karajan-code 4.33.0 → 4.35.0

package/src/environment/panel.js

@@ -11,6 +11,8 @@
  * code, and then it says so instead of staying quiet.
  */
 import { resolveRole } from "../config/role-resolver.js";
+import { policyFileHash, recordGateDecision } from "../policy/decisions.js";
+import { readIdentity } from "../identity/store.js";
 
 /** Roles worth announcing: who writes, who reviews, who arbitrates. */
 export const PANEL_ROLES = ["coder", "reviewer", "solomon"];
@@ -42,6 +44,37 @@ export function panelLine(config) {
   ].join("\n");
 }
 
+/**
+ * KJC-TSK-0868: the host writing the code while another coder is declared is
+ * not an offence to block, it is a fact to record. Announcing at session start
+ * is not enough: the user chose who writes and finds out it did not happen by
+ * accident, one turn at a time.
+ *
+ * @returns {{coder: string, host: string}|null} null when there is nothing to
+ *   record: no coder declared, no host detected, or the host IS the coder.
+ */
+export function panelDeviation(config, host) {
+  const { coder } = resolvePanel(config);
+  if (!coder || !host || coder === host) return null;
+  return { coder, host };
+}
+
+/**
+ * KJC-TSK-0873: the log holds both sides. A deviation alone cannot say whether
+ * the panel is honoured almost always or almost never, and those are different
+ * situations. The compliance seat is written where the declared coder is
+ * actually invoked (`kj code`); the deviation one when the turn ends.
+ */
+export function sealPanel({ projectDir, coder, host = null, honoured = false }) {
+  const who = readIdentity(projectDir);
+  return recordGateDecision(projectDir, {
+    decision: honoured ? "ok" : "exempt", chokepoint: "panel", escape: null, tool: null,
+    coder, host: honoured ? coder : host,
+    who: who ? { gh: who.gh_user ?? null, git: who.git_email ?? null, grade: "declarada" } : null,
+    policy_hash: policyFileHash(projectDir),
+  });
+}
+
 /** Human-facing one-liner for `kj check` and friends. */
 export function panelSummary(config) {
   const { coder, reviewer, solomon } = resolvePanel(config);

package/src/guards/output-guard.js

@@ -12,7 +12,7 @@ const DESTRUCTIVE_PATTERNS = [
 const CREDENTIAL_PATTERNS = [
   { id: "aws-key", pattern: /AKIA[0-9A-Z]{16}/, severity: "critical", message: "AWS access key exposed" },
   { id: "private-key", pattern: /-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----/, severity: "critical", message: "Private key exposed" },
-  { id: "generic-secret", pattern: /(password|secret|token|api_key|apikey)\s*[:=]\s*["'][^"']{8,}["']/i, severity: "critical", message: "Hardcoded secret detected. Use .env file + process.env instead" },
+  { id: "generic-secret", pattern: /(password|secret|token|api_key|apikey)\s*[:=]\s*["'][^"']{8,}["']/i, severity: "critical", message: "Hardcoded secret detected. Move it to the environment or a secrets manager" },
   { id: "github-token", pattern: /gh[pousr]_[A-Za-z0-9_]{36,}/, severity: "critical", message: "GitHub token exposed" },
   { id: "npm-token", pattern: /npm_[A-Za-z0-9]{36,}/, severity: "critical", message: "npm token exposed" },
   { id: "openai-key", pattern: /sk-[A-Za-z0-9]{20,}/, severity: "critical", message: "OpenAI API key exposed" },
@@ -24,7 +24,7 @@ const CREDENTIAL_PATTERNS = [
   { id: "slack-token", pattern: /xox[bpors]-[A-Za-z0-9-]{10,}/, severity: "critical", message: "Slack token exposed" },
   { id: "jwt-secret", pattern: /jwt[_-]?secret\s*[:=]\s*["'][^"']{8,}["']/i, severity: "critical", message: "JWT secret hardcoded. Use .env file" },
   { id: "database-url", pattern: /(mongodb|postgres|mysql|redis):\/\/[^"'\s]+:[^"'\s]+@/i, severity: "critical", message: "Database URL with credentials exposed. Use .env file" },
-  { id: "hardcoded-key-assignment", pattern: /(?:const|let|var)\s+\w*(?:key|secret|token|password)\w*\s*=\s*["'][A-Za-z0-9_-]{16,}["']/i, severity: "critical", message: "Hardcoded key in variable. Use process.env or .env file" },
+  { id: "hardcoded-key-assignment", pattern: /(?:const|let|var)\s+\w*(?:key|secret|token|password)\w*\s*=\s*["'][A-Za-z0-9_-]{16,}["']/i, severity: "critical", message: "Hardcoded key in an assignment. Move it to the environment or a secrets manager" },
 ];
 
 // Default protected files (block if these appear in added/modified lines)
@@ -115,6 +115,49 @@ export function checkProtectedFiles(diff, protectedFiles) {
   return violations;
 }
 
+/**
+ * KJC-BUG-0215 (issue #1733): estas dos reglas acusan por el NOMBRE del
+ * identificador, no por la forma del valor, asi que un prefijo de cache llamado
+ * EXPERIMENTS_HANDOFF_TOKENS_NAMESPACE bloqueo una ejecucion entera con
+ * severidad critica y sin salida. Las demas reglas miran el valor (AKIA…,
+ * sk_live_…) y esas aciertan.
+ *
+ * El arreglo NO es adivinar: la review tumbo tres heuristicas seguidas y con
+ * razon, porque `const dbPassword = "db-password"` tambien tiene pinta inocente
+ * y es una credencial. Lo que faltaba era CAUCE: que el proyecto pueda declarar
+ * la excepcion en su configuracion versionada, donde se revisa en la PR como
+ * cualquier otra linea, y que el guard diga como hacerlo cuando bloquea.
+ */
+const NAME_BASED_RULES = new Set(["hardcoded-key-assignment", "generic-secret"]);
+
+const HOW_TO_DECLARE = "If it is not a secret, declare it in guards.output.non_secret_assignments as NAME or path/to/file:NAME";
+
+/** El identificador al que se asigna, cuando la linea deja leerlo. */
+const assignedName = (content) => /([A-Za-z_$][\w$]*)\s*[:=]\s*["']/.exec(content)?.[1] ?? null;
+
+/** Una entrada declarada se lee como `NAME` o `path/to/file:NAME`. */
+const splitEntry = (entry) => {
+  const cut = entry.lastIndexOf(":");
+  return cut === -1 ? { path: null, name: entry } : { path: entry.slice(0, cut), name: entry.slice(cut + 1) };
+};
+
+/**
+ * Excepcion DECLARADA, no inferida: el proyecto afirma por escrito que esta
+ * asignacion no guarda un secreto. Sin `file` la declaracion vale para todo el
+ * repositorio; con el, solo para ese fichero, que es lo estrecho y preferible.
+ */
+export function declaredNonSecret(configGuards, file, content) {
+  const declared = configGuards?.output?.non_secret_assignments;
+  if (!Array.isArray(declared) || declared.length === 0) return false;
+  const name = assignedName(content);
+  if (!name) return false;
+  return declared.some(entry => {
+    if (typeof entry !== "string") return false;
+    const target = splitEntry(entry.trim());
+    return target.name === name && (target.path === null || target.path === file);
+  });
+}
+
 /**
  * Scan a diff for pattern violations.
  * Returns { pass: boolean, violations: Array<{id, severity, file, line, message, matchedContent}> }
@@ -133,8 +176,17 @@ export function scanDiff(diff, config = {}) {
   // Check patterns against added lines
   for (const { file, line, content } of addedLines) {
     for (const { id, pattern, severity, message } of patterns) {
-      if (pattern.test(content)) {
-        violations.push({ id, severity, file, line, message, matchedContent: content.trim().slice(0, 200) });
+      if (!pattern.test(content)) continue;
+      const matchedContent = content.trim().slice(0, 200);
+      // KJC-BUG-0215: una regla que acusa por el nombre necesita un cauce
+      // declarado para el falso positivo, y decirlo cuando bloquea.
+      if (!NAME_BASED_RULES.has(id)) {
+        violations.push({ id, severity, file, line, message, matchedContent });
+      } else if (declaredNonSecret(configGuards, file, content)) {
+        violations.push({ id, severity: "warning", file, line, matchedContent,
+          message: `${message}. Declared as non-secret in guards.output.non_secret_assignments` });
+      } else {
+        violations.push({ id, severity, file, line, matchedContent, message: `${message}. ${HOW_TO_DECLARE}` });
       }
     }
   }

package/src/harden/guidelines-engine.js

@@ -28,6 +28,8 @@ export function stripDevHooksBlock(source) {
   return { content: `${before}${joiner}${after}`, migrated: true };
 }
 
+const countLines = (text) => String(text || "").split("\n").filter((l) => l.trim()).length;
+
 export function installGuidelines({ projectDir = process.cwd(), dryRun = false, language = null } = {}) {
   // KJC-BUG-0199 (issue #1773): the rules that enter the agent's context must
   // be the rules of THIS project's language. kj harden already detects it for
@@ -45,8 +47,12 @@ export function installGuidelines({ projectDir = process.cwd(), dryRun = false,
       body,
       style: "html",
     });
+    // KJC-BUG-0206: harden removing rules is a fact worth saying. It silently
+    // dropped six lines from this repo's own files because the detected language
+    // had no block, and "updated" read like an improvement.
+    const shrank = countLines(content) < countLines(raw);
     if (!dryRun && (migrated || action !== "unchanged")) writeFileSync(target, content);
-    results.push({ file, action: migrated ? "migrated" : action });
+    results.push({ file, action: migrated ? "migrated" : action, ...(shrank ? { shrank: true } : {}) });
   }
   return { dryRun, guidelines: results };
 }

package/src/harden/guidelines-templates.js

@@ -76,9 +76,18 @@ export const LANGUAGE_GUIDELINES = {
   ],
 };
 
+/**
+ * Languages that share another's block (KJC-BUG-0206). TypeScript is the same
+ * ecosystem as JavaScript, and the block already says so in its heading; but the
+ * stack detector reports `typescript` for a repo with a tsconfig, so the lookup
+ * missed and harden ERASED the rules a project already had.
+ */
+const ALIASES = { typescript: "javascript" };
+
 /** The guidelines body for a language (unknown or absent ⇒ the core alone). */
 export function guidelinesBody(language = null) {
-  const extra = LANGUAGE_GUIDELINES[String(language || "").toLowerCase()] ?? [];
+  const key = String(language || "").toLowerCase();
+  const extra = LANGUAGE_GUIDELINES[ALIASES[key] ?? key] ?? [];
   return [...CORE, ...extra].join("\n");
 }
 

package/src/harden/harness-hooks.js

@@ -44,6 +44,12 @@ process.stdin.on("end", () => {
 `;
 
 /** Write a managed hook script under .karajan/harness/ and return its path. */
+/**
+ * KJC-BUG-0211: el cuerpo canonico de los guardias que instala ESTE modulo,
+ * para que quien verifica un sello pueda RECOMPUTAR en vez de fiarse del hash.
+ */
+export const HARNESS_BODIES = { "pretooluse.mjs": SCRIPT_BODY };
+
 export function writeHarnessScript(projectDir, name, body) {
   const dir = join(projectDir, ".karajan", "harness");
   mkdirSync(dir, { recursive: true });

package/src/harden/sentinel-hooks.js

@@ -10,9 +10,10 @@
 
 import { readFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { CARD_REF_RE } from "../review/card-first.js";
-import { mergeClaudeHooks, writeHarnessScript } from "./harness-hooks.js";
+import { HARNESS_BODIES, mergeClaudeHooks, writeHarnessScript } from "./harness-hooks.js";
 
 /** The harness lives at the PROJECT root — resolve it even from a subdir. */
 export function resolveSentinelRoot(dir = process.cwd()) {
@@ -134,7 +135,7 @@ import process from "node:process";
 import { relative } from "node:path";
 import { spawnSync } from "node:child_process";
 import { CODE, TESTS, ROOT, CARD, branchOf, load, save, session } from "./sentinel-lib.mjs";
-const ESCAPES = ["KJ_ALLOW_WRITE", "KJ_ALLOW_REWRITE", "KJ_ALLOW_NO_CARD", "KJ_ALLOW_NO_TESTS", "KJ_ALLOW_PII", "KJ_ALLOW_POLICY", "KJ_ALLOW_IDENTITY", "KJ_ALLOW_BOARD", "KJ_ALLOW_NO_RAG"];
+const ESCAPES = ["KJ_ALLOW_WRITE", "KJ_ALLOW_REWRITE", "KJ_ALLOW_NO_CARD", "KJ_ALLOW_NO_TESTS", "KJ_ALLOW_PII", "KJ_ALLOW_POLICY", "KJ_ALLOW_IDENTITY", "KJ_ALLOW_BOARD", "KJ_ALLOW_NO_RAG", "KJ_ALLOW_NO_VERIFY"];
 let raw = "";
 process.stdin.on("data", (d) => { raw += d; });
 process.stdin.on("end", () => {
@@ -364,6 +365,18 @@ process.stdin.on("end", () => {
       if (claimsNote) console.log(JSON.stringify({ systemMessage: claimsNote }));
       process.exit(0);
     }
+    // KJC-TSK-0868: si el anfitrion ha escrito codigo teniendo otro coder
+    // declarado, eso no se bloquea, se REGISTRA: el usuario eligio quien
+    // escribe y merece enterarse por el decision log, no por casualidad. Una
+    // vez por sesion, y si kj no responde se reintenta en el turno siguiente.
+    if (!s.panel_sealed && (s.edited_sources || []).length > 0) {
+      const p = spawnSync("kj", ["sentinel", "panel-check", "--session", sid], { cwd: ROOT, encoding: "utf8" });
+      if (!p.error && p.status === 0) {
+        s.panel_sealed = true;
+        save(state);
+        if ((p.stdout || "").trim()) console.error(p.stdout.trim());
+      }
+    }
     const v = violations(s, branchOf());
     if (claimsBlock) v.push(claimsBlock);
     if (!v.length) {
@@ -406,9 +419,19 @@ import { dirname, join, relative, resolve } from "node:path";
 import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { homedir } from "node:os";
+import { fileURLToPath } from "node:url";
 import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, branchOf, foreignLane, load, save, session, violations, recordEscape, pendingMoves, pendingText } from "./sentinel-lib.mjs";
 const EDIT_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
-const PUBLISH = /\\bnpm\\s+publish\\b|\\bfirebase\\s+deploy\\b|\\bgh\\s+release\\s+create\\b/;
+// KJC-BUG-0204: el comando real lleva flags EN MEDIO del verbo
+// (firebase --account a@b --project p deploy --only hosting:main), asi que la
+// adyacencia dejaba pasar sin mirar justo el despliegue que el gate vigila.
+// Las palabras del verbo tienen que aparecer en orden, no pegadas.
+const PUBLISH_VERBS = [["npm", "publish"], ["firebase", "deploy"], ["gh", "release", "create"]];
+// Cada palabra se lee por su basename: /usr/bin/npm publish es la misma
+// publicacion que npm publish (catch de la review).
+const wordsOf = (text) => String(text).split(/[^A-Za-z0-9_.@:/-]+/).filter(Boolean).map((w) => w.slice(w.lastIndexOf("/") + 1)).filter(Boolean);
+const inOrder = (want, got) => { let i = 0; for (const w of got) if (w === want[i] && ++i === want.length) return true; return false; };
+const isPublish = (cmd) => { const got = wordsOf(cmd); return PUBLISH_VERBS.some((verb) => inOrder(verb, got)); };
 const PUSH = /\\bgit\\s+push\\b/;
 const PROTECTED = /\\.claude\\/settings\\.json\\b|\\.karajan\\/(hooks|harness)\\//;
 let raw = "";
@@ -849,7 +872,30 @@ process.stdin.on("end", () => {
           process.exit(2);
         }
       } else if (pres.status !== 0) {
-        if (escOn("KJ_ALLOW_POLICY")) { recordEscape(sid, "KJ_ALLOW_POLICY", tool); }
+        // KJC-BUG-0207: un kj que NO ARRANCA no es una violacion de policy. Con
+        // kj linkado al arbol, un error de sintaxis transitorio en src/ dejaba
+        // la sesion sin Edit, sin Write y sin Bash, o sea sin las herramientas
+        // para arreglar el fichero, y el remedio que sugeria (kj policy check)
+        // tampoco arrancaba. Se avisa fuerte y se deja pasar: el resto de este
+        // guard sigue vigente, que es lo que protege el metodo.
+        const broken = /SyntaxError|ReferenceError|Cannot find module|ERR_MODULE_NOT_FOUND|ERR_REQUIRE_ESM/.exec(String(pres.stderr || ""));
+        // Abrir el gate entero seria un bypass a la carta (romper un modulo y
+        // seguir sin policy), catch de la review. Se permite EXACTAMENTE una
+        // cosa: editar el fichero que rompe kj. Lo demas sigue denegado.
+        const at = broken ? (String(pres.stderr || "").split("\\n").map((l) => l.trim()).find((l) => /^[^ ]+\\.(m?js|cjs|ts):\\d+$/.test(l)) || "") : "";
+        // Node localiza los errores de un modulo ESM como file:///ruta.js:124,
+        // y esa forma no es una ruta de fichero (catch de la review).
+        const asPath = (p) => (p.startsWith("file:") ? fileURLToPath(p) : p);
+        const brokenFile = at ? asPath(at.slice(0, at.lastIndexOf(":"))) : "";
+        if (broken) {
+          const target = input.file_path || input.notebook_path || "";
+          const repairing = EDIT_TOOLS.includes(tool) && brokenFile && target && resolve(String(target)) === resolve(brokenFile);
+          if (repairing) console.error("karajan sentinel: kj no arranca (" + broken[0] + " en " + at + ") — la policy no se puede evaluar, asi que solo se permite arreglar ESE fichero. Arreglalo y vuelve." + doc("policy"));
+          else {
+            console.error("karajan sentinel: kj no arranca (" + broken[0] + (at ? " en " + at : "") + "), asi que la policy no se puede evaluar y NADA MAS pasa: edita " + (brokenFile || "el fichero que rompe kj") + " para arreglarlo. No es un deny de policy, es kj roto." + doc("policy"));
+            process.exit(2);
+          }
+        } else if (escOn("KJ_ALLOW_POLICY")) { recordEscape(sid, "KJ_ALLOW_POLICY", tool); }
         else {
           console.error("karajan sentinel: kj policy eval fallo (exit " + pres.status + ") — la policy declarada no se pudo evaluar, deny por defecto; diagnostica con kj policy check y corrige .karajan/policy.yml fuera de la sesion (o KJ_ALLOW_POLICY=1 = excepcion consciente, queda registrada)." + doc("policy"));
           process.exit(2);
@@ -907,19 +953,40 @@ process.stdin.on("end", () => {
         const rs = load().sessions?.[sid] || {};
         const hits = rs.rag_hits || [];
         const dirOf = (p) => (p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "");
-        const fresh = !existsSync(String(file));
+        // KJC-BUG-0210: nuevo no es "no existe en disco". En cuanto la sesion
+        // lo crea, la siguiente edicion exigia una respuesta del RAG sobre un
+        // fichero que el indice NO puede tener. El hecho comprobable: un
+        // fichero que git no conoce no ha podido indexarse.
+        // Solo se pregunta a git en el camino lento, cuando el gate iba a
+        // denegar: exit 1 = git responde que no lo conoce; cualquier otro
+        // resultado se comporta como hasta ahora y bloquea.
+        const fresh = () => !existsSync(String(file)) || spawnSync("git", ["-C", ROOT, "ls-files", "--error-unmatch", "--", rel], { encoding: "utf8" }).status === 1;
         // A path outside this tree is another lane's business (the lane guard
         // above rules on it) and the ledger only holds in-repo paths.
         // KJC-BUG-0190: with nothing indexed, no query can cover anything —
         // the gate asks for kj rag index instead of denying the impossible.
-        const covered = rel.startsWith("..") || hits.includes(rel) || hits.some((h) => dirOf(h) === dirOf(rel)) || (fresh && (rs.rag_queries || []).length > 0) || rs.rag_index_empty === true;
+        const covered = rel.startsWith("..") || hits.includes(rel) || hits.some((h) => dirOf(h) === dirOf(rel)) || ((rs.rag_queries || []).length > 0 && fresh()) || rs.rag_index_empty === true;
         if (!covered) {
           if (escOn("KJ_ALLOW_NO_RAG")) {
             // Recorded ONCE per session: the escape is a conscious exception, not a per-edit tax.
             if (!(rs.escapes || []).includes("KJ_ALLOW_NO_RAG")) recordEscape(sid, "KJ_ALLOW_NO_RAG", tool);
           } else {
-            console.error("karajan sentinel: rag-first — el RAG no ha respondido sobre " + rel + " en esta sesion; consulta antes de tocarlo: kj_rag_query / kj rag query <que hace " + rel + " y donde mas vive ese concepto>. (KJ_ALLOW_NO_RAG=1 = excepcion consciente, queda registrada)" + doc("rag-first"));
-            process.exit(2);
+            // KJC-BUG-0216 (issue #1807): un .astro, un .php o cualquier fichero
+            // sin adapter NO puede estar en el indice, asi que exigir una
+            // respuesta del RAG sobre el es pedir lo imposible, y empujaba a
+            // dejar KJ_ALLOW_NO_RAG puesta para siempre. La exencion es SOLO
+            // esa: un indice vacio o por detras si tiene arreglo (kj rag index)
+            // y sigue bloqueando, porque si no el gate desapareceria en
+            // cualquier proyecto sin indexar. Nada legible = se bloquea.
+            const cov = spawnSync("kj", ["rag", "covers", rel, "--json"], { cwd: ROOT, encoding: "utf8" });
+            let blind = null;
+            try { const c = JSON.parse(String(cov.stdout || "")); if (c.state === "not-indexable") blind = c.reason; } catch { blind = null; }
+            if (blind) {
+              console.error("karajan sentinel: rag-first — " + blind + " — no se te exige consultar lo que el indice no puede tener; el gate lo anota y sigue" + doc("rag-first"));
+            } else {
+              console.error("karajan sentinel: rag-first — el RAG no ha respondido sobre " + rel + " en esta sesion; consulta antes de tocarlo: kj_rag_query / kj rag query <que hace " + rel + " y donde mas vive ese concepto>. (KJ_ALLOW_NO_RAG=1 = excepcion consciente, queda registrada)" + doc("rag-first"));
+              process.exit(2);
+            }
           }
         }
       }
@@ -930,15 +997,54 @@ process.stdin.on("end", () => {
       // and nothing advances (commit, new PR, another merge; push and the end of
       // the turn go through violations()) until the card is moved. The board is
       // true at all times or the method stops — never a rule in the agent's memory.
+      // ENF-B (KJC-TSK-0854): el review es obligatorio, no una sugerencia. Una
+      // bandera no puede apagar el gate de commit, y mover core.hooksPath lo
+      // apaga entero. El --no-verify que kj harden --commit usa por dentro no
+      // pasa por aqui: no es una tool call. Escape humano, sellado como el resto.
+      const words = wordsOf(cmd);
+      // git acepta abreviaturas no ambiguas de las opciones largas, asi que
+      // --no-ver salta el hook igual que --no-verify (catch de la review).
+      const shortWithN = (w) => w.length > 1 && w[0] === "-" && w[1] !== "-" && w.includes("n");
+      const skipsVerify = (w) => shortWithN(w) || (w.length >= 5 && "--no-verify".startsWith(w));
+      // Mover core.hooksPath apaga TODOS los hooks. git tiene varias puertas
+      // para lo mismo (config, -c, --config-env, GIT_CONFIG_KEY_n) y no
+      // distingue mayusculas en la llave, asi que lo que se vigila es la LLAVE
+      // en cualquier posicion (dos catches de la review). Leerla no hace nada.
+      // Nombrar la llave basta para denegar: exceptuar las lecturas invitaba a
+      // colar una detras del cambio (git config core.hooksPath /x; cat algo),
+      // catch de la review. Leerla tiene remedio barato, perderla no.
+      // Se busca la llave DENTRO del token y no solo al principio: las formas
+      // de inyeccion la empotran (GIT_CONFIG_KEY_0=core.hooksPath,
+      // --config-env=core.hooksPath=VAR) y una propiedad de seguridad no puede
+      // depender de como parta las palabras el separador (catch de la review).
+      const movesHooks = cmd.toLowerCase().includes("core.hookspath");
+      if ((inOrder(["git", "commit"], words) && words.some(skipsVerify)) || movesHooks) {
+        if (escOn("KJ_ALLOW_NO_VERIFY")) { recordEscape(sid, "KJ_ALLOW_NO_VERIFY", tool); }
+        else {
+          console.error("karajan sentinel: el gate de commit no se apaga con una bandera — el review cruzado y la policy corren en el hook, y saltarselos deja el diff sin veredicto. Si el hook esta roto, arreglalo; si de verdad hace falta, es una decision de tu usuario. (KJ_ALLOW_NO_VERIFY=1 = excepcion consciente, queda registrada)" + doc("escapes"));
+          process.exit(2);
+        }
+      }
       const MERGE = /\\bgh\\s+pr\\s+merge(\\s+(\\d+))?/;
       const ADVANCE = /\\bgit\\s+commit\\b|\\bgit\\s+push\\b|\\bgh\\s+pr\\s+create\\b/; // push also falls under violations() — explicit here too (review catch)
       const mergeM = cmd.match(MERGE);
       const pend = pendingMoves(load().sessions?.[sid]);
       if (pend.length > 0 && (mergeM || ADVANCE.test(cmd))) {
-        if (escOn("KJ_ALLOW_BOARD")) { recordEscape(sid, "KJ_ALLOW_BOARD", tool); }
-        else {
-          console.error("karajan sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + pend.map((p) => "- " + pendingText(p)).join("\\n") + "\\n(KJ_ALLOW_BOARD=1 = excepcion consciente, queda registrada)" + doc("board-sync"));
-          process.exit(2);
+        // KJC-BUG-0198: una card partida en varias PRs no puede quedar bloqueada
+        // por su primera mitad. kj decide con un hecho comprobable (otra PR
+        // abierta de la card); si kj no responde, se bloquea como siempre.
+        const bg = spawnSync("kj", ["sentinel", "board-gate", "--session", sid, "--json"], { cwd: ROOT, encoding: "utf8" });
+        let blocking = pend, carried = [];
+        if (!bg.error && (bg.status === 0 || bg.status === 2)) {
+          try { const d = JSON.parse(bg.stdout); blocking = d.blocking || []; carried = d.carried || []; } catch { /* sin respuesta legible: como siempre */ }
+        }
+        for (const c of carried) console.error("karajan sentinel: board-sync arrastra " + c.card + " — " + c.why + ", se movera al cerrarla");
+        if (blocking.length > 0) {
+          if (escOn("KJ_ALLOW_BOARD")) { recordEscape(sid, "KJ_ALLOW_BOARD", tool); }
+          else {
+            console.error("karajan sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + blocking.map((p) => "- " + pendingText(p)).join("\\n") + "\\n(KJ_ALLOW_BOARD=1 = excepcion consciente, queda registrada)" + doc("board-sync"));
+            process.exit(2);
+          }
         }
       }
       // (the pending entry itself is recorded by the PostToolUse hook, only once
@@ -956,13 +1062,24 @@ process.stdin.on("end", () => {
           process.exit(2);
         }
       }
-      if (PUBLISH.test(cmd)) {
+      if (isPublish(cmd)) {
         if (escOn("KJ_ALLOW_RELEASE")) { recordEscape(sid, "KJ_ALLOW_RELEASE", tool); process.exit(0); }
-        const res = spawnSync("kj", ["release", "check", "--json"], { cwd: ROOT, encoding: "utf8" });
+        // KJC-BUG-0204: el check se evalua PARA este comando. Un item que
+        // declara remedied_by no bloquea el comando que lo repara (desplegar
+        // la landing era justo lo que el check pedia); publicar no se exime.
+        const res = spawnSync("kj", ["release", "check", "--json", "--for-command", cmd], { cwd: ROOT, encoding: "utf8" });
         if (res.error || res.status === null) process.exit(0);
+        let parsed = null;
+        try { parsed = JSON.parse(res.stdout); } catch { /* raw output */ }
+        const lifted = (parsed && parsed.lifted) || [];
+        if (res.status === 0 && lifted.length > 0) {
+          // En voz alta: una exencion que nadie ve no se distingue de un gate que no mira.
+          console.error("karajan sentinel: release check en rojo SOLO por lo que este comando repara (" + lifted.join(", ") + ") — pasa, y el resto sigue en verde" + doc("release"));
+          process.exit(0);
+        }
         if (res.status !== 0) {
           let items = "";
-          try { items = (JSON.parse(res.stdout).checks || []).filter((c) => !c.ok).map((c) => "\\n- " + c.name + ": " + c.detail).join(""); } catch { /* raw output */ }
+          try { items = (parsed.checks || []).filter((c) => !c.ok && c.lifted !== true).map((c) => "\\n- " + c.name + ": " + c.detail).join(""); } catch { /* raw output */ }
           console.error("karajan sentinel: release check en ROJO — no se publica ni despliega hasta resolverlo:" + (items || "\\n- corre kj release check para el detalle") + "\\n(KJ_ALLOW_RELEASE=1 = excepcion consciente, queda registrada)" + doc("release"));
           process.exit(2);
         }
@@ -1000,24 +1117,124 @@ const SCRIPT_BODIES = {
  * package — outside the project tree, beyond the session's tool reach —
  * because nothing under .karajan can vouch for itself.
  */
-export function verifySentinelScripts({ projectDir } = {}) {
-  const dir = join(projectDir || resolveSentinelRoot(), ".karajan", "harness");
+const PROVENANCE_PATH = ".karajan/supervisor-provenance.json";
+
+/**
+ * KJC-BUG-0211: el cuerpo que kj escribiria para ese guardia, venga de las
+ * plantillas del Sentinel o de las del harness. Quien verifica un sello
+ * recomputa con esto; sin el, un sello que cubre los guardias (KJC-BUG-0197)
+ * no se puede ni commitear, porque nadie sabe comprobarlos.
+ */
+export const canonicalHarnessBody = (name) => SCRIPT_BODIES[name] ?? HARNESS_BODIES[name] ?? null;
+
+/**
+ * KJC-BUG-0197: what did a human actually seal, per guard?
+ *
+ * Read from **git**, never from the working tree. The provenance is tracked and
+ * written only by `kj harden --commit` (a human act with four layers, ADR 0009),
+ * so the committed copy is the external reference; the copy on disk is as
+ * forgeable as the guard it would vouch for, and the review caught exactly that.
+ * No git, no commit, no seal: then nothing is forgiven and the check fails
+ * closed, which is the safe direction.
+ *
+ * The map is keyed BY PATH: a hash sealed for one file never vouches for
+ * another (also the review's catch).
+ *
+ * @returns {Map<string, string>} relative path → sealed sha256
+ */
+function sealedByPath(projectDir, gitShowFn) {
+  try {
+    const raw = gitShowFn
+      ? gitShowFn(projectDir, PROVENANCE_PATH)
+      : execFileSync("git", ["-C", projectDir, "show", `HEAD:${PROVENANCE_PATH}`], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    const files = JSON.parse(raw)?.files;
+    const out = new Map();
+    for (const entry of Array.isArray(files) ? files : []) {
+      if (typeof entry?.file === "string" && typeof entry?.sha256 === "string") out.set(entry.file, entry.sha256);
+    }
+    return out;
+  } catch {
+    return new Map();
+  }
+}
+
+/**
+ * @returns {{ok: boolean, mismatched: string[], drift?: string[], reason?: string}}
+ *   `mismatched` is TAMPERING: a guard holds content nobody sealed, and that is
+ *   what the hooks block on. `drift` is a sealed guard whose templates have
+ *   moved on, which `kj harden` applies and which is not a defect.
+ */
+export function verifySentinelScripts({ projectDir, readFileFn = readFileSync, gitShowFn = null } = {}) {
+  const root = projectDir || resolveSentinelRoot();
+  const dir = join(root, ".karajan", "harness");
+  const installed = new Map();
   const mismatched = [];
   for (const [name, body] of Object.entries(SCRIPT_BODIES)) {
     try {
-      if (readFileSync(join(dir, name), "utf8") !== body) mismatched.push(name);
+      const text = readFileFn(join(dir, name), "utf8");
+      installed.set(name, text);
+      if (text !== body) mismatched.push(name);
     } catch {
-      mismatched.push(name);
+      mismatched.push(name); // missing: there is no content for a seal to cover
     }
   }
-  return { ok: mismatched.length === 0, mismatched };
+  if (mismatched.length === 0) return { ok: true, mismatched: [] };
+
+  // A mismatch is only forgiven when what sits there is something a human
+  // sealed. Editing a guard produces content no seal covers, so the forgiveness
+  // cannot be borrowed by also editing a template: that was the hole in the
+  // first attempt at this fix, and the review was right to reject it.
+  const sealed = sealedByPath(root, gitShowFn);
+  const drift = [];
+  const tampered = [];
+  for (const name of mismatched) {
+    const text = installed.get(name);
+    const sealedHash = sealed.get(`.karajan/harness/${name}`);
+    if (text !== undefined && sealedHash && sealedHash === createHash("sha256").update(text).digest("hex")) drift.push(name);
+    else tampered.push(name);
+  }
+  if (tampered.length > 0) return { ok: false, mismatched: tampered, ...(drift.length ? { drift } : {}) };
+  return {
+    ok: true,
+    mismatched: [],
+    drift,
+    reason: "el harness instalado está sellado y las plantillas de este árbol van por delante (kj harden lo pone al día) — no es manipulación",
+  };
 }
 
-/** Write the sentinel scripts (shared lib + state writer + gates) and wire them. */
-export function installSentinelHooks({ projectDir = process.cwd(), logger = console } = {}) {
-  const [lib, post, stop, pre] = Object.entries(SCRIPT_BODIES).map(([name, body]) =>
-    writeHarnessScript(projectDir, name, body),
-  );
+/**
+ * Write the sentinel scripts (shared lib + state writer + gates) and wire them.
+ *
+ * KJC-BUG-0193: a guard holding exactly what a human sealed is LEFT ALONE. This
+ * is the command a session reaches for when it has edited the templates, and
+ * rewriting the guards here un-sealed the ones actually running, so the very act
+ * of unblocking destroyed the seal that made unblocking unnecessary. Advancing
+ * them is a human act: `kj harden --commit` moves guards and seal together.
+ * Anything nobody sealed is rewritten as before, because restoring a tampered
+ * guard is still the right move.
+ */
+export function installSentinelHooks({ projectDir = process.cwd(), logger = console, human = false, gitShowFn = null } = {}) {
+  const sealed = human ? new Map() : sealedByPath(projectDir, gitShowFn);
+  const deferred = [];
+  const keepsItsSeal = (name) => {
+    const sealedHash = sealed.get(`.karajan/harness/${name}`);
+    if (!sealedHash) return false;
+    try {
+      return sealedHash === createHash("sha256").update(readFileSync(join(projectDir, ".karajan", "harness", name), "utf8")).digest("hex");
+    } catch {
+      return false; // no hay contenido que un sello pueda cubrir
+    }
+  };
+  const [lib, post, stop, pre] = Object.entries(SCRIPT_BODIES).map(([name, body]) => {
+    if (keepsItsSeal(name)) {
+      deferred.push(name);
+      return join(projectDir, ".karajan", "harness", name);
+    }
+    return writeHarnessScript(projectDir, name, body);
+  });
+  if (deferred.length > 0) {
+    logger?.info?.(`kj harden: ${deferred.join(", ")} se queda como está — es lo que un humano selló, y avanzarlo es suyo: kj harden --commit`);
+  }
   const { wired } = mergeClaudeHooks({
     projectDir,
     logger,
@@ -1033,5 +1250,5 @@ export function installSentinelHooks({ projectDir = process.cwd(), logger = cons
       { event: "Stop", script: "stop.mjs" },
     ],
   });
-  return { scripts: [lib, post, stop, pre], wired };
+  return { scripts: [lib, post, stop, pre], wired, deferred };
 }

package/src/harden/supervisor-commit.js

@@ -16,6 +16,13 @@ import { isPhoneEnrolled, requestPhoneSignature } from "./phone-sign.js";
 
 export const PROVENANCE_FILE = ".karajan/supervisor-provenance.json";
 const HOOKS_PREFIX = ".karajan/hooks/";
+// KJC-BUG-0197: la procedencia del supervisor no cubría los guardias del
+// supervisor. Sellaba los hooks de git y ningún .mjs del harness, que son
+// justo los que vigilan la sesión, así que nada externo podía decir si un
+// guardia instalado era auténtico. Los ficheros siguen fuera de git (los
+// veredictos son locales por diseño); lo que viaja y se firma es su HUELLA,
+// dentro de una procedencia que sí está trackeada.
+const HARNESS_PREFIX = ".karajan/harness/";
 
 const sha256 = (abs) => createHash("sha256").update(readFileSync(abs)).digest("hex");
 
@@ -58,6 +65,23 @@ function defaultConfirm(nonce) {
 }
 
 /** Ficheros de supervisor TRACKEADOS con cambios (staged o no). */
+/**
+ * KJC-BUG-0197: los guardias del Sentinel que el sello debe cubrir. No salen de
+ * `git status` (están gitignorados), así que se leen del disco. Un proyecto sin
+ * harness (perfil minimal) sella los hooks y nada más.
+ * @returns {string[]} rutas relativas, ordenadas
+ */
+export function harnessGuards(projectDir) {
+  try {
+    return readdirSync(join(projectDir, HARNESS_PREFIX))
+      .filter((f) => f.endsWith(".mjs"))
+      .map((f) => HARNESS_PREFIX + f)
+      .sort();
+  } catch {
+    return [];
+  }
+}
+
 export function supervisorDrift({ projectDir, gitFn }) {
   const run = gitFn || ((args) => execFileSync("git", args, { cwd: projectDir, encoding: "utf8" }));
   // Un rename sale como "R  old -> new" (catch de codex): ambas rutas son
@@ -107,10 +131,26 @@ export async function commitSupervisorRegeneration({
   // La provenance describe SIEMPRE el estado COMPLETO del supervisor (cazado
   // en el primer estreno real: un sello parcial pisaba al anterior y dejaba
   // ficheros sin respaldo). Borrados del drift ⇒ deleted (catch de codex).
-  const current = readdirSync(join(projectDir, HOOKS_PREFIX)).map((f) => HOOKS_PREFIX + f).sort();
+  const current = [
+    ...readdirSync(join(projectDir, HOOKS_PREFIX)).map((f) => HOOKS_PREFIX + f),
+    ...harnessGuards(projectDir),
+  ].sort();
+  // KJC-BUG-0197: un guardia BORRADO se anota como borrado, igual que un hook.
+  // No hacía falta para desencadenar el re-sello (la lista encoge, así que la
+  // cobertura ya falla), pero registrar la ausencia dice más que omitirla:
+  // quien lea la procedencia ve que ese guardia se fue, no que nunca estuvo.
+  const previousGuards = (() => {
+    try {
+      return JSON.parse(readFileSync(join(projectDir, PROVENANCE_FILE), "utf8"))?.files ?? [];
+    } catch { return []; }
+  })();
+  const goneGuards = previousGuards
+    .map((f) => f?.file)
+    .filter((f) => typeof f === "string" && f.startsWith(HARNESS_PREFIX) && !existsSync(join(projectDir, f)));
   const hashed = [
     ...current.map((file) => ({ file, sha256: sha256(join(projectDir, file)) })),
     ...drift.filter((f) => !existsSync(join(projectDir, f))).map((file) => ({ file, deleted: true })),
+    ...goneGuards.map((file) => ({ file, deleted: true })),
   ];
   let previous = null;
   try { previous = JSON.parse(readFileSync(join(projectDir, PROVENANCE_FILE), "utf8")); } catch { /* primer sello */ }