karajan-code 4.33.0 → 4.34.0

package/src/harden/sentinel-hooks.js

@@ -10,9 +10,10 @@
 
 import { readFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { CARD_REF_RE } from "../review/card-first.js";
-import { mergeClaudeHooks, writeHarnessScript } from "./harness-hooks.js";
+import { HARNESS_BODIES, mergeClaudeHooks, writeHarnessScript } from "./harness-hooks.js";
 
 /** The harness lives at the PROJECT root — resolve it even from a subdir. */
 export function resolveSentinelRoot(dir = process.cwd()) {
@@ -134,7 +135,7 @@ import process from "node:process";
 import { relative } from "node:path";
 import { spawnSync } from "node:child_process";
 import { CODE, TESTS, ROOT, CARD, branchOf, load, save, session } from "./sentinel-lib.mjs";
-const ESCAPES = ["KJ_ALLOW_WRITE", "KJ_ALLOW_REWRITE", "KJ_ALLOW_NO_CARD", "KJ_ALLOW_NO_TESTS", "KJ_ALLOW_PII", "KJ_ALLOW_POLICY", "KJ_ALLOW_IDENTITY", "KJ_ALLOW_BOARD", "KJ_ALLOW_NO_RAG"];
+const ESCAPES = ["KJ_ALLOW_WRITE", "KJ_ALLOW_REWRITE", "KJ_ALLOW_NO_CARD", "KJ_ALLOW_NO_TESTS", "KJ_ALLOW_PII", "KJ_ALLOW_POLICY", "KJ_ALLOW_IDENTITY", "KJ_ALLOW_BOARD", "KJ_ALLOW_NO_RAG", "KJ_ALLOW_NO_VERIFY"];
 let raw = "";
 process.stdin.on("data", (d) => { raw += d; });
 process.stdin.on("end", () => {
@@ -364,6 +365,18 @@ process.stdin.on("end", () => {
       if (claimsNote) console.log(JSON.stringify({ systemMessage: claimsNote }));
       process.exit(0);
     }
+    // KJC-TSK-0868: si el anfitrion ha escrito codigo teniendo otro coder
+    // declarado, eso no se bloquea, se REGISTRA: el usuario eligio quien
+    // escribe y merece enterarse por el decision log, no por casualidad. Una
+    // vez por sesion, y si kj no responde se reintenta en el turno siguiente.
+    if (!s.panel_sealed && (s.edited_sources || []).length > 0) {
+      const p = spawnSync("kj", ["sentinel", "panel-check", "--session", sid], { cwd: ROOT, encoding: "utf8" });
+      if (!p.error && p.status === 0) {
+        s.panel_sealed = true;
+        save(state);
+        if ((p.stdout || "").trim()) console.error(p.stdout.trim());
+      }
+    }
     const v = violations(s, branchOf());
     if (claimsBlock) v.push(claimsBlock);
     if (!v.length) {
@@ -406,9 +419,19 @@ import { dirname, join, relative, resolve } from "node:path";
 import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { homedir } from "node:os";
+import { fileURLToPath } from "node:url";
 import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, branchOf, foreignLane, load, save, session, violations, recordEscape, pendingMoves, pendingText } from "./sentinel-lib.mjs";
 const EDIT_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
-const PUBLISH = /\\bnpm\\s+publish\\b|\\bfirebase\\s+deploy\\b|\\bgh\\s+release\\s+create\\b/;
+// KJC-BUG-0204: el comando real lleva flags EN MEDIO del verbo
+// (firebase --account a@b --project p deploy --only hosting:main), asi que la
+// adyacencia dejaba pasar sin mirar justo el despliegue que el gate vigila.
+// Las palabras del verbo tienen que aparecer en orden, no pegadas.
+const PUBLISH_VERBS = [["npm", "publish"], ["firebase", "deploy"], ["gh", "release", "create"]];
+// Cada palabra se lee por su basename: /usr/bin/npm publish es la misma
+// publicacion que npm publish (catch de la review).
+const wordsOf = (text) => String(text).split(/[^A-Za-z0-9_.@:/-]+/).filter(Boolean).map((w) => w.slice(w.lastIndexOf("/") + 1)).filter(Boolean);
+const inOrder = (want, got) => { let i = 0; for (const w of got) if (w === want[i] && ++i === want.length) return true; return false; };
+const isPublish = (cmd) => { const got = wordsOf(cmd); return PUBLISH_VERBS.some((verb) => inOrder(verb, got)); };
 const PUSH = /\\bgit\\s+push\\b/;
 const PROTECTED = /\\.claude\\/settings\\.json\\b|\\.karajan\\/(hooks|harness)\\//;
 let raw = "";
@@ -849,7 +872,30 @@ process.stdin.on("end", () => {
           process.exit(2);
         }
       } else if (pres.status !== 0) {
-        if (escOn("KJ_ALLOW_POLICY")) { recordEscape(sid, "KJ_ALLOW_POLICY", tool); }
+        // KJC-BUG-0207: un kj que NO ARRANCA no es una violacion de policy. Con
+        // kj linkado al arbol, un error de sintaxis transitorio en src/ dejaba
+        // la sesion sin Edit, sin Write y sin Bash, o sea sin las herramientas
+        // para arreglar el fichero, y el remedio que sugeria (kj policy check)
+        // tampoco arrancaba. Se avisa fuerte y se deja pasar: el resto de este
+        // guard sigue vigente, que es lo que protege el metodo.
+        const broken = /SyntaxError|ReferenceError|Cannot find module|ERR_MODULE_NOT_FOUND|ERR_REQUIRE_ESM/.exec(String(pres.stderr || ""));
+        // Abrir el gate entero seria un bypass a la carta (romper un modulo y
+        // seguir sin policy), catch de la review. Se permite EXACTAMENTE una
+        // cosa: editar el fichero que rompe kj. Lo demas sigue denegado.
+        const at = broken ? (String(pres.stderr || "").split("\\n").map((l) => l.trim()).find((l) => /^[^ ]+\\.(m?js|cjs|ts):\\d+$/.test(l)) || "") : "";
+        // Node localiza los errores de un modulo ESM como file:///ruta.js:124,
+        // y esa forma no es una ruta de fichero (catch de la review).
+        const asPath = (p) => (p.startsWith("file:") ? fileURLToPath(p) : p);
+        const brokenFile = at ? asPath(at.slice(0, at.lastIndexOf(":"))) : "";
+        if (broken) {
+          const target = input.file_path || input.notebook_path || "";
+          const repairing = EDIT_TOOLS.includes(tool) && brokenFile && target && resolve(String(target)) === resolve(brokenFile);
+          if (repairing) console.error("karajan sentinel: kj no arranca (" + broken[0] + " en " + at + ") — la policy no se puede evaluar, asi que solo se permite arreglar ESE fichero. Arreglalo y vuelve." + doc("policy"));
+          else {
+            console.error("karajan sentinel: kj no arranca (" + broken[0] + (at ? " en " + at : "") + "), asi que la policy no se puede evaluar y NADA MAS pasa: edita " + (brokenFile || "el fichero que rompe kj") + " para arreglarlo. No es un deny de policy, es kj roto." + doc("policy"));
+            process.exit(2);
+          }
+        } else if (escOn("KJ_ALLOW_POLICY")) { recordEscape(sid, "KJ_ALLOW_POLICY", tool); }
         else {
           console.error("karajan sentinel: kj policy eval fallo (exit " + pres.status + ") — la policy declarada no se pudo evaluar, deny por defecto; diagnostica con kj policy check y corrige .karajan/policy.yml fuera de la sesion (o KJ_ALLOW_POLICY=1 = excepcion consciente, queda registrada)." + doc("policy"));
           process.exit(2);
@@ -907,12 +953,19 @@ process.stdin.on("end", () => {
         const rs = load().sessions?.[sid] || {};
         const hits = rs.rag_hits || [];
         const dirOf = (p) => (p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "");
-        const fresh = !existsSync(String(file));
+        // KJC-BUG-0210: nuevo no es "no existe en disco". En cuanto la sesion
+        // lo crea, la siguiente edicion exigia una respuesta del RAG sobre un
+        // fichero que el indice NO puede tener. El hecho comprobable: un
+        // fichero que git no conoce no ha podido indexarse.
+        // Solo se pregunta a git en el camino lento, cuando el gate iba a
+        // denegar: exit 1 = git responde que no lo conoce; cualquier otro
+        // resultado se comporta como hasta ahora y bloquea.
+        const fresh = () => !existsSync(String(file)) || spawnSync("git", ["-C", ROOT, "ls-files", "--error-unmatch", "--", rel], { encoding: "utf8" }).status === 1;
         // A path outside this tree is another lane's business (the lane guard
         // above rules on it) and the ledger only holds in-repo paths.
         // KJC-BUG-0190: with nothing indexed, no query can cover anything —
         // the gate asks for kj rag index instead of denying the impossible.
-        const covered = rel.startsWith("..") || hits.includes(rel) || hits.some((h) => dirOf(h) === dirOf(rel)) || (fresh && (rs.rag_queries || []).length > 0) || rs.rag_index_empty === true;
+        const covered = rel.startsWith("..") || hits.includes(rel) || hits.some((h) => dirOf(h) === dirOf(rel)) || ((rs.rag_queries || []).length > 0 && fresh()) || rs.rag_index_empty === true;
         if (!covered) {
           if (escOn("KJ_ALLOW_NO_RAG")) {
             // Recorded ONCE per session: the escape is a conscious exception, not a per-edit tax.
@@ -930,15 +983,54 @@ process.stdin.on("end", () => {
       // and nothing advances (commit, new PR, another merge; push and the end of
       // the turn go through violations()) until the card is moved. The board is
       // true at all times or the method stops — never a rule in the agent's memory.
+      // ENF-B (KJC-TSK-0854): el review es obligatorio, no una sugerencia. Una
+      // bandera no puede apagar el gate de commit, y mover core.hooksPath lo
+      // apaga entero. El --no-verify que kj harden --commit usa por dentro no
+      // pasa por aqui: no es una tool call. Escape humano, sellado como el resto.
+      const words = wordsOf(cmd);
+      // git acepta abreviaturas no ambiguas de las opciones largas, asi que
+      // --no-ver salta el hook igual que --no-verify (catch de la review).
+      const shortWithN = (w) => w.length > 1 && w[0] === "-" && w[1] !== "-" && w.includes("n");
+      const skipsVerify = (w) => shortWithN(w) || (w.length >= 5 && "--no-verify".startsWith(w));
+      // Mover core.hooksPath apaga TODOS los hooks. git tiene varias puertas
+      // para lo mismo (config, -c, --config-env, GIT_CONFIG_KEY_n) y no
+      // distingue mayusculas en la llave, asi que lo que se vigila es la LLAVE
+      // en cualquier posicion (dos catches de la review). Leerla no hace nada.
+      // Nombrar la llave basta para denegar: exceptuar las lecturas invitaba a
+      // colar una detras del cambio (git config core.hooksPath /x; cat algo),
+      // catch de la review. Leerla tiene remedio barato, perderla no.
+      // Se busca la llave DENTRO del token y no solo al principio: las formas
+      // de inyeccion la empotran (GIT_CONFIG_KEY_0=core.hooksPath,
+      // --config-env=core.hooksPath=VAR) y una propiedad de seguridad no puede
+      // depender de como parta las palabras el separador (catch de la review).
+      const movesHooks = cmd.toLowerCase().includes("core.hookspath");
+      if ((inOrder(["git", "commit"], words) && words.some(skipsVerify)) || movesHooks) {
+        if (escOn("KJ_ALLOW_NO_VERIFY")) { recordEscape(sid, "KJ_ALLOW_NO_VERIFY", tool); }
+        else {
+          console.error("karajan sentinel: el gate de commit no se apaga con una bandera — el review cruzado y la policy corren en el hook, y saltarselos deja el diff sin veredicto. Si el hook esta roto, arreglalo; si de verdad hace falta, es una decision de tu usuario. (KJ_ALLOW_NO_VERIFY=1 = excepcion consciente, queda registrada)" + doc("escapes"));
+          process.exit(2);
+        }
+      }
       const MERGE = /\\bgh\\s+pr\\s+merge(\\s+(\\d+))?/;
       const ADVANCE = /\\bgit\\s+commit\\b|\\bgit\\s+push\\b|\\bgh\\s+pr\\s+create\\b/; // push also falls under violations() — explicit here too (review catch)
       const mergeM = cmd.match(MERGE);
       const pend = pendingMoves(load().sessions?.[sid]);
       if (pend.length > 0 && (mergeM || ADVANCE.test(cmd))) {
-        if (escOn("KJ_ALLOW_BOARD")) { recordEscape(sid, "KJ_ALLOW_BOARD", tool); }
-        else {
-          console.error("karajan sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + pend.map((p) => "- " + pendingText(p)).join("\\n") + "\\n(KJ_ALLOW_BOARD=1 = excepcion consciente, queda registrada)" + doc("board-sync"));
-          process.exit(2);
+        // KJC-BUG-0198: una card partida en varias PRs no puede quedar bloqueada
+        // por su primera mitad. kj decide con un hecho comprobable (otra PR
+        // abierta de la card); si kj no responde, se bloquea como siempre.
+        const bg = spawnSync("kj", ["sentinel", "board-gate", "--session", sid, "--json"], { cwd: ROOT, encoding: "utf8" });
+        let blocking = pend, carried = [];
+        if (!bg.error && (bg.status === 0 || bg.status === 2)) {
+          try { const d = JSON.parse(bg.stdout); blocking = d.blocking || []; carried = d.carried || []; } catch { /* sin respuesta legible: como siempre */ }
+        }
+        for (const c of carried) console.error("karajan sentinel: board-sync arrastra " + c.card + " — " + c.why + ", se movera al cerrarla");
+        if (blocking.length > 0) {
+          if (escOn("KJ_ALLOW_BOARD")) { recordEscape(sid, "KJ_ALLOW_BOARD", tool); }
+          else {
+            console.error("karajan sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + blocking.map((p) => "- " + pendingText(p)).join("\\n") + "\\n(KJ_ALLOW_BOARD=1 = excepcion consciente, queda registrada)" + doc("board-sync"));
+            process.exit(2);
+          }
         }
       }
       // (the pending entry itself is recorded by the PostToolUse hook, only once
@@ -956,13 +1048,24 @@ process.stdin.on("end", () => {
           process.exit(2);
         }
       }
-      if (PUBLISH.test(cmd)) {
+      if (isPublish(cmd)) {
         if (escOn("KJ_ALLOW_RELEASE")) { recordEscape(sid, "KJ_ALLOW_RELEASE", tool); process.exit(0); }
-        const res = spawnSync("kj", ["release", "check", "--json"], { cwd: ROOT, encoding: "utf8" });
+        // KJC-BUG-0204: el check se evalua PARA este comando. Un item que
+        // declara remedied_by no bloquea el comando que lo repara (desplegar
+        // la landing era justo lo que el check pedia); publicar no se exime.
+        const res = spawnSync("kj", ["release", "check", "--json", "--for-command", cmd], { cwd: ROOT, encoding: "utf8" });
         if (res.error || res.status === null) process.exit(0);
+        let parsed = null;
+        try { parsed = JSON.parse(res.stdout); } catch { /* raw output */ }
+        const lifted = (parsed && parsed.lifted) || [];
+        if (res.status === 0 && lifted.length > 0) {
+          // En voz alta: una exencion que nadie ve no se distingue de un gate que no mira.
+          console.error("karajan sentinel: release check en rojo SOLO por lo que este comando repara (" + lifted.join(", ") + ") — pasa, y el resto sigue en verde" + doc("release"));
+          process.exit(0);
+        }
         if (res.status !== 0) {
           let items = "";
-          try { items = (JSON.parse(res.stdout).checks || []).filter((c) => !c.ok).map((c) => "\\n- " + c.name + ": " + c.detail).join(""); } catch { /* raw output */ }
+          try { items = (parsed.checks || []).filter((c) => !c.ok && c.lifted !== true).map((c) => "\\n- " + c.name + ": " + c.detail).join(""); } catch { /* raw output */ }
           console.error("karajan sentinel: release check en ROJO — no se publica ni despliega hasta resolverlo:" + (items || "\\n- corre kj release check para el detalle") + "\\n(KJ_ALLOW_RELEASE=1 = excepcion consciente, queda registrada)" + doc("release"));
           process.exit(2);
         }
@@ -1000,24 +1103,124 @@ const SCRIPT_BODIES = {
  * package — outside the project tree, beyond the session's tool reach —
  * because nothing under .karajan can vouch for itself.
  */
-export function verifySentinelScripts({ projectDir } = {}) {
-  const dir = join(projectDir || resolveSentinelRoot(), ".karajan", "harness");
+const PROVENANCE_PATH = ".karajan/supervisor-provenance.json";
+
+/**
+ * KJC-BUG-0211: el cuerpo que kj escribiria para ese guardia, venga de las
+ * plantillas del Sentinel o de las del harness. Quien verifica un sello
+ * recomputa con esto; sin el, un sello que cubre los guardias (KJC-BUG-0197)
+ * no se puede ni commitear, porque nadie sabe comprobarlos.
+ */
+export const canonicalHarnessBody = (name) => SCRIPT_BODIES[name] ?? HARNESS_BODIES[name] ?? null;
+
+/**
+ * KJC-BUG-0197: what did a human actually seal, per guard?
+ *
+ * Read from **git**, never from the working tree. The provenance is tracked and
+ * written only by `kj harden --commit` (a human act with four layers, ADR 0009),
+ * so the committed copy is the external reference; the copy on disk is as
+ * forgeable as the guard it would vouch for, and the review caught exactly that.
+ * No git, no commit, no seal: then nothing is forgiven and the check fails
+ * closed, which is the safe direction.
+ *
+ * The map is keyed BY PATH: a hash sealed for one file never vouches for
+ * another (also the review's catch).
+ *
+ * @returns {Map<string, string>} relative path → sealed sha256
+ */
+function sealedByPath(projectDir, gitShowFn) {
+  try {
+    const raw = gitShowFn
+      ? gitShowFn(projectDir, PROVENANCE_PATH)
+      : execFileSync("git", ["-C", projectDir, "show", `HEAD:${PROVENANCE_PATH}`], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    const files = JSON.parse(raw)?.files;
+    const out = new Map();
+    for (const entry of Array.isArray(files) ? files : []) {
+      if (typeof entry?.file === "string" && typeof entry?.sha256 === "string") out.set(entry.file, entry.sha256);
+    }
+    return out;
+  } catch {
+    return new Map();
+  }
+}
+
+/**
+ * @returns {{ok: boolean, mismatched: string[], drift?: string[], reason?: string}}
+ *   `mismatched` is TAMPERING: a guard holds content nobody sealed, and that is
+ *   what the hooks block on. `drift` is a sealed guard whose templates have
+ *   moved on, which `kj harden` applies and which is not a defect.
+ */
+export function verifySentinelScripts({ projectDir, readFileFn = readFileSync, gitShowFn = null } = {}) {
+  const root = projectDir || resolveSentinelRoot();
+  const dir = join(root, ".karajan", "harness");
+  const installed = new Map();
   const mismatched = [];
   for (const [name, body] of Object.entries(SCRIPT_BODIES)) {
     try {
-      if (readFileSync(join(dir, name), "utf8") !== body) mismatched.push(name);
+      const text = readFileFn(join(dir, name), "utf8");
+      installed.set(name, text);
+      if (text !== body) mismatched.push(name);
     } catch {
-      mismatched.push(name);
+      mismatched.push(name); // missing: there is no content for a seal to cover
     }
   }
-  return { ok: mismatched.length === 0, mismatched };
+  if (mismatched.length === 0) return { ok: true, mismatched: [] };
+
+  // A mismatch is only forgiven when what sits there is something a human
+  // sealed. Editing a guard produces content no seal covers, so the forgiveness
+  // cannot be borrowed by also editing a template: that was the hole in the
+  // first attempt at this fix, and the review was right to reject it.
+  const sealed = sealedByPath(root, gitShowFn);
+  const drift = [];
+  const tampered = [];
+  for (const name of mismatched) {
+    const text = installed.get(name);
+    const sealedHash = sealed.get(`.karajan/harness/${name}`);
+    if (text !== undefined && sealedHash && sealedHash === createHash("sha256").update(text).digest("hex")) drift.push(name);
+    else tampered.push(name);
+  }
+  if (tampered.length > 0) return { ok: false, mismatched: tampered, ...(drift.length ? { drift } : {}) };
+  return {
+    ok: true,
+    mismatched: [],
+    drift,
+    reason: "el harness instalado está sellado y las plantillas de este árbol van por delante (kj harden lo pone al día) — no es manipulación",
+  };
 }
 
-/** Write the sentinel scripts (shared lib + state writer + gates) and wire them. */
-export function installSentinelHooks({ projectDir = process.cwd(), logger = console } = {}) {
-  const [lib, post, stop, pre] = Object.entries(SCRIPT_BODIES).map(([name, body]) =>
-    writeHarnessScript(projectDir, name, body),
-  );
+/**
+ * Write the sentinel scripts (shared lib + state writer + gates) and wire them.
+ *
+ * KJC-BUG-0193: a guard holding exactly what a human sealed is LEFT ALONE. This
+ * is the command a session reaches for when it has edited the templates, and
+ * rewriting the guards here un-sealed the ones actually running, so the very act
+ * of unblocking destroyed the seal that made unblocking unnecessary. Advancing
+ * them is a human act: `kj harden --commit` moves guards and seal together.
+ * Anything nobody sealed is rewritten as before, because restoring a tampered
+ * guard is still the right move.
+ */
+export function installSentinelHooks({ projectDir = process.cwd(), logger = console, human = false, gitShowFn = null } = {}) {
+  const sealed = human ? new Map() : sealedByPath(projectDir, gitShowFn);
+  const deferred = [];
+  const keepsItsSeal = (name) => {
+    const sealedHash = sealed.get(`.karajan/harness/${name}`);
+    if (!sealedHash) return false;
+    try {
+      return sealedHash === createHash("sha256").update(readFileSync(join(projectDir, ".karajan", "harness", name), "utf8")).digest("hex");
+    } catch {
+      return false; // no hay contenido que un sello pueda cubrir
+    }
+  };
+  const [lib, post, stop, pre] = Object.entries(SCRIPT_BODIES).map(([name, body]) => {
+    if (keepsItsSeal(name)) {
+      deferred.push(name);
+      return join(projectDir, ".karajan", "harness", name);
+    }
+    return writeHarnessScript(projectDir, name, body);
+  });
+  if (deferred.length > 0) {
+    logger?.info?.(`kj harden: ${deferred.join(", ")} se queda como está — es lo que un humano selló, y avanzarlo es suyo: kj harden --commit`);
+  }
   const { wired } = mergeClaudeHooks({
     projectDir,
     logger,
@@ -1033,5 +1236,5 @@ export function installSentinelHooks({ projectDir = process.cwd(), logger = cons
       { event: "Stop", script: "stop.mjs" },
     ],
   });
-  return { scripts: [lib, post, stop, pre], wired };
+  return { scripts: [lib, post, stop, pre], wired, deferred };
 }

package/src/harden/supervisor-commit.js

@@ -16,6 +16,13 @@ import { isPhoneEnrolled, requestPhoneSignature } from "./phone-sign.js";
 
 export const PROVENANCE_FILE = ".karajan/supervisor-provenance.json";
 const HOOKS_PREFIX = ".karajan/hooks/";
+// KJC-BUG-0197: la procedencia del supervisor no cubría los guardias del
+// supervisor. Sellaba los hooks de git y ningún .mjs del harness, que son
+// justo los que vigilan la sesión, así que nada externo podía decir si un
+// guardia instalado era auténtico. Los ficheros siguen fuera de git (los
+// veredictos son locales por diseño); lo que viaja y se firma es su HUELLA,
+// dentro de una procedencia que sí está trackeada.
+const HARNESS_PREFIX = ".karajan/harness/";
 
 const sha256 = (abs) => createHash("sha256").update(readFileSync(abs)).digest("hex");
 
@@ -58,6 +65,23 @@ function defaultConfirm(nonce) {
 }
 
 /** Ficheros de supervisor TRACKEADOS con cambios (staged o no). */
+/**
+ * KJC-BUG-0197: los guardias del Sentinel que el sello debe cubrir. No salen de
+ * `git status` (están gitignorados), así que se leen del disco. Un proyecto sin
+ * harness (perfil minimal) sella los hooks y nada más.
+ * @returns {string[]} rutas relativas, ordenadas
+ */
+export function harnessGuards(projectDir) {
+  try {
+    return readdirSync(join(projectDir, HARNESS_PREFIX))
+      .filter((f) => f.endsWith(".mjs"))
+      .map((f) => HARNESS_PREFIX + f)
+      .sort();
+  } catch {
+    return [];
+  }
+}
+
 export function supervisorDrift({ projectDir, gitFn }) {
   const run = gitFn || ((args) => execFileSync("git", args, { cwd: projectDir, encoding: "utf8" }));
   // Un rename sale como "R  old -> new" (catch de codex): ambas rutas son
@@ -107,10 +131,26 @@ export async function commitSupervisorRegeneration({
   // La provenance describe SIEMPRE el estado COMPLETO del supervisor (cazado
   // en el primer estreno real: un sello parcial pisaba al anterior y dejaba
   // ficheros sin respaldo). Borrados del drift ⇒ deleted (catch de codex).
-  const current = readdirSync(join(projectDir, HOOKS_PREFIX)).map((f) => HOOKS_PREFIX + f).sort();
+  const current = [
+    ...readdirSync(join(projectDir, HOOKS_PREFIX)).map((f) => HOOKS_PREFIX + f),
+    ...harnessGuards(projectDir),
+  ].sort();
+  // KJC-BUG-0197: un guardia BORRADO se anota como borrado, igual que un hook.
+  // No hacía falta para desencadenar el re-sello (la lista encoge, así que la
+  // cobertura ya falla), pero registrar la ausencia dice más que omitirla:
+  // quien lea la procedencia ve que ese guardia se fue, no que nunca estuvo.
+  const previousGuards = (() => {
+    try {
+      return JSON.parse(readFileSync(join(projectDir, PROVENANCE_FILE), "utf8"))?.files ?? [];
+    } catch { return []; }
+  })();
+  const goneGuards = previousGuards
+    .map((f) => f?.file)
+    .filter((f) => typeof f === "string" && f.startsWith(HARNESS_PREFIX) && !existsSync(join(projectDir, f)));
   const hashed = [
     ...current.map((file) => ({ file, sha256: sha256(join(projectDir, file)) })),
     ...drift.filter((f) => !existsSync(join(projectDir, f))).map((file) => ({ file, deleted: true })),
+    ...goneGuards.map((file) => ({ file, deleted: true })),
   ];
   let previous = null;
   try { previous = JSON.parse(readFileSync(join(projectDir, PROVENANCE_FILE), "utf8")); } catch { /* primer sello */ }

package/src/harden/workflow-templates.js

@@ -196,9 +196,15 @@ export const SHRINK_BUDGET_WORKFLOW = [
   "          BASE_REF: ${{ github.base_ref }}",
   "        run: |",
   // KJC-TSK-0795 AC4 — measured in GREBLA: a 414-line warning that was almost
-  // all pnpm-lock.yaml. Generated files are weight nobody wrote: the generated
-  // gate applies the same exclusions kj's own repo applies.
-  "          d=$(git diff --numstat \"origin/${BASE_REF}...HEAD\" -- . ':!**/*.md' ':!*.lock' ':!package-lock.json' ':!pnpm-lock.yaml' ':!npm-shrinkwrap.json' ':!dist/**' ':!build/**' ':!coverage/**' ':!**/*.snap' ':!**/__snapshots__/**' || true)",
+  // all pnpm-lock.yaml. Generated files are weight nobody wrote.
+  //
+  // KJC-BUG-0205: this line used to exclude `**/*.md` wholesale while claiming
+  // to apply "the same exclusions kj's own repo applies". It did not: kj counts
+  // AI-rule files (CLAUDE.md, AGENTS.md, templates/**) ON PURPOSE, because they
+  // enter the agent's context every run and unbounded growth there dilutes the
+  // signal. Documentation is exempt where documentation lives; markdown that
+  // instructs an agent is code.
+  "          d=$(git diff --numstat \"origin/${BASE_REF}...HEAD\" -- . ':!**/docs/**/*.md' ':!**/docs/**/*.mdx' ':!**/docs/**/*.txt' ':!**/docs/**/*.rst' ':!README.md' ':!README.*.md' ':!CHANGELOG.md' ':!CONTRIBUTING.md' ':!SECURITY.md' ':!CODE_OF_CONDUCT.md' ':!MIGRATION*.md' ':!TODO*.md' ':!*.lock' ':!package-lock.json' ':!pnpm-lock.yaml' ':!npm-shrinkwrap.json' ':!dist/**' ':!build/**' ':!coverage/**' ':!**/*.snap' ':!**/__snapshots__/**' ':!**/*.min.js' ':!**/*.map' || true)",
   '          a=$(printf "%s\\n" "$d" | awk \'$1!="-"{s+=$1}END{print s+0}\')',
   '          r=$(printf "%s\\n" "$d" | awk \'$2!="-"{s+=$2}END{print s+0}\')',
   '          net=$((a - r)); echo "net=$net (limit=$LOC_LIMIT)"',

package/src/policy/supervisor-verify.js

@@ -9,9 +9,11 @@ import { lstatSync, readFileSync } from "node:fs";
 import { resolve, sep } from "node:path";
 
 import { renderCanonicalHook } from "../harden/harden-engine.js";
+import { canonicalHarnessBody } from "../harden/sentinel-hooks.js";
 import { PROVENANCE_FILE } from "../harden/supervisor-commit.js";
 
 const HOOKS_PREFIX = ".karajan/hooks/";
+const HARNESS_PREFIX = ".karajan/harness/";
 // globalHooksDir es el único texto libre que se interpola en el render:
 // vocabulario cerrado de ruta o la provenance no verifica NADA.
 const SAFE_DIR = /^(\$HOME)?(\/[\w.@%+~-]+)+$/;
@@ -34,36 +36,63 @@ export function verifiedSupervisorFiles({ projectDir }) {
     return { files: new Set(), reason: "globalHooksDir no verificable en la provenance" };
   }
   const ok = new Set();
+  const unjudgeable = new Set();
   const entries = Array.isArray(prov?.files) ? prov.files : [];
-  const hooksRoot = resolve(projectDir, HOOKS_PREFIX);
+  // KJC-BUG-0211: desde KJC-BUG-0197 el sello cubre tambien los guardias del
+  // supervisor, y aqui solo se sabian verificar los hooks. Como `complete`
+  // exige que TODAS las entradas verifiquen, el sello no se podia ni commitear.
+  const ROOTS = [HOOKS_PREFIX, HARNESS_PREFIX].map((p) => [p, resolve(projectDir, p)]);
   for (const entry of entries) {
-    if (typeof entry?.file !== "string" || !entry.file.startsWith(HOOKS_PREFIX)) continue;
+    if (typeof entry?.file !== "string") continue;
+    const kind = ROOTS.find(([prefix]) => entry.file.startsWith(prefix));
+    if (!kind) continue;
+    const [prefix, root] = kind;
     // Contención por resolución, no por prefijo textual (catch de codex).
     const abs = resolve(projectDir, entry.file);
-    if (!abs.startsWith(hooksRoot + sep)) continue;
+    if (!abs.startsWith(root + sep)) continue;
     let st = null;
     try { st = lstatSync(abs); } catch { /* no hay objeto en la ruta */ }
     if (entry.deleted === true) {
       if (st === null) ok.add(entry.file);
       continue;
     }
+    // KJC-BUG-0212: los guardias estan en .gitignore, viven solo en la maquina
+    // que ejecuta kj harden. Que no esten AQUI no es que no verifiquen: es que
+    // este checkout (CI, otro clon) no puede juzgarlos. Un hook ausente si
+    // significa algo, porque los hooks si viajan con el repo.
+    // Pero "no esta aqui" no vale como cheque en blanco: el hash declarado
+    // tiene que ser el de un guardia que kj CONOCE, o una procedencia forjada
+    // colaria entradas ausentes con cualquier hash (catch de la review).
+    if (prefix === HARNESS_PREFIX && st === null) {
+      const body = canonicalHarnessBody(entry.file.slice(prefix.length));
+      if (body != null && typeof entry.sha256 === "string" && sha256(Buffer.from(body, "utf8")) === entry.sha256) unjudgeable.add(entry.file);
+      continue;
+    }
     if (typeof entry.sha256 !== "string" || !st?.isFile()) continue;
     if (sha256(readFileSync(abs)) !== entry.sha256) continue;
+    // No se confia en el hash sellado: se recomputa lo que kj escribiria.
     let canonical;
     try {
-      canonical = renderCanonicalHook(entry.file.slice(HOOKS_PREFIX.length), gen);
+      const name = entry.file.slice(prefix.length);
+      canonical = prefix === HOOKS_PREFIX ? renderCanonicalHook(name, gen) : canonicalHarnessBody(name);
     } catch {
       continue;
     }
-    if (sha256(Buffer.from(canonical, "utf8")) === entry.sha256) ok.add(entry.file);
+    if (canonical != null && sha256(Buffer.from(canonical, "utf8")) === entry.sha256) ok.add(entry.file);
   }
-  // `complete` = CADA entrada verificó: solo entonces la provenance se
-  // describe con honestidad y su propio diff puede alzarse.
-  const complete = entries.length > 0 && entries.every((e) => typeof e?.file === "string" && ok.has(e.file));
-  return { files: ok, complete };
+  // `complete` = ninguna entrada FALLO y alguna verifico. Exigir que todas
+  // verifiquen hacia imposible sellar desde cualquier sitio que no fuera la
+  // maquina que sello, porque los guardias no viajan con el repo (0212).
+  const judged = (e) => ok.has(e.file) || unjudgeable.has(e.file);
+  const complete = ok.size > 0 && entries.every((e) => typeof e?.file === "string" && judged(e));
+  return { files: ok, complete, unjudgeable };
 }
 
-/** Filtra violaciones de supervisor respaldadas — {violations, lifted}. */
+/**
+ * Filtra violaciones de supervisor respaldadas — {violations, lifted, note?}.
+ * `note` dice lo que este sitio NO ha podido juzgar, para que un levantamiento
+ * mas laxo de lo que parece no pase por silencio (KJC-BUG-0212).
+ */
 export function liftSealedSupervisorViolations({ projectDir, violations }) {
   const RULE = "defaults.supervisor.write";
   if (!violations.some((v) => v.rule_id === RULE && v.file)) return { violations, lifted: 0 };
@@ -75,5 +104,10 @@ export function liftSealedSupervisorViolations({ projectDir, violations }) {
     && v.file
     && (sealed.files.has(v.file) || (v.file === PROVENANCE_FILE && sealed.complete === true));
   const kept = violations.filter((v) => !liftable(v));
-  return { violations: kept, lifted: violations.length - kept.length };
+  const unjudged = sealed.unjudgeable?.size ?? 0;
+  return {
+    violations: kept,
+    lifted: violations.length - kept.length,
+    ...(unjudged > 0 ? { note: `${unjudged} guardia(s) del sello no existen en este checkout y no se han podido comprobar aquí` } : {}),
+  };
 }

package/src/review/board-pending.js

@@ -0,0 +1,68 @@
+/**
+ * Which pending board moves actually block (KJC-BUG-0198).
+ *
+ * board-sync blocked every advance until a merged PR's card reached a closing
+ * state, which assumes one PR per card while the project's rule splits any card
+ * over ~150 lines. With KJC-BUG-0197 (#1802 and #1803) that demanded a move that
+ * would have been a lie, and the way out was `KJ_ALLOW_BOARD=1`, which switches
+ * the whole gate off. A card still being delivered is not a lying board; a TURN
+ * ending with work nobody recorded is, and that stays the Stop gate's job.
+ *
+ * One verifiable fact carries a pending, never a promise in prose: the same card
+ * has another OPEN pull request. A branch named after the card is not enough,
+ * because the merged branch carries that name too, so accepting it would forgive
+ * every merge made from its own lane.
+ */
+
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { CARD_REF_RE } from "./card-first.js";
+
+const cardOf = (text) => {
+  const m = CARD_REF_RE.exec(String(text || ""));
+  return m ? m[0].toUpperCase() : null;
+};
+
+/**
+ * `openPrHeads` null means the list could not be read, and then nothing is
+ * forgiven. `openPrNumbers` pairs with it so a pending never forgives itself.
+ *
+ * @returns {{blocking: Array<object>, carried: Array<{card: string, why: string}>, reason?: string}}
+ */
+export function blockingMoves({ pendings = [], openPrHeads = null, openPrNumbers = [] }) {
+  if (pendings.length === 0) return { blocking: [], carried: [] };
+  if (openPrHeads === null) return { blocking: [...pendings], carried: [], reason: "no se pudo comprobar si la card sigue viva en otra PR abierta (gh no respondió) — se bloquea" };
+  const openCards = new Set();
+  for (const [i, head] of openPrHeads.entries()) {
+    // A pending must never forgive itself: the PR it came from is merged, and if
+    // a stale listing still shows it, it does not count as "still open".
+    if (openPrNumbers[i] !== undefined && pendings.some((p) => Number(p.pr) === Number(openPrNumbers[i]))) continue;
+    const card = cardOf(head);
+    if (card) openCards.add(card);
+  }
+  const blocking = [], carried = [];
+  for (const p of pendings) {
+    const card = p.card ? String(p.card).toUpperCase() : null;
+    if (!card) { blocking.push(p); continue; } // nothing to check against
+    if (openCards.has(card)) carried.push({ card, why: "sigue entregándose en una PR abierta" });
+    else blocking.push(p);
+  }
+  return { blocking, carried };
+}
+
+const readJson = (path) => { try { return JSON.parse(readFileSync(path, "utf8")); } catch { return null; } };
+
+/** The decision the guard asks for, gathering the facts here so the rule ships
+ * with npm instead of waiting for the human to reseal the harness. */
+export function boardGate({ projectDir = process.cwd(), sessionId = "default", deps = {} } = {}) {
+  const state = deps.readState?.() ?? readJson(join(projectDir, ".karajan", "harness", "sentinel-state.json"));
+  const pendings = state?.sessions?.[sessionId]?.pending_moves;
+  if (!Array.isArray(pendings) || pendings.length === 0) return { blocking: [], carried: [] };
+  const run = deps.run ?? ((cmd, args) => execFileSync(cmd, args, { cwd: projectDir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 }));
+  let open = null;
+  try { open = JSON.parse(run("gh", ["pr", "list", "--state", "open", "--limit", "100", "--json", "number,headRefName"])); } catch { /* fail closed */ }
+  const listed = Array.isArray(open) ? open : null;
+  return blockingMoves({ pendings, openPrHeads: listed?.map((p) => p.headRefName) ?? null, openPrNumbers: listed?.map((p) => Number(p.number)) ?? [] });
+}