karajan-code 4.21.0 → 4.22.0

package/src/claims/cross-check.js

@@ -0,0 +1,81 @@
+/**
+ * Crossing what was said against what actually ran (CLM-A, KJC-TSK-0801).
+ *
+ * The transcript is the register of sources: every command, query and read left
+ * its output there, so nothing has to be annotated by hand. A datum that appears
+ * in some output is BACKED; one that appears nowhere came out of the model's
+ * memory (UNBACKED); one whose own source says otherwise is DENIED — and that
+ * is the only verdict that blocks, because it is a proven hallucination and not
+ * a suspicion.
+ *
+ * What cannot be decided is NOT_CHECKABLE, never an accusation: a guard that
+ * cries wolf gets switched off (KJC-PCS-0082).
+ */
+import { extractClaims } from "./extract.js";
+
+export const BACKED = "backed";
+export const UNBACKED = "unbacked";
+export const DENIED = "denied";
+export const NOT_CHECKABLE = "not_checkable";
+
+const norm = (s) => String(s ?? "").toLowerCase();
+const escape = (s) => s.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/**
+ * Numbers must match as WHOLE tokens: searching "4" as a substring finds it inside "24.6 kB"
+ * and backs a figure nobody measured. Found while running this over a real message — the
+ * synthetic tests had passed. Ids, paths and versions are distinctive enough as substrings.
+ */
+function appearsIn(output, claim) {
+  const needle = norm(claim.value);
+  if (claim.kind === "path" || claim.kind === "card" || claim.kind === "version") return output.includes(needle);
+  return new RegExp(`(?<![\\w.])${escape(needle)}(?![\\w.])`).test(output);
+}
+
+/** "no cards", "[]", "0 results" — a source that positively states emptiness. */
+const SAYS_EMPTY = /(^|\W)(\[\]|\bnone\b|\bno results?\b|\bempty\b|\b0 (results?|items?|matches|cards?|files?)\b)/i;
+
+/**
+ * @param {{text: string, outputs: string[], userSaid?: string}} input
+ *   outputs: tool outputs of the turn, in order. userSaid: what the user wrote (also a source).
+ * @returns {{claims: Array<object>, denied: Array<object>, unbacked: Array<object>}}
+ */
+export function crossCheck({ text, outputs = [], userSaid = "" }) {
+  const haystack = [...outputs.map(norm), norm(userSaid)];
+  const claims = extractClaims(text).map((claim) => ({ ...claim, status: verdictFor(claim, haystack) }));
+  return {
+    claims,
+    denied: claims.filter((c) => c.status === DENIED),
+    unbacked: claims.filter((c) => c.status === UNBACKED),
+  };
+}
+
+function verdictFor(claim, haystack) {
+  if (haystack.some((h) => appearsIn(h, claim))) return BACKED;
+
+  // A count stated as non-zero while every source that mentions the same noun says empty:
+  // that is the "four cards are waiting" case, and it is the one that blocks.
+  if (claim.kind === "count" && Number(claim.value) > 0) {
+    const noun = nounAfterCount(claim.sentence, claim.value);
+    if (noun) {
+      const mentions = haystack.filter((h) => h.includes(norm(noun)));
+      if (mentions.length && mentions.every((h) => SAYS_EMPTY.test(h))) return DENIED;
+    }
+    // Small numbers are prose as often as data ("las dos capas", "3 reglas"): not worth accusing.
+    if (Number(claim.value) <= 3) return NOT_CHECKABLE;
+  }
+  return UNBACKED;
+}
+
+function nounAfterCount(sentence, value) {
+  const m = new RegExp(`${value}\\s+([a-zá-ú]{4,})`, "i").exec(sentence);
+  return m ? m[1] : null;
+}
+
+/** One human line per problem; the message is what makes a guard usable. */
+export function formatClaimReport({ denied, unbacked }) {
+  const lines = [];
+  for (const c of denied) lines.push(`✗ "${c.value}" (${c.kind}) is DENIED by the output that should back it — ${c.sentence.slice(0, 100)}`);
+  for (const c of unbacked) lines.push(`? "${c.value}" (${c.kind}) has no backing in this turn — verify it or say it is from memory`);
+  return lines.join("\n");
+}

package/src/claims/extract.js

@@ -0,0 +1,56 @@
+/**
+ * Hard data in what the AI says (CLM-A, KJC-TSK-0801, ADR "claims with evidence").
+ *
+ * A model states an invented figure with the same confidence as a measured one,
+ * and that figure travels to a PR, a card, another session or the user, where
+ * nobody checks it again. This module pulls the CHECKABLE data out of a text —
+ * counts, versions, file paths, card ids, commit SHAs — so it can be crossed
+ * against what actually ran. Prose is left alone: only data is verifiable.
+ *
+ * Deterministic and free: no model in the loop. Verifying must be cheaper than
+ * inventing, or nobody will verify.
+ */
+
+/** Sentences that ALREADY admit they are unverified are respected, never reported. */
+const HEDGES = /\b(de memoria|sin (comprobar|verificar)|no (lo )?he (comprobado|verificado)|creo que|puede que|quizá|quizás|probablemente|from memory|unverified|not checked|i think|probably)\b/i;
+
+// Most specific first: a number already claimed as a PR or a version is not also a bare count.
+// A number with no unit next to it (an OTP, a phone) is deliberately NOT a claim: it is not
+// verifiable from prose, and some of them are secrets that must never travel into a report.
+const PATTERNS = [
+  { kind: "card", re: /\b([A-Z]{3}-(?:TSK|BUG|PCS|SPR|PLA|PRP)-\d{4})\b/g, value: (m) => m[1] },
+  { kind: "path", re: /\b((?:[\w.-]+\/){1,}[\w.-]+\.\w{1,5})\b/g, value: (m) => m[1] },
+  { kind: "version", re: /\bv?(\d+\.\d+\.\d+(?:-[\w.]+)?)\b/g, value: (m) => m[1] },
+  { kind: "pr", re: /(?:^|[\s(])#(\d{2,6})\b/g, value: (m) => m[1] },
+  { kind: "sha", re: /\b([0-9a-f]{7,40})\b/g, value: (m) => m[1] },
+  // A number that means something: "1004 ficheros", "8 ocurrencias", "53 tests".
+  { kind: "count", re: /\b(\d[\d.,]*)\s+(?=[a-záéíóúñ]{3,})/gi, value: (m) => m[1].replaceAll(".", "").replaceAll(",", "") },
+];
+
+/** Splits into sentences so a hedge only covers what it is attached to. */
+const sentences = (text) => String(text || "").split(/(?<=[.!?\n])\s+/).filter(Boolean);
+
+/**
+ * @param {string} text
+ * @returns {Array<{kind: string, value: string, sentence: string}>} unique claims, in order.
+ */
+export function extractClaims(text) {
+  const out = [];
+  const seen = new Set();
+  for (const sentence of sentences(text)) {
+    if (HEDGES.test(sentence)) continue; // saying "I did not check" is the behaviour to encourage
+    const claimedHere = new Set();
+    for (const { kind, re, value } of PATTERNS) {
+      for (const m of sentence.matchAll(re)) {
+        const v = value(m);
+        if (claimedHere.has(v)) continue; // already claimed as something more specific
+        claimedHere.add(v);
+        const key = `${kind}:${v}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        out.push({ kind, value: v, sentence: sentence.trim() });
+      }
+    }
+  }
+  return out;
+}

package/src/claims/turn.js

@@ -0,0 +1,54 @@
+/**
+ * Reading one turn out of the transcript (CLM-B, KJC-TSK-0802).
+ *
+ * The transcript is the register of sources: what the AI finally said, what the
+ * user asked, and every tool output in between. Nothing is annotated by hand —
+ * this just reads what the session already wrote.
+ *
+ * A turn = from the user's last real message to the end. A "user" entry whose
+ * content is a tool_result is NOT the user talking: it is the machine answering.
+ */
+import { readFileSync } from "node:fs";
+
+const MAX_OUTPUT = 20_000; // a single huge output must not eat the whole check
+const blocks = (entry) => {
+  const c = entry?.message?.content;
+  return Array.isArray(c) ? c : typeof c === "string" ? [{ type: "text", text: c }] : [];
+};
+const isToolResult = (entry) => blocks(entry).some((b) => b.type === "tool_result");
+const textOf = (value) =>
+  typeof value === "string" ? value : Array.isArray(value) ? value.map((b) => b?.text ?? "").join("\n") : String(value ?? "");
+
+/** Parses the JSONL, ignoring lines that are not valid JSON (a partial write must not throw). */
+export function readEntries(path) {
+  const out = [];
+  for (const line of readFileSync(path, "utf8").split("\n")) {
+    if (!line.trim()) continue;
+    try { out.push(JSON.parse(line)); } catch { /* a half-written line is not a reason to fail */ }
+  }
+  return out;
+}
+
+/**
+ * @param {string} path transcript_path given by the hook
+ * @returns {{text: string, outputs: string[], userSaid: string}}
+ *   text: what the AI says at the end of the turn (its final prose, no thinking).
+ */
+export function readTurn(path) {
+  const entries = readEntries(path);
+  const startedAt = entries.findLastIndex((e) => e.type === "user" && !isToolResult(e));
+  const turn = startedAt >= 0 ? entries.slice(startedAt) : entries;
+
+  const userSaid = startedAt >= 0 ? textOf(entries[startedAt]?.message?.content) : "";
+  const outputs = [];
+  for (const entry of turn) {
+    for (const b of blocks(entry)) {
+      if (b.type === "tool_result") outputs.push(textOf(b.content).slice(0, MAX_OUTPUT));
+    }
+  }
+  // The final message is the last assistant entry that actually says something
+  // (one with tool_use only is the AI working, not the AI reporting).
+  const finals = turn.filter((e) => e.type === "assistant" && blocks(e).some((b) => b.type === "text" && b.text?.trim()));
+  const text = finals.length ? blocks(finals.at(-1)).filter((b) => b.type === "text").map((b) => b.text).join("\n") : "";
+  return { text, outputs, userSaid };
+}

package/src/cli/advanced-commands.js

@@ -30,7 +30,7 @@ export const ADVANCED_GROUPS = [
   { title: "Pipeline (piezas sueltas)", commands: ["autorun", "code", "review", "solomon", "agent", "scan", "tournament"] },
   { title: "Análisis pre-run", commands: ["discover", "triage", "researcher", "architect", "onboard", "brief"] },
   { title: "Búsqueda / RAG", commands: ["rag", "qmd", "watch"] },
-  { title: "Calidad / auditoría", commands: ["audit", "check", "mutate", "webperf", "sonar", "privacy", "release", "policy"] },
+  { title: "Calidad / auditoría", commands: ["audit", "check", "mutate", "webperf", "sonar", "privacy", "release", "policy", "claims"] },
   { title: "Sesión / board", commands: ["resume", "report", "board", "hu", "adr", "worktree", "undo", "standby", "sentinel", "identity"] },
   { title: "Infra / setup", commands: ["install-tools", "ollama", "skills", "roles", "agents", "env"] },
   { title: "Mantenimiento", commands: ["clean", "sync", "telemetry", "report-issue"] },

package/src/cli/register-meta.js

@@ -5,6 +5,8 @@ import { architectCommand } from "../commands/architect.js";
 import { onboardCommand } from "../commands/onboard.js";
 import { startCommand } from "../commands/start.js";
 import { identityCommand } from "../commands/identity.js";
+import { policyCommand } from "../commands/policy.js";
+import { claimsCommand } from "../commands/claims.js";
 import { ragIndexCommand, ragQueryCommand, ragInstallHooksCommand, ragEvalCommand } from "../commands/rag.js";
 import { qmdQueryCommand } from "../commands/qmd.js";
 import { ragMcpCommand } from "../commands/rag-mcp.js";
@@ -311,6 +313,14 @@ export function registerMeta(program, { pkgVersion }) {
     });
 
   // KJC-TSK-0733 PL-A — policy as code: motor determinista en modo warn.
+  // CLM-B (KJC-TSK-0802): the data the AI states, checked against what actually ran.
+  program.command("claims").description("Afirmaciones con fuente: comprueba los datos que la IA afirma en un turno contra las salidas de ese turno (ADR claims-with-evidence)")
+    .command("check")
+    .description("Cruza el mensaje final del turno con sus salidas — exit 2 solo si un dato está DESMENTIDO por su propia fuente; falla abierto si no puede leer el transcript")
+    .requiredOption("--transcript <path>", "Ruta del transcript de la sesión (la que pasa el hook)")
+    .option("--json", "Machine-readable")
+    .action(async (flags) => { process.exitCode = await claimsCommand({ flags }); });
+
   const policyCmd = program.command("policy").description("Policy as code (.karajan/policy.yml, vocabulario cerrado): eval/check deterministas, grant con caducidad, anchor del decision log — deny en commit y CI");
   policyCmd.command("eval")
     .description("Evalúa UNA tool call: imprime {decision, rule_id, reason}; --strict devuelve exit 2 en deny (contrato para adaptadores de hooks)")
@@ -320,7 +330,6 @@ export function registerMeta(program, { pkgVersion }) {
     .option("--strict", "Exit 2 si deny")
     .action(async (flags) => {
       await withConfig(pkgVersion, "policy-eval", flags, async ({ config }) => {
-        const { policyCommand } = await import("../commands/policy.js");
         process.exitCode = await policyCommand({ action: "eval", config, flags });
       });
     });
@@ -331,7 +340,6 @@ export function registerMeta(program, { pkgVersion }) {
     .option("--reason <text>", "Justificación escrita en el momento")
     .action(async (flags) => {
       await withConfig(pkgVersion, "policy-grant", flags, async ({ config }) => {
-        const { policyCommand } = await import("../commands/policy.js");
         process.exitCode = await policyCommand({ action: "grant", config, flags });
       });
     });
@@ -348,10 +356,27 @@ export function registerMeta(program, { pkgVersion }) {
     .description("Verifica la cadena del decision log y sella su head-hash en .karajan/policy-anchor.json (trackeado) — anclaje temporal en la historia de git, GOV-C2")
     .action(async (flags) => {
       await withConfig(pkgVersion, "policy-anchor", flags, async ({ config }) => {
-        const { policyCommand } = await import("../commands/policy.js");
         process.exitCode = await policyCommand({ action: "anchor", config, flags });
       });
     });
+  policyCmd.command("seal")
+    .description("Sella en el decision log un escape KJ_ALLOW_* usado en tool-time (exempt, chokepoint=tool, identidad declarada del clon) — lo invoca el Sentinel, GOV-F")
+    .requiredOption("--escape <name>", "Escape usado (p.ej. KJ_ALLOW_BOARD)")
+    .option("--tool <tool>", "Tool que lo usó (Bash, Edit…)")
+    .action(async (flags) => {
+      await withConfig(pkgVersion, "policy-seal", flags, async ({ config }) => {
+        process.exitCode = await policyCommand({ action: "seal", config, flags });
+      });
+    });
+  policyCmd.command("report")
+    .description("Informe determinista del decision log y las concesiones: avisos/denegaciones/exenciones por regla, denegaciones abiertas, concesiones vivas/vencidas/renovadas y señales — cadena rota = exit 1 (PL-E)")
+    .option("--soon <days>", "Días para considerar una concesión 'próxima a vencer'", "7")
+    .option("--json", "Machine-readable")
+    .action(async (flags) => {
+      await withConfig(pkgVersion, "policy-report", flags, async ({ config }) => {
+        process.exitCode = await policyCommand({ action: "report", config, flags });
+      });
+    });
   policyCmd.command("check")
     .description("Comprueba el diff (staged, o base...head con --range) contra la policy — warn por defecto; --strict devuelve exit 2 si hay violación enforcement=deny (tier C, merge-blocking)")
     .option("--role <role>", "Rol del agente", "coder")
@@ -360,7 +385,6 @@ export function registerMeta(program, { pkgVersion }) {
     .option("--json", "Machine-readable")
     .action(async (flags) => {
       await withConfig(pkgVersion, "policy-check", flags, async ({ config }) => {
-        const { policyCommand } = await import("../commands/policy.js");
         process.exitCode = await policyCommand({ action: "check", config, flags });
       });
     });
@@ -599,9 +623,10 @@ export function registerMeta(program, { pkgVersion }) {
 
   program
     .command("board [action]")
-    .description("Manage HU Board (start|stop|status|open|cleanup)")
+    .description("Manage HU Board (start|stop|status|open|cleanup) — SIN acción arranca un servidor persistente en segundo plano (equivale a `start`)")
     .option("--port <number>", "Port (default: 4000)", "4000")
     .option("--bind <host>", "Bind host (default: 127.0.0.1; use 0.0.0.0 to expose on LAN — token auth auto-enforced)")
+    .option("--force", "Arranca aunque hu_board.enabled sea false en kj.config.yml")
     .action(async (action = "start", opts) => {
       await withConfig(pkgVersion, "board", opts, async ({ config, logger }) => {
         // KJC-TSK-0684 (issue #1287): an external board is the source of
@@ -612,6 +637,21 @@ export function registerMeta(program, { pkgVersion }) {
           console.log(`⚠ this project's board lives in ${name} (state_backend: external) — kj does not run a parallel HU Board here.`);
           return;
         }
+        // KJC-BUG-0152 (issue #1427): `kj board` with no action starts a persistent server.
+        // Doing that while hu_board.enabled is false contradicts kj doctor, which reports the
+        // board as skipped — two commands saying opposite things about the same config. The
+        // system works or fails loudly; it never does the opposite of what the config says.
+        // Only `start` is gated (the bare command defaults to it): stop, status, cleanup and open
+        // never bring a server up, and blocking them would take away the way to tidy up.
+        if (config?.hu_board?.enabled === false && !opts.force && action === "start") {
+          logger.error(
+            `hu_board.enabled es false en kj.config.yml — no arranco el HU Board (kj doctor ya lo reporta como omitido).\n` +
+            `  Para arrancarlo igualmente: kj board ${action} --force\n` +
+            `  Para dejarlo activado siempre: pon hu_board.enabled: true en kj.config.yml`
+          );
+          process.exitCode = 1;
+          return;
+        }
         const port = Number(opts.port) || config.hu_board?.port || 4000;
         const bind = opts.bind || config.hu_board?.bind || "127.0.0.1";
         await boardCommand({ action, port, bind, logger });

package/src/commands/claims.js

@@ -0,0 +1,41 @@
+/**
+ * `kj claims check --transcript <path>` (CLM-B, KJC-TSK-0802) — checks the data
+ * the AI states in a turn against what actually ran in that same turn.
+ *
+ * Deterministic and free: no model in the loop. Exit 2 only when a datum is
+ * DENIED by its own source — a proven hallucination. Everything else is
+ * reported, per the accepted ADR: inform always, block almost never.
+ *
+ * It fails OPEN. A verifier that cannot read the transcript says so and gets out
+ * of the way: a broken check must never hold a session hostage.
+ */
+import { readTurn } from "../claims/turn.js";
+import { crossCheck, formatClaimReport } from "../claims/cross-check.js";
+
+export async function claimsCommand({ flags = {}, logger = console, readTurnFn = readTurn } = {}) {
+  const path = flags.transcript;
+  if (!path) {
+    logger.error("kj claims check: --transcript <path> is required");
+    return 1;
+  }
+  let turn;
+  try {
+    turn = readTurnFn(path);
+  } catch (err) {
+    // Not observable: the transcript could not be read. Never reported as clean.
+    const note = `kj claims: transcript not readable (${err.message}) — nothing checked`;
+    if (flags.json) logger.log(JSON.stringify({ ok: true, checked: false, reason: note }));
+    else logger.error(note);
+    return 0;
+  }
+
+  const result = crossCheck(turn);
+  if (flags.json) {
+    logger.log(JSON.stringify({ ok: true, checked: true, denied: result.denied, unbacked: result.unbacked, claims: result.claims.length }));
+  } else if (result.denied.length || result.unbacked.length) {
+    logger.error(formatClaimReport(result));
+  } else {
+    logger.log(`kj claims: ${result.claims.length} dato(s) comprobado(s), todos con respaldo en este turno`);
+  }
+  return result.denied.length ? 2 : 0;
+}

package/src/commands/init.js

@@ -862,7 +862,7 @@ export async function initCommand({ logger, flags = {} }) {
       await installAiTrashHook(logger);
     } else {
       logger.warn("ai-trash kj-trash binary not found — destructive ops unprotected.");
-      logger.warn("  Install karajan-code globally (npm i -g karajan-code) so kj-trash is on PATH.");
+      logger.warn("  Install karajan-code globally (npm i -g @karajan-family/code) so kj-trash is on PATH.");
     }
   }
 

package/src/commands/policy.js

@@ -12,7 +12,10 @@ import { createHash } from "node:crypto";
 import { readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { checkStagedDiff, evalToolCall, loadPolicy } from "../policy/engine.js";
-import { loadStandingExceptions, recordPolicyException } from "../policy/exceptions.js";
+import { loadExceptionRecords, loadStandingExceptions, recordPolicyException } from "../policy/exceptions.js";
+import { buildPolicyReport } from "../policy/report.js";
+import { policyFileHash, recordGateDecision } from "../policy/decisions.js";
+import { readIdentity } from "../identity/store.js";
 import { verifyDecisionChain } from "@karajan-family/governance";
 
 const execFileAsync = promisify(execFile);
@@ -123,6 +126,39 @@ export async function policyCommand({ action, config = {}, flags = {}, logger =
     }
   }
 
+  // PL-E (KJC-TSK-0767): el informe — evidencia de proceso determinista
+  // sobre los dos jsonl. Cadena rota = exit 1: un informe sobre un log
+  // manipulado no es un informe. El resto es informativo (exit 0).
+  if (action === "report") {
+    let decisionLines = [];
+    try {
+      decisionLines = readFileSync(join(projectDir, ".karajan", "policy-decisions.jsonl"), "utf8").split("\n").filter((l) => l.trim());
+    } catch { /* sin decisiones aún: el informe lo dice con ceros */ }
+    const exc = loadExceptionRecords(projectDir);
+    const soonDays = Number(flags.soon ?? 7);
+    const report = buildPolicyReport({ decisionLines, exceptionRecords: exc.records, policy, soonDays: Number.isFinite(soonDays) ? soonDays : 7 });
+    if (flags.json) {
+      logger.info?.(JSON.stringify({ ...report, exceptions_discarded: exc.discarded }));
+      return report.chain.ok ? 0 : 1;
+    }
+    const { chain, decisions: d, rules, grants: g } = report;
+    if (chain.ok) logger.info?.(`✓ decision log: cadena íntegra (${chain.length} decisiones)`);
+    else logger.error?.(`✗ decision log: cadena rota en la entrada ${chain.at} (${chain.reason}) — el log ha sido manipulado`);
+    if (d.discarded > 0 || exc.discarded > 0) logger.warn?.(`⚠ líneas corruptas descartadas: ${d.discarded} en decisiones, ${exc.discarded} en excepciones`);
+    const cps = Object.entries(d.chokepoints).map(([k, v]) => `${k} ${v}`).join(" · ") || "ninguno";
+    logger.info?.(`decisiones: allow ${d.allow} · deny ${d.deny} · exempt ${d.exempt} · abiertas ${d.open} (chokepoints: ${cps})`);
+    logger.info?.(rules.length > 0 ? "reglas (ordenadas por fricción):" : "reglas: ninguna ha avisado ni denegado todavía");
+    for (const r of rules) {
+      const meta = [r.enforcement && `enforcement=${r.enforcement}`, r.class && `class=${r.class}`].filter(Boolean).join(" ");
+      logger.info?.(`  [${r.rule_id}] ${meta} — warn ${r.warns} · deny ${r.denies} · exempt ${r.exempts} · abiertas ${r.open}`);
+    }
+    logger.info?.(`concesiones: vivas ${g.alive.length} (próximas a vencer ${g.soon.length}) · vencidas ${g.expired.length} · puntuales ${g.point}`);
+    for (const e of g.alive) logger.info?.(`  [${e.rule_id}] hasta ${e.expiresAt} — ${e.who?.git ?? "?"}: ${e.justification ?? "sin justificación"}`);
+    logger.info?.(report.signals.length > 0 ? "señales:" : "señales: ninguna");
+    for (const s of report.signals) logger.warn?.(`  ⚠ ${s}`);
+    return chain.ok ? 0 : 1;
+  }
+
   if (action === "eval") {
     let input;
     try {
@@ -131,9 +167,54 @@ export async function policyCommand({ action, config = {}, flags = {}, logger =
       logger.error?.("policy eval: --input debe ser JSON válido");
       return 1;
     }
-    const verdict = evalToolCall(policy, { role: flags.role || "coder", tool: flags.tool, input, root: projectDir });
+    const role = flags.role || "coder";
+    const verdict = evalToolCall(policy, { role, tool: flags.tool, input, root: projectDir });
+    const strictDeny = verdict.decision === "deny" && Boolean(flags.strict);
+    // GOV-F (KJC-TSK-0768): el deny de tool-time (contrato --strict del
+    // Sentinel) entra en la MISMA cadena que las decisiones de commit — con
+    // el hash del tool_input como artefacto. Un sello fallido se dice ANTES
+    // del veredicto (la última línea de stdout sigue siendo el JSON que el
+    // Sentinel parsea) y el deny se mantiene: jamás un allow por fallo de registro.
+    if (strictDeny) {
+      try {
+        recordGateDecision(projectDir, {
+          decision: "deny", chokepoint: "tool", rule_ids: [verdict.rule_id], role, tool: flags.tool ?? null,
+          ...(verdict.class ? { class: verdict.class } : {}),
+          // El hash es del payload CRUDO recibido (--input tal cual), no de su
+          // re-serialización: el mismo JSON con otro orden o espacios es otro
+          // artefacto para la auditoría (catch de codex).
+          policy_hash: policyFileHash(projectDir), artifact_hash: createHash("sha256").update(String(flags.input ?? ""), "utf8").digest("hex"),
+        });
+      } catch (err) {
+        logger.error?.(`policy eval: deny NO sellado en el decision log (${err.message}) — el deny se mantiene`);
+      }
+    }
     logger.info?.(JSON.stringify(verdict));
-    return verdict.decision === "deny" && flags.strict ? 2 : 0;
+    return strictDeny ? 2 : 0;
+  }
+
+  // GOV-F (KJC-TSK-0768): un escape KJ_ALLOW_* usado en tool-time es una
+  // excepción consciente — se sella como exempt chokepoint=tool con la
+  // identidad DECLARADA del clon (identity.local.yml), para que el informe
+  // y el anchor la vean. Lo llama el Sentinel; cualquiera puede auditarlo.
+  if (action === "seal") {
+    if (!flags.escape) {
+      logger.error?.("policy seal: --escape <KJ_ALLOW_X> es obligatorio — un escape sin nombre no es auditable");
+      return 1;
+    }
+    try {
+      const who = readIdentity(projectDir);
+      const rec = recordGateDecision(projectDir, {
+        decision: "exempt", chokepoint: "tool", escape: flags.escape, tool: flags.tool ?? null,
+        who: who ? { gh: who.gh_user ?? null, git: who.git_email ?? null, grade: "declarada" } : null,
+        policy_hash: policyFileHash(projectDir),
+      });
+      logger.info?.(`✓ escape ${rec.escape} sellado (chokepoint tool${rec.tool ? `, ${rec.tool}` : ""})`);
+      return 0;
+    } catch (err) {
+      logger.error?.(`policy seal: ${err.message}`);
+      return 1;
+    }
   }
 
   // check — staged por defecto, base...head con --range (CI). Warn salvo

package/src/commands/review-gate.js

@@ -289,8 +289,10 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
     console.log(res.ok
       ? `✓ verdict ok — approved by ${res.verdict.reviewer} (diff ${res.verdict.diffHash.slice(0, 12)})`
       : `✗ ${res.reason}`);
-    // GOV-C: el allow del chokepoint de COMMIT es evidencia — se sella.
-    if (res.ok) seal("allow");
+    // GOV-C: el allow del chokepoint de COMMIT es evidencia — se sella. PL-E
+    // (KJC-TSK-0767): con las reglas que AVISARON, para que "nace avisando y
+    // gana dientes" se decida con datos (kj policy report), no a ciegas.
+    if (res.ok) seal("allow", gate.warns.length > 0 ? { warn_rule_ids: gate.warns.map((w) => w.rule_id) } : {});
     process.exitCode = res.ok ? 0 : 1;
     return res;
   }

package/src/environment/playbook.js

@@ -52,7 +52,8 @@ const playbookBody = (stateBackend, boardName) => `# Karajan method (v4)
 
 You are the orchestrator; Karajan governs. A task is DONE when its
 done-statement is literally true, the full suite is green, and every commit
-carries a cross-AI verdict.
+carries a cross-AI verdict. A card closed? Point your user at the board
+(\`kj board start\` → http://localhost:4000/#governance): that is where to look.
 
 Invariants (the git gates enforce these — they are not suggestions):
 

package/src/guards/duplicate-members.js

@@ -0,0 +1,86 @@
+/**
+ * Duplicate class members (KJC-TSK-0796) — a bug JavaScript refuses to report.
+ *
+ * Declaring the same member twice in a class is legal: the LAST one wins and the
+ * first disappears in silence. No runtime error, no lint warning, no compiler
+ * complaint. That is how a `updated()` that loaded the data was lost in GREBLA
+ * and a tab stayed empty in production for 17 days.
+ *
+ * What matters is not that there is a duplicate — it is WHAT WAS LOST: the body
+ * that will never run. That is what the finding says.
+ *
+ * Honest about its limits (the fourth verdict): a file this guard could not read,
+ * or one whose member names are computed at runtime, is reported as NOT OBSERVABLE
+ * — never as clean.
+ */
+import { parse } from "@babel/parser";
+
+const plugins = (file) => [
+  ...(/\.(ts|tsx|mts|cts)$/.test(file) ? ["typescript"] : []),
+  ...(/\.(tsx|jsx)$/.test(file) || !/\.(ts|mts|cts)$/.test(file) ? ["jsx"] : []),
+  "decorators",
+];
+const isClass = (node) => node?.type === "ClassDeclaration" || node?.type === "ClassExpression";
+
+/** Walks every node of the tree; enough for a syntax-only guard (no scope analysis). */
+function walk(node, visit) {
+  if (!node || typeof node.type !== "string") return;
+  visit(node);
+  for (const key of Object.keys(node)) {
+    const child = node[key];
+    if (Array.isArray(child)) child.forEach((c) => walk(c, visit));
+    else if (child && typeof child.type === "string") walk(child, visit);
+  }
+}
+
+const memberName = (member) => {
+  if (member.computed) return null; // `[expr]() {}` — the name is not known until it runs
+  const key = member.key ?? member.id;
+  if (key?.type === "Identifier") return key.name;
+  if (key?.type === "PrivateName") return `#${key.id.name}`;
+  if (key?.type === "StringLiteral" || key?.type === "NumericLiteral") return String(key.value);
+  return null;
+};
+
+/**
+ * @param {string} source
+ * @param {{file?: string}} [where]
+ * @returns {{findings: Array<object>, notObservable: {file: string, reason: string}|null}}
+ *   Each finding: {file, className, member, lostLine, winnerLine, message}.
+ */
+export function findDuplicateMembers(source, { file = "<source>" } = {}) {
+  let tree;
+  try {
+    tree = parse(source, { sourceType: "unambiguous", allowReturnOutsideFunction: true, plugins: plugins(file) });
+  } catch (err) {
+    return { findings: [], notObservable: { file, reason: `could not be parsed (${err.message}) — not read as clean` } };
+  }
+  const findings = [];
+  let computed = 0;
+  walk(tree, (node) => {
+    if (!isClass(node)) return;
+    const className = node.id?.name ?? "(anonymous)";
+    const seen = new Map();
+    for (const member of node.body.body) {
+      // get/set of the same name are legal, and a static member is a different slot from an
+      // instance one — treating either as a duplicate would be the false positive that gets a
+      // guard switched off (the credibility rule of KJC-PCS-0082).
+      // A TypeScript overload signature (TSDeclareMethod) declares the same name on purpose and
+      // carries no body: counting it would flag every overloaded method in the codebase.
+      if (member.type === "StaticBlock" || member.type === "TSDeclareMethod" || member.type === "TSIndexSignature" || member.kind === "get" || member.kind === "set") continue;
+      const name = memberName(member);
+      if (name === null) { computed += 1; continue; }
+      const key = `${member.static ? "static " : ""}${name}`;
+      const line = member.loc.start.line;
+      const first = seen.get(key);
+      if (first === undefined) { seen.set(key, line); continue; }
+      findings.push({
+        file, className, member: key, lostLine: first, winnerLine: line,
+        message: `${file}:${line} — ${className}: the ${key} of line ${first} never runs, the one of line ${line} replaces it`,
+      });
+      seen.set(key, line); // a third copy is reported against the second, not against the first
+    }
+  });
+  const notObservable = computed > 0 && findings.length === 0 ? { file, reason: `${computed} member name(s) computed at runtime — this file cannot be fully checked` } : null;
+  return { findings, notObservable };
+}