karajan-code 4.25.0 → 4.27.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.25.0",
+  "version": "4.27.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/packages/hu-board/public/app.js

@@ -163,6 +163,9 @@ let lastOpenedLog = null;     // { id, label, tailUrl(offset) }
  */
 function navigate(view) {
   currentView = view;
+  // KJC-TSK-0820: going back to the Dashboard unloads the project — it is
+  // the only place where a (different) project gets picked.
+  if (view === 'dashboard' && !scopedProjectSlug) selectedProject = '';
   window.location.hash = selectedProject ? `${view}/${selectedProject}` : view;
 
   // Update active nav button
@@ -179,14 +182,43 @@ function navigate(view) {
  */
 function selectProject(projectId) {
   selectedProject = projectId;
-  document.getElementById('project-select').value = projectId;
   navigate('board');
 }
 
+/**
+ * KJC-TSK-0820 — two-level nav. Which nav bars are visible: the generic
+ * one always; the project sub-bar only while a project is loaded, and
+ * never on the Dashboard (that's where projects get picked). Pure.
+ * @param {string} view
+ * @param {string} projectId
+ * @returns {{ generic: boolean, project: boolean }}
+ */
+function projectNavVisibility(view, projectId) {
+  return { generic: true, project: Boolean(projectId) && view !== 'dashboard' };
+}
+
+/**
+ * Applies projectNavVisibility() to the DOM and stamps the loaded
+ * project's name on the sub-bar.
+ */
+function updateProjectNav() {
+  const bar = document.getElementById('project-nav');
+  if (!bar) return;
+  const visible = projectNavVisibility(currentView, selectedProject).project;
+  bar.hidden = !visible;
+  if (!visible) return;
+  const nameEl = document.getElementById('project-nav-name');
+  nameEl.textContent = projectNameCache[selectedProject] || humaniseProjectName(selectedProject);
+  resolveProjectMeta(selectedProject).then((meta) => {
+    if (meta.name) nameEl.textContent = meta.name;
+  });
+}
+
 /**
  * Renders the current view.
  */
 function render() {
+  updateProjectNav();
   switch (currentView) {
     case 'dashboard': return renderDashboard();
     case 'board': return renderBoard();
@@ -197,46 +229,6 @@ function render() {
   }
 }
 
-/**
- * Populates the project selector dropdown.
- */
-async function populateProjectSelect() {
-  try {
-    const projects = await api('/api/projects');
-    const select = document.getElementById('project-select');
-    // Which project should appear pre-selected? Order:
-    //   1. scopedProjectSlug (URL is /p/<slug>)  — locked, never changes
-    //   2. selectedProject (route state, ej. #board/<slug>)
-    //   3. ""                                    — "All Projects"
-    // PR-D: the previous version cleared innerHTML and never marked
-    // any option as selected, so the dropdown showed "All Projects"
-    // even when scoped to one. handleRoute() set .value separately
-    // BUT the value was lost in the race because the matching option
-    // didn't exist yet when handleRoute ran. Setting .selected on
-    // the option directly avoids the race.
-    const desired = scopedProjectSlug || selectedProject || '';
-    select.innerHTML = '';
-    const all = document.createElement('option');
-    all.value = '';
-    all.textContent = 'All Projects';
-    if (desired === '') all.selected = true;
-    select.appendChild(all);
-    for (const p of projects) {
-      const opt = document.createElement('option');
-      opt.value = p.id;
-      opt.textContent = p.name || p.id;
-      if (p.id === desired) opt.selected = true;
-      select.appendChild(opt);
-    }
-    // Final guard: if `desired` did not match any rendered option
-    // (project not on the board yet), still set the value so
-    // handleRoute's expectation holds.
-    if (desired) select.value = desired;
-  } catch {
-    // Silently fail — project list will be empty
-  }
-}
-
 /**
  * Parses the hash route and renders.
  */
@@ -248,13 +240,15 @@ function handleRoute() {
   // In scoped mode the project is locked — the hash controls the view
   // only. `board/<slug>` becomes `board` and the slug stays fixed.
   currentView = parts[0] || 'board';
-  selectedProject = scopedProjectSlug || parts[1] || '';
+  // Dashboard never carries a loaded project (KJC-TSK-0820): it is the
+  // project picker, so a `#dashboard/<slug>` deep-link drops the slug.
+  selectedProject = scopedProjectSlug
+    || (currentView === 'dashboard' ? '' : parts[1] || '');
 
   document.querySelectorAll('.nav-btn').forEach((btn) => {
     btn.classList.toggle('active', btn.dataset.view === currentView);
   });
 
-  document.getElementById('project-select').value = selectedProject;
   render();
 }
 

package/packages/hu-board/public/index.html

@@ -21,17 +21,7 @@
       </div>
     </div>
     <nav class="header__nav">
-      <button class="nav-btn active" data-view="board" title="Kanban board: every HU of the selected project, grouped by status (Pending → Certified → Done). Click an HU card to expand the detail panel.">Board</button>
-      <button class="nav-btn" data-view="graph" title="Dependency graph of the selected project's HUs — who blocks whom. Useful before scheduling work.">Graph</button>
-      <button class="nav-btn" data-view="dashboard" title="Per-project landing: stats grid + project list. Click a project card to focus the kanban / graph on that project.">Dashboard</button>
-      <button class="nav-btn" data-view="sessions" title="Every kj run that has touched the board, newest first. Filter by project; click a session to inspect its iterations, commits and checkpoints.">Sessions</button>
-      <button class="nav-btn" data-view="governance" title="The acta: policy rules by friction, the hash-chained decision log and its anchor, standing exceptions with owner and expiry, renewals and signals.">Governance</button>
-      <a class="nav-btn" href="/pipeline.html" title="Live observability of pipeline runs (Karajan v2.7+): stage timings, agent calls, decision logs.">Pipeline</a>
-      <a class="nav-btn" href="/rag.html" title="RAG retrieval-quality dashboard: chunk counts, embedder provider, db size.">RAG</a>
-      <a class="nav-btn" href="/wiki.html" title="Search the per-project QMD semantic wiki (docs, plans, reviews).">Wiki</a>
-      <select class="project-select" id="project-select">
-        <option value="">All Projects</option>
-      </select>
+      <button class="nav-btn active" data-view="dashboard" title="Per-project landing: stats grid + project list. Click a project card to load that project — its views appear in the project bar below.">Dashboard</button>
       <div class="header__controls">
         <button class="control-btn" id="help-btn" title="What does each view do? Quick reference for Board / Graph / Dashboard / Sessions / Pipeline.">?</button>
         <button class="control-btn" id="config-btn" title="Configurar Karajan (modelos, agentes, tope de iteraciones, …)">⚙</button>
@@ -44,6 +34,20 @@
     </nav>
   </header>
 
+  <!-- KJC-TSK-0820: project sub-bar. Hidden until a project is loaded from
+       the dashboard; every entry here shows data of THAT project. Switching
+       projects = back to Dashboard (the select is gone on purpose). -->
+  <nav class="project-nav" id="project-nav" hidden>
+    <span class="project-nav__name" id="project-nav-name"></span>
+    <button class="nav-btn nav-btn--project" data-view="board" title="Kanban board: every HU of the loaded project, grouped by status (Pending → Certified → Done). Click an HU card to expand the detail panel.">Board</button>
+    <button class="nav-btn nav-btn--project" data-view="graph" title="Dependency graph of the loaded project's HUs — who blocks whom. Useful before scheduling work.">Graph</button>
+    <button class="nav-btn nav-btn--project" data-view="sessions" title="Every kj run of the loaded project, newest first. Click a session to inspect its iterations, commits and checkpoints.">Sessions</button>
+    <button class="nav-btn nav-btn--project" data-view="governance" title="The acta: policy rules by friction, the hash-chained decision log and its anchor, standing exceptions with owner and expiry, renewals and signals.">Governance</button>
+    <a class="nav-btn nav-btn--project" href="/pipeline.html" title="Live observability of pipeline runs (Karajan v2.7+): stage timings, agent calls, decision logs.">Pipeline</a>
+    <a class="nav-btn nav-btn--project" href="/rag.html" title="RAG retrieval-quality dashboard: chunk counts, embedder provider, db size.">RAG</a>
+    <a class="nav-btn nav-btn--project" href="/wiki.html" title="Search the per-project QMD semantic wiki (docs, plans, reviews).">Wiki</a>
+  </nav>
+
   <main class="main" id="app">
     <div class="loading">
       <div class="loading__spinner"></div>

package/packages/hu-board/public/styles.css

@@ -124,20 +124,36 @@ a:hover {
   border-color: var(--accent-purple);
 }
 
-.project-select {
-  background: var(--bg-primary);
-  border: 1px solid var(--border);
-  color: var(--text-primary);
-  padding: 6px 12px;
-  border-radius: var(--radius-sm);
-  font-family: var(--font-sans);
+/* ---- Project sub-bar (KJC-TSK-0820) ----
+ * Second nav level, only visible while a project is loaded. Teal, not
+ * purple: project-scoped actions must read as a different tier from the
+ * generic header. */
+.project-nav {
+  display: flex;
+  gap: 8px;
+  align-items: center;
+  flex-wrap: wrap;
+  padding: 8px 24px;
+  background: var(--bg-card);
+  border-bottom: 1px solid var(--border);
+}
+
+.project-nav[hidden] {
+  display: none;
+}
+
+.project-nav__name {
+  color: var(--accent-teal);
+  font-weight: 600;
   font-size: 0.85rem;
-  cursor: pointer;
+  margin-right: 8px;
 }
 
-.project-select:focus {
-  outline: none;
-  border-color: var(--accent-purple);
+.nav-btn--project:hover,
+.nav-btn--project.active {
+  background: var(--accent-teal-dim);
+  color: var(--bg-primary);
+  border-color: var(--accent-teal-dim);
 }
 
 .header__controls {
@@ -955,13 +971,12 @@ a:hover {
 /* ---- Scoped-project mode (URL: /p/<slug>) ---- */
 /* Hide multi-project affordances when the board is scoped to a single
  * project — the page only makes sense as "this project's Kanban".
- * Multi-project UX (the All Projects selector, the Sessions tab, the
+ * Multi-project UX (the Dashboard picker, the Sessions tab, the
  * Pipeline page link) adds noise and broke the user's mental model
  * during dogfooding. */
-body.scoped-mode .project-select,
 body.scoped-mode .nav-btn[data-view="sessions"],
 body.scoped-mode .nav-btn[data-view="dashboard"],
-body.scoped-mode .header__nav a[href="/pipeline.html"] {
+body.scoped-mode a[href="/pipeline.html"] {
   display: none;
 }
 

package/packages/hu-board/public/utils/graph-view.js

@@ -99,7 +99,7 @@ async function renderGraph() {
   if (!selectedProject) {
     app.innerHTML = renderEmptyState(
       'Pick a project first',
-      'The dependency graph is per-project. Choose one in the dropdown above and I will draw its HU DAG.'
+      'The dependency graph is per-project. Pick one on the Dashboard and I will draw its HU DAG.'
     );
     return;
   }

package/packages/hu-board/public/utils/init-listeners.js

@@ -6,8 +6,7 @@
 // the boot block run.
 //
 // Globals consumed from earlier scripts / app.js:
-//   - navigate(), render(), handleRoute(),
-//     populateProjectSelect()         (app.js)
+//   - navigate(), render(), handleRoute() (app.js)
 //   - showCommandLauncher(),
 //     nextIsTestValue()               (utils/command-launcher.js)
 //   - showHelp(), showConfirm(),
@@ -32,13 +31,6 @@ document.querySelectorAll('.nav-btn').forEach((btn) => {
   btn.addEventListener('click', () => navigate(btn.dataset.view));
 });
 
-// Project selector
-document.getElementById('project-select').addEventListener('change', (e) => {
-  selectedProject = e.target.value;
-  window.location.hash = selectedProject ? `${currentView}/${selectedProject}` : currentView;
-  render();
-});
-
 // Sync button — re-scan disk for new batches
 document.getElementById('sync-btn').addEventListener('click', async () => {
   const btn = document.getElementById('sync-btn');
@@ -46,7 +38,6 @@ document.getElementById('sync-btn').addEventListener('click', async () => {
   btn.textContent = '⏳';
   try {
     await fetch('/api/sync', { method: 'POST' });
-    await populateProjectSelect();
     render();
   } catch { /* ignore */ }
   btn.textContent = '🔄';
@@ -106,7 +97,6 @@ document.addEventListener('click', async (e) => {
     });
     if (!res.ok) throw new Error(`HTTP ${res.status}`);
     // Re-render the project list so the badge reflects the new value.
-    await populateProjectSelect();
     render();
   } catch (err) {
     await showError(err.message, { title: 'Failed to update is_test' });
@@ -130,7 +120,6 @@ document.addEventListener('click', async (e) => {
   try {
     const res = await fetch(`/api/projects/${encodeURIComponent(projectId)}`, { method: 'DELETE' });
     if (!res.ok) throw new Error(`HTTP ${res.status}`);
-    await populateProjectSelect();
     render();
   } catch (err) {
     await showError(err.message, { title: 'Failed to delete project' });
@@ -161,7 +150,6 @@ startStandbyPolling();
 
 // Initial load — sync disk data first so new batches are visible
 triggerSync().then(() => {
-  populateProjectSelect();
   handleRoute();
   subscribeToServerEvents();
 });
@@ -174,7 +162,6 @@ triggerSync().then(() => {
 refreshInterval = setInterval(async () => {
   if (document.getElementById('modal-backdrop').classList.contains('hidden')) {
     await triggerSync();
-    await populateProjectSelect();
     await smartRefresh(null);
   }
 }, 60_000);

package/packages/hu-board/public/utils/maggle-mode.js

@@ -29,7 +29,7 @@ const MAGGLE_LABELS = {
   'nav.board': 'Tablero',
   'nav.dashboard': 'Proyectos',
   'nav.more': 'Más',
-  'picker.hint': 'Elige un proyecto para ver su tablero. Puedes cambiar de proyecto arriba a la derecha.',
+  'picker.hint': 'Elige un proyecto para ver su tablero. Para cambiar de proyecto, vuelve a «Proyectos».',
   'picker.project': 'proyecto',
   'launcher.title': '📝 Pedir trabajo a Karajan',
   'launcher.planLabel': '📝 Pedir trabajo nuevo',
@@ -86,7 +86,10 @@ function applyMaggleChrome() {
   if (!nav) return;
   const KEEP = { board: MAGGLE_LABELS['nav.board'], dashboard: MAGGLE_LABELS['nav.dashboard'] };
   const advanced = [];
-  for (const btn of nav.querySelectorAll('.nav-btn')) {
+  // KJC-TSK-0820: nav buttons live in TWO bars now — the generic header
+  // and the project sub-bar (#project-nav). Fold both; Tablero stays in
+  // the sub-bar so it only shows once a project is loaded.
+  for (const btn of document.querySelectorAll('.header__nav .nav-btn, .project-nav .nav-btn')) {
     const view = btn.dataset.view;
     if (view && KEEP[view]) {
       btn.title = `${btn.textContent.trim()} — ${btn.title}`;
@@ -118,8 +121,11 @@ function applyMaggleChrome() {
       expert.remove();
     }
   });
-  // After the LAST nav button, so the plain row reads Tablero | Proyectos | Más.
-  advanced.at(-1).after(more);
+  // In the GENERIC bar (before the control buttons), so the plain header
+  // reads Proyectos | Más and the sub-bar keeps only Tablero.
+  const controls = nav.querySelector('.header__controls');
+  if (controls) controls.before(more);
+  else nav.append(more);
 }
 
 if (typeof document !== 'undefined' && document.addEventListener) {

package/packages/hu-board/public/utils/project-actions.js

@@ -11,8 +11,7 @@
 //   - formatDuration()            (utils/formatters.js)
 //   - projectNameCache            (mutable in app.js — assignment crosses
 //                                  scripts transparently)
-//   - populateProjectSelect()     (app.js)
-//   - renderBoard()               (app.js)
+//   - render()                    (app.js)
 
 /**
  * PR-G: rename a project from the header ✎ button. Opens a small
@@ -67,11 +66,11 @@ window.renameProjectModal = function renameProjectModal(projectId, currentName)
         return;
       }
       // Update the cached display name + refresh the board so the
-      // header, dropdown and project picker all show the new value.
+      // header, project bar and project picker all show the new value.
       projectNameCache[projectId] = newName;
       try { dlg.close(); } catch { /* ignore */ }
-      await populateProjectSelect();
-      await renderBoard();
+      // render() (not renderBoard()) so the project bar name refreshes too.
+      await render();
     } catch (err) {
       errorEl.style.display = 'block';
       errorEl.textContent = err.message || String(err);

package/packages/hu-board/public/utils/project-picker-view.js

@@ -74,7 +74,7 @@ async function renderProjectPicker() {
       <span class="section-header__count">${sorted.length} ${maggleText('picker.project', 'project')}${sorted.length === 1 ? '' : 's'}</span>
     </div>
     <p style="padding:8px 4px 16px;color:var(--text-muted);font-size:0.9rem">
-      ${maggleText('picker.hint', 'Pick a project to see its kanban. Use the project selector in the header to switch later.')}
+      ${maggleText('picker.hint', 'Pick a project to see its kanban. To switch later, go back to the Dashboard.')}
     </p>
     <div style="display:grid;grid-template-columns:repeat(auto-fill, minmax(320px, 1fr));gap:14px">
       ${sorted.map((p) => {

package/packages/hu-board/src/db.js

@@ -377,6 +377,19 @@ export function ensureDb() {
  * @param {{ id: string, name?: string, first_seen?: string, last_activity?: string, total_stories?: number }} project
  */
 export function upsertProject(project) {
+  // KJC-BUG-0163 — the iron rule: a project NAME is unique on the dashboard.
+  // Two projects with the same visible name are indistinguishable in the
+  // picker; registering the second fails LOUD instead of blending in.
+  if (project.name) {
+    const clash = getDb()
+      .prepare('SELECT id FROM projects WHERE name = ? AND id != ?')
+      .get(project.name, project.id);
+    if (clash) {
+      throw new Error(
+        `board: el nombre "${project.name}" ya pertenece al proyecto "${clash.id}" — dos proyectos no pueden llamarse igual (KJC-BUG-0163); renombra el plan o el directorio de "${project.id}"`,
+      );
+    }
+  }
   // is_shared (KJC-PRP-0002 PR3) is set by sync when a plan came from
   // `.karajan-shared/`. COALESCE with the existing column keeps the badge
   // once it's been promoted — a second non-shared plan won't unset it.

package/packages/hu-board/src/sync.js

@@ -456,7 +456,12 @@ export function syncPlanFile(filePath) {
     //      with a SPEC about "Linux Assistant", the basename here would
     //      misleadingly say "Hu Board" — that's why plan.name wins.
     //   3. slugToTitle of the task / projectId as a last resort.
-    const projectName = data.name
+    // KJC-BUG-0162: the default backlog plan is named "brain-backlog" — a
+    // DEFAULT, not a user choice. Every project synced through it ended up
+    // named "brain-backlog", indistinguishable in the picker. Only a real,
+    // user-given plan name may override the repo-derived name.
+    const userGivenName = data.name && data.name !== 'brain-backlog' ? data.name : null;
+    const projectName = userGivenName
       || (canonicalDir ? titleCaseBasename(basename(canonicalDir)) : null)
       || slugToTitle(data.task || '')
       || projectId;

package/src/cli/register-meta.js

@@ -372,6 +372,7 @@ export function registerMeta(program, { pkgVersion }) {
     .option("--rule <rule_id>", "Regla exacta (p.ej. roles.coder.write.deny)")
     .option("--until <iso>", "Caducidad ISO-8601 (p.ej. 2026-09-01T00:00:00Z)")
     .option("--reason <text>", "Justificación escrita en el momento")
+    .option("--global", "Ámbito global (~/.karajan): vale para todos tus proyectos de esta máquina — KJC-TSK-0813")
     .action(async (flags) => {
       await withConfig(pkgVersion, "policy-grant", flags, async ({ config }) => {
         process.exitCode = await policyCommand({ action: "grant", config, flags });
@@ -782,10 +783,13 @@ export function registerMeta(program, { pkgVersion }) {
     .option("--interactive", "Adopt the kj standard piece by piece (default keeps yours)")
     .option("--dry-run", "Show what would change without writing")
     .option("--json", "Emit machine-readable JSON")
+    .option("--commit", "Versiona la regeneración del supervisor con procedencia sellada (acto humano, ADR 0009)")
     .action(async (flags) => {
       await withConfig(pkgVersion, "harden", flags, async ({ logger }) => {
         await hardenCommand({
           profile: flags.profile,
+          commitSupervisor: flags.commit === true,
+          kjVersion: pkgVersion,
           config: flags.config !== false,
           ci: flags.ci !== false,
           guidelines: flags.guidelines !== false,

package/src/commands/harden.js

@@ -14,6 +14,7 @@ import { resolveTestOnPush } from "../harden/test-on-push.js";
 import { compareHarden, formatAdvisoryReport } from "../harden/advisory.js";
 import { interactiveHarden } from "../harden/interactive.js";
 import { createWizard, isTTY } from "../utils/wizard.js";
+import { commitSupervisorRegeneration } from "../harden/supervisor-commit.js";
 import { installConfigsForRoots } from "../harden/config-engine.js";
 import { installGuidelines } from "../harden/guidelines-engine.js";
 import { commandsForLanguage } from "../harden/hook-commands.js";
@@ -88,6 +89,8 @@ export async function hardenCommand({
   interactive = false,
   only = [],
   exclude = [],
+  commitSupervisor = false,
+  kjVersion = null,
   logger = console,
 } = {}) {
   const repoCfg = readHardenConfig(projectDir);
@@ -199,5 +202,24 @@ export async function hardenCommand({
     out.identity = id.declared ? id.identity : null;
     if (id.pending) out.identityPending = id.pending;
   }
+  // KJC-BUG-0161 / ADR 0009 (opción A): --commit versiona la regeneración
+  // del supervisor con procedencia sellada. Acto humano — el guard vive en
+  // commitSupervisorRegeneration y rechaza sesiones de agente.
+  if (commitSupervisor && !dryRun) {
+    try {
+      out.supervisorCommit = commitSupervisorRegeneration({
+        projectDir,
+        kjVersion: kjVersion ?? "unknown",
+        generation: result.generation ?? { profile },
+        logger,
+      });
+    } catch (err) {
+      // Fallar ALTO (catch de codex): un --commit que no commitea no puede
+      // devolver ok — quien lo pidió debe verlo, no descubrirlo después.
+      logger.error?.(`kj harden: ${err.message}`);
+      out.supervisorCommit = { committed: false, reason: err.message };
+      out.ok = false;
+    }
+  }
   return out;
 }

package/src/commands/policy.js

@@ -12,7 +12,8 @@ import { createHash } from "node:crypto";
 import { readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { checkStagedDiff, evalToolCall, loadPolicy } from "../policy/engine.js";
-import { loadExceptionRecords, loadStandingExceptions, recordPolicyException } from "../policy/exceptions.js";
+import { liftSealedSupervisorViolations } from "../policy/supervisor-verify.js";
+import { loadExceptionRecords, loadGlobalExceptionRecords, loadStandingExceptions, recordPolicyException } from "../policy/exceptions.js";
 import { buildPolicyReport } from "../policy/report.js";
 import { policyFileHash, recordGateDecision } from "../policy/decisions.js";
 import { readIdentity } from "../identity/store.js";
@@ -110,12 +111,16 @@ export async function policyCommand({ action, config = {}, flags = {}, logger =
       // regla re-concedida N veces es la política real pidiendo que la
       // cambien por su cauce. Se cuenta contra TODAS las permanentes previas
       // (vencidas incluidas: precisamente esas son la sedimentación).
-      const previous = loadStandingExceptions(projectDir).standing.filter((e) => e.rule_id === rule).length;
+      // KJC-TSK-0813: --global escribe en ~/.karajan (todos los proyectos de
+      // la máquina). El contador de renovaciones cuenta sobre la FUSIÓN.
+      const scope = flags.global ? "global" : "project";
+      const previous = loadStandingExceptions(projectDir, { home: deps.home }).standing.filter((e) => e.rule_id === rule).length;
       const rec = recordPolicyException({
-        projectDir,
+        projectDir, scope, deps: { home: deps.home },
         entry: { rule_id: rule, justification: reason.trim(), scopeKind: "permanente", expiresAt: until },
       });
-      logger.info?.(`✓ excepción permanente registrada: [${rec.rule_id}] hasta ${rec.expiresAt} — concedida por ${rec.who?.git ?? "?"} (${rec.who?.grade ?? "?"})`);
+      const ambit = scope === "global" ? " [ámbito global — todos tus proyectos de esta máquina]" : "";
+      logger.info?.(`✓ excepción permanente registrada${ambit}: [${rec.rule_id}] hasta ${rec.expiresAt} — concedida por ${rec.who?.git ?? "?"} (${rec.who?.grade ?? "?"})`);
       if (previous >= 1) {
         logger.warn?.(`⚠ ${previous + 1}ª concesión sobre esta regla — una excepción que se renueva ya no es una excepción: considera cambiar la política por su cauce (PR a .karajan/policy.yml)`);
       }
@@ -134,7 +139,11 @@ export async function policyCommand({ action, config = {}, flags = {}, logger =
     try {
       decisionLines = readFileSync(join(projectDir, ".karajan", "policy-decisions.jsonl"), "utf8").split("\n").filter((l) => l.trim());
     } catch { /* sin decisiones aún: el informe lo dice con ceros */ }
-    const exc = loadExceptionRecords(projectDir);
+    // KJC-TSK-0813 (AC3): el informe cubre TAMBIÉN el almacén global — cada
+    // registro llega con su origin FÍSICO estampado por la carga.
+    const proj = loadExceptionRecords(projectDir);
+    const glob = loadGlobalExceptionRecords({ home: deps.home });
+    const exc = { records: [...proj.records, ...glob.records], discarded: proj.discarded + glob.discarded };
     const soonDays = Number(flags.soon ?? 7);
     const report = buildPolicyReport({ decisionLines, exceptionRecords: exc.records, policy, soonDays: Number.isFinite(soonDays) ? soonDays : 7 });
     if (flags.json) {
@@ -152,8 +161,10 @@ export async function policyCommand({ action, config = {}, flags = {}, logger =
       const meta = [r.enforcement && `enforcement=${r.enforcement}`, r.class && `class=${r.class}`].filter(Boolean).join(" ");
       logger.info?.(`  [${r.rule_id}] ${meta} — warn ${r.warns} · deny ${r.denies} · exempt ${r.exempts} · abiertas ${r.open}`);
     }
-    logger.info?.(`concesiones: vivas ${g.alive.length} (próximas a vencer ${g.soon.length}) · vencidas ${g.expired.length} · puntuales ${g.point}`);
-    for (const e of g.alive) logger.info?.(`  [${e.rule_id}] hasta ${e.expiresAt} — ${e.who?.git ?? "?"}: ${e.justification ?? "sin justificación"}`);
+    // Con 0 globales el resumen queda EXACTAMENTE como siempre (hay consumidores de texto).
+    const globals = g.alive.filter((e) => e.origin === "global").length;
+    logger.info?.(`concesiones: vivas ${g.alive.length} (${globals > 0 ? `${globals} globales, ` : ""}próximas a vencer ${g.soon.length}) · vencidas ${g.expired.length} · puntuales ${g.point}`);
+    for (const e of g.alive) logger.info?.(`  [${e.rule_id}] hasta ${e.expiresAt}${e.origin === "global" ? " [global]" : ""} — ${e.who?.git ?? "?"}: ${e.justification ?? "sin justificación"}`);
     logger.info?.(report.signals.length > 0 ? "señales:" : "señales: ninguna");
     for (const s of report.signals) logger.warn?.(`  ⚠ ${s}`);
     return chain.ok ? 0 : 1;
@@ -221,7 +232,14 @@ export async function policyCommand({ action, config = {}, flags = {}, logger =
   // --strict (PL-C): con --strict, una violación enforcement=deny devuelve
   // exit 2 nombrando la regla — el contrato merge-blocking del tier C.
   const facts = await stagedFacts(projectDir, deps.gitFn, flags.range || null);
-  const violations = checkStagedDiff(policy, { role: flags.role || "coder", ...facts });
+  let violations = checkStagedDiff(policy, { role: flags.role || "coder", ...facts });
+  // ADR 0009 (KJC-BUG-0161): en CI la misma exención estructural que en la
+  // review — supervisor respaldado por provenance sellada + render canónico.
+  const sup = liftSealedSupervisorViolations({ projectDir, violations });
+  if (sup.lifted > 0) {
+    logger.info?.(`✓ policy: ${sup.lifted} fichero(s) de supervisor verificados contra la provenance sellada (ADR 0009)`);
+    violations = sup.violations;
+  }
   const hard = flags.strict ? violations.filter((v) => v.enforcement === "deny") : [];
   if (flags.json) {
     logger.info?.(JSON.stringify({ mode: flags.strict ? "strict" : "warn", violations }));

package/src/commands/review-gate.js

@@ -15,6 +15,7 @@ import { ensureGateTrackable } from "../review/gate-gitignore.js";
 import { runSonarPregate, formatSonarFinding, addedLinesByFile } from "../review/sonar-pregate.js";
 import { runMutationPregate, formatSurvivor } from "../review/mutation-pregate.js";
 import { checkCardFirst } from "../review/card-first.js";
+import { liftSealedSupervisorViolations } from "../policy/supervisor-verify.js";
 import { checkTestsWithCode } from "../review/tests-with-code.js";
 import { loadPrivacyList, scanText } from "../privacy/scan.js";
 import { checkStagedDiff, loadPolicy } from "../policy/engine.js";
@@ -52,6 +53,13 @@ async function rawDiff(range, extraArgs = []) {
   return res.stdout;
 }
 
+// KJC-TSK-0813 (AC3): la exención dice su PROCEDENCIA — un standing global
+// (concedido para toda la máquina) no pasa por uno del proyecto. El texto
+// de las de proyecto queda EXACTAMENTE como estaba.
+export const formatExempted = (e) => (e.standing
+  ? `⚠ policy standing [${e.rule_id}] — excepción permanente${e.standing.origin === "global" ? " GLOBAL" : ""} viva hasta ${e.standing.expiresAt} (${e.standing.justification || "sin justificación"})`
+  : `⚠ policy exempt [${e.rule_id}] — excepción registrada en .karajan/policy-exceptions.jsonl (${e.justification})`);
+
 function printVerdict(record) {
   if (record.verdict === "approved") {
     const ws = record.workspace ? ` [${record.workspace}]` : "";
@@ -255,13 +263,20 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
     recordException: (entry) => recordPolicyException({ projectDir, entry }),
     standingExceptions: std.standing,
   });
+  // ADR 0009 (KJC-BUG-0161): la exención ESTRUCTURAL del supervisor — un
+  // diff de .karajan/hooks respaldado por la provenance sellada Y el render
+  // canónico no es una edición: es la regeneración de kj harden --commit.
+  {
+    const res = liftSealedSupervisorViolations({ projectDir, violations: gate.denials });
+    if (res.lifted > 0) {
+      console.log(`✓ policy: ${res.lifted} fichero(s) de supervisor verificados contra la provenance sellada (ADR 0009) — regeneración, no edición`);
+      gate.denials = res.violations;
+      gate.ok = gate.denials.length === 0 && !gate.invalid;
+    }
+  }
   const at = (v) => (v.file ? ` (${v.file})` : "");
   for (const w of gate.warns) console.log(`⚠ policy [${w.rule_id}] ${w.reason}${at(w)}`);
-  for (const e of gate.exempted) {
-    console.log(e.standing
-      ? `⚠ policy standing [${e.rule_id}] — excepción permanente viva hasta ${e.standing.expiresAt} (${e.standing.justification || "sin justificación"})`
-      : `⚠ policy exempt [${e.rule_id}] — excepción registrada en .karajan/policy-exceptions.jsonl (${e.justification})`);
-  }
+  for (const e of gate.exempted) console.log(formatExempted(e));
   // GOV-C (KJC-TSK-0747): las decisiones de chokepoint dejan rastro
   // hash-encadenado — cada deny, cada excepción, y el allow del commit.
   const chokepoint = flags.check ? "commit" : "review";

package/src/harden/harden-engine.js

@@ -22,6 +22,24 @@ export function isGitRepo(projectDir) {
   return existsSync(join(projectDir, ".git"));
 }
 
+/**
+ * KJC-BUG-0161 / ADR 0009: el contenido CANÓNICO de un hook para una
+ * generación dada — exactamente lo que installHooks escribiría partiendo
+ * de cero. La verificación estructural del supervisor recomputa esto y
+ * compara por hash: un fichero con una sola coma manual ya no coincide.
+ */
+export function renderCanonicalHook(hook, generation = {}) {
+  const { cmds = {}, baseBranch = null, globalHooksDir = null } = generation;
+  const { content } = upsertManagedBlock({
+    source: HOOK_PREAMBLE,
+    blockId: `hook:${hook}`,
+    version: BLOCK_VERSION,
+    body: hookBody(hook, cmds, { globalHooksDir, baseBranch }),
+    style: "hash",
+  });
+  return content;
+}
+
 /**
  * Install (or refresh) the profile's hooks under `.karajan/hooks/` and point
  * `core.hooksPath` there. Idempotent. `dryRun` computes actions without
@@ -76,5 +94,7 @@ export async function installHooks({
     await runCommand("git", ["config", "core.hooksPath", HOOKS_DIR], { cwd: projectDir });
   }
 
-  return { profile, hooksPath: HOOKS_DIR, dryRun, hooks: results };
+  // KJC-BUG-0161: los parámetros con los que SE GENERÓ — lo que la
+  // provenance necesita registrar para que CI pueda recomputar y comparar.
+  return { profile, hooksPath: HOOKS_DIR, dryRun, hooks: results, generation: { profile, cmds, baseBranch, globalHooksDir } };
 }