { q = c; continue; }
+        if (c === ";" || c === "|" || c === "&" || c === ESC_NL || c === ESC_BT || c === "$" || c === "(" || c === ")") return c;
+      }
+      return q === null ? null : "comilla sin cerrar";
+    };
+    // IDN-B (KJC-TSK-0763, ADR 0005): identity lock — gh and mutating git never
+    // run under an account other than the one THIS CLONE declared (the incident:
+    // a gh comment without switch went out as the client account). Deny BEFORE
+    // the damage with the literal remedy; never auto-switch; undeclared = closed.
+    if (tool === "Bash" && CMD_TEXT.length > 0) {
+      const idFile = join(ROOT, ".karajan", "identity.local.yml");
+      const idLine = (key) => {
+        if (!existsSync(idFile)) return null;
+        const line = readFileSync(idFile, "utf8").split(ESC_NL).find((l) => l.startsWith(key + ":"));
+        const v = line ? line.slice(key.length + 1).trim() : "";
+        return v.length > 0 ? v : null;
+      };
+      const declaredGh = idLine("gh_user");
+      const declaredEmail = idLine("git_email");
+      const ghHostsPath = join(process.env.GH_CONFIG_DIR || join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "gh"), "hosts.yml");
+      const activeGh = () => {
+        if (!existsSync(ghHostsPath)) return null;
+        const lines = readFileSync(ghHostsPath, "utf8").split(ESC_NL);
+        const start = lines.findIndex((l) => l.startsWith("github.com:"));
+        if (start < 0) return null;
+        for (let k = start + 1; k < lines.length; k += 1) {
+          if (lines[k].length > 0 && lines[k][0] !== " " && lines[k][0] !== ESC_TAB) break;
+          const t = lines[k].trim();
+          if (t.startsWith("user:")) { const u = t.slice(5).trim(); return u.length > 0 ? u : null; }
+        }
+        return null;
+      };
+      const words = (seg) => seg.trim().split(" ").filter((w) => w.length > 0 && w !== ESC_TAB);
+      const headOf = (ws) => { let k = 0; while (k < ws.length && ws[k].indexOf("=") > 0 && ws[k].indexOf("=") < ws[k].length) k += 1; return ws.slice(k); };
+      // Wrapper shells hide the payload in a string (review catch): scan inside.
+      const WRAPPERS =["sh", "bash", "zsh", "dash", "eval", "env", "xargs", "sudo", "nohup", "time", "exec"];
+      let switchedTo = null;
+      const problems = [];
+      // $( and backticks are separators too (review catch): their payload is its own segment.
+      const SEPS = [";", "&&", "||", "|", "$(", String.fromCharCode(96), "(", ")"];
+      const bare = (w) => w.replaceAll(String.fromCharCode(39), "").replaceAll(String.fromCharCode(34), "");
+      const scan = (text, depth) => { if (depth > 3) return; for (const seg of SEPS.reduce((acc, s) => acc.flatMap((l) => l.split(s)), text.split(ESC_NL))) checkSeg(headOf(words(seg)), depth, words(seg)); };
+      const checkSeg = (ws, depth, raw) => {
+        if (ws.length === 0) return;
+        if (WRAPPERS.includes(ws[0])) { // wrapper args have arity (sudo -u bob): scan from the first gh/git/wrapper token (review catch)
+          const j = ws.findIndex((w, i) => i > 0 && ["gh", "git", ...WRAPPERS].includes(bare(w)));
+          if (j > 0) scan(ws.slice(j).map(bare).join(" "), depth + 1);
+          return;
+        }
+        if (ws[0] === "gh") {
+          if (ws[1] === "auth") {
+            if (ws[2] === "switch") { const u = ws.indexOf("--user"); if (u > 0 && ws[u + 1]) switchedTo = ws[u + 1]; }
+            return; // session commands ARE the remedy — never blocked
+          }
+          if (!declaredGh) { problems.push("gh without a declared identity for this clone — run: kj identity set"); return; }
+          const eff = switchedTo || activeGh();
+          if (eff !== declaredGh) problems.push("gh as '" + (eff || "no session") + "' but this clone is declared as '" + declaredGh + "' — prefix the command: gh auth switch --user " + declaredGh + " && ...");
+          return;
+        }
+        if (ws[0] === "git") {
+          // Global options (-C, -c, --git-dir, --work-tree...) are NOT re-implemented: they
+          // are forwarded verbatim to git var, so git resolves identity exactly as the real
+          // command would (review catches: -C cumulative, --git-dir, --opt=value forms).
+          const TWO = ["-c", "-C", "--git-dir", "--work-tree", "--namespace", "--super-prefix", "--exec-path", "--config-env"];
+          let k = 1;
+          while (k < ws.length && ws[k].startsWith("-")) k += TWO.includes(ws[k]) && ws[k + 1] ? 2 : 1;
+          const globals = ws.slice(1, k).map(bare);
+          const sub = ws[k];
+          if (sub === "push") { // push authenticates with the gh session, not user.email (review catch)
+            if (!declaredGh) { problems.push("git push without a declared identity for this clone — run: kj identity set"); return; }
+            const eff = switchedTo || activeGh();
+            if (eff !== declaredGh) problems.push("git push with gh session '" + (eff || "no session") + "' but this clone is declared as '" + declaredGh + "' — prefix: gh auth switch --user " + declaredGh + " && ...");
+            return;
+          }
+          // IDN-B2: anything that authors or rewrites commits carries an identity (review catch).
+          if (!["commit", "tag", "merge", "rebase", "cherry-pick", "am", "revert"].includes(sub)) return; // am: the COMMITTER is still this user
+          if (!declaredEmail) { problems.push("git " + sub + " without a declared identity for this clone — run: kj identity set"); return; }
+          // Let GIT resolve author and committer under the command's own environment
+          // (review catch: user.email, -c, GIT_*_EMAIL, EMAIL, GIT_CONFIG_*, includeIf are
+          // its business): git var is the single source of truth.
+          const assigns = raw.slice(0, raw.length - ws.length).filter((w) => w.indexOf("=") > 0);
+          const env = Object.assign({}, process.env);
+          for (const w of assigns) env[w.slice(0, w.indexOf("="))] = bare(w.slice(w.indexOf("=") + 1));
+          const ident = (v) => {
+            const r = spawnSync("git", [...globals, "var", v], { cwd: ROOT, encoding: "utf8", env });
+            const s = r.status === 0 ? String(r.stdout) : "";
+            const a = s.indexOf("<");
+            const b = s.indexOf(">");
+            return a >= 0 && b > a ? s.slice(a + 1, b) : null;
+          };
+          const ai = ws.findIndex((w) => w.startsWith("--author"));
+          const authorRaw = ai < 0 ? null : ws[ai].includes("=") ? ws[ai].slice(ws[ai].indexOf("=") + 1) : ws.slice(ai + 1).join(" ");
+          const authorMail = authorRaw === null ? null : bare(authorRaw.includes("<") ? authorRaw.slice(authorRaw.indexOf("<") + 1, authorRaw.indexOf(">")) : authorRaw.trim());
+          const mails = [authorMail ?? ident("GIT_AUTHOR_IDENT"), ident("GIT_COMMITTER_IDENT")]; // --author overrides the author (review catch); the committer is always git's
+          const offender = mails.find((m) => m !== null && m !== declaredEmail) ?? (mails[0] === null ? "none" : null);
+          if (offender !== null) problems.push("git " + sub + " as '" + offender + "' but this clone is declared as '" + declaredEmail + "' — use: git -c user.email=" + declaredEmail + " " + sub + " ... (or git config user.email " + declaredEmail + ")");
+        }
+      };
+      scan(CMD_TEXT, 0);
+      if (problems.length > 0) {
+        if (escOn("KJ_ALLOW_IDENTITY")) { recordEscape(sid, "KJ_ALLOW_IDENTITY", tool); }
+        else {
+          console.error("kj sentinel: identity lock (ADR 0005) —" + problems.map((p) => ESC_NL + "- " + p).join("") + ESC_NL + "(KJ_ALLOW_IDENTITY=1 = excepcion consciente, queda registrada)");
+          process.exit(2);
+        }
+      }
+    }
     // MONO-0 (KJC-TSK-0737, ADR 0002): cada sesion muta solo SU worktree;
     // otro carril del MISMO repo se deniega ANTES del dano. Lectura libre.
     const laneOf = (p) => {
@@ -475,6 +697,23 @@ process.stdin.on("end", () => {
     }
     if (tool === "Bash") {
       const cmd = String(input.command || "");
+      // KJC-TSK-0765 board-sync: a merge leaves its card PENDING in the tracker
+      // and nothing advances (commit, new PR, another merge; push and the end of
+      // the turn go through violations()) until the card is moved. The board is
+      // true at all times or the method stops — never a rule in the agent's memory.
+      const MERGE = /\\bgh\\s+pr\\s+merge(\\s+(\\d+))?/;
+      const ADVANCE = /\\bgit\\s+commit\\b|\\bgit\\s+push\\b|\\bgh\\s+pr\\s+create\\b/; // push also falls under violations() — explicit here too (review catch)
+      const mergeM = cmd.match(MERGE);
+      const pend = pendingMoves(load().sessions?.[sid]);
+      if (pend.length > 0 && (mergeM || ADVANCE.test(cmd))) {
+        if (escOn("KJ_ALLOW_BOARD")) { recordEscape(sid, "KJ_ALLOW_BOARD", tool); }
+        else {
+          console.error("kj sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + pend.map((p) => "- " + pendingText(p)).join("\\n") + "\\n(KJ_ALLOW_BOARD=1 = excepcion consciente, queda registrada)");
+          process.exit(2);
+        }
+      }
+      // (the pending entry itself is recorded by the PostToolUse hook, only once
+      // gh confirms "merged pull request #N" — a failed merge never blocks)
       if (PUBLISH.test(cmd)) {
         if (escOn("KJ_ALLOW_RELEASE")) { recordEscape(sid, "KJ_ALLOW_RELEASE", tool); process.exit(0); }
         const res = spawnSync("kj", ["release", "check", "--json"], { cwd: ROOT, encoding: "utf8" });
@@ -486,7 +725,15 @@ process.stdin.on("end", () => {
           process.exit(2);
         }
       } else if (PUSH.test(cmd)) {
-        const v = violations(load().sessions?.[sid], branchOf());
+        // KJC-BUG-0147: the board escape covers the push too — a pending move
+        // blocks the push like it blocks the commit, and the SAME conscious,
+        // recorded escape opens both (multi-PR cards are a legitimate plan).
+        const sess = load().sessions?.[sid];
+        let v = violations(sess, branchOf());
+        if (v.length && pendingMoves(sess).length && escOn("KJ_ALLOW_BOARD")) {
+          recordEscape(sid, "KJ_ALLOW_BOARD", tool);
+          v = violations({ ...sess, pending_moves: [] }, branchOf());
+        }
         if (v.length) {
           console.error("kj sentinel: git push con el metodo en rojo:\\n" + v.map((x) => "- " + x).join("\\n") + "\\nResuelve antes de empujar. Estado: kj sentinel status");
           process.exit(2);
@@ -536,6 +783,11 @@ export function installSentinelHooks({ projectDir = process.cwd(), logger = cons
       { event: "PreToolUse", matcher: "Write|Edit|MultiEdit|NotebookEdit", script: "pretooluse-sentinel.mjs" },
       { event: "PreToolUse", matcher: "Bash", script: "pretooluse-sentinel.mjs" },
       { event: "PostToolUse", matcher: "Write|Edit|MultiEdit|NotebookEdit", script: "posttooluse.mjs" },
+      // KJC-TSK-0765 board-sync: the merge (Bash) and the tracker move (MCP
+      // update_card) are observed AFTER the fact — found live: with only the
+      // edit matchers wired, the board-sync recorder never ran in production.
+      { event: "PostToolUse", matcher: "Bash", script: "posttooluse.mjs" },
+      { event: "PostToolUse", matcher: "mcp__.*__update_card", script: "posttooluse.mjs" },
       { event: "Stop", script: "stop.mjs" },
     ],
   });

package/src/identity/bootstrap.js

@@ -0,0 +1,48 @@
+/**
+ * Identity lock — bootstrap (IDN-A, KJC-TSK-0762). Runs at the end of
+ * `kj harden` (and therefore `kj env install`): if this clone has no declared
+ * identity, capture it — but ONLY with a human confirming on a TTY. Headless
+ * runs never bind blindly (the first real `set --yes` bound a clone to an
+ * account another session had switched to); they report the pending step
+ * with the exact command instead. Fail-loud, never a guess.
+ */
+
+import { readIdentity, writeIdentity } from "./store.js";
+import { activeGhUser, effectiveGitEmail } from "./detect.js";
+import { createWizard, isTTY } from "../utils/wizard.js";
+
+/**
+ * @param {{projectDir: string, logger?: object, deps?: object}} args
+ * @returns {Promise<{declared: boolean, identity: object|null, pending: string|null}>}
+ */
+export async function ensureIdentity({ projectDir, logger = null, deps = {} }) {
+  const existing = readIdentity(projectDir);
+  if (existing) return { declared: true, identity: existing, pending: null };
+
+  const gh = activeGhUser(deps.hostsPath ? { hostsPath: deps.hostsPath } : {});
+  const email = effectiveGitEmail(projectDir, deps.gitFn ? { gitFn: deps.gitFn } : {});
+  const hint = `kj identity set --gh ${gh ?? "<user>"} --email ${email ?? "<email>"}`;
+  const tty = (deps.isTTY || isTTY)();
+
+  if (!tty || !gh || !email) {
+    const why = !gh || !email ? "no active gh session or git email" : "non-interactive run";
+    const pending = `identity not declared for this clone (${why}) — run: ${hint}`;
+    logger?.warn?.(`kj identity: ${pending}`);
+    return { declared: false, identity: null, pending };
+  }
+
+  const wizard = (deps.makeWizard || createWizard)();
+  try {
+    const ok = await wizard.confirm(`Bind this clone to gh ${gh} / git ${email}? (other sessions may switch gh accounts — verify)`, true);
+    if (!ok) {
+      const pending = `identity not declared (declined) — run: ${hint}`;
+      logger?.warn?.(`kj identity: ${pending}`);
+      return { declared: false, identity: null, pending };
+    }
+  } finally {
+    wizard.close();
+  }
+  const identity = writeIdentity(projectDir, { gh_user: gh, git_email: email });
+  logger?.info?.(`kj identity: declared gh ${gh} / git ${email} → .karajan/identity.local.yml (ignored by git)`);
+  return { declared: true, identity, pending: null };
+}

package/src/identity/compare.js

@@ -0,0 +1,38 @@
+/**
+ * Identity lock — compare (IDN-A, KJC-TSK-0762). Pure: declared vs effective
+ * → {ok, mismatches}. Every mismatch carries the LITERAL remedy, because the
+ * gate (IDN-B) and the hooks (IDN-C) print it instead of auto-switching —
+ * changing the user's keyring is the user's act, never the agent's.
+ */
+
+/**
+ * @param {{gh_user: string, git_email: string}|null} declared
+ * @param {{gh_user: string|null, git_email: string|null}} effective
+ * @returns {{ok: boolean, mismatches: Array<{field: string, declared: string|null, effective: string|null, remedy: string}>}}
+ */
+export function compareIdentity(declared, effective) {
+  if (!declared) {
+    return {
+      ok: false,
+      mismatches: [{ field: "identity", declared: null, effective: null, remedy: "kj identity set — this clone has no declared identity yet" }],
+    };
+  }
+  const mismatches = [];
+  if (effective.gh_user !== declared.gh_user) {
+    mismatches.push({
+      field: "gh_user",
+      declared: declared.gh_user,
+      effective: effective.gh_user ?? null,
+      remedy: effective.gh_user ? `gh auth switch --user ${declared.gh_user}` : `gh auth login (as ${declared.gh_user}) or gh auth switch --user ${declared.gh_user}`,
+    });
+  }
+  if (effective.git_email !== declared.git_email) {
+    mismatches.push({
+      field: "git_email",
+      declared: declared.git_email,
+      effective: effective.git_email ?? null,
+      remedy: `git config user.email ${declared.git_email} (or -c user.email=${declared.git_email} on the command)`,
+    });
+  }
+  return { ok: mismatches.length === 0, mismatches };
+}