karajan-code 4.25.0 → 4.26.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.25.0",
+  "version": "4.26.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/packages/hu-board/public/app.js

@@ -163,6 +163,9 @@ let lastOpenedLog = null;     // { id, label, tailUrl(offset) }
  */
 function navigate(view) {
   currentView = view;
+  // KJC-TSK-0820: going back to the Dashboard unloads the project — it is
+  // the only place where a (different) project gets picked.
+  if (view === 'dashboard' && !scopedProjectSlug) selectedProject = '';
   window.location.hash = selectedProject ? `${view}/${selectedProject}` : view;
 
   // Update active nav button
@@ -179,14 +182,43 @@ function navigate(view) {
  */
 function selectProject(projectId) {
   selectedProject = projectId;
-  document.getElementById('project-select').value = projectId;
   navigate('board');
 }
 
+/**
+ * KJC-TSK-0820 — two-level nav. Which nav bars are visible: the generic
+ * one always; the project sub-bar only while a project is loaded, and
+ * never on the Dashboard (that's where projects get picked). Pure.
+ * @param {string} view
+ * @param {string} projectId
+ * @returns {{ generic: boolean, project: boolean }}
+ */
+function projectNavVisibility(view, projectId) {
+  return { generic: true, project: Boolean(projectId) && view !== 'dashboard' };
+}
+
+/**
+ * Applies projectNavVisibility() to the DOM and stamps the loaded
+ * project's name on the sub-bar.
+ */
+function updateProjectNav() {
+  const bar = document.getElementById('project-nav');
+  if (!bar) return;
+  const visible = projectNavVisibility(currentView, selectedProject).project;
+  bar.hidden = !visible;
+  if (!visible) return;
+  const nameEl = document.getElementById('project-nav-name');
+  nameEl.textContent = projectNameCache[selectedProject] || humaniseProjectName(selectedProject);
+  resolveProjectMeta(selectedProject).then((meta) => {
+    if (meta.name) nameEl.textContent = meta.name;
+  });
+}
+
 /**
  * Renders the current view.
  */
 function render() {
+  updateProjectNav();
   switch (currentView) {
     case 'dashboard': return renderDashboard();
     case 'board': return renderBoard();
@@ -197,46 +229,6 @@ function render() {
   }
 }
 
-/**
- * Populates the project selector dropdown.
- */
-async function populateProjectSelect() {
-  try {
-    const projects = await api('/api/projects');
-    const select = document.getElementById('project-select');
-    // Which project should appear pre-selected? Order:
-    //   1. scopedProjectSlug (URL is /p/<slug>)  — locked, never changes
-    //   2. selectedProject (route state, ej. #board/<slug>)
-    //   3. ""                                    — "All Projects"
-    // PR-D: the previous version cleared innerHTML and never marked
-    // any option as selected, so the dropdown showed "All Projects"
-    // even when scoped to one. handleRoute() set .value separately
-    // BUT the value was lost in the race because the matching option
-    // didn't exist yet when handleRoute ran. Setting .selected on
-    // the option directly avoids the race.
-    const desired = scopedProjectSlug || selectedProject || '';
-    select.innerHTML = '';
-    const all = document.createElement('option');
-    all.value = '';
-    all.textContent = 'All Projects';
-    if (desired === '') all.selected = true;
-    select.appendChild(all);
-    for (const p of projects) {
-      const opt = document.createElement('option');
-      opt.value = p.id;
-      opt.textContent = p.name || p.id;
-      if (p.id === desired) opt.selected = true;
-      select.appendChild(opt);
-    }
-    // Final guard: if `desired` did not match any rendered option
-    // (project not on the board yet), still set the value so
-    // handleRoute's expectation holds.
-    if (desired) select.value = desired;
-  } catch {
-    // Silently fail — project list will be empty
-  }
-}
-
 /**
  * Parses the hash route and renders.
  */
@@ -248,13 +240,15 @@ function handleRoute() {
   // In scoped mode the project is locked — the hash controls the view
   // only. `board/<slug>` becomes `board` and the slug stays fixed.
   currentView = parts[0] || 'board';
-  selectedProject = scopedProjectSlug || parts[1] || '';
+  // Dashboard never carries a loaded project (KJC-TSK-0820): it is the
+  // project picker, so a `#dashboard/<slug>` deep-link drops the slug.
+  selectedProject = scopedProjectSlug
+    || (currentView === 'dashboard' ? '' : parts[1] || '');
 
   document.querySelectorAll('.nav-btn').forEach((btn) => {
     btn.classList.toggle('active', btn.dataset.view === currentView);
   });
 
-  document.getElementById('project-select').value = selectedProject;
   render();
 }
 

package/packages/hu-board/public/index.html

@@ -21,17 +21,7 @@
       </div>
     </div>
     <nav class="header__nav">
-      <button class="nav-btn active" data-view="board" title="Kanban board: every HU of the selected project, grouped by status (Pending → Certified → Done). Click an HU card to expand the detail panel.">Board</button>
-      <button class="nav-btn" data-view="graph" title="Dependency graph of the selected project's HUs — who blocks whom. Useful before scheduling work.">Graph</button>
-      <button class="nav-btn" data-view="dashboard" title="Per-project landing: stats grid + project list. Click a project card to focus the kanban / graph on that project.">Dashboard</button>
-      <button class="nav-btn" data-view="sessions" title="Every kj run that has touched the board, newest first. Filter by project; click a session to inspect its iterations, commits and checkpoints.">Sessions</button>
-      <button class="nav-btn" data-view="governance" title="The acta: policy rules by friction, the hash-chained decision log and its anchor, standing exceptions with owner and expiry, renewals and signals.">Governance</button>
-      <a class="nav-btn" href="/pipeline.html" title="Live observability of pipeline runs (Karajan v2.7+): stage timings, agent calls, decision logs.">Pipeline</a>
-      <a class="nav-btn" href="/rag.html" title="RAG retrieval-quality dashboard: chunk counts, embedder provider, db size.">RAG</a>
-      <a class="nav-btn" href="/wiki.html" title="Search the per-project QMD semantic wiki (docs, plans, reviews).">Wiki</a>
-      <select class="project-select" id="project-select">
-        <option value="">All Projects</option>
-      </select>
+      <button class="nav-btn active" data-view="dashboard" title="Per-project landing: stats grid + project list. Click a project card to load that project — its views appear in the project bar below.">Dashboard</button>
       <div class="header__controls">
         <button class="control-btn" id="help-btn" title="What does each view do? Quick reference for Board / Graph / Dashboard / Sessions / Pipeline.">?</button>
         <button class="control-btn" id="config-btn" title="Configurar Karajan (modelos, agentes, tope de iteraciones, …)">⚙</button>
@@ -44,6 +34,20 @@
     </nav>
   </header>
 
+  <!-- KJC-TSK-0820: project sub-bar. Hidden until a project is loaded from
+       the dashboard; every entry here shows data of THAT project. Switching
+       projects = back to Dashboard (the select is gone on purpose). -->
+  <nav class="project-nav" id="project-nav" hidden>
+    <span class="project-nav__name" id="project-nav-name"></span>
+    <button class="nav-btn nav-btn--project" data-view="board" title="Kanban board: every HU of the loaded project, grouped by status (Pending → Certified → Done). Click an HU card to expand the detail panel.">Board</button>
+    <button class="nav-btn nav-btn--project" data-view="graph" title="Dependency graph of the loaded project's HUs — who blocks whom. Useful before scheduling work.">Graph</button>
+    <button class="nav-btn nav-btn--project" data-view="sessions" title="Every kj run of the loaded project, newest first. Click a session to inspect its iterations, commits and checkpoints.">Sessions</button>
+    <button class="nav-btn nav-btn--project" data-view="governance" title="The acta: policy rules by friction, the hash-chained decision log and its anchor, standing exceptions with owner and expiry, renewals and signals.">Governance</button>
+    <a class="nav-btn nav-btn--project" href="/pipeline.html" title="Live observability of pipeline runs (Karajan v2.7+): stage timings, agent calls, decision logs.">Pipeline</a>
+    <a class="nav-btn nav-btn--project" href="/rag.html" title="RAG retrieval-quality dashboard: chunk counts, embedder provider, db size.">RAG</a>
+    <a class="nav-btn nav-btn--project" href="/wiki.html" title="Search the per-project QMD semantic wiki (docs, plans, reviews).">Wiki</a>
+  </nav>
+
   <main class="main" id="app">
     <div class="loading">
       <div class="loading__spinner"></div>

package/packages/hu-board/public/styles.css

@@ -124,20 +124,36 @@ a:hover {
   border-color: var(--accent-purple);
 }
 
-.project-select {
-  background: var(--bg-primary);
-  border: 1px solid var(--border);
-  color: var(--text-primary);
-  padding: 6px 12px;
-  border-radius: var(--radius-sm);
-  font-family: var(--font-sans);
+/* ---- Project sub-bar (KJC-TSK-0820) ----
+ * Second nav level, only visible while a project is loaded. Teal, not
+ * purple: project-scoped actions must read as a different tier from the
+ * generic header. */
+.project-nav {
+  display: flex;
+  gap: 8px;
+  align-items: center;
+  flex-wrap: wrap;
+  padding: 8px 24px;
+  background: var(--bg-card);
+  border-bottom: 1px solid var(--border);
+}
+
+.project-nav[hidden] {
+  display: none;
+}
+
+.project-nav__name {
+  color: var(--accent-teal);
+  font-weight: 600;
   font-size: 0.85rem;
-  cursor: pointer;
+  margin-right: 8px;
 }
 
-.project-select:focus {
-  outline: none;
-  border-color: var(--accent-purple);
+.nav-btn--project:hover,
+.nav-btn--project.active {
+  background: var(--accent-teal-dim);
+  color: var(--bg-primary);
+  border-color: var(--accent-teal-dim);
 }
 
 .header__controls {
@@ -955,13 +971,12 @@ a:hover {
 /* ---- Scoped-project mode (URL: /p/<slug>) ---- */
 /* Hide multi-project affordances when the board is scoped to a single
  * project — the page only makes sense as "this project's Kanban".
- * Multi-project UX (the All Projects selector, the Sessions tab, the
+ * Multi-project UX (the Dashboard picker, the Sessions tab, the
  * Pipeline page link) adds noise and broke the user's mental model
  * during dogfooding. */
-body.scoped-mode .project-select,
 body.scoped-mode .nav-btn[data-view="sessions"],
 body.scoped-mode .nav-btn[data-view="dashboard"],
-body.scoped-mode .header__nav a[href="/pipeline.html"] {
+body.scoped-mode a[href="/pipeline.html"] {
   display: none;
 }
 

package/packages/hu-board/public/utils/graph-view.js

@@ -99,7 +99,7 @@ async function renderGraph() {
   if (!selectedProject) {
     app.innerHTML = renderEmptyState(
       'Pick a project first',
-      'The dependency graph is per-project. Choose one in the dropdown above and I will draw its HU DAG.'
+      'The dependency graph is per-project. Pick one on the Dashboard and I will draw its HU DAG.'
     );
     return;
   }

package/packages/hu-board/public/utils/init-listeners.js

@@ -6,8 +6,7 @@
 // the boot block run.
 //
 // Globals consumed from earlier scripts / app.js:
-//   - navigate(), render(), handleRoute(),
-//     populateProjectSelect()         (app.js)
+//   - navigate(), render(), handleRoute() (app.js)
 //   - showCommandLauncher(),
 //     nextIsTestValue()               (utils/command-launcher.js)
 //   - showHelp(), showConfirm(),
@@ -32,13 +31,6 @@ document.querySelectorAll('.nav-btn').forEach((btn) => {
   btn.addEventListener('click', () => navigate(btn.dataset.view));
 });
 
-// Project selector
-document.getElementById('project-select').addEventListener('change', (e) => {
-  selectedProject = e.target.value;
-  window.location.hash = selectedProject ? `${currentView}/${selectedProject}` : currentView;
-  render();
-});
-
 // Sync button — re-scan disk for new batches
 document.getElementById('sync-btn').addEventListener('click', async () => {
   const btn = document.getElementById('sync-btn');
@@ -46,7 +38,6 @@ document.getElementById('sync-btn').addEventListener('click', async () => {
   btn.textContent = '⏳';
   try {
     await fetch('/api/sync', { method: 'POST' });
-    await populateProjectSelect();
     render();
   } catch { /* ignore */ }
   btn.textContent = '🔄';
@@ -106,7 +97,6 @@ document.addEventListener('click', async (e) => {
     });
     if (!res.ok) throw new Error(`HTTP ${res.status}`);
     // Re-render the project list so the badge reflects the new value.
-    await populateProjectSelect();
     render();
   } catch (err) {
     await showError(err.message, { title: 'Failed to update is_test' });
@@ -130,7 +120,6 @@ document.addEventListener('click', async (e) => {
   try {
     const res = await fetch(`/api/projects/${encodeURIComponent(projectId)}`, { method: 'DELETE' });
     if (!res.ok) throw new Error(`HTTP ${res.status}`);
-    await populateProjectSelect();
     render();
   } catch (err) {
     await showError(err.message, { title: 'Failed to delete project' });
@@ -161,7 +150,6 @@ startStandbyPolling();
 
 // Initial load — sync disk data first so new batches are visible
 triggerSync().then(() => {
-  populateProjectSelect();
   handleRoute();
   subscribeToServerEvents();
 });
@@ -174,7 +162,6 @@ triggerSync().then(() => {
 refreshInterval = setInterval(async () => {
   if (document.getElementById('modal-backdrop').classList.contains('hidden')) {
     await triggerSync();
-    await populateProjectSelect();
     await smartRefresh(null);
   }
 }, 60_000);

package/packages/hu-board/public/utils/maggle-mode.js

@@ -29,7 +29,7 @@ const MAGGLE_LABELS = {
   'nav.board': 'Tablero',
   'nav.dashboard': 'Proyectos',
   'nav.more': 'Más',
-  'picker.hint': 'Elige un proyecto para ver su tablero. Puedes cambiar de proyecto arriba a la derecha.',
+  'picker.hint': 'Elige un proyecto para ver su tablero. Para cambiar de proyecto, vuelve a «Proyectos».',
   'picker.project': 'proyecto',
   'launcher.title': '📝 Pedir trabajo a Karajan',
   'launcher.planLabel': '📝 Pedir trabajo nuevo',
@@ -86,7 +86,10 @@ function applyMaggleChrome() {
   if (!nav) return;
   const KEEP = { board: MAGGLE_LABELS['nav.board'], dashboard: MAGGLE_LABELS['nav.dashboard'] };
   const advanced = [];
-  for (const btn of nav.querySelectorAll('.nav-btn')) {
+  // KJC-TSK-0820: nav buttons live in TWO bars now — the generic header
+  // and the project sub-bar (#project-nav). Fold both; Tablero stays in
+  // the sub-bar so it only shows once a project is loaded.
+  for (const btn of document.querySelectorAll('.header__nav .nav-btn, .project-nav .nav-btn')) {
     const view = btn.dataset.view;
     if (view && KEEP[view]) {
       btn.title = `${btn.textContent.trim()} — ${btn.title}`;
@@ -118,8 +121,11 @@ function applyMaggleChrome() {
       expert.remove();
     }
   });
-  // After the LAST nav button, so the plain row reads Tablero | Proyectos | Más.
-  advanced.at(-1).after(more);
+  // In the GENERIC bar (before the control buttons), so the plain header
+  // reads Proyectos | Más and the sub-bar keeps only Tablero.
+  const controls = nav.querySelector('.header__controls');
+  if (controls) controls.before(more);
+  else nav.append(more);
 }
 
 if (typeof document !== 'undefined' && document.addEventListener) {

package/packages/hu-board/public/utils/project-actions.js

@@ -11,8 +11,7 @@
 //   - formatDuration()            (utils/formatters.js)
 //   - projectNameCache            (mutable in app.js — assignment crosses
 //                                  scripts transparently)
-//   - populateProjectSelect()     (app.js)
-//   - renderBoard()               (app.js)
+//   - render()                    (app.js)
 
 /**
  * PR-G: rename a project from the header ✎ button. Opens a small
@@ -67,11 +66,11 @@ window.renameProjectModal = function renameProjectModal(projectId, currentName)
         return;
       }
       // Update the cached display name + refresh the board so the
-      // header, dropdown and project picker all show the new value.
+      // header, project bar and project picker all show the new value.
       projectNameCache[projectId] = newName;
       try { dlg.close(); } catch { /* ignore */ }
-      await populateProjectSelect();
-      await renderBoard();
+      // render() (not renderBoard()) so the project bar name refreshes too.
+      await render();
     } catch (err) {
       errorEl.style.display = 'block';
       errorEl.textContent = err.message || String(err);

package/packages/hu-board/public/utils/project-picker-view.js

@@ -74,7 +74,7 @@ async function renderProjectPicker() {
       <span class="section-header__count">${sorted.length} ${maggleText('picker.project', 'project')}${sorted.length === 1 ? '' : 's'}</span>
     </div>
     <p style="padding:8px 4px 16px;color:var(--text-muted);font-size:0.9rem">
-      ${maggleText('picker.hint', 'Pick a project to see its kanban. Use the project selector in the header to switch later.')}
+      ${maggleText('picker.hint', 'Pick a project to see its kanban. To switch later, go back to the Dashboard.')}
     </p>
     <div style="display:grid;grid-template-columns:repeat(auto-fill, minmax(320px, 1fr));gap:14px">
       ${sorted.map((p) => {

package/packages/hu-board/src/db.js

@@ -377,6 +377,19 @@ export function ensureDb() {
  * @param {{ id: string, name?: string, first_seen?: string, last_activity?: string, total_stories?: number }} project
  */
 export function upsertProject(project) {
+  // KJC-BUG-0163 — the iron rule: a project NAME is unique on the dashboard.
+  // Two projects with the same visible name are indistinguishable in the
+  // picker; registering the second fails LOUD instead of blending in.
+  if (project.name) {
+    const clash = getDb()
+      .prepare('SELECT id FROM projects WHERE name = ? AND id != ?')
+      .get(project.name, project.id);
+    if (clash) {
+      throw new Error(
+        `board: el nombre "${project.name}" ya pertenece al proyecto "${clash.id}" — dos proyectos no pueden llamarse igual (KJC-BUG-0163); renombra el plan o el directorio de "${project.id}"`,
+      );
+    }
+  }
   // is_shared (KJC-PRP-0002 PR3) is set by sync when a plan came from
   // `.karajan-shared/`. COALESCE with the existing column keeps the badge
   // once it's been promoted — a second non-shared plan won't unset it.

package/packages/hu-board/src/sync.js

@@ -456,7 +456,12 @@ export function syncPlanFile(filePath) {
     //      with a SPEC about "Linux Assistant", the basename here would
     //      misleadingly say "Hu Board" — that's why plan.name wins.
     //   3. slugToTitle of the task / projectId as a last resort.
-    const projectName = data.name
+    // KJC-BUG-0162: the default backlog plan is named "brain-backlog" — a
+    // DEFAULT, not a user choice. Every project synced through it ended up
+    // named "brain-backlog", indistinguishable in the picker. Only a real,
+    // user-given plan name may override the repo-derived name.
+    const userGivenName = data.name && data.name !== 'brain-backlog' ? data.name : null;
+    const projectName = userGivenName
       || (canonicalDir ? titleCaseBasename(basename(canonicalDir)) : null)
       || slugToTitle(data.task || '')
       || projectId;

package/src/cli/register-meta.js

@@ -372,6 +372,7 @@ export function registerMeta(program, { pkgVersion }) {
     .option("--rule <rule_id>", "Regla exacta (p.ej. roles.coder.write.deny)")
     .option("--until <iso>", "Caducidad ISO-8601 (p.ej. 2026-09-01T00:00:00Z)")
     .option("--reason <text>", "Justificación escrita en el momento")
+    .option("--global", "Ámbito global (~/.karajan): vale para todos tus proyectos de esta máquina — KJC-TSK-0813")
     .action(async (flags) => {
       await withConfig(pkgVersion, "policy-grant", flags, async ({ config }) => {
         process.exitCode = await policyCommand({ action: "grant", config, flags });

package/src/commands/policy.js

@@ -12,7 +12,7 @@ import { createHash } from "node:crypto";
 import { readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { checkStagedDiff, evalToolCall, loadPolicy } from "../policy/engine.js";
-import { loadExceptionRecords, loadStandingExceptions, recordPolicyException } from "../policy/exceptions.js";
+import { loadExceptionRecords, loadGlobalExceptionRecords, loadStandingExceptions, recordPolicyException } from "../policy/exceptions.js";
 import { buildPolicyReport } from "../policy/report.js";
 import { policyFileHash, recordGateDecision } from "../policy/decisions.js";
 import { readIdentity } from "../identity/store.js";
@@ -110,12 +110,16 @@ export async function policyCommand({ action, config = {}, flags = {}, logger =
       // regla re-concedida N veces es la política real pidiendo que la
       // cambien por su cauce. Se cuenta contra TODAS las permanentes previas
       // (vencidas incluidas: precisamente esas son la sedimentación).
-      const previous = loadStandingExceptions(projectDir).standing.filter((e) => e.rule_id === rule).length;
+      // KJC-TSK-0813: --global escribe en ~/.karajan (todos los proyectos de
+      // la máquina). El contador de renovaciones cuenta sobre la FUSIÓN.
+      const scope = flags.global ? "global" : "project";
+      const previous = loadStandingExceptions(projectDir, { home: deps.home }).standing.filter((e) => e.rule_id === rule).length;
       const rec = recordPolicyException({
-        projectDir,
+        projectDir, scope, deps: { home: deps.home },
         entry: { rule_id: rule, justification: reason.trim(), scopeKind: "permanente", expiresAt: until },
       });
-      logger.info?.(`✓ excepción permanente registrada: [${rec.rule_id}] hasta ${rec.expiresAt} — concedida por ${rec.who?.git ?? "?"} (${rec.who?.grade ?? "?"})`);
+      const ambit = scope === "global" ? " [ámbito global — todos tus proyectos de esta máquina]" : "";
+      logger.info?.(`✓ excepción permanente registrada${ambit}: [${rec.rule_id}] hasta ${rec.expiresAt} — concedida por ${rec.who?.git ?? "?"} (${rec.who?.grade ?? "?"})`);
       if (previous >= 1) {
         logger.warn?.(`⚠ ${previous + 1}ª concesión sobre esta regla — una excepción que se renueva ya no es una excepción: considera cambiar la política por su cauce (PR a .karajan/policy.yml)`);
       }
@@ -134,7 +138,11 @@ export async function policyCommand({ action, config = {}, flags = {}, logger =
     try {
       decisionLines = readFileSync(join(projectDir, ".karajan", "policy-decisions.jsonl"), "utf8").split("\n").filter((l) => l.trim());
     } catch { /* sin decisiones aún: el informe lo dice con ceros */ }
-    const exc = loadExceptionRecords(projectDir);
+    // KJC-TSK-0813 (AC3): el informe cubre TAMBIÉN el almacén global — cada
+    // registro llega con su origin FÍSICO estampado por la carga.
+    const proj = loadExceptionRecords(projectDir);
+    const glob = loadGlobalExceptionRecords({ home: deps.home });
+    const exc = { records: [...proj.records, ...glob.records], discarded: proj.discarded + glob.discarded };
     const soonDays = Number(flags.soon ?? 7);
     const report = buildPolicyReport({ decisionLines, exceptionRecords: exc.records, policy, soonDays: Number.isFinite(soonDays) ? soonDays : 7 });
     if (flags.json) {
@@ -152,8 +160,10 @@ export async function policyCommand({ action, config = {}, flags = {}, logger =
       const meta = [r.enforcement && `enforcement=${r.enforcement}`, r.class && `class=${r.class}`].filter(Boolean).join(" ");
       logger.info?.(`  [${r.rule_id}] ${meta} — warn ${r.warns} · deny ${r.denies} · exempt ${r.exempts} · abiertas ${r.open}`);
     }
-    logger.info?.(`concesiones: vivas ${g.alive.length} (próximas a vencer ${g.soon.length}) · vencidas ${g.expired.length} · puntuales ${g.point}`);
-    for (const e of g.alive) logger.info?.(`  [${e.rule_id}] hasta ${e.expiresAt} — ${e.who?.git ?? "?"}: ${e.justification ?? "sin justificación"}`);
+    // Con 0 globales el resumen queda EXACTAMENTE como siempre (hay consumidores de texto).
+    const globals = g.alive.filter((e) => e.origin === "global").length;
+    logger.info?.(`concesiones: vivas ${g.alive.length} (${globals > 0 ? `${globals} globales, ` : ""}próximas a vencer ${g.soon.length}) · vencidas ${g.expired.length} · puntuales ${g.point}`);
+    for (const e of g.alive) logger.info?.(`  [${e.rule_id}] hasta ${e.expiresAt}${e.origin === "global" ? " [global]" : ""} — ${e.who?.git ?? "?"}: ${e.justification ?? "sin justificación"}`);
     logger.info?.(report.signals.length > 0 ? "señales:" : "señales: ninguna");
     for (const s of report.signals) logger.warn?.(`  ⚠ ${s}`);
     return chain.ok ? 0 : 1;

package/src/commands/review-gate.js

@@ -52,6 +52,13 @@ async function rawDiff(range, extraArgs = []) {
   return res.stdout;
 }
 
+// KJC-TSK-0813 (AC3): la exención dice su PROCEDENCIA — un standing global
+// (concedido para toda la máquina) no pasa por uno del proyecto. El texto
+// de las de proyecto queda EXACTAMENTE como estaba.
+export const formatExempted = (e) => (e.standing
+  ? `⚠ policy standing [${e.rule_id}] — excepción permanente${e.standing.origin === "global" ? " GLOBAL" : ""} viva hasta ${e.standing.expiresAt} (${e.standing.justification || "sin justificación"})`
+  : `⚠ policy exempt [${e.rule_id}] — excepción registrada en .karajan/policy-exceptions.jsonl (${e.justification})`);
+
 function printVerdict(record) {
   if (record.verdict === "approved") {
     const ws = record.workspace ? ` [${record.workspace}]` : "";
@@ -257,11 +264,7 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
   });
   const at = (v) => (v.file ? ` (${v.file})` : "");
   for (const w of gate.warns) console.log(`⚠ policy [${w.rule_id}] ${w.reason}${at(w)}`);
-  for (const e of gate.exempted) {
-    console.log(e.standing
-      ? `⚠ policy standing [${e.rule_id}] — excepción permanente viva hasta ${e.standing.expiresAt} (${e.standing.justification || "sin justificación"})`
-      : `⚠ policy exempt [${e.rule_id}] — excepción registrada en .karajan/policy-exceptions.jsonl (${e.justification})`);
-  }
+  for (const e of gate.exempted) console.log(formatExempted(e));
   // GOV-C (KJC-TSK-0747): las decisiones de chokepoint dejan rastro
   // hash-encadenado — cada deny, cada excepción, y el allow del commit.
   const chokepoint = flags.check ? "commit" : "review";

package/src/harden/sentinel-hooks.js

@@ -43,6 +43,7 @@ export const CARD = new RegExp(${JSON.stringify(CARD_REF_RE.source)}, "i");
 export const BASE_BRANCHES = new Set(["main", "master"]);
 export const load = () => { try { return JSON.parse(readFileSync(STATE, "utf8")); } catch { return {}; } };
 export const save = (state) => writeFileSync(STATE, JSON.stringify(state, null, 2));
+export const doc = (a) => " — doc: https://karajancode.com/docs/guides/sentinel/#" + a;
 export const session = (state, sid) => {
   state.sessions ||= {};
   return (state.sessions[sid] ||= { edited_sources: [], edited_tests: [], escapes: [], errors: [], blocks: 0 });
@@ -108,9 +109,9 @@ export const recordEscape = (sid, escape, tool) => {
     const args = ["policy", "seal", "--escape", escape];
     if (tool) args.push("--tool", String(tool));
     const r = spawnSync("kj", args, { cwd: ROOT, encoding: "utf8" });
-    if (r.error || r.status !== 0) console.error("kj sentinel: escape " + escape + " usado pero NO sellado en el decision log (kj policy seal " + (r.error ? r.error.message : "exit " + r.status) + ") — revisa kj; el escape queda solo en sentinel-state.json");
+    if (r.error || r.status !== 0) console.error("karajan sentinel: escape " + escape + " usado pero NO sellado en el decision log (kj policy seal " + (r.error ? r.error.message : "exit " + r.status) + ") — revisa kj; el escape queda solo en sentinel-state.json" + doc("escapes"));
   } catch (e) {
-    console.error("kj sentinel: escape " + escape + " usado pero NO sellado en el decision log: " + e.message);
+    console.error("karajan sentinel: escape " + escape + " usado pero NO sellado en el decision log: " + e.message + doc("escapes"));
   }
 };
 `;
@@ -121,7 +122,7 @@ const POST_BODY = `#!/usr/bin/env node
 // a tool call (PostToolUse, always exit 0).
 import { relative } from "node:path";
 import { spawnSync } from "node:child_process";
-import { CODE, TESTS, ROOT, CARD, branchOf, load, save, session } from "./sentinel-lib.mjs";
+import { doc, CODE, TESTS, ROOT, CARD, branchOf, load, save, session } from "./sentinel-lib.mjs";
 const ESCAPES = ["KJ_ALLOW_WRITE", "KJ_ALLOW_REWRITE", "KJ_ALLOW_NO_CARD", "KJ_ALLOW_NO_TESTS", "KJ_ALLOW_PII", "KJ_ALLOW_POLICY", "KJ_ALLOW_IDENTITY", "KJ_ALLOW_BOARD"];
 let raw = "";
 process.stdin.on("data", (d) => { raw += d; });
@@ -233,7 +234,7 @@ import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { load, save, branchOf, violations, ROOT } from "./sentinel-lib.mjs";
+import { doc, load, save, branchOf, violations, ROOT } from "./sentinel-lib.mjs";
 // KJC-TSK-0774: when the turn ends green with cards closed, remind the user
 // where to look — the board URL if it runs (pid file alive), else how to start it.
 const boardHint = () => {
@@ -274,10 +275,10 @@ process.stdin.on("end", () => {
       state.tamper_blocks = (state.tamper_blocks || 0) + 1;
       save(state);
       if (state.tamper_blocks > 3) {
-        console.error("kj sentinel: fail-open tras 3 bloqueos por manipulacion sin restaurar — corre kj harden y avisa a tu usuario");
+        console.error("karajan sentinel: fail-open tras 3 bloqueos por manipulacion sin restaurar — corre kj harden y avisa a tu usuario" + doc("supervisor"));
         process.exit(0);
       }
-      console.error("kj sentinel: scripts del supervisor modificados fuera de kj harden (" + tampered.join(", ") + ") — restaura con kj harden antes de terminar; si lo cambiaste tu (humano), reinstalar lo deja en verde.");
+      console.error("karajan sentinel: scripts del supervisor modificados fuera de kj harden (" + tampered.join(", ") + ") — restaura con kj harden antes de terminar; si lo cambiaste tu (humano), reinstalar lo deja en verde." + doc("supervisor"));
       process.exit(2);
     }
     state.tamper_blocks = 0;
@@ -296,7 +297,7 @@ process.stdin.on("end", () => {
     }
     const s = state.sessions?.[sid];
     if (!s) {
-      if (claimsBlock) { console.error("kj sentinel: el turno NO puede terminar:" + String.fromCharCode(10) + "- " + claimsBlock); process.exit(2); }
+      if (claimsBlock) { console.error("karajan sentinel: el turno NO puede terminar:" + String.fromCharCode(10) + "- " + claimsBlock + doc("claims")); process.exit(2); }
       if (claimsNote) console.log(JSON.stringify({ systemMessage: claimsNote }));
       process.exit(0);
     }
@@ -306,9 +307,9 @@ process.stdin.on("end", () => {
       s.blocks = 0;
       const notes = [];
       if (claimsNote) notes.push(claimsNote);
-      if ((s.escapes || []).length) notes.push("kj sentinel: esta sesion uso " + s.escapes.length + " escape(s): " + s.escapes.join(", ") + " — decision registrada; detalle en kj sentinel status.");
+      if ((s.escapes || []).length) notes.push("karajan sentinel: esta sesion uso " + s.escapes.length + " escape(s): " + s.escapes.join(", ") + " — decision registrada; detalle en kj sentinel status.");
       if ((s.closed_cards || []).length) {
-        notes.push("kj sentinel: card(s) cerrada(s) en este turno: " + s.closed_cards.join(", ") + " — el board las muestra: " + boardHint());
+        notes.push("karajan sentinel: card(s) cerrada(s) en este turno: " + s.closed_cards.join(", ") + " — el board las muestra: " + boardHint());
         s.closed_cards = [];
       }
       save(state);
@@ -319,11 +320,11 @@ process.stdin.on("end", () => {
     if (s.blocks > 3) {
       (s.errors ||= []).push("fail-open: 3 bloqueos consecutivos sin resolver — el sentinel se aparta para no colgar la sesion");
       save(state);
-      console.error("kj sentinel: fail-open tras 3 bloqueos sin resolver — revisa kj sentinel status con tu usuario");
+      console.error("karajan sentinel: fail-open tras 3 bloqueos sin resolver — revisa kj sentinel status con tu usuario" + doc("stop-gate"));
       process.exit(0);
     }
     save(state);
-    console.error("kj sentinel: el turno NO puede terminar con el metodo en rojo:\\n" + v.map((x) => "- " + x).join("\\n") + "\\nResuelve las violaciones (o pide a tu usuario el escape) y termina de nuevo. Estado: kj sentinel status");
+    console.error("karajan sentinel: el turno NO puede terminar con el metodo en rojo:\\n" + v.map((x) => "- " + x).join("\\n") + "\\nResuelve las violaciones (o pide a tu usuario el escape) y termina de nuevo. Estado: kj sentinel status" + doc("stop-gate"));
     process.exit(2);
   } catch { /* fail open */ }
   process.exit(0);
@@ -340,7 +341,7 @@ import { dirname, join, relative, resolve } from "node:path";
 import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { homedir } from "node:os";
-import { CODE, TESTS, ROOT, BASE_BRANCHES, CARD, branchOf, foreignLane, load, save, session, violations, recordEscape, pendingMoves, pendingText } from "./sentinel-lib.mjs";
+import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, branchOf, foreignLane, load, save, session, violations, recordEscape, pendingMoves, pendingText } from "./sentinel-lib.mjs";
 const EDIT_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
 const PUBLISH = /\\bnpm\\s+publish\\b|\\bfirebase\\s+deploy\\b|\\bgh\\s+release\\s+create\\b/;
 const PUSH = /\\bgit\\s+push\\b/;
@@ -357,7 +358,7 @@ process.stdin.on("end", () => {
       const target = input.file_path || input.notebook_path;
       const relT = target ? relative(ROOT, String(target)).replaceAll("\\\\", "/") : "";
       if (relT && PROTECTED.test(relT)) {
-        console.error("kj sentinel: ese fichero es parte del supervisor (" + relT + ") — solo el humano desmonta el sentinel, editalo fuera de la sesion.");
+        console.error("karajan sentinel: ese fichero es parte del supervisor (" + relT + ") — solo el humano desmonta el sentinel, editalo fuera de la sesion." + doc("supervisor"));
         process.exit(2);
       }
     }
@@ -367,7 +368,7 @@ process.stdin.on("end", () => {
     // substitution) cannot be resolved from command text: that vector is
     // caught by the Stop gate's checksum verification, which blocks the turn.
     if (tool === "Bash" && PROTECTED.test(String(input.command || "").replaceAll("\\\\", "/"))) {
-      console.error("kj sentinel: los ficheros del supervisor no se tocan desde Bash — consultalos con la tool Read/Grep; solo el humano los modifica, fuera de la sesion.");
+      console.error("karajan sentinel: los ficheros del supervisor no se tocan desde Bash — consultalos con la tool Read/Grep; solo el humano los modifica, fuera de la sesion." + doc("supervisor"));
       process.exit(2);
     }
     if (process.env.KJ_SENTINEL_OFF === "1") process.exit(0);
@@ -411,7 +412,7 @@ process.stdin.on("end", () => {
       if (bad === null) return true;
       if (!escNoted.has(name)) {
         escNoted.add(name);
-        console.error("kj sentinel: " + name + "=1 presente pero IGNORADO — el escape solo vale en un comando simple y este contiene " + JSON.stringify(bad) + " fuera de comillas simples (sin ; | & $ ( ) backtick ni salto de linea: parte el comando o usa -F fichero)");
+        console.error("karajan sentinel: " + name + "=1 presente pero IGNORADO — el escape solo vale en un comando simple y este contiene " + JSON.stringify(bad) + " fuera de comillas simples (sin ; | & $ ( ) backtick ni salto de linea: parte el comando o usa -F fichero)" + doc("escapes"));
       }
       return false;
     };
@@ -530,7 +531,7 @@ process.stdin.on("end", () => {
       if (problems.length > 0) {
         if (escOn("KJ_ALLOW_IDENTITY")) { recordEscape(sid, "KJ_ALLOW_IDENTITY", tool); }
         else {
-          console.error("kj sentinel: identity lock (ADR 0005) —" + problems.map((p) => ESC_NL + "- " + p).join("") + ESC_NL + "(KJ_ALLOW_IDENTITY=1 = excepcion consciente, queda registrada)");
+          console.error("karajan sentinel: identity lock (ADR 0005) —" + problems.map((p) => ESC_NL + "- " + p).join("") + ESC_NL + "(KJ_ALLOW_IDENTITY=1 = excepcion consciente, queda registrada)" + doc("identity"));
           process.exit(2);
         }
       }
@@ -553,7 +554,7 @@ process.stdin.on("end", () => {
     };
     const laneDeny = (what, lane) => {
       if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); return false; }
-      console.error("kj sentinel: " + what + " vive en otro carril (" + lane + ") de este repo — cada sesion muta solo SU worktree (MONO-0). Cruce deliberado: KJ_ALLOW_CROSS_LANE=1, queda registrado.");
+      console.error("karajan sentinel: " + what + " vive en otro carril (" + lane + ") de este repo — cada sesion muta solo SU worktree (MONO-0). Cruce deliberado: KJ_ALLOW_CROSS_LANE=1, queda registrado." + doc("cross-lane"));
       return true;
     };
     if (EDIT_TOOLS.includes(tool)) {
@@ -581,7 +582,7 @@ process.stdin.on("end", () => {
         if (/(^|[;&|(\\s])(cd|pushd)([ \\t]|$)/.test(cmd)) {
           if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); }
           else {
-            console.error("kj sentinel: cd/pushd en un comando mutador — las rutas posteriores no son verificables por el guard de carriles (MONO-0); usa git -C / npm --prefix / rutas ABSOLUTAS sin cd (o KJ_ALLOW_CROSS_LANE=1, queda registrado).");
+            console.error("karajan sentinel: cd/pushd en un comando mutador — las rutas posteriores no son verificables por el guard de carriles (MONO-0); usa git -C / npm --prefix / rutas ABSOLUTAS sin cd (o KJ_ALLOW_CROSS_LANE=1, queda registrado)." + doc("cross-lane"));
             process.exit(2);
           }
         }
@@ -600,7 +601,7 @@ process.stdin.on("end", () => {
         if (/>{1,2}[ \\t]*["']?[\\$\`]/.test(cmd)) {
           if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); }
           else {
-            console.error("kj sentinel: redireccion con destino tras variable/sustitucion — el guard de carriles no puede verificarlo (MONO-0); usa una ruta LITERAL (o KJ_ALLOW_CROSS_LANE=1, queda registrado).");
+            console.error("karajan sentinel: redireccion con destino tras variable/sustitucion — el guard de carriles no puede verificarlo (MONO-0); usa una ruta LITERAL (o KJ_ALLOW_CROSS_LANE=1, queda registrado)." + doc("cross-lane"));
             process.exit(2);
           }
         }
@@ -666,7 +667,7 @@ process.stdin.on("end", () => {
         if (/\\$\\(|\`/.test(cmd) || quotedPathWithSpaces(cmd)) {
           if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); }
           else {
-            console.error("kj sentinel: sustitucion de comandos o ruta entrecomillada con espacios en un comando mutador — no verificable por el guard de carriles (MONO-0); usa valores/rutas LITERALES sin sustitucion (o KJ_ALLOW_CROSS_LANE=1, queda registrado).");
+            console.error("karajan sentinel: sustitucion de comandos o ruta entrecomillada con espacios en un comando mutador — no verificable por el guard de carriles (MONO-0); usa valores/rutas LITERALES sin sustitucion (o KJ_ALLOW_CROSS_LANE=1, queda registrado)." + doc("cross-lane"));
             process.exit(2);
           }
         }
@@ -675,7 +676,7 @@ process.stdin.on("end", () => {
         if (!segs.every((s) => !/[\\$]/.test(s) || SAFE_EXP_SEG.test(s))) {
           if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); }
           else {
-            console.error("kj sentinel: expansion de shell en una herramienta generica de fichero/interprete — el objetivo no es verificable por el guard de carriles (MONO-0); usa rutas LITERALES o un runner del toolchain (o KJ_ALLOW_CROSS_LANE=1, queda registrado).");
+            console.error("karajan sentinel: expansion de shell en una herramienta generica de fichero/interprete — el objetivo no es verificable por el guard de carriles (MONO-0); usa rutas LITERALES o un runner del toolchain (o KJ_ALLOW_CROSS_LANE=1, queda registrado)." + doc("cross-lane"));
             process.exit(2);
           }
         }
@@ -708,7 +709,7 @@ process.stdin.on("end", () => {
       const actorRole = process.env.KJ_POLICY_ROLE || "coder";
       const pres = spawnSync("kj", ["policy", "eval", "--strict", "--role", actorRole, "--tool", tool, "--input", JSON.stringify(input)], { cwd: ROOT, encoding: "utf8" });
       if (pres.error || pres.status === null) {
-        console.error("kj sentinel: .karajan/policy.yml declara enforcement pero kj no es ejecutable — la policy no se puede evaluar; restaura kj en el PATH (npm i -g @karajan-family/code, o el nombre legacy karajan-code) o retira la policy conscientemente.");
+        console.error("karajan sentinel: .karajan/policy.yml declara enforcement pero kj no es ejecutable — la policy no se puede evaluar; restaura kj en el PATH (npm i -g @karajan-family/code, o el nombre legacy karajan-code) o retira la policy conscientemente." + doc("policy"));
         process.exit(2);
       }
       if (pres.status === 2) {
@@ -717,13 +718,13 @@ process.stdin.on("end", () => {
         const secure = !!(v && v.class === "security");
         if (!secure && escOn("KJ_ALLOW_POLICY")) { recordEscape(sid, "KJ_ALLOW_POLICY", tool); }
         else {
-          console.error("kj sentinel: policy deny [" + ((v && v.rule_id) || "policy") + "] " + ((v && v.reason) || "la tool call viola la policy del proyecto") + (secure ? " [security — sin escape ni arbitraje]" : " (KJ_ALLOW_POLICY=1 = excepcion consciente, queda registrada; el commit exigira ademas KJ_POLICY_REASON)"));
+          console.error("karajan sentinel: policy deny [" + ((v && v.rule_id) || "policy") + "] " + ((v && v.reason) || "la tool call viola la policy del proyecto") + (secure ? " [security — sin escape ni arbitraje]" : " (KJ_ALLOW_POLICY=1 = excepcion consciente, queda registrada; el commit exigira ademas KJ_POLICY_REASON)") + doc("policy"));
           process.exit(2);
         }
       } else if (pres.status !== 0) {
         if (escOn("KJ_ALLOW_POLICY")) { recordEscape(sid, "KJ_ALLOW_POLICY", tool); }
         else {
-          console.error("kj sentinel: kj policy eval fallo (exit " + pres.status + ") — la policy declarada no se pudo evaluar, deny por defecto; diagnostica con kj policy check y corrige .karajan/policy.yml fuera de la sesion (o KJ_ALLOW_POLICY=1 = excepcion consciente, queda registrada).");
+          console.error("karajan sentinel: kj policy eval fallo (exit " + pres.status + ") — la policy declarada no se pudo evaluar, deny por defecto; diagnostica con kj policy check y corrige .karajan/policy.yml fuera de la sesion (o KJ_ALLOW_POLICY=1 = excepcion consciente, queda registrada)." + doc("policy"));
           process.exit(2);
         }
       }
@@ -746,7 +747,7 @@ process.stdin.on("end", () => {
           if (hard.length && blockOn) {
             if (escOn("KJ_ALLOW_STEWARD")) { recordEscape(sid, "KJ_ALLOW_STEWARD", tool); }
             else {
-              console.error("kj sentinel: steward — el estado del proyecto bloquea empezar (barrido " + rep.sweptAt + "):" + String.fromCharCode(10) + hard.map((r) => "- " + r.id + ": " + (r.evidence || "") + " -> " + (r.remedy || r.renew || "kj steward sweep")).join(String.fromCharCode(10)) + String.fromCharCode(10) + "(KJ_ALLOW_STEWARD=1 = excepcion consciente de esta sesion, queda registrada)");
+              console.error("karajan sentinel: steward — el estado del proyecto bloquea empezar (barrido " + rep.sweptAt + "):" + String.fromCharCode(10) + hard.map((r) => "- " + r.id + ": " + (r.evidence || "") + " -> " + (r.remedy || r.renew || "kj steward sweep")).join(String.fromCharCode(10)) + String.fromCharCode(10) + "(KJ_ALLOW_STEWARD=1 = excepcion consciente de esta sesion, queda registrada)" + doc("steward"));
               process.exit(2);
             }
           }
@@ -768,8 +769,8 @@ process.stdin.on("end", () => {
         if (why) {
           if (escOn("KJ_ALLOW_NO_CARD")) { recordEscape(sid, "KJ_ALLOW_NO_CARD", tool); process.exit(0); }
           console.error(why === "base"
-            ? "kj sentinel: no se editan fuentes en la rama base '" + branch + "' — crea la card (kj hu add) y la rama: git checkout -b feat/<CARD-ID>-descripcion. (KJ_ALLOW_NO_CARD=1 = excepcion consciente, queda registrada)"
-            : "kj sentinel: la rama '" + branch + "' no referencia ninguna card — crea/mueve la card a running (kj hu add | kj hu move) y usa una rama feat/<CARD-ID>-descripcion. (KJ_ALLOW_NO_CARD=1 = excepcion consciente, queda registrada)");
+            ? "karajan sentinel: no se editan fuentes en la rama base '" + branch + "' — crea la card (kj hu add) y la rama: git checkout -b feat/<CARD-ID>-descripcion. (KJ_ALLOW_NO_CARD=1 = excepcion consciente, queda registrada)" + doc("card-first")
+            : "karajan sentinel: la rama '" + branch + "' no referencia ninguna card — crea/mueve la card a running (kj hu add | kj hu move) y usa una rama feat/<CARD-ID>-descripcion. (KJ_ALLOW_NO_CARD=1 = excepcion consciente, queda registrada)" + doc("card-first"));
           process.exit(2);
         }
       }
@@ -787,7 +788,7 @@ process.stdin.on("end", () => {
       if (pend.length > 0 && (mergeM || ADVANCE.test(cmd))) {
         if (escOn("KJ_ALLOW_BOARD")) { recordEscape(sid, "KJ_ALLOW_BOARD", tool); }
         else {
-          console.error("kj sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + pend.map((p) => "- " + pendingText(p)).join("\\n") + "\\n(KJ_ALLOW_BOARD=1 = excepcion consciente, queda registrada)");
+          console.error("karajan sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + pend.map((p) => "- " + pendingText(p)).join("\\n") + "\\n(KJ_ALLOW_BOARD=1 = excepcion consciente, queda registrada)" + doc("board-sync"));
           process.exit(2);
         }
       }
@@ -802,7 +803,7 @@ process.stdin.on("end", () => {
         const body = bodyFile[2] || bodyFile[3] || bodyFile[4];
         const g = spawnSync("kj", ["claims", "gate", "--transcript", transcript, "--file", body], { cwd: ROOT, encoding: "utf8" });
         if (!g.error && g.status === 2) {
-          console.error("kj sentinel: claims — un dato del cuerpo de la PR esta DESMENTIDO por las salidas de este turno:\\n" + (g.stderr || "").trim() + "\\nVerificalo o marcalo como no comprobado antes de crear la PR. Detalle: kj claims check --transcript " + transcript + " --file " + body);
+          console.error("karajan sentinel: claims — un dato del cuerpo de la PR esta DESMENTIDO por las salidas de este turno:\\n" + (g.stderr || "").trim() + "\\nVerificalo o marcalo como no comprobado antes de crear la PR. Detalle: kj claims check --transcript " + transcript + " --file " + body + doc("claims"));
           process.exit(2);
         }
       }
@@ -813,7 +814,7 @@ process.stdin.on("end", () => {
         if (res.status !== 0) {
           let items = "";
           try { items = (JSON.parse(res.stdout).checks || []).filter((c) => !c.ok).map((c) => "\\n- " + c.name + ": " + c.detail).join(""); } catch { /* raw output */ }
-          console.error("kj sentinel: release check en ROJO — no se publica ni despliega hasta resolverlo:" + (items || "\\n- corre kj release check para el detalle") + "\\n(KJ_ALLOW_RELEASE=1 = excepcion consciente, queda registrada)");
+          console.error("karajan sentinel: release check en ROJO — no se publica ni despliega hasta resolverlo:" + (items || "\\n- corre kj release check para el detalle") + "\\n(KJ_ALLOW_RELEASE=1 = excepcion consciente, queda registrada)" + doc("release"));
           process.exit(2);
         }
       } else if (PUSH.test(cmd)) {
@@ -827,7 +828,7 @@ process.stdin.on("end", () => {
           v = violations({ ...sess, pending_moves: [] }, branchOf());
         }
         if (v.length) {
-          console.error("kj sentinel: git push con el metodo en rojo:\\n" + v.map((x) => "- " + x).join("\\n") + "\\nResuelve antes de empujar. Estado: kj sentinel status");
+          console.error("karajan sentinel: git push con el metodo en rojo:\\n" + v.map((x) => "- " + x).join("\\n") + "\\nResuelve antes de empujar. Estado: kj sentinel status" + doc("push-gate"));
           process.exit(2);
         }
       }

package/src/harden/workflow-templates.js

@@ -40,7 +40,9 @@ export const NO_AI_ATTRIBUTION_WORKFLOW = [
   "        env:",
   "          BASE_REF: ${{ github.base_ref }}",
   "        run: |",
-  '          msgs=$(git log --format=%B "origin/${BASE_REF}...HEAD" || true)',
+  '          if ! msgs=$(git log --format=%B "origin/${BASE_REF}...HEAD"); then',
+  '            echo "::error::cannot resolve origin/${BASE_REF}...HEAD — the scan did not run"; exit 1',
+  "          fi",
   "          pat='co-authored-by:.*(claude|anthropic|openai|chatgpt|gpt-[0-9]|copilot|gemini|cursor|windsurf|codeium|deepseek)'",
   "          pat=\"$pat|(generated|written|authored|assisted|powered) (by|with|using) .*(claude|anthropic|openai|copilot|gemini)\"",
   '          if printf "%s" "$msgs" | grep -qiE "$pat"; then',

package/src/policy/exceptions.js

@@ -6,7 +6,7 @@
  */
 import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { userInfo } from "node:os";
+import { homedir, userInfo } from "node:os";
 import { spawnSync } from "node:child_process";
 import { recordPolicyException as kernelRecord } from "@karajan-family/governance";
 
@@ -23,20 +23,25 @@ function defaultIdentity(projectDir) {
  * reporta), jamás rompe la evaluación. Las puntuales no dan standing.
  * @returns {{standing: object[], discarded: number}}
  */
-export function loadStandingExceptions(projectDir) {
-  const { records, discarded } = loadExceptionRecords(projectDir);
-  return { standing: records.filter((rec) => rec.scopeKind === "permanente"), discarded };
+export function loadStandingExceptions(projectDir, { home } = {}) {
+  const proj = loadExceptionRecords(projectDir);
+  const glob = loadGlobalExceptionRecords({ home });
+  return {
+    standing: [...proj.records, ...glob.records].filter((rec) => rec.scopeKind === "permanente"),
+    discarded: proj.discarded + glob.discarded,
+  };
 }
 
 /**
- * TODOS los registros del jsonl (permanentes y puntuales) con el mismo parse
- * tolerante — el informe (PL-E) cuenta también las puntuales.
- * @returns {{records: object[], discarded: number}}
+ * Ruta del almacén GLOBAL (~/.karajan): excepciones de la máquina, no de un
+ * proyecto. `home` es inyectable SOLO para tests.
  */
-export function loadExceptionRecords(projectDir) {
+export const globalExceptionsFile = ({ home } = {}) => join(home ?? homedir(), ".karajan", "policy-exceptions.jsonl");
+
+function readRecordsAt(file, origin) {
   let raw;
   try {
-    raw = readFileSync(join(projectDir, ".karajan", "policy-exceptions.jsonl"), "utf8");
+    raw = readFileSync(file, "utf8");
   } catch {
     return { records: [], discarded: 0 };
   }
@@ -49,7 +54,9 @@ export function loadExceptionRecords(projectDir) {
       // JSON válido pero no-objeto (null, número…) es tan corrupto como el
       // que no parsea: se descarta contando (catch de codex, explícito).
       if (typeof rec !== "object" || rec === null) discarded += 1;
-      else records.push(rec);
+      // Procedencia FÍSICA (KJC-TSK-0813): el origin es el almacén del que
+      // se LEYÓ la línea, pisando lo que la línea declare — no se miente.
+      else records.push({ ...rec, origin });
     } catch {
       discarded += 1;
     }
@@ -57,14 +64,43 @@ export function loadExceptionRecords(projectDir) {
   return { records, discarded };
 }
 
+/**
+ * TODOS los registros del jsonl (permanentes y puntuales) con el mismo parse
+ * tolerante — el informe (PL-E) cuenta también las puntuales.
+ * @returns {{records: object[], discarded: number}}
+ */
+export function loadExceptionRecords(projectDir) {
+  return readRecordsAt(join(projectDir, ".karajan", "policy-exceptions.jsonl"), "project");
+}
+
+/** @returns {{records: object[], discarded: number}} */
+export function loadGlobalExceptionRecords({ home } = {}) {
+  return readRecordsAt(globalExceptionsFile({ home }), "global");
+}
+
 function defaultAppend(projectDir, line) {
   const dir = join(projectDir, ".karajan");
   mkdirSync(dir, { recursive: true });
   appendFileSync(join(dir, "policy-exceptions.jsonl"), line, "utf8");
 }
 
+const globalAppend = (home) => (_projectDir, line) => {
+  const dir = join(home ?? homedir(), ".karajan");
+  mkdirSync(dir, { recursive: true });
+  appendFileSync(join(dir, "policy-exceptions.jsonl"), line, "utf8");
+};
+
 /** @returns {object} the recorded entry (with ts + who resolved). */
-export function recordPolicyException({ projectDir, entry, deps = {} }) {
-  const { append = defaultAppend, identity = defaultIdentity } = deps;
-  return kernelRecord({ projectDir, entry, deps: { append, identity } });
+export function recordPolicyException({ projectDir, entry, deps = {}, scope = "project" }) {
+  if (scope !== "project" && scope !== "global") {
+    throw new TypeError(`recordPolicyException: scope "${scope}" no existe — solo project o global`);
+  }
+  // Un global puntual NO existe: lo puntual liga al hash de un artefacto de
+  // UN proyecto; el ámbito global solo admite permanentes con caducidad.
+  if (scope === "global" && (entry?.scopeKind !== "permanente" || !entry?.expiresAt)) {
+    throw new TypeError("recordPolicyException: el ámbito global exige scopeKind permanente con expiresAt — un global puntual no existe");
+  }
+  const { home, append = scope === "global" ? globalAppend(home) : defaultAppend, identity = defaultIdentity } = deps;
+  // El origin escrito es informativo: la carga re-estampa el FÍSICO igualmente.
+  return kernelRecord({ projectDir, entry: { ...entry, origin: scope }, deps: { append, identity } });
 }