karajan-code 4.32.0 → 4.34.0

package/src/checks/action-pins.js

@@ -0,0 +1,131 @@
+/**
+ * KJC-TSK-0870 — the maintenance that pinning moved onto kj.
+ *
+ * Issue #1374 was right: `kj harden` generated workflows with moving tags
+ * (`actions/checkout@v4`), and kj's own `kj audit --security` flagged them, so
+ * five of the project's seven warnings came from files kj had just written.
+ * They are pinned to commit SHAs now.
+ *
+ * Pinning trades one risk for another: nobody can move the tag under you, and
+ * nobody delivers the upstream patch either. A pin that nobody revisits is a
+ * vulnerability with a long shelf life, and since kj writes those lines, kj is
+ * the one that has to notice. That is this check.
+ *
+ * It lives in `kj doctor` (a person asking about their environment) and NOT in
+ * `kj check` (a gate that CI runs): a gate that needs the network is a gate
+ * that fails on a plane, and turning red over an unreachable API is how a gate
+ * loses its credibility.
+ */
+
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+import { PINNED_ACTIONS } from "../harden/workflow-templates.js";
+
+const execFileAsync = promisify(execFile);
+// Nobody waits for a diagnostic. Both clients are capped, and the pins are
+// asked in parallel, so an unreachable GitHub costs one timeout and not one
+// per action.
+const CALL_TIMEOUT_MS = 5_000;
+
+const STRATEGY_MANUAL = "manual";
+const API = "https://api.github.com/repos";
+
+/** `owner/repo@sha # tag` as written in the templates. */
+export function parsePin(pin) {
+  const m = /^([^@\s]+)@([0-9a-f]{40})\s*#\s*(\S+)$/i.exec(String(pin || "").trim());
+  return m ? { action: m[1], sha: m[2].toLowerCase(), tag: m[3] } : null;
+}
+
+const SHA_RE = /^[0-9a-f]{40}$/;
+const clean = (s) => String(s || "").trim().toLowerCase();
+
+/**
+ * The SHA a tag points at today, asked through `gh` when it is there.
+ *
+ * Measured, not assumed: plain unauthenticated `fetch` answered 403 on the
+ * first real run, because GitHub allows 60 calls an hour PER IP and any shared
+ * or NAT-ed address burns that between everyone behind it. A check that
+ * answers "could not check" almost always is decorative. `gh` carries the
+ * user's own credentials (5000/hour) and kj already relies on it elsewhere;
+ * `fetch` stays as the fallback for whoever has no gh.
+ *
+ * @returns {Promise<string|null>} null when the answer cannot be trusted.
+ */
+export async function currentSha(action, tag, { fetchFn = fetch, ghFn = ghSha } = {}) {
+  const viaGh = await ghFn(action, tag);
+  if (viaGh) return viaGh;
+  const res = await fetchFn(`${API}/${action}/commits/${encodeURIComponent(tag)}`, {
+    headers: { Accept: "application/vnd.github.sha", "User-Agent": "karajan-code" },
+    signal: AbortSignal.timeout(CALL_TIMEOUT_MS),
+  });
+  if (!res?.ok) return null;
+  const body = clean(await res.text());
+  return SHA_RE.test(body) ? body : null;
+}
+
+/** @returns {Promise<string|null>} null when gh is absent, unauthenticated or unhappy. */
+async function ghSha(action, tag) {
+  try {
+    const { stdout } = await execFileAsync("gh", ["api", `repos/${action}/commits/${tag}`, "--jq", ".sha"], {
+      encoding: "utf8",
+      timeout: CALL_TIMEOUT_MS,
+    });
+    const sha = clean(stdout);
+    return SHA_RE.test(sha) ? sha : null;
+  } catch {
+    return null;
+  }
+}
+
+/** @internal Exported for dynamic import from tests. */
+export function createActionPinsCheck({ pins = PINNED_ACTIONS, deps = {} } = {}) {
+  return {
+    name: "action-pins",
+    label: "actions fijadas por SHA",
+    strategy: STRATEGY_MANUAL,
+    describe: "Detect a pinned GitHub Action whose tag has moved on without it",
+    async detect() {
+      const entries = Object.entries(pins).map(([key, pin]) => ({ key, ...(parsePin(pin) || {}) }));
+      const malformed = entries.filter((e) => !e.sha);
+      const asked = await Promise.all(
+        entries.filter((x) => x.sha).map(async (e) => {
+          // offline, rate limited, DNS down, gh missing: not an answer
+          const latest = await currentSha(e.action, e.tag, deps).catch(() => null);
+          return { ...e, latest };
+        }),
+      );
+      const stale = asked.filter((e) => e.latest && e.latest !== e.sha);
+      const unchecked = asked.filter((e) => !e.latest).length;
+
+      if (malformed.length > 0) {
+        return {
+          ok: false,
+          severity: "warn",
+          detail: `pin mal formado: ${malformed.map((m) => m.key).join(", ")} — un pin que no se puede leer no se puede comprobar`,
+          fix: "revisa PINNED_ACTIONS en src/harden/workflow-templates.js: owner/repo@<sha de 40> # <tag>",
+        };
+      }
+      if (stale.length > 0) {
+        return {
+          ok: false,
+          severity: "warn",
+          detail: stale.map((s) => `${s.action} ${s.tag} apunta hoy a ${s.latest.slice(0, 12)} y kj fija ${s.sha.slice(0, 12)}`).join(" · "),
+          fix: stale.map((s) => `${s.action}@${s.latest} # ${s.tag}`).join("  ·  "),
+        };
+      }
+      // Never claim what was not looked at (the card's own acceptance
+      // criterion): an unreachable API is said, not passed off as green.
+      if (unchecked > 0) {
+        return {
+          ok: true,
+          severity: "info",
+          detail: unchecked === entries.length
+            ? "no se pudo comprobar ninguna action (¿sin red o con la API de GitHub limitando?)"
+            : `${unchecked} action(s) sin comprobar (¿sin red o con la API de GitHub limitando?)`,
+        };
+      }
+      return { ok: true, severity: "info", detail: `${entries.length} action(s) fijadas y al día` };
+    },
+  };
+}

package/src/checks/project-checks.js

@@ -24,6 +24,7 @@ import { checkBinary } from "../utils/agent-detect.js";
 import { getInstallCommand } from "../utils/os-detect.js";
 import { STRATEGY } from "./types.js";
 import { createRepoStateCheck } from "./repo-state.js";
+import { createActionPinsCheck } from "./action-pins.js";
 
 /**
  * Detect signals del proyecto. Devuelve un set de tags con qué hay en el
@@ -246,5 +247,10 @@ export function getProjectChecks({ projectDir }) {
     // check looks at — the order it was set up in, whether the contract
     // travels, whether this clone declares who works it.
     createRepoStateCheck({ projectDir }),
+    // KJC-TSK-0870: pinning the actions by SHA (issue #1374) moved their
+    // maintenance onto kj. Doctor asks upstream whether a tag has moved on
+    // without its pin; `kj check` deliberately does not, because a gate that
+    // needs the network is a gate that fails on a plane.
+    createActionPinsCheck(),
   ];
 }

package/src/checks/release-check.js

@@ -106,6 +106,42 @@ async function packPrivacyCheck(projectDir, pkg) {
   }
 }
 
+/**
+ * KJC-BUG-0204 — an item may declare WHICH command repairs it (`remedied_by`),
+ * so the gate stops blocking the one action that would turn it green. It was
+ * the landing: the check demanded a deployed site and the guard blocked the
+ * deploy, leaving `KJ_ALLOW_RELEASE=1` — switching the gate off entirely — as
+ * the only way to reach the publish that came next.
+ */
+const remedy = (item) => (typeof item?.remedied_by === "string" && item.remedied_by.trim() ? { remediedBy: item.remedied_by.trim() } : {});
+
+/**
+ * The words of a verb must appear in the command IN ORDER, as whole words:
+ * `firebase deploy` covers `firebase --account a@b --project p deploy --only x`,
+ * and `deploy firebase` is a different command. Separators (`;`, `|`, `&`,
+ * parentheses) split words, so `(npm publish)` is still a publication.
+ * A word is read by its basename, so `/usr/bin/npm publish` is the same
+ * publication as `npm publish` (review catch: an absolute path hid one).
+ */
+const wordsOf = (text) => String(text).split(/[^A-Za-z0-9_.@:/-]+/).filter(Boolean).map((w) => w.slice(w.lastIndexOf("/") + 1)).filter(Boolean);
+
+export function remediesCommand(remediedBy, command) {
+  const want = wordsOf(remediedBy);
+  if (want.length === 0) return false;
+  let i = 0;
+  for (const word of wordsOf(command)) if (word === want[i] && ++i === want.length) return true;
+  return false;
+}
+
+/**
+ * A publication is irreversible: no declared item may excuse one. Detected with
+ * the SAME tolerance as a remedy (review catch): matching only adjacent words
+ * left `npm --registry https://r.example publish` undetected, so an item could
+ * have lifted a red check while the publication went ahead.
+ */
+const PUBLICATION_VERBS = ["npm publish", "gh release create"];
+const isPublication = (command) => PUBLICATION_VERBS.some((verb) => remediesCommand(verb, command));
+
 async function declaredItems(projectDir, config, version) {
   const items = config?.release_check?.items;
   if (!Array.isArray(items)) return [];
@@ -116,13 +152,16 @@ async function declaredItems(projectDir, config, version) {
       const p = isAbsolute(item.file_contains.path) ? item.file_contains.path : join(projectDir, item.file_contains.path);
       const needle = String(item.file_contains.pattern).replaceAll("{version}", version ?? "");
       const ok = existsSync(p) && readFileSync(p, "utf8").includes(needle);
-      checks.push({ name, ok, detail: ok ? `"${needle}" found in ${item.file_contains.path}` : `"${needle}" NOT found in ${item.file_contains.path}` });
+      checks.push({ name, ok, ...remedy(item), detail: ok ? `"${needle}" found in ${item.file_contains.path}` : `"${needle}" NOT found in ${item.file_contains.path}` });
     } else if (item?.command) {
       try {
         const res = await runCommand("sh", ["-c", String(item.command).replaceAll("{version}", version ?? "")], { cwd: projectDir });
-        checks.push({ name, ok: res.exitCode === 0, detail: res.exitCode === 0 ? "command exited 0" : `command exited ${res.exitCode}` });
+        checks.push({ name, ok: res.exitCode === 0, ...remedy(item), detail: res.exitCode === 0 ? "command exited 0" : `command exited ${res.exitCode}` });
       } catch (err) {
-        checks.push({ name, ok: false, detail: `command failed to run: ${err.message}` });
+        // El remedio viaja tambien cuando el item no se pudo ni ejecutar
+        // (catch de la review): si no, el comando que lo repara queda
+        // bloqueado justo cuando el check no ha podido comprobar nada.
+        checks.push({ name, ok: false, ...remedy(item), detail: `command failed to run: ${err.message}` });
       }
     } else {
       checks.push({ name, ok: false, detail: "unknown item shape — use file_contains {path, pattern} or command" });
@@ -160,10 +199,17 @@ export async function dualPublishCheck(projectDir, pkg, run = runCommand) {
   }
 }
 
-export async function runReleaseCheck({ projectDir = process.cwd(), config = {} } = {}) {
+export async function runReleaseCheck({ projectDir = process.cwd(), config = {}, forCommand = null } = {}) {
   const { checks, version, pkg } = await genericChecks(projectDir);
   const pack = await packPrivacyCheck(projectDir, pkg);
   const dual = await dualPublishCheck(projectDir, pkg);
   checks.push(...(pack ? [pack] : []), ...(dual ? [dual] : []), await policyRangeCheck(projectDir), ...await declaredItems(projectDir, config, version));
-  return { ok: checks.every((c) => c.ok), version, checks };
+  if (forCommand === null) return { ok: checks.every((c) => c.ok), version, checks };
+  // A lifted check stays RED in the report: the fact is not falsified, it just
+  // stops blocking the command that exists to repair it. The mark travels ON
+  // the check (review catch): two items may share a name, and a name-keyed
+  // list would have exempted a red check nothing remedies.
+  const liftable = !isPublication(forCommand);
+  const marked = checks.map((c) => (liftable && !c.ok && c.remediedBy && remediesCommand(c.remediedBy, forCommand) ? { ...c, lifted: true } : c));
+  return { ok: marked.every((c) => c.ok || c.lifted === true), version, checks: marked, lifted: marked.filter((c) => c.lifted).map((c) => c.name) };
 }

package/src/cli/register-meta.js

@@ -40,6 +40,9 @@ import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { spawnSync } from "node:child_process";
 import { verifySentinelScripts, resolveSentinelRoot } from "../harden/sentinel-hooks.js";
+import { boardGate } from "../review/board-pending.js";
+import { panelDeviation } from "../environment/panel.js";
+import { detectHostAgent } from "../utils/agent-detect.js";
 
 /**
  * Register the "meta" / single-role / housekeeping commands: pre-pipeline
@@ -337,12 +340,16 @@ export function registerMeta(program, { pkgVersion }) {
   release.command("check")
     .description("Verify the release checklist deterministically (manifest vs CHANGELOG vs tags, privacy scan of publishable files, plus the project's release_check.items); exit 1 lists exactly what is missing")
     .option("--json", "Machine-readable result")
+    // KJC-BUG-0204: el guard pregunta POR un comando. Un item que declara
+    // remedied_by no bloquea el comando que lo repara; publicar nunca se exime.
+    .option("--for-command <cmd>", "Evaluate the checklist for this command: red items whose remedied_by is this command do not block it")
     .action(async (flags) => {
       await withConfig(pkgVersion, "release-check", flags, async ({ config }) => {
-        const res = await runReleaseCheck({ projectDir: config?.projectDir || process.cwd(), config });
+        const res = await runReleaseCheck({ projectDir: config?.projectDir || process.cwd(), config, forCommand: flags.forCommand ?? null });
         if (flags.json) process.stdout.write(`${JSON.stringify(res)}\n`);
         else {
           for (const c of res.checks) console.log(`  ${c.ok ? "✓" : "✗"} ${c.name}: ${c.detail}`);
+          if (res.lifted?.length) console.log(`  ℓ no bloquean este comando porque es su remedio: ${res.lifted.join(", ")}`);
           console.log(res.ok ? `release check: ready to release ${res.version ?? ""}`.trim() : "release check: NOT ready — fix the red items first");
         }
         process.exitCode = res.ok ? 0 : 1;
@@ -419,8 +426,12 @@ export function registerMeta(program, { pkgVersion }) {
     });
   policyCmd.command("seal")
     .description("Sella en el decision log un escape KJ_ALLOW_* usado en tool-time (exempt, chokepoint=tool, identidad declarada del clon) — lo invoca el Sentinel, GOV-F")
-    .requiredOption("--escape <name>", "Escape usado (p.ej. KJ_ALLOW_BOARD)")
+    .option("--escape <name>", "Escape usado (p.ej. KJ_ALLOW_BOARD)")
     .option("--tool <tool>", "Tool que lo usó (Bash, Edit…)")
+    // KJC-TSK-0868: el panel se sella igual, con su propio chokepoint.
+    .option("--panel <coder>", "Coder declarado cuando el anfitrión escribió el código")
+    .option("--host <agent>", "Anfitrión que escribió, para el asiento del panel")
+    .option("--honoured", "El panel se CUMPLIÓ: escribió el coder declarado (KJC-TSK-0873)")
     .action(async (flags) => {
       await withConfig(pkgVersion, "policy-seal", flags, async ({ config }) => {
         process.exitCode = await policyCommand({ action: "seal", config, flags });
@@ -466,9 +477,38 @@ export function registerMeta(program, { pkgVersion }) {
     .action((flags) => {
       const res = verifySentinelScripts();
       if (flags.json) process.stdout.write(`${JSON.stringify(res)}\n`);
+      // KJC-BUG-0197: manipulación y desfase son hechos distintos y se leen
+      // distinto. Un desfase no es un defecto: los guardias que corren están
+      // sellados, solo son más viejos que las plantillas de este árbol.
+      else if (res.drift?.length && res.ok) console.log(`sentinel verify: scripts sellados, con desfase (${res.drift.join(", ")}) — ${res.reason}`);
       else console.log(res.ok ? "sentinel verify: scripts intactos" : `sentinel verify: modificados fuera de kj harden: ${res.mismatched.join(", ")} — restaura con kj harden`);
       process.exitCode = res.ok ? 0 : 1;
     });
+  // KJC-TSK-0868: el anfitrión escribiendo con otro coder declarado no se
+  // bloquea, se registra. El Stop gate pregunta una vez por sesión.
+  sentinel.command("panel-check")
+    .description("Record in the decision log that the host wrote code while another coder is declared (chokepoint panel); prints nothing and records nothing when the panel was honoured")
+    .requiredOption("--session <id>", "Host session id, for the record")
+    .action(async (flags) => {
+      await withConfig(pkgVersion, "sentinel-panel-check", flags, async ({ config }) => {
+        const dev = panelDeviation(config, detectHostAgent());
+        if (!dev) return;
+        process.exitCode = await policyCommand({ action: "seal", config, flags: { panel: dev.coder, host: dev.host }, logger: { info: () => {}, error: console.error } });
+        if (process.exitCode === 0) console.log(`ℓ panel: el coder declarado es ${dev.coder} y ha escrito ${dev.host} — registrado como excepción consciente (kj report lo cuenta)`);
+      });
+    });
+  // KJC-BUG-0198: el guard pregunta, kj decide con un hecho comprobable (otra
+  // PR abierta de la card), y exit 2 = bloquea.
+  sentinel.command("board-gate")
+    .description("Decide which pending board moves actually block: a card still being delivered in another open PR is carried, everything else blocks; exit 2 = blocked")
+    .requiredOption("--session <id>", "Host session id whose pending moves are evaluated")
+    .option("--json", "Machine-readable result")
+    .action((flags) => {
+      const res = boardGate({ projectDir: resolveSentinelRoot(), sessionId: flags.session });
+      if (flags.json) process.stdout.write(`${JSON.stringify(res)}\n`);
+      else for (const c of res.carried) console.log(`ℓ board-sync: ${c.card} ${c.why} — se moverá al cerrarla`);
+      process.exitCode = res.blocking.length > 0 ? 2 : 0;
+    });
 
   // KJC-TSK-0704 — the outbound privacy boundary: audit before anything ships.
   const privacy = program.command("privacy").description("Personal-data (PII) auditing of outbound boundaries: staged diffs, build outputs, docs trees");

package/src/cli/register-pipeline.js

@@ -179,11 +179,21 @@ export function registerPipeline(program, { pkgVersion }) {
     .argument("[task]", "Task description (REQUIRED — provide as argument or via --task-file)")
     .option("--task-file <path>", "Read the task from a file (e.g. .md)")
     .option("--coder <name>")
+    // KJC-TSK-0864: --coder is the pipeline's word for it, --agent is the
+    // session's. Same knob, two vocabularies; naming both and disagreeing is
+    // an error, never a silent precedence.
+    .option("--agent <name>", "The agent that writes (alias of --coder)")
+    .option("--card <ref>", "Card/HU the work belongs to — its statement and criteria reach the coder")
     .option("--coder-model <name>")
     .action(async (task, flags) => {
+      if (flags.agent && flags.coder && flags.agent !== flags.coder) {
+        console.error(`kj code: --agent ${flags.agent} and --coder ${flags.coder} name different agents — pick one`);
+        process.exit(2);
+      }
+      if (flags.agent) flags.coder = flags.agent;
       await withConfig(pkgVersion, "code", flags, async ({ config, logger }) => {
         const resolvedTask = await resolveTaskInput({ task, taskFile: flags.taskFile, projectDir: config.projectDir, logger });
-        await codeCommand({ task: resolvedTask, config, logger });
+        await codeCommand({ task: resolvedTask, config, logger, flags });
       });
     });
 

package/src/commands/check.js

@@ -9,6 +9,7 @@ import { collectMethodStats, formatMethodStats } from "../checks/method.js";
 import { createRagCoverageCheck } from "../checks/rag-coverage.js";
 import { checkAiSurface, formatAiSurface } from "../checks/ai-surface.js";
 import { detectObservedAgents } from "../utils/agent-detect.js";
+import { panelSummary } from "../environment/panel.js";
 import { loadConfig } from "../config.js";
 
 export async function checkCommand({ projectDir = process.cwd(), profile = "standard", json = false, logger = console } = {}) {
@@ -44,6 +45,10 @@ export async function checkCommand({ projectDir = process.cwd(), profile = "stan
   if (method) logger.info?.(`  method: ${formatMethodStats(method)}`);
   logger.info?.(`  ${ragCoverage.ok ? "✓" : "✗"} rag-coverage: ${ragCoverage.detail}`);
   if (aiSurface) logger.info?.(`  ${formatAiSurface(aiSurface)}`);
+  // KJC-TSK-0865: who writes and who reviews is the user's choice, so it is
+  // said out loud next to everything else that describes the project. Never
+  // a check: it has no ok/fail, it informs.
+  logger.info?.(`  ${panelSummary(config)}`);
   if (ok) logger.info?.("Harness OK.");
   else if (result.ok) logger.info?.("RAG index drift detected — a gate cannot protect what it cannot see.");
   else logger.info?.("Harness drift detected — run `kj harden` to repair.");

package/src/commands/code.js

@@ -2,13 +2,25 @@ import fs from "node:fs/promises";
 import { createAgent } from "../agents/index.js";
 import { assertAgentsAvailable } from "../agents/availability.js";
 import { buildCoderPrompt } from "../prompts/coder.js";
+import { resolveCardContext } from "../prompts/card-context.js";
+import { composeTask, resolveRagContext } from "../prompts/session-context.js";
 import { resolveRole } from "../config.js";
+// KJC-TSK-0859: the agents no longer substitute a dead model behind your back,
+// so the command needs the declared chain, with the one-shot policy a command
+// deserves (KJC-BUG-0194 moved it to its own module: audit needs the same).
+import { withBrainRecovery } from "../brain/with-brain-recovery.js";
+import { buildRoleFallbackChain } from "../brain/role-fallback-chain.js";
+import { ONE_SHOT_POLICY } from "../brain/one-shot-policy.js";
+import { sealPanel } from "../environment/panel.js";
 import { withCliRunLog } from "../utils/cli-run-log.js";
 import { createCliProgressReporter } from "../utils/cli-progress.js";
 
-export async function codeCommand({ task, config, logger }) {
+export async function codeCommand({ task, config, logger, flags = {} }) {
   return withCliRunLog("code", { projectDir: config?.projectDir, logger }, async ({ runLog }) => {
     const coderRole = resolveRole(config, "coder");
+    // KJC-TSK-0864: no quota, not authenticated or simply absent? This THROWS
+    // with the agent named. The one thing it never does is quietly fall back
+    // to whoever happens to be reachable.
     await assertAgentsAvailable([coderRole.provider]);
     logger.info(`Coder (${coderRole.provider}) starting...`);
     runLog.logText(`[coder] provider=${coderRole.provider}`);
@@ -21,11 +33,39 @@ export async function codeCommand({ task, config, logger }) {
         try { coderRules = await fs.readFile("coder-rules.md", "utf8"); } catch { /* no coder rules file */ }
       }
     }
-    const prompt = await buildCoderPrompt({ task, coderRules, methodology: config.development?.methodology || "tdd" });
+    const card = await resolveCardContext({ projectDir: config.projectDir, ref: flags.card || null });
+    if (card?.external) logger.warn(`card ${card.huId} lives on a board kj cannot read — passing the reference, not its text`);
+    else if (card) logger.info(`Card ${card.huId}: ${card.title}`);
+    // The method's first invariant is that the RAG answers before you assume.
+    // The session asks on the coder's behalf: a subprocess coder cannot run
+    // `kj rag query` itself, so it used to guess the codebase instead.
+    const rag = await resolveRagContext({ task, config, logger });
+    // The pipeline always passed projectDir (it arms the directory-boundary
+    // rule and the skills section) and the provider. `kj code` did not, so the
+    // declared coder got a weaker prompt from the session than from `kj run`.
+    const prompt = await buildCoderPrompt({
+      task: composeTask(task, [card?.section, rag?.section]),
+      coderRules,
+      methodology: config.development?.methodology || "tdd",
+      projectDir: config.projectDir,
+      provider: coderRole.provider,
+      huId: card?.huId ?? null,
+      acceptanceTests: card?.acceptanceTests ?? null,
+      serenaEnabled: Boolean(config.serena?.enabled),
+      rtkAvailable: Boolean(config.rtk?.available),
+    });
     const progress = createCliProgressReporter({ role: "coder" });
     let result;
     try {
-      result = await coder.runTask({ prompt, onOutput: progress.onOutput, role: "coder" });
+      result = await withBrainRecovery({
+        agent: { runTask: (args) => coder.runTask(args), provider: coderRole.provider, model: coderRole.model },
+        taskArgs: { prompt, onOutput: progress.onOutput, role: "coder" },
+        role: "coder",
+        provider: coderRole.provider,
+        logger,
+        policy: ONE_SHOT_POLICY,
+        fallback: buildRoleFallbackChain({ config, role: "coder", logger }),
+      });
       progress.finish(result.ok ? "done" : "failed");
     } catch (err) { progress.finish("failed"); throw err; }
     if (!result.ok) {
@@ -39,7 +79,22 @@ export async function codeCommand({ task, config, logger }) {
       logger.warn(result.error);
     }
     logger.info(`Coder completed (exit ${result.exitCode})`);
+    // KJC-TSK-0873: aqui es donde el panel SE CUMPLE — el coder declarado ha
+    // escrito. Queda asentado junto a las desviaciones para que el recuento de
+    // kj report signifique algo: casi siempre y casi nunca no se ven igual.
+    // Solo cuenta como cumplido si el coder declarado TERMINO bien: ni una
+    // salida distinta de cero ni una caida al fallback son "escribio el coder
+    // que elegiste" (dos catches de la review). Si escribio otro, se asienta
+    // como desviacion nombrandolo.
+    const ranBy = result.provider || coderRole.provider;
+    if (result.exitCode === 0) {
+      try { sealPanel({ projectDir: config.projectDir, coder: coderRole.provider, host: ranBy, honoured: ranBy === coderRole.provider }); }
+      catch (err) { logger.warn(`panel: no se pudo sellar quién escribió (${err.message}) — el trabajo del coder no se toca`); }
+    }
+    // The work is in the tree, not committed: the gate is the next step and a
+    // DIFFERENT AI runs it. Saying so here is what keeps the panel honest.
+    logger.info(`The work is in the tree. Review it before committing: kj review --staged (a different AI than ${coderRole.provider}).`);
     runLog.logText(`[coder] finished (exit=${result.exitCode})`);
-    return { ok: true };
+    return { ok: true, provider: coderRole.provider, card: card?.huId ?? null, ragSources: rag?.sources ?? [] };
   });
 }

package/src/commands/env.js

@@ -71,6 +71,7 @@ export async function envInstallCommand({ config = null, logger = null, flags =
     projectDir, target: flags.target || "all",
     stateBackend: config?.state_backend || "hu-board",
     boardName: config?.board?.name || null,
+    config, // KJC-TSK-0865: the panel travels with the method
   });
   console.log(`✓ Karajan playbook installed in: ${result.files.join(", ")}`);
 
@@ -213,7 +214,7 @@ export async function envInstallCommand({ config = null, logger = null, flags =
     // CLAUDE.md, but the running session loaded its context BEFORE — nobody
     // re-reads it. Print the method so it enters THIS conversation now.
     console.log("\n— The Karajan method below is IN EFFECT from this very message. If your session started before this install, apply it from now on:\n");
-    console.log(renderPlaybook({ stateBackend: config?.state_backend || "hu-board", boardName: config?.board?.name || null }));
+    console.log(renderPlaybook({ stateBackend: config?.state_backend || "hu-board", boardName: config?.board?.name || null, config }));
   }
   return result;
 }

package/src/commands/harden.js

@@ -153,7 +153,10 @@ export async function hardenCommand({
       result.harnessHooks = hh.wired ? "wired" : "script-only";
       // KJC-TSK-0713 — the Sentinel: method state + Stop gate (turn cannot
       // end red). Same Claude-only harness surface as the tool gate.
-      const sh = installSentinelHooks({ projectDir, logger });
+      // KJC-BUG-0193: solo un humano avanza lo que un humano selló. Sin
+      // --commit, un guardia sellado se queda como está en lugar de quedarse
+      // sin sello, que es como una sesión se dejaba sin herramientas.
+      const sh = installSentinelHooks({ projectDir, logger, human: commitSupervisor });
       result.sentinelHooks = sh.wired ? "wired" : "script-only";
     }
   } catch (err) {
@@ -171,7 +174,9 @@ export async function hardenCommand({
     ? installWorkflows({ projectDir, language: roots[0]?.language ?? null, profile, mutation, dryRun })
     : null;
   const withGuidelines = guidelines && profile !== "minimal";
-  const gl = withGuidelines ? installGuidelines({ projectDir, dryRun }) : null;
+  // KJC-BUG-0199 (issue #1773): the same detected language the workflows and
+  // the configs already use — a Python project must not be told to use `const`.
+  const gl = withGuidelines ? installGuidelines({ projectDir, language: roots[0]?.language ?? null, dryRun }) : null;
   const out = {
     ok: true,
     ...result,
@@ -193,7 +198,11 @@ export async function hardenCommand({
     logger.info?.(`  • ${c.file}: ${c.action}${note}`);
   }
   for (const w of out.workflows) logger.info?.(`  • ${w.file}: ${w.action}`);
-  for (const g of out.guidelines) logger.info?.(`  • ${g.file}: ${g.action}`);
+  for (const g of out.guidelines) {
+    logger.info?.(`  • ${g.file}: ${g.action}`);
+    // KJC-BUG-0206: quitar reglas no puede leerse como "updated" y nada más.
+    if (g.shrank) logger.warn?.(`    ⚠ ${g.file} queda con MENOS reglas que antes — revisa si el lenguaje detectado es el que crees (kj check lo dice)`);
+  }
   if (!dryRun) logger.info?.("core.hooksPath set. Verify later with `kj check`.");
   // IDN-A (KJC-TSK-0762): a hardened clone declares who works it. Captured
   // only with a human confirming; headless runs get the pending command.

package/src/commands/policy.js

@@ -15,6 +15,8 @@ import { checkStagedDiff, evalToolCall, loadPolicy } from "../policy/engine.js";
 import { liftSealedSupervisorViolations } from "../policy/supervisor-verify.js";
 import { loadExceptionRecords, loadGlobalExceptionRecords, loadStandingExceptions, recordPolicyException } from "../policy/exceptions.js";
 import { buildPolicyReport } from "../policy/report.js";
+import { budgetedNet } from "../review/loc-budget.js";
+import { sealPanel } from "../environment/panel.js";
 import { policyFileHash, recordGateDecision } from "../policy/decisions.js";
 import { readIdentity } from "../identity/store.js";
 import { verifyDecisionChain } from "@karajan-family/governance";
@@ -32,12 +34,10 @@ async function stagedFacts(projectDir, gitFn, range = null) {
     .split("\n")
     .map((s) => s.trim())
     .filter(Boolean);
-  let net = 0;
-  for (const line of (await run([...base, "--numstat"])).split("\n")) {
-    const [a, r] = line.trim().split(/\s+/);
-    if (a && a !== "-") net += Number(a) || 0;
-    if (r && r !== "-") net -= Number(r) || 0;
-  }
+  // KJC-BUG-0208: el presupuesto lo decide un solo modulo. Este sitio sumaba el
+  // numstat entero, asi que el job policy-check de CI contaba la documentacion
+  // y el gate bloqueante no: la misma regla con dos respuestas.
+  const { net } = budgetedNet(await run([...base, "--numstat"]));
   return { files, netLinesAdded: net };
 }
 
@@ -209,18 +209,23 @@ export async function policyCommand({ action, config = {}, flags = {}, logger =
   // identidad DECLARADA del clon (identity.local.yml), para que el informe
   // y el anchor la vean. Lo llama el Sentinel; cualquiera puede auditarlo.
   if (action === "seal") {
-    if (!flags.escape) {
-      logger.error?.("policy seal: --escape <KJ_ALLOW_X> es obligatorio — un escape sin nombre no es auditable");
+    // KJC-TSK-0868: el mismo asiento sirve para el panel — el anfitrión escribió
+    // teniendo otro coder declarado. Mismo log encadenado, otro chokepoint.
+    if (!flags.escape && !flags.panel) {
+      logger.error?.("policy seal: --escape <KJ_ALLOW_X> o --panel <coder> es obligatorio — un asiento sin nombre no es auditable");
       return 1;
     }
     try {
       const who = readIdentity(projectDir);
-      const rec = recordGateDecision(projectDir, {
-        decision: "exempt", chokepoint: "tool", escape: flags.escape, tool: flags.tool ?? null,
-        who: who ? { gh: who.gh_user ?? null, git: who.git_email ?? null, grade: "declarada" } : null,
-        policy_hash: policyFileHash(projectDir),
-      });
-      logger.info?.(`✓ escape ${rec.escape} sellado (chokepoint tool${rec.tool ? `, ${rec.tool}` : ""})`);
+      const rec = flags.panel
+        ? sealPanel({ projectDir, coder: flags.panel, host: flags.host ?? null, honoured: Boolean(flags.honoured) })
+        : recordGateDecision(projectDir, {
+          decision: "exempt", chokepoint: "tool", escape: flags.escape, tool: flags.tool ?? null,
+          who: who ? { gh: who.gh_user ?? null, git: who.git_email ?? null, grade: "declarada" } : null,
+          policy_hash: policyFileHash(projectDir),
+        });
+      if (rec.chokepoint === "panel") logger.info?.(`✓ panel sellado: el coder declarado es ${rec.coder} y escribió ${rec.host ?? "el anfitrión"}`);
+      else logger.info?.(`✓ escape ${rec.escape} sellado (chokepoint tool${rec.tool ? `, ${rec.tool}` : ""})`);
       return 0;
     } catch (err) {
       logger.error?.(`policy seal: ${err.message}`);
@@ -238,6 +243,8 @@ export async function policyCommand({ action, config = {}, flags = {}, logger =
   const sup = liftSealedSupervisorViolations({ projectDir, violations });
   if (sup.lifted > 0) {
     logger.info?.(`✓ policy: ${sup.lifted} fichero(s) de supervisor verificados contra la provenance sellada (ADR 0009)`);
+    // KJC-BUG-0212: lo que este sitio no ha podido juzgar se dice, no se calla.
+    if (sup.note) logger.info?.(`ℓ policy: ${sup.note}`);
     violations = sup.violations;
   }
   const hard = flags.strict ? violations.filter((v) => v.enforcement === "deny") : [];

package/src/commands/report.js

@@ -226,6 +226,26 @@ export function formatSentinelEscapes(state) {
   return `Sentinel escapes used (${events.length}):\n${lines.join("\n")}`;
 }
 
+/**
+ * KJC-TSK-0873 — the panel tally. The user chose who writes; this says how
+ * often it happened. One number alone would not: a project where the panel is
+ * honoured almost always and one where it almost never is look identical until
+ * both sides are counted.
+ */
+export function formatPanelTally(lines) {
+  let honoured = 0;
+  let host = 0;
+  for (const line of lines) {
+    let rec;
+    try { rec = JSON.parse(line); } catch { continue; }
+    if (rec?.chokepoint !== "panel") continue;
+    if (rec.decision === "ok") honoured += 1;
+    else host += 1;
+  }
+  if (honoured + host === 0) return null;
+  return `Panel (who wrote): declared coder ${honoured}, host ${host}`;
+}
+
 // The sentinel state is a PROJECT artifact (<project>/.karajan/harness), not
 // a session artifact: the `dir` the report handlers receive is the GLOBAL
 // sessions root (~/.karajan/sessions) and never contains it. `kj report` is
@@ -241,6 +261,14 @@ async function printSentinelEscapes({ projectDir = process.cwd(), format } = {})
       console.log(text);
     }
   } catch { /* no sentinel state in this project — nothing to report */ }
+  try {
+    const log = await fs.readFile(path.join(projectDir, ".karajan", "policy-decisions.jsonl"), "utf8");
+    const tally = formatPanelTally(log.split("\n").filter((l) => l.trim()));
+    if (tally) {
+      console.log("");
+      console.log(tally);
+    }
+  } catch { /* no decision log — no panel to tally */ }
 }
 
 function formatDuration(ms) {