karajan-code 4.26.0 → 4.28.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.26.0",
+  "version": "4.28.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",
@@ -116,6 +116,7 @@
     "karajan-rag": "^1.2.0",
     "knip": "^6.15.0",
     "madge": "^8.0.0",
+    "qrcode-terminal": "0.12.0",
     "sqlite-vec": "^0.1.9",
     "valibot": "^1.4.1",
     "web-tree-sitter": "^0.26.9",

package/src/cli/register-meta.js

@@ -148,6 +148,15 @@ export function registerMeta(program, { pkgVersion }) {
         process.exitCode = await identityCommand({ action: "set", config, flags });
       });
     });
+  identityCmd
+    .command("enroll-phone")
+    .description("Enroll the phone's PUBLIC signing key (base64 of the raw 32-byte ed25519 key) for the supervisor seal")
+    .argument("<publicKeyBase64>", "raw ed25519 public key, base64 (shown by the phone app)")
+    .action(async (publicKeyBase64, flags) => {
+      await withConfig(pkgVersion, "identity-enroll-phone", flags, async ({ config }) => {
+        process.exitCode = await identityCommand({ action: "enroll-phone", config, flags: { ...flags, publicKeyBase64 } });
+      });
+    });
 
   // MGL-A (KJC-TSK-0808): the muggle launcher — one command, at most one
   // question, and the person lands inside a governed conversation.
@@ -783,10 +792,13 @@ export function registerMeta(program, { pkgVersion }) {
     .option("--interactive", "Adopt the kj standard piece by piece (default keeps yours)")
     .option("--dry-run", "Show what would change without writing")
     .option("--json", "Emit machine-readable JSON")
+    .option("--commit", "Versiona la regeneración del supervisor con procedencia sellada (acto humano, ADR 0009)")
     .action(async (flags) => {
       await withConfig(pkgVersion, "harden", flags, async ({ logger }) => {
         await hardenCommand({
           profile: flags.profile,
+          commitSupervisor: flags.commit === true,
+          kjVersion: pkgVersion,
           config: flags.config !== false,
           ci: flags.ci !== false,
           guidelines: flags.guidelines !== false,

package/src/commands/harden.js

@@ -14,6 +14,7 @@ import { resolveTestOnPush } from "../harden/test-on-push.js";
 import { compareHarden, formatAdvisoryReport } from "../harden/advisory.js";
 import { interactiveHarden } from "../harden/interactive.js";
 import { createWizard, isTTY } from "../utils/wizard.js";
+import { commitSupervisorRegeneration } from "../harden/supervisor-commit.js";
 import { installConfigsForRoots } from "../harden/config-engine.js";
 import { installGuidelines } from "../harden/guidelines-engine.js";
 import { commandsForLanguage } from "../harden/hook-commands.js";
@@ -88,6 +89,8 @@ export async function hardenCommand({
   interactive = false,
   only = [],
   exclude = [],
+  commitSupervisor = false,
+  kjVersion = null,
   logger = console,
 } = {}) {
   const repoCfg = readHardenConfig(projectDir);
@@ -199,5 +202,24 @@ export async function hardenCommand({
     out.identity = id.declared ? id.identity : null;
     if (id.pending) out.identityPending = id.pending;
   }
+  // KJC-BUG-0161 / ADR 0009 (opción A): --commit versiona la regeneración
+  // del supervisor con procedencia sellada. Acto humano — el guard vive en
+  // commitSupervisorRegeneration y rechaza sesiones de agente.
+  if (commitSupervisor && !dryRun) {
+    try {
+      out.supervisorCommit = await commitSupervisorRegeneration({
+        projectDir,
+        kjVersion: kjVersion ?? "unknown",
+        generation: result.generation ?? { profile },
+        logger,
+      });
+    } catch (err) {
+      // Fallar ALTO (catch de codex): un --commit que no commitea no puede
+      // devolver ok — quien lo pidió debe verlo, no descubrirlo después.
+      logger.error?.(`kj harden: ${err.message}`);
+      out.supervisorCommit = { committed: false, reason: err.message };
+      out.ok = false;
+    }
+  }
   return out;
 }

package/src/commands/identity.js

@@ -8,6 +8,7 @@
  *           no session and no flags → exit 1.
  */
 
+import { enrollPhone } from "../harden/phone-sign.js";
 import { readIdentity, writeIdentity } from "../identity/store.js";
 import { activeGhUser, effectiveGitEmail } from "../identity/detect.js";
 import { compareIdentity } from "../identity/compare.js";
@@ -23,6 +24,18 @@ export async function identityCommand({ action = "show", config, flags = {}, dep
     git_email: effectiveGitEmail(projectDir, detectOpts.gitFn ? { gitFn: detectOpts.gitFn } : {}),
   };
 
+  // KJC-TSK-0822: enrola la clave PÚBLICA del móvil (la privada nunca toca esta máquina).
+  if (action === "enroll-phone") {
+    try {
+      enrollPhone(flags.publicKeyBase64, { home: deps.home });
+    } catch (err) {
+      log(`kj identity enroll-phone: ${err.message}`);
+      return 1;
+    }
+    log("Móvil enrolado: la clave pública quedó en ~/.karajan/supervisor-phone.json. A partir de ahora, sellar el supervisor pedirá la firma de tu móvil.");
+    return 0;
+  }
+
   if (action === "set") {
     const candidate = { gh_user: flags.gh || effective.gh_user, git_email: flags.email || effective.git_email };
     if (!candidate.gh_user || !candidate.git_email) {

package/src/commands/policy.js

@@ -12,6 +12,7 @@ import { createHash } from "node:crypto";
 import { readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { checkStagedDiff, evalToolCall, loadPolicy } from "../policy/engine.js";
+import { liftSealedSupervisorViolations } from "../policy/supervisor-verify.js";
 import { loadExceptionRecords, loadGlobalExceptionRecords, loadStandingExceptions, recordPolicyException } from "../policy/exceptions.js";
 import { buildPolicyReport } from "../policy/report.js";
 import { policyFileHash, recordGateDecision } from "../policy/decisions.js";
@@ -231,7 +232,14 @@ export async function policyCommand({ action, config = {}, flags = {}, logger =
   // --strict (PL-C): con --strict, una violación enforcement=deny devuelve
   // exit 2 nombrando la regla — el contrato merge-blocking del tier C.
   const facts = await stagedFacts(projectDir, deps.gitFn, flags.range || null);
-  const violations = checkStagedDiff(policy, { role: flags.role || "coder", ...facts });
+  let violations = checkStagedDiff(policy, { role: flags.role || "coder", ...facts });
+  // ADR 0009 (KJC-BUG-0161): en CI la misma exención estructural que en la
+  // review — supervisor respaldado por provenance sellada + render canónico.
+  const sup = liftSealedSupervisorViolations({ projectDir, violations });
+  if (sup.lifted > 0) {
+    logger.info?.(`✓ policy: ${sup.lifted} fichero(s) de supervisor verificados contra la provenance sellada (ADR 0009)`);
+    violations = sup.violations;
+  }
   const hard = flags.strict ? violations.filter((v) => v.enforcement === "deny") : [];
   if (flags.json) {
     logger.info?.(JSON.stringify({ mode: flags.strict ? "strict" : "warn", violations }));

package/src/commands/review-gate.js

@@ -15,6 +15,7 @@ import { ensureGateTrackable } from "../review/gate-gitignore.js";
 import { runSonarPregate, formatSonarFinding, addedLinesByFile } from "../review/sonar-pregate.js";
 import { runMutationPregate, formatSurvivor } from "../review/mutation-pregate.js";
 import { checkCardFirst } from "../review/card-first.js";
+import { liftSealedSupervisorViolations } from "../policy/supervisor-verify.js";
 import { checkTestsWithCode } from "../review/tests-with-code.js";
 import { loadPrivacyList, scanText } from "../privacy/scan.js";
 import { checkStagedDiff, loadPolicy } from "../policy/engine.js";
@@ -262,6 +263,17 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
     recordException: (entry) => recordPolicyException({ projectDir, entry }),
     standingExceptions: std.standing,
   });
+  // ADR 0009 (KJC-BUG-0161): la exención ESTRUCTURAL del supervisor — un
+  // diff de .karajan/hooks respaldado por la provenance sellada Y el render
+  // canónico no es una edición: es la regeneración de kj harden --commit.
+  {
+    const res = liftSealedSupervisorViolations({ projectDir, violations: gate.denials });
+    if (res.lifted > 0) {
+      console.log(`✓ policy: ${res.lifted} fichero(s) de supervisor verificados contra la provenance sellada (ADR 0009) — regeneración, no edición`);
+      gate.denials = res.violations;
+      gate.ok = gate.denials.length === 0 && !gate.invalid;
+    }
+  }
   const at = (v) => (v.file ? ` (${v.file})` : "");
   for (const w of gate.warns) console.log(`⚠ policy [${w.rule_id}] ${w.reason}${at(w)}`);
   for (const e of gate.exempted) console.log(formatExempted(e));

package/src/harden/harden-engine.js

@@ -22,6 +22,24 @@ export function isGitRepo(projectDir) {
   return existsSync(join(projectDir, ".git"));
 }
 
+/**
+ * KJC-BUG-0161 / ADR 0009: el contenido CANÓNICO de un hook para una
+ * generación dada — exactamente lo que installHooks escribiría partiendo
+ * de cero. La verificación estructural del supervisor recomputa esto y
+ * compara por hash: un fichero con una sola coma manual ya no coincide.
+ */
+export function renderCanonicalHook(hook, generation = {}) {
+  const { cmds = {}, baseBranch = null, globalHooksDir = null } = generation;
+  const { content } = upsertManagedBlock({
+    source: HOOK_PREAMBLE,
+    blockId: `hook:${hook}`,
+    version: BLOCK_VERSION,
+    body: hookBody(hook, cmds, { globalHooksDir, baseBranch }),
+    style: "hash",
+  });
+  return content;
+}
+
 /**
  * Install (or refresh) the profile's hooks under `.karajan/hooks/` and point
  * `core.hooksPath` there. Idempotent. `dryRun` computes actions without
@@ -76,5 +94,7 @@ export async function installHooks({
     await runCommand("git", ["config", "core.hooksPath", HOOKS_DIR], { cwd: projectDir });
   }
 
-  return { profile, hooksPath: HOOKS_DIR, dryRun, hooks: results };
+  // KJC-BUG-0161: los parámetros con los que SE GENERÓ — lo que la
+  // provenance necesita registrar para que CI pueda recomputar y comparar.
+  return { profile, hooksPath: HOOKS_DIR, dryRun, hooks: results, generation: { profile, cmds, baseBranch, globalHooksDir } };
 }

package/src/harden/hook-templates.js

@@ -8,6 +8,8 @@
  * is imposed on non-JS repos. See docs/specs/quality-harness.md §5.
  */
 
+import { homedir } from "node:os";
+
 const CONVENTIONAL_TYPES = "feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert";
 const AI_ATTRIBUTION = "co-authored-by:.*(claude|gpt|copilot|gemini)|(generated|written) (by|with) .*(claude|gpt|copilot)";
 
@@ -27,10 +29,18 @@ export const PROFILE_HOOKS = {
 // guarded, so machines without it are unaffected.
 function chainToGlobal(hook, globalHooksDir) {
   if (!globalHooksDir) return [];
+  // KJC-BUG-0161 (ADR 0009): a committed hook must not bake a machine's
+  // absolute home path — resolve through $HOME at runtime so the same
+  // generated content is valid on every machine and its provenance stays
+  // verifiable (and no local filesystem layout leaks into a public repo).
+  const home = homedir();
+  const dir = globalHooksDir === home || globalHooksDir.startsWith(`${home}/`)
+    ? `$HOME${globalHooksDir.slice(home.length)}`
+    : globalHooksDir;
   return [
     "# Chain the machine's previous global hook (kj harden keeps it active).",
-    `if [ -x "${globalHooksDir}/${hook}" ]; then`,
-    `  "${globalHooksDir}/${hook}" "$@"; rc=$?`,
+    `if [ -x "${dir}/${hook}" ]; then`,
+    `  "${dir}/${hook}" "$@"; rc=$?`,
     '  [ "$rc" -eq 0 ] || exit "$rc"',
     "fi",
   ];
@@ -99,6 +109,14 @@ export function hookBody(hook, cmds = {}, { globalHooksDir = null, baseBranch =
       if (cmds.format) lines.push(`${cmds.format} || { echo 'kj harden: format check failed'; exit 1; }`);
       if (!cmds.lint && !cmds.format) lines.push("# (no lint/format command detected for this stack)");
       lines.push(
+        "# KJC-BUG-0164: attribution is surface EVERYWHERE — the staged diff's",
+        "# ADDED lines (changelog, docs, code comments) are scanned too, with",
+        "# the same precise pattern (tool MENTIONS stay legal; attribution not).",
+        "# The guard's own definition files are excluded by literal path — they",
+        "# CONTAIN the pattern; excluding a path that does not exist is harmless.",
+        `if git diff --cached -- . ':(exclude).github/workflows/kj-no-ai-attribution.yml' ':(exclude)src/harden/hook-templates.js' ':(exclude)src/harden/workflow-templates.js' ':(exclude)src/harden/sentinel-hooks.js' ':(exclude)scripts/ai-attribution-guard.yml' ':(exclude)tests/harden/attribution-guard.test.js' ':(exclude)tests/harden/sentinel-hooks.test.js' | grep '^+' | grep -qiE '${AI_ATTRIBUTION}|generated with \\[?claude'; then`,
+        "  echo 'kj harden: AI attribution is not allowed in committed content'; exit 1",
+        "fi",
         "# v4 review gate (ENV-C1, opt-in via `kj review --install-gate`):",
         "# a staged diff only enters with a recorded cross-AI approved verdict.",
         "if [ -f .karajan/review-gate ]; then",

package/src/harden/phone-sign.js

@@ -0,0 +1,119 @@
+/**
+ * KJC-TSK-0822 (PRP-0023) — capa 5 del sello del supervisor: firma asimétrica
+ * desde el móvil. La clave privada vive SOLO en el teléfono; aquí se enrola su
+ * clave PÚBLICA (~/.karajan/supervisor-phone.json) y se verifica ed25519
+ * contra ella — el transporte (Firestore, PR siguiente) nunca es la verdad.
+ */
+import { createHash, createPublicKey, randomBytes, verify } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+import qrcode from "qrcode-terminal";
+
+const SPKI_ED25519_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
+// La config del relé (apiKey de cliente Firestore — pública por diseño, la
+// misma que la página firmante lleva incrustada) NO viaja en el tarball: el
+// escáner de privacidad del pack deniega claves google con razón general, y
+// servirla desde la landing la hace además rotable sin release.
+const RELAY_CONFIG_URL = "https://karajancode.com/sign/relay.json";
+let relayCache = null;
+async function relayConfig(fetchFn) {
+  if (relayCache) return relayCache;
+  const res = await fetchFn(RELAY_CONFIG_URL);
+  if (!res.ok) throw new Error(`phone-sign: no pude cargar la config del relé (${res.status}) — revisa la red`);
+  const cfg = await res.json();
+  if (!cfg?.apiKey || !cfg?.projectId || !cfg?.collection) throw new Error("phone-sign: config del relé incompleta");
+  relayCache = {
+    apiKey: cfg.apiKey,
+    url: `https://firestore.googleapis.com/v1/projects/${cfg.projectId}/databases/(default)/documents/${cfg.collection}`,
+  };
+  return relayCache;
+}
+const SIGN_PAGE = "https://karajancode.com/sign";
+const POLL_INTERVAL_MS = 2000;
+const TTL_MS = 120000;
+
+const phoneKeyPath = (home) => join(home ?? homedir(), ".karajan", "supervisor-phone.json");
+
+export const isPhoneEnrolled = ({ home } = {}) => existsSync(phoneKeyPath(home));
+
+export const readEnrolledKey = ({ home } = {}) =>
+  JSON.parse(readFileSync(phoneKeyPath(home), "utf8")).publicKey;
+
+/** Valida y persiste la clave pública del móvil (base64 del raw de 32 bytes). */
+export function enrollPhone(publicKeyBase64, { home } = {}) {
+  const raw = Buffer.from(publicKeyBase64 ?? "", "base64");
+  if (raw.length !== 32 || raw.toString("base64") !== publicKeyBase64) {
+    throw new Error("la clave debe ser base64 canónico de EXACTAMENTE 32 bytes (ed25519 raw)");
+  }
+  mkdirSync(join(phoneKeyPath(home), ".."), { recursive: true });
+  const record = { publicKey: publicKeyBase64, enrolledAt: new Date().toISOString() };
+  writeFileSync(phoneKeyPath(home), `${JSON.stringify(record, null, 2)}\n`, "utf8");
+}
+
+/** Payload canónico firmado: files EXACTAMENTE como se enviaron, JSON sin espacios. */
+export function canonicalPayload({ cid, nonce, project, files }) {
+  const filesHash = createHash("sha256").update(JSON.stringify(files)).digest("hex");
+  return `kj-supervisor-sign:v1:${cid}:${nonce}:${project}:${filesHash}`;
+}
+
+/** Verifica la firma (base64) del payload contra la clave pública raw (base64). */
+export function verifyPhoneSignature({ payload, signature, publicKey }) {
+  const der = Buffer.concat([SPKI_ED25519_PREFIX, Buffer.from(publicKey, "base64")]);
+  const key = createPublicKey({ key: der, format: "der", type: "spki" });
+  return verify(null, Buffer.from(payload, "utf8"), key, Buffer.from(signature, "base64"));
+}
+
+/**
+ * Publica la petición en Firestore, enseña QR + URL, pollea el doc y verifica
+ * la firma. Sin fallbacks silenciosos: red caída o HTTP no-ok ⇒ throw. Firma
+ * mala / clave ajena / TTL vencido ⇒ {ok:false, reason}.
+ * @returns {Promise<{ok: boolean, reason?: string}>}
+ */
+export async function requestPhoneSignature({ project, files, kjVersion, logger = console, deps = {} }) {
+  const fetchFn = deps.fetch ?? fetch;
+  const now = deps.now ?? Date.now;
+  const sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+  const drawQr = deps.qr ?? ((url) => qrcode.generate(url, { small: true }));
+  const cid = randomBytes(16).toString("hex");
+  const nonce = randomBytes(16).toString("hex");
+  const body = {
+    fields: {
+      nonce: { stringValue: nonce },
+      project: { stringValue: project },
+      kj_version: { stringValue: kjVersion },
+      state: { stringValue: "pending" },
+      createdAt: { timestampValue: new Date().toISOString() },
+      files: { arrayValue: { values: files.map((f) => ({ mapValue: { fields: { file: { stringValue: f.file }, sha256: { stringValue: f.sha256 ?? "" } } } })) } },
+    },
+  };
+  const relay = await relayConfig(fetchFn);
+  const created = await fetchFn(`${relay.url}?documentId=${cid}&key=${relay.apiKey}`, {
+    method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(body),
+  });
+  if (!created.ok) {
+    throw new Error(`phone-sign: no se pudo publicar la petición de firma (HTTP ${created.status}) — sin red no hay sello, no se degrada`);
+  }
+  const signUrl = `${SIGN_PAGE}?c=${cid}`;
+  drawQr(signUrl);
+  logger.info?.(`phone-sign: escanea el QR o abre ${signUrl} y firma en el móvil (caduca en ${TTL_MS / 1000}s)`);
+  const deadline = now() + TTL_MS;
+  while (now() < deadline) {
+    const res = await fetchFn(`${relay.url}/${cid}?key=${relay.apiKey}`);
+    if (!res.ok) throw new Error(`phone-sign: fallo consultando la petición de firma (HTTP ${res.status})`);
+    const fields = (await res.json()).fields ?? {};
+    if (fields.state?.stringValue === "signed") {
+      const enrolled = readEnrolledKey({ home: deps.home });
+      if (fields.publicKey?.stringValue !== enrolled) {
+        return { ok: false, reason: "la publicKey del doc no coincide con la enrolada — el doc es transporte, la verdad es la enrolada" };
+      }
+      const payload = canonicalPayload({ cid, nonce, project, files });
+      const good = verifyPhoneSignature({ payload, signature: fields.signature?.stringValue ?? "", publicKey: enrolled });
+      return good ? { ok: true } : { ok: false, reason: "firma ed25519 inválida para el payload canónico" };
+    }
+    logger.info?.("phone-sign: esperando la firma del móvil…");
+    await sleep(POLL_INTERVAL_MS);
+  }
+  return { ok: false, reason: "caducado" };
+}

package/src/harden/sentinel-hooks.js

@@ -371,6 +371,58 @@ process.stdin.on("end", () => {
       console.error("karajan sentinel: los ficheros del supervisor no se tocan desde Bash — consultalos con la tool Read/Grep; solo el humano los modifica, fuera de la sesion." + doc("supervisor"));
       process.exit(2);
     }
+    // KJC-BUG-0164: todo gh que PUBLICA texto (pr/issue/release, create/edit/
+    // comment/review) se escanea contra el patron de ATRIBUCION a IA antes de
+    // salir — comando inline Y ficheros --body-file/--notes-file. Regla
+    // determinista del proyecto: prohibido, sin escape. Un fichero ilegible
+    // tampoco publica (fail closed).
+    {
+      // Regex SIN backslashes a proposito (clases de caracteres, emoji
+      // literal): asi la plantilla y el fichero generado son identicos y no
+      // hay doble-escape que leer mal.
+      const ghCmd = String(input.command || "");
+      if (tool === "Bash" && /(^|[^a-zA-Z])gh([^a-zA-Z]|$)/.test(ghCmd) && /(^|[^a-z])(pr|issue|release)([^a-z]|$)/.test(ghCmd) && /(^|[^a-z])(create|edit|comment|review)([^a-z]|$)/.test(ghCmd)) {
+        const attrib = /co-authored-by:.{0,120}(claude|gpt|copilot|gemini)|(generated|written|created) (by|with).{0,120}(claude|gpt|copilot|gemini|codex)|generated with [[]?claude|🤖/is;
+        let corpus = ghCmd;
+        for (const m of ghCmd.matchAll(/--(?:body-file|notes-file|comment-file)[= ]+("([^"]+)"|'([^']+)'|([^ ]+))/g)) {
+          const bodyPath = m[2] || m[3] || m[4];
+          try { corpus += "\\n" + readFileSync(bodyPath, "utf8"); } catch {
+            console.error("karajan sentinel: no puedo leer " + bodyPath + " para el escaneo de atribucion — sin escaneo no se publica." + doc("attribution"));
+            process.exit(2);
+          }
+        }
+        if (attrib.test(corpus)) {
+          console.error("karajan sentinel: atribucion a IA detectada en contenido a PUBLICAR (PR/issue/release) — prohibida por regla determinista del proyecto: limpia el texto." + doc("attribution"));
+          process.exit(2);
+        }
+      }
+    }
+    // KJC-TSK-0822 v1.1: enrolar (o pisar) la clave del movil es acto humano
+    // — si un agente pudiera enrolar una clave SUYA, contestaria la capa 5 el
+    // solo. Ni el comando ni el fichero de enrolamiento desde la sesion.
+    {
+      const enrollCmd = String(input.command || "");
+      const namesEnroll = (enrollCmd.includes("identity") && enrollCmd.includes("enroll-phone")) || enrollCmd.includes("supervisor-phone.json");
+      const writesEnroll = EDIT_TOOLS.includes(tool) && String(input.file_path || "").includes("supervisor-phone.json");
+      if ((tool === "Bash" && namesEnroll) || writesEnroll) {
+        console.error("karajan sentinel: el enrolamiento del movil (capa 5) es un acto humano — pideselo a tu usuario; supervisor-phone.json no se toca desde la sesion." + doc("supervisor"));
+        process.exit(2);
+      }
+    }
+    // ADR 0009 (KJC-BUG-0161): kj harden --commit es un ACTO HUMANO — la
+    // sesion ni lo intenta. Sin escape (superficie de supervisor). includes()
+    // a proposito: cero ambiguedad de escapes en plantilla, y fail-closed
+    // (mencionarlo en un argumento tambien bloquea: preferible a un hueco).
+    // ANTES de KJ_SENTINEL_OFF a proposito, como el guard PROTECTED de
+    // arriba: un env var lo pone tambien un agente — el supervisor no se
+    // apaga con interruptores al alcance del supervisado.
+    {
+      const kjCmd = String(input.command || "");
+      if (tool === "Bash" && kjCmd.includes("harden") && kjCmd.includes("--commit")) {
+        console.error("karajan sentinel: kj harden --commit es un acto humano (ADR 0009) — pideselo a tu usuario; ninguna sesion de agente lo ejecuta." + doc("supervisor"));
+        process.exit(2);
+      }
+    }
     if (process.env.KJ_SENTINEL_OFF === "1") process.exit(0);
     // KJC-BUG-0142: cada deny anuncia su escape como prefijo del comando
     // (KJ_ALLOW_X=1 cmd), pero el hook corre con el env del HOST — el
@@ -564,6 +616,15 @@ process.stdin.on("end", () => {
     }
     if (tool === "Bash") {
       const cmd = String(input.command || "");
+      // KJC-BUG-0166: una sesion intento EN BUCLE retirar el ARBOL PRINCIPAL
+      // con git worktree remove y KJ_ALLOW_CROSS_LANE puesto. Retirar un
+      // worktree es destruccion de la estructura del repo — jamas trabajo de
+      // una sesion, y el escape de cruce NO puede ampararlo. Deny sin escape
+      // (el cauce sancionado es kj worktree done, que corre dentro de kj).
+      if (/(^|[^a-z])git[^a-z]+worktree[^a-z]+(remove|prune)/.test(cmd)) {
+        console.error("karajan sentinel: git worktree remove/prune no se ejecuta desde una sesion — destruccion de estructura del repo, sin escape; usa kj worktree done." + doc("cross-lane"));
+        process.exit(2);
+      }
       // Deny-unless-known-read-only: un allowlist de verbos mutadores era
       // esquivable (dd, interpretes). Solo un comando SIMPLE de lectura (sin
       // encadenar ni redirigir) puede nombrar otro carril; leer carriles es

package/src/harden/supervisor-commit.js

@@ -0,0 +1,169 @@
+/**
+ * KJC-BUG-0161 / ADR 0009 (opción A) — `kj harden --commit`, el cauce
+ * sancionado del supervisor: ACTO HUMANO que versiona la regeneración con
+ * provenance trackeada (versión, parámetros, sha256), sello en el acta y
+ * commit quirúrgico. El --no-verify es a conciencia: lo que salta en local
+ * lo re-verifica CI contra la provenance (pieza 3).
+ */
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { closeSync, existsSync, openSync, readFileSync, readSync, readdirSync, writeFileSync } from "node:fs";
+import { basename, join } from "node:path";
+
+import { recordGateDecision } from "../policy/decisions.js";
+import { readIdentity } from "../identity/store.js";
+import { isPhoneEnrolled, requestPhoneSignature } from "./phone-sign.js";
+
+export const PROVENANCE_FILE = ".karajan/supervisor-provenance.json";
+const HOOKS_PREFIX = ".karajan/hooks/";
+
+const sha256 = (abs) => createHash("sha256").update(readFileSync(abs)).digest("hex");
+
+// Capa 3 del acto humano (test adversarial del 6-sep): un pty falso engaña a
+// isTTY y `env -u` borra CLAUDECODE, pero el kj que lanza un agente DESCIENDE
+// de su proceso — y eso está en /proc lo falsifique quien lo falsifique.
+const AGENT_PROC = /claude|codex|copilot|gemini|opencode|\bagy\b/i;
+export function agentAncestry({ pid = process.pid, readProc = null, maxDepth = 40 } = {}) {
+  const read = readProc || ((p) => {
+    const stat = readFileSync(`/proc/${p}/stat`, "utf8");
+    const ppid = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
+    let cmd = "";
+    try { cmd = readFileSync(`/proc/${p}/cmdline`).toString("utf8").replaceAll("\0", " "); } catch { /* gone */ }
+    return { ppid, cmd };
+  });
+  let cur = pid;
+  for (let i = 0; i < maxDepth && cur > 1; i += 1) {
+    let info;
+    try { info = read(cur); } catch { return { agent: false, unknown: true }; }
+    if (info?.cmd && AGENT_PROC.test(info.cmd)) return { agent: true, match: info.cmd.slice(0, 80) };
+    if (!Number.isFinite(info?.ppid) || info.ppid === cur) break;
+    cur = info.ppid;
+  }
+  return { agent: false };
+}
+
+// Lee la respuesta del nonce de la TTY REAL del proceso (no de stdin, que un
+// atacante alimenta por pipe): /dev/tty solo existe con terminal de control.
+function defaultConfirm(nonce) {
+  process.stdout.write(`harden --commit: teclea "${nonce}" para confirmar que eres humano: `);
+  try {
+    const buf = Buffer.alloc(64);
+    const fd = openSync("/dev/tty", "r");
+    const n = readSync(fd, buf, 0, 64);
+    closeSync(fd);
+    return buf.toString("utf8", 0, n).trim();
+  } catch {
+    return null;
+  }
+}
+
+/** Ficheros de supervisor TRACKEADOS con cambios (staged o no). */
+export function supervisorDrift({ projectDir, gitFn }) {
+  const run = gitFn || ((args) => execFileSync("git", args, { cwd: projectDir, encoding: "utf8" }));
+  // Un rename sale como "R  old -> new" (catch de codex): ambas rutas son
+  // drift — la vieja se versiona como borrado y la nueva con su hash.
+  return run(["status", "--porcelain", "--", ".karajan/hooks"])
+    .split("\n")
+    .flatMap((l) => l.slice(3).trim().split(" -> "))
+    .filter((f) => f.startsWith(HOOKS_PREFIX));
+}
+
+/**
+ * @returns {Promise<{committed: boolean, reason?: string, files?: object[]}>}
+ */
+export async function commitSupervisorRegeneration({
+  projectDir,
+  kjVersion,
+  generation,
+  logger = console,
+  gitFn = null,
+  env = process.env,
+  tty = process.stdout.isTTY,
+  deps = {},
+}) {
+  // El cauce es humano por diseño (ADR 0009): una sesión de agente no lo usa.
+  if (env.CLAUDECODE || env.KJ_NON_INTERACTIVE === "1" || !tty) {
+    throw new Error(
+      "harden --commit es un acto humano: córrelo desde TU terminal, fuera de una sesión de agente (ADR 0009)",
+    );
+  }
+  const anc = agentAncestry(deps.ancestry ?? {});
+  if (anc.agent) {
+    throw new Error(
+      `harden --commit es un acto humano y este proceso desciende de un agente (${anc.match}) — ni con pty falso ni con el entorno limpio (ADR 0009)`,
+    );
+  }
+  // Capa 4 (test adversarial 6-sep: un huérfano a init con pty falso y
+  // prompts a ciegas llegó hasta aquí): nonce aleatorio tecleado de vuelta.
+  // Un alimentador ciego no conoce el código; automatizar su lectura exige
+  // un driver expect — premeditación inequívoca, no un descuido.
+  const nonce = createHash("sha256").update(String(Math.random())).digest("hex").slice(0, 6);
+  const answer = (deps.confirm ?? defaultConfirm)(nonce);
+  if (answer !== nonce) {
+    throw new Error(`harden --commit: confirmación humana fallida (esperaba "${nonce}") — ADR 0009`);
+  }
+  const run = gitFn || ((args) => execFileSync("git", args, { cwd: projectDir, encoding: "utf8" }));
+  const drift = supervisorDrift({ projectDir, gitFn: run });
+  // La provenance describe SIEMPRE el estado COMPLETO del supervisor (cazado
+  // en el primer estreno real: un sello parcial pisaba al anterior y dejaba
+  // ficheros sin respaldo). Borrados del drift ⇒ deleted (catch de codex).
+  const current = readdirSync(join(projectDir, HOOKS_PREFIX)).map((f) => HOOKS_PREFIX + f).sort();
+  const hashed = [
+    ...current.map((file) => ({ file, sha256: sha256(join(projectDir, file)) })),
+    ...drift.filter((f) => !existsSync(join(projectDir, f))).map((file) => ({ file, deleted: true })),
+  ];
+  let previous = null;
+  try { previous = JSON.parse(readFileSync(join(projectDir, PROVENANCE_FILE), "utf8")); } catch { /* primer sello */ }
+  const covered = JSON.stringify(previous?.files ?? null) === JSON.stringify(hashed);
+  if (drift.length === 0 && covered) {
+    logger.info?.("harden --commit: sin drift y provenance completa — nada que versionar");
+    return { committed: false, reason: "sin drift" };
+  }
+  // Capa 5 (KJC-TSK-0822 / PRP-0023): con móvil enrolado la firma asimétrica
+  // es OBLIGATORIA — jamás se degrada a solo-nonce. Firma los MISMOS
+  // files/hashes de la provenance (normalizados al par {file, sha256}).
+  const phone = deps.phone ?? { enrolled: isPhoneEnrolled, request: requestPhoneSignature };
+  if (phone.enrolled({})) {
+    const signed = await phone.request({
+      project: basename(projectDir),
+      files: hashed.map(({ file, sha256: hash }) => ({ file, sha256: hash ?? "" })),
+      kjVersion,
+      logger,
+    });
+    if (!signed.ok) {
+      throw new Error(`capa 5: firma del móvil rechazada (${signed.reason}) — con móvil enrolado el sello exige su firma (PRP-0023)`);
+    }
+  }
+  const who = readIdentity(projectDir);
+  const provenance = {
+    kj_version: kjVersion,
+    generated_at: new Date().toISOString(),
+    generation,
+    who: who ? { gh: who.gh_user ?? null, git: who.git_email ?? null, grade: "declarada" } : null,
+    files: hashed,
+  };
+  writeFileSync(join(projectDir, PROVENANCE_FILE), `${JSON.stringify(provenance, null, 2)}\n`, "utf8");
+  recordGateDecision(projectDir, {
+    decision: "exempt",
+    chokepoint: "supervisor",
+    kind: "supervisor-regeneration",
+    kj_version: kjVersion,
+    files: hashed,
+    who: provenance.who,
+  });
+  // Por DIRECTORIO, no por fichero: un rename ya staged deja la ruta vieja
+  // sin existir y `git add -- <vieja>` falla; `-A` sobre el dir del
+  // supervisor versiona altas, cambios, borrados y renombrados por igual.
+  run(["add", "-A", "--", PROVENANCE_FILE, ".karajan/hooks"]);
+  run([
+    "commit",
+    "--no-verify",
+    "-m",
+    `chore(harden): supervisor regenerated and sealed by kj harden v${kjVersion}`,
+    "--",
+    PROVENANCE_FILE,
+    ".karajan/hooks",
+  ]);
+  logger.info?.(`harden --commit: ${hashed.length} fichero(s) de supervisor versionados con procedencia sellada`);
+  return { committed: true, files: hashed };
+}

package/src/harden/workflow-templates.js

@@ -36,9 +36,14 @@ export const NO_AI_ATTRIBUTION_WORKFLOW = [
   `      - uses: ${PINNED_ACTIONS.checkout}`,
   "        with:",
   "          fetch-depth: 0",
-  "      - name: Scan commit messages for AI attribution",
+  "      - name: Scan commit messages and PR body for AI attribution",
   "        env:",
   "          BASE_REF: ${{ github.base_ref }}",
+  // KJC-BUG-0164: el cuerpo de la PR tambien es superficie — 15 PRs entraron
+  // con pie de atribucion porque solo se escaneaban commits. Via env, jamas
+  // interpolado en el script (el cuerpo es texto no confiable).
+  "          PR_BODY: ${{ github.event.pull_request.body }}",
+  "          PR_TITLE: ${{ github.event.pull_request.title }}",
   "        run: |",
   '          if ! msgs=$(git log --format=%B "origin/${BASE_REF}...HEAD"); then',
   '            echo "::error::cannot resolve origin/${BASE_REF}...HEAD — the scan did not run"; exit 1',
@@ -48,6 +53,9 @@ export const NO_AI_ATTRIBUTION_WORKFLOW = [
   '          if printf "%s" "$msgs" | grep -qiE "$pat"; then',
   '            echo "::error::AI attribution detected in commit messages"; exit 1',
   "          fi",
+  '          if printf "%s\\n%s" "$PR_BODY" "$PR_TITLE" | grep -qiE "$pat|generated with \\[?claude|🤖"; then',
+  '            echo "::error::AI attribution detected in the PR body or title"; exit 1',
+  "          fi",
   '          echo "AI attribution scan: clean"',
 ].join("\n");
 

package/src/policy/engine.js

@@ -25,7 +25,9 @@ import {
 export const SUPERVISOR_DEFAULTS = [
   {
     id: "defaults.supervisor.write",
-    pattern: /\.claude\/settings\.json\b|\.karajan\/(hooks|harness)\//,
+    // ADR 0009: la provenance del supervisor es superficie de supervisor —
+    // un agente no la escribe; solo kj harden --commit (humano) la produce.
+    pattern: /\.claude\/settings\.json\b|\.karajan\/(hooks|harness)\/|\.karajan\/supervisor-provenance\.json\b/,
     message: "nombra ficheros del supervisor — solo el humano los modifica, fuera de la sesión",
   },
 ];

package/src/policy/supervisor-verify.js

@@ -0,0 +1,79 @@
+/**
+ * KJC-BUG-0161 / ADR 0009, pieza 3 — exención ESTRUCTURAL del supervisor:
+ * un fichero de .karajan/hooks solo deja de ser violación si su contenido
+ * coincide (sha256) con la provenance sellada Y con el render canónico
+ * recomputado. No confía: recomputa. Una coma manual sigue denegada.
+ */
+import { createHash } from "node:crypto";
+import { lstatSync, readFileSync } from "node:fs";
+import { resolve, sep } from "node:path";
+
+import { renderCanonicalHook } from "../harden/harden-engine.js";
+import { PROVENANCE_FILE } from "../harden/supervisor-commit.js";
+
+const HOOKS_PREFIX = ".karajan/hooks/";
+// globalHooksDir es el único texto libre que se interpola en el render:
+// vocabulario cerrado de ruta o la provenance no verifica NADA.
+const SAFE_DIR = /^(\$HOME)?(\/[\w.@%+~-]+)+$/;
+
+const sha256 = (buf) => createHash("sha256").update(buf).digest("hex");
+
+/**
+ * @returns {{files: Set<string>, reason?: string}} rutas repo-relativas de
+ * supervisor cuyo estado actual está respaldado por la provenance sellada.
+ */
+export function verifiedSupervisorFiles({ projectDir }) {
+  let prov;
+  try {
+    prov = JSON.parse(readFileSync(resolve(projectDir, PROVENANCE_FILE), "utf8"));
+  } catch {
+    return { files: new Set(), reason: "sin provenance" };
+  }
+  const gen = prov?.generation ?? {};
+  if (gen.globalHooksDir != null && !SAFE_DIR.test(gen.globalHooksDir)) {
+    return { files: new Set(), reason: "globalHooksDir no verificable en la provenance" };
+  }
+  const ok = new Set();
+  const entries = Array.isArray(prov?.files) ? prov.files : [];
+  const hooksRoot = resolve(projectDir, HOOKS_PREFIX);
+  for (const entry of entries) {
+    if (typeof entry?.file !== "string" || !entry.file.startsWith(HOOKS_PREFIX)) continue;
+    // Contención por resolución, no por prefijo textual (catch de codex).
+    const abs = resolve(projectDir, entry.file);
+    if (!abs.startsWith(hooksRoot + sep)) continue;
+    let st = null;
+    try { st = lstatSync(abs); } catch { /* no hay objeto en la ruta */ }
+    if (entry.deleted === true) {
+      if (st === null) ok.add(entry.file);
+      continue;
+    }
+    if (typeof entry.sha256 !== "string" || !st?.isFile()) continue;
+    if (sha256(readFileSync(abs)) !== entry.sha256) continue;
+    let canonical;
+    try {
+      canonical = renderCanonicalHook(entry.file.slice(HOOKS_PREFIX.length), gen);
+    } catch {
+      continue;
+    }
+    if (sha256(Buffer.from(canonical, "utf8")) === entry.sha256) ok.add(entry.file);
+  }
+  // `complete` = CADA entrada verificó: solo entonces la provenance se
+  // describe con honestidad y su propio diff puede alzarse.
+  const complete = entries.length > 0 && entries.every((e) => typeof e?.file === "string" && ok.has(e.file));
+  return { files: ok, complete };
+}
+
+/** Filtra violaciones de supervisor respaldadas — {violations, lifted}. */
+export function liftSealedSupervisorViolations({ projectDir, violations }) {
+  const RULE = "defaults.supervisor.write";
+  if (!violations.some((v) => v.rule_id === RULE && v.file)) return { violations, lifted: 0 };
+  const sealed = verifiedSupervisorFiles({ projectDir });
+  // La violación sobre la PROPIA provenance solo se alza si la provenance
+  // entera verificó — a medias no describe la verdad y sigue denegada.
+  const liftable = (v) =>
+    v.rule_id === RULE
+    && v.file
+    && (sealed.files.has(v.file) || (v.file === PROVENANCE_FILE && sealed.complete === true));
+  const kept = violations.filter((v) => !liftable(v));
+  return { violations: kept, lifted: violations.length - kept.length };
+}

package/src/review/gate-gitignore.js

@@ -25,7 +25,11 @@ export const CONTRACT_BLOCK = [
   "!.karajan/hooks/commit-msg",
   "!.karajan/hooks/pre-push",
   "!.karajan/hooks/post-merge",
+  "!.karajan/hooks/prepare-commit-msg",
   "!.karajan/adrs/",
+  // ADR 0009 (KJC-BUG-0161): la procedencia del supervisor VIAJA con el
+  // repo — es lo que CI verifica. Cazado en el primer harden --commit real.
+  "!.karajan/supervisor-provenance.json",
 ];
 
 /**