karajan-code 4.34.0 → 4.35.1

package/src/orchestrator/config-init.js

@@ -5,7 +5,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { computeBaseRef, setSnapshot } from "../review/diff-generator.js";
-import { ensureContractBlockPresent } from "../review/gate-gitignore.js";
+import { ensureContractBlockPresent, excludeLocalArtifacts } from "../review/gate-gitignore.js";
 import { revParse } from "../utils/git.js";
 import { buildCoderPrompt } from "../prompts/coder.js";
 import { buildReviewerPrompt } from "../prompts/reviewer.js";
@@ -55,26 +55,18 @@ export async function autoInit(projectDir, logger) {
     }
   }
 
-  // Ensure .gitignore exists with universal entries only (stack-specific added after planner)
-  // KJC-BUG-0123: `.karajan/` is NOT in this list on purpose — a bare
-  // dir-exclude breaks the gate contract (git cannot re-include children);
-  // the canonical block is appended below from its single source.
-  const gitignorePath = path.join(projectDir, ".gitignore");
-  const universalIgnores = [".env", "*.log", ".DS_Store", ".reviews/"];
+  // KJC-BUG-0213 (issue #1734): el .gitignore es del equipo y viaja con el repo.
+  // Ahi solo entra el contrato v4, que el equipo entero hereda; los artefactos
+  // de una ejecucion son nuestros y locales, asi que van a .git/info/exclude.
+  // Lo que kj metia antes (.env, *.log, .DS_Store) era opinion sobre un
+  // proyecto ajeno, y aparecia en el diff de otra persona sin haberlo pedido.
   try {
-    let content = "";
-    if (await exists(gitignorePath)) {
-      content = await fs.readFile(gitignorePath, "utf8");
-    }
-    const missing = universalIgnores.filter(entry => !content.includes(entry));
-    if (missing.length > 0) {
-      const append = (content && !content.endsWith("\n") ? "\n" : "") + missing.join("\n") + "\n";
-      await fs.appendFile(gitignorePath, append, "utf8");
-      logger.info(`Created .gitignore with universal entries`);
-    }
-    await ensureContractBlockPresent(projectDir);
+    const contract = await ensureContractBlockPresent(projectDir);
+    if (contract.changed) logger.info("El contrato v4 se ha anadido a .gitignore (lo hereda quien clone)");
+    const local = await excludeLocalArtifacts(projectDir);
+    if (local.changed) logger.info(`Artefactos de kj excluidos en .git/info/exclude: ${local.added.join(", ")}`);
   } catch (err) {
-    logger.warn(`Failed to create .gitignore: ${err.message}`);
+    logger.warn(`Failed to prepare .gitignore: ${err.message}`);
   }
 
   const karajanDir = path.join(projectDir, ".karajan");
@@ -125,89 +117,11 @@ export async function autoInit(projectDir, logger) {
   }
 }
 
-// Stack-specific .gitignore patterns keyed by language/framework
-const STACK_GITIGNORE = {
-  javascript: ["node_modules/", "dist/", "build/", "coverage/", ".cache/", "*.tsbuildinfo"],
-  typescript: ["node_modules/", "dist/", "build/", "coverage/", ".cache/", "*.tsbuildinfo"],
-  python: ["__pycache__/", "*.pyc", ".venv/", "venv/", "*.egg-info/", ".pytest_cache/", "htmlcov/", ".mypy_cache/"],
-  java: ["target/", "*.class", "*.jar", "*.war", ".gradle/", "build/", ".settings/", ".classpath", ".project"],
-  kotlin: ["target/", "*.class", "build/", ".gradle/", ".kotlin/"],
-  go: ["bin/", "*.exe", "vendor/"],
-  rust: ["target/", "Cargo.lock"],
-  ruby: ["vendor/bundle/", ".bundle/", "coverage/", "tmp/"],
-  php: ["vendor/", ".phpunit.result.cache", "storage/logs/"],
-  csharp: ["bin/", "obj/", "*.suo", "*.user", "packages/", ".vs/"],
-  swift: [".build/", "Packages/", "*.xcodeproj/", "DerivedData/"],
-  dart: [".dart_tool/", "build/", ".packages"],
-};
-
-/**
- * Update .gitignore with stack-specific entries after planner/architect decides the stack.
- * Detects stack from: triage taskType, architect output, planner output, or task keywords.
- */
-export async function updateGitignoreForStack(projectDir, { stageResults, task, logger }) {
-  const gitignorePath = path.join(projectDir, ".gitignore");
-  const detected = new Set();
-
-  // From architect — if it chose layers/patterns, it may hint at the language
-  const arch = stageResults?.architect?.architecture;
-  if (arch) {
-    const archText = JSON.stringify(arch).toLowerCase();
-    for (const lang of Object.keys(STACK_GITIGNORE)) {
-      if (archText.includes(lang)) detected.add(lang);
-    }
-  }
-
-  // From planner — scan plan text for language keywords
-  const planText = (stageResults?.planner?.plan || "").toLowerCase();
-  // From task description
-  const taskText = (task || "").toLowerCase();
-  const combined = `${planText} ${taskText}`;
-
-  const langKeywords = {
-    javascript: ["node", "npm", "express", "react", "vue", "next", "vite", "vitest", "jest", "pnpm", "yarn", "javascript", "js"],
-    typescript: ["typescript", "tsx", "tsc"],
-    python: ["python", "django", "flask", "fastapi", "pip", "pytest", "poetry"],
-    java: ["java", "spring", "maven", "gradle", "junit"],
-    kotlin: ["kotlin", "ktor"],
-    go: ["golang", "go mod", "gin", "fiber"],
-    rust: ["rust", "cargo", "tokio"],
-    ruby: ["ruby", "rails", "gem", "bundler", "rspec"],
-    php: ["php", "laravel", "composer", "symfony"],
-    csharp: ["c#", "csharp", "dotnet", ".net", "aspnet"],
-    swift: ["swift", "swiftui", "vapor"],
-    dart: ["dart", "flutter"],
-  };
-
-  for (const [lang, keywords] of Object.entries(langKeywords)) {
-    if (keywords.some(kw => combined.includes(kw))) detected.add(lang);
-  }
-
-  if (detected.size === 0) return;
-
-  // Collect all entries for detected stacks
-  const entries = [];
-  for (const lang of detected) {
-    entries.push(...(STACK_GITIGNORE[lang] || []));
-  }
-  const unique = [...new Set(entries)];
-
-  try {
-    let content = "";
-    if (await exists(gitignorePath)) {
-      content = await fs.readFile(gitignorePath, "utf8");
-    }
-    const missing = unique.filter(entry => !content.includes(entry));
-    if (missing.length > 0) {
-      const header = `\n# ${[...detected].join(" + ")} project\n`;
-      const append = header + missing.join("\n") + "\n";
-      await fs.appendFile(gitignorePath, append, "utf8");
-      logger.info(`Updated .gitignore for ${[...detected].join(" + ")}: ${missing.join(", ")}`);
-    }
-  } catch (err) {
-    logger.warn(`Failed to update .gitignore for stack: ${err.message}`);
-  }
-}
+// KJC-BUG-0213 (issue #1734): aqui vivia updateGitignoreForStack, que deducia
+// el stack buscando palabras como "ts" o "js" en el texto del plan y de la
+// tarea. Cualquier frase las contiene, asi que un proyecto Laravel acabo con
+// reglas de TypeScript en SU .gitignore. Un acierto por casualidad no vale para
+// escribir en un fichero que no es nuestro: la funcion se retira entera.
 
 /**
  * Load product context from well-known file locations.

package/src/orchestrator/drivers/iteration-phases/guards.js

@@ -24,10 +24,17 @@ export async function runGuardStages({ config, logger, emitter, eventBase, sessi
 
   if (!outputEnabled && !perfEnabled) return { action: "ok" };
 
+  // KJC-BUG-0214 (issue #1733): los guards juzgan LO QUE HA HECHO ESTE RUN, no
+  // la rama entera. Con el merge-base contra la base, cualquier linea anadida
+  // en cualquier momento de la rama contaba como recien escrita, y una
+  // ejecucion se bloqueo por codigo preexistente que el coder no toco. La
+  // sesion ya guarda HEAD al arrancar precisamente para esto.
   const baseBranch = config.base_branch || "main";
+  const runStart = session?.head_at_start || session?.session_start_sha || null;
   let diff;
   try {
-    const baseRef = await computeBaseRef({ baseBranch });
+    const baseRef = runStart || await computeBaseRef({ baseBranch });
+    if (!runStart) logger.warn("Guards: sin punto de arranque del run, se juzga la rama entera contra la base");
     diff = await generateDiff({ baseRef, projectDir: config?.projectDir || null });
   } catch {
     logger.warn("Guards: could not generate diff, skipping");

package/src/orchestrator/drivers/pre-loop.js

@@ -57,7 +57,7 @@ import { maybeGenerateAutoHuBatch } from "./pre-loop-phases/auto-hu-batch.js";
 
 import {
   applyTriageOverrides, applyAutoSimplify, applyFlagOverrides,
-  resolvePipelinePolicies, updateGitignoreForStack,
+  resolvePipelinePolicies,
 } from "../config-init.js";
 import { tryCiComment } from "../ci-integration.js";
 import { getIntegration } from "../integrations.js";
@@ -322,7 +322,7 @@ export async function runPreLoopStages({ config, logger, emitter, eventBase, ses
   // Hard fail if blocking checks failed (SonarQube enabled but not available)
   if (!preflightResult.ok) {
     const errorLines = (preflightResult.errors || [])
-      .map(e => `  - ${e.message}\n    Fix: ${e.fix}`)
+      .map(e => `  - ${e.message}${e.fix ? `\n    Fix: ${e.fix}` : ""}`)
       .join("\n");
     throw new Error(
       `Preflight FAILED — environment changed during session. Fix the issues and retry:\n${errorLines}`
@@ -350,7 +350,6 @@ export async function runPreLoopStages({ config, logger, emitter, eventBase, ses
 
   // --- Update .gitignore with stack-specific entries based on planner/architect output ---
   const projectDir = updatedConfig.projectDir || process.cwd();
-  await updateGitignoreForStack(projectDir, { stageResults, task, logger });
 
   // --- Auto-HU: when triage recommended decomposition and no manual huFile, generate HU batch ---
   await maybeGenerateAutoHuBatch({

package/src/rag/coverage.js

@@ -8,10 +8,29 @@
  * matchers are the single truth, here and in the indexer.
  */
 import { execa } from "execa";
-import { isAbsolute, relative } from "node:path";
+import { extname, isAbsolute, normalize, relative } from "node:path";
 import { detectAdaptersForProject, buildMatchers } from "../lang/registry.js";
+import { GENERATED_CONFIG_FILES } from "../harden/config-templates.js";
 import { getLastIndexedCommit, projectSlug } from "./vec-store.js";
 
+
+/**
+ * KJC-BUG-0221 — `kj harden` instala commitlint.config.js y eslint.config.js, y
+ * la cobertura los exigia indexados, asi que `kj check` denunciaba como drift
+ * dos ficheros que kj mismo acababa de escribir: la herramienta creando el
+ * fichero y quejandose de el. El criterio es el que ya usa el presupuesto de
+ * LOC (src/review/loc-budget.js): lo generado no cuenta, porque nadie lo
+ * escribio, y el RAG existe para responder sobre el codigo del equipo.
+ *
+ * La lista sale de la propia tabla de plantillas de harden, para que anadir un
+ * config no obligue a acordarse de esta otra lista.
+ */
+export function isGeneratedByHarden(rel) {
+  if (!rel) return false;
+  const base = rel.split("/").pop();
+  return GENERATED_CONFIG_FILES.has(base);
+}
+
 /**
  * @param {string} projectDir
  * @param {{db: object}} deps - an open vec store
@@ -21,7 +40,10 @@ export async function ragIndexCoverage(projectDir, { db }) {
   const project = projectSlug(projectDir);
   const matchers = buildMatchers(detectAdaptersForProject(projectDir));
   const { stdout } = await execa("git", ["-C", projectDir, "ls-files", "-z"]);
-  const sources = stdout.split("\0").filter((p) => p && matchers.isCodeFile(p) && !matchers.shouldSkip(p));
+  const all = stdout.split("\0").filter((p) => p && matchers.isCodeFile(p) && !matchers.shouldSkip(p));
+  // Lo que kj genera se informa aparte: ni se exige indexado ni se esconde.
+  const generated = all.filter(isGeneratedByHarden);
+  const sources = all.filter((p) => !isGeneratedByHarden(p));
 
   const rows = db.prepare("SELECT DISTINCT source FROM chunks WHERE kind = 'code' AND project_slug = ?").all(project);
   const indexed = new Set(rows.map((r) => (isAbsolute(r.source) ? relative(projectDir, r.source) : r.source)));
@@ -44,5 +66,36 @@ export async function ragIndexCoverage(projectDir, { db }) {
     stale = sources.filter((p) => indexed.has(p) && changed.has(p));
   }
 
-  return { project, total: sources.length, indexed: sources.length - missing.length, missing, stale, lastIndexedCommit, absent: indexed.size === 0 };
+  return { project, total: sources.length, indexed: sources.length - missing.length, missing, stale, generated, lastIndexedCommit, absent: indexed.size === 0 };
+}
+
+/**
+ * KJC-BUG-0216 (issue #1807) — POR QUE el RAG no puede responder sobre un
+ * fichero. El gate rag-first exigia una respuesta sobre cualquier fichero
+ * tocado, y para un .astro (o .php, o cualquier lenguaje sin adapter) eso es
+ * imposible: el indexador nunca lo toma. La unica salida era KJ_ALLOW_NO_RAG
+ * puesta por costumbre en todos los comandos, y con ella puesta el gate deja de
+ * informar y borra la diferencia entre "no pude consultar" y "no quise".
+ *
+ * `canAnswer` es la respuesta que el gate necesita: solo cuando es true tiene
+ * sentido exigir que el RAG haya hablado de ese fichero.
+ *
+ * @returns {{state: "indexed"|"stale"|"not-indexable"|"index-empty", rel: string, canAnswer: boolean, reason: string}}
+ */
+export function fileIndexState(projectDir, file, { db }) {
+  const project = projectSlug(projectDir);
+  // `./src/a.js` y `src/a.js` son el mismo fichero: sin normalizar, el segundo
+  // salia "stale" estando indexado (catch de la review).
+  const rel = normalize(isAbsolute(file) ? relative(projectDir, file) : file);
+  const matchers = buildMatchers(detectAdaptersForProject(projectDir));
+  const rows = db.prepare("SELECT DISTINCT source FROM chunks WHERE project_slug = ?").all(project);
+  const indexed = new Set(rows.map((r) => normalize(isAbsolute(r.source) ? relative(projectDir, r.source) : r.source)));
+
+  if (indexed.has(rel)) return { state: "indexed", rel, canAnswer: true, reason: `the index holds chunks for ${rel}` };
+  if (indexed.size === 0) return { state: "index-empty", rel, canAnswer: false, reason: `nothing of this project is indexed yet: kj rag index` };
+  if (matchers.shouldSkip(rel)) return { state: "not-indexable", rel, canAnswer: false, reason: `${rel} lives under a path the indexer always skips` };
+  if (!matchers.isCodeFile(rel) && extname(rel).toLowerCase() !== ".md") {
+    return { state: "not-indexable", rel, canAnswer: false, reason: `no language adapter covers ${extname(rel) || "a file with no extension"}, so the indexer never takes ${rel}` };
+  }
+  return { state: "stale", rel, canAnswer: false, reason: `${rel} is indexable but absent from the index: kj rag index --since auto` };
 }

package/src/review/card-first.js

@@ -93,6 +93,18 @@ export async function checkCardFirst({ config = {}, projectDir = process.cwd(),
         ? { ok: false, mode: "block", reason, level: v.level }
         : { ok: true, mode: "warn", reason, level: v.level };
     }
+    // KJC-TSK-0878 (issue #1371): "no he podido verificar" y "he verificado y
+    // esta mal" no son lo mismo, y ambas pueden merecer una parada. El proyecto
+    // decide si la primera para, y el mensaje dice cual de las dos es: un gate
+    // que aprueba lo que no ha comprobado da una confianza que no ha ganado.
+    // Sin adaptador declarado no hay nada que bloquear: la opcion no castiga a
+    // quien aun no tiene verify_cmd.
+    if (v.verified === null && config.board?.unverifiable === "block" && config.board?.verify_cmd) {
+      return {
+        ok: false, mode: "block", level: v.level,
+        reason: `branch references ${ref} but the card could not be verified against ${boardName} — ${v.note} (board.unverifiable: block refuses to approve a check kj did not make)`,
+      };
+    }
     return { ok: true, mode: "pass", ref, level: v.level, ...(v.note ? { note: v.note } : {}) };
   }
   const reason = `no card reference in branch "${branch}" — card-first on ${boardName}: create the card there and name the branch after it (e.g. feat/ABC-123-summary)`;

package/src/review/gate-gitignore.js

@@ -12,6 +12,8 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 
+import { runCommand } from "../utils/process.js";
+
 // KJC-BUG-0123 (issue #1268): exported as the SINGLE source of truth — kj
 // init and the orchestrator's autoInit write this same block instead of a
 // bare `.karajan/` exclude (which git cannot re-include children of).
@@ -48,6 +50,59 @@ export async function ensureContractBlockPresent(projectDir) {
   return { changed: true };
 }
 
+/**
+ * KJC-BUG-0213 (issue #1734): lo que kj deja en el repo durante una ejecucion
+ * es suyo y es local, asi que se excluye donde no molesta a nadie:
+ * `.git/info/exclude` no viaja con el repo ni aparece en el diff de otro.
+ * La ruta se pregunta a git para que funcione tambien en un worktree, donde
+ * `.git` es un fichero y no un directorio.
+ */
+const LOCAL_ARTIFACTS = [
+  ".reviews/", ".kj/", ".kj-ready.json",
+  // KJC-BUG-0220: lo que kj escribe DENTRO de .karajan/ y NO viaja. Sin esto
+  // se quedaba en tierra de nadie (ni versionado ni ignorado) y salia como `??`
+  // en cada git status del equipo. Se enumera en vez de ignorar .karajan/
+  // entero a proposito: kj.config.yml y las reglas del agente son del equipo, y
+  // esconderselas seria decidir por ellos. Los ficheros del supervisor viajan
+  // por su cauce sellado (ADR 0009) y tampoco entran aqui.
+  ".karajan/harness/",            // el arnes del anfitrion: cada maquina lo regenera
+  ".karajan/policy-decisions.jsonl",
+  ".karajan/policy-exceptions.jsonl",
+  ".karajan/identity.local.yml",  // identidad por clon (ADR 0005)
+  ".karajan/sentinel-state.json",
+  ".karajan/rag.db",
+  ".karajan/audit-history.db",
+  ".karajan/update-check.json",
+  ".karajan/karajan.env",
+  ".karajan/agent-skills/",
+  ".karajan/audits/",
+  ".karajan/reviews/",
+  ".karajan/steward/",
+  ".karajan/plans/",
+];
+
+export async function excludeLocalArtifacts(projectDir, run = runCommand) {
+  let file = path.join(projectDir, ".git", "info", "exclude");
+  try {
+    const res = await run("git", ["-C", projectDir, "rev-parse", "--git-path", "info/exclude"]);
+    const out = res?.stdout?.trim();
+    if (res?.exitCode === 0 && out) file = path.isAbsolute(out) ? out : path.join(projectDir, out);
+  } catch { /* sin git utilizable: se intenta la ruta por defecto */ }
+  let text = "";
+  try { text = (await fs.readFile(file, "utf8")) || ""; } catch { /* aun no existe */ }
+  const lines = new Set(text.split("\n").map((l) => l.trim()));
+  const missing = LOCAL_ARTIFACTS.filter((a) => !lines.has(a));
+  if (missing.length === 0) return { changed: false, added: [] };
+  try {
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    const sep = text && !text.endsWith("\n") ? "\n" : "";
+    await fs.appendFile(file, `${sep}# Karajan run artifacts (local only, never shared)\n${missing.join("\n")}\n`, "utf8");
+    return { changed: true, added: missing };
+  } catch {
+    return { changed: false, added: [] };
+  }
+}
+
 export async function ensureGateTrackable(projectDir) {
   const file = path.join(projectDir, ".gitignore");
   let text;

package/src/review/kj-provenance.js

@@ -0,0 +1,42 @@
+/**
+ * kj-provenance — KJC-BUG-0222. Un gate que dice QUE falla sin decir CONTRA QUE
+ * compara ensena a saltarselo. El aviso del harness decia "does not match the
+ * installed kj" y ahi acababa, asi que en campo se leyo como "kj se
+ * desincroniza solo": una sesion se monto el ritual de ejecutar `kj harden`
+ * antes de cada review y de cada commit, veinte veces en un dia, sin
+ * preguntarse por que. La causa estaba entera en el dato que faltaba: ese kj
+ * estaba npm-linkado a un arbol de desarrollo cuyas plantillas cambiaron seis
+ * veces en dos dias.
+ *
+ * Saltarse un gate ritualmente es peor que no tenerlo, porque parece que se
+ * cumple.
+ */
+import { createRequire } from "node:module";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+
+/**
+ * Que kj esta juzgando: version, de donde sale y si es un paquete instalado o
+ * un arbol de desarrollo enlazado. Nunca lanza: esto SOLO adorna un mensaje, y
+ * un fallo aqui jamas puede cambiar el veredicto de un gate.
+ *
+ * @returns {{version: string|null, root: string, linked: boolean, label: string}}
+ */
+export function kjProvenance(moduleDir = here) {
+  const root = resolve(moduleDir, "..", "..");
+  let version = null;
+  try {
+    version = createRequire(import.meta.url)(resolve(root, "package.json")).version || null;
+  } catch { /* sin manifest legible: se dice lo que se sabe */ }
+  // Un kj instalado vive bajo node_modules. Cualquier otra ruta es un arbol de
+  // trabajo enlazado (npm link), y entonces sus plantillas se mueven con cada
+  // edicion de quien lo desarrolla, en TODOS los proyectos de la maquina.
+  const linked = !root.includes(`${"node_modules"}/karajan-code`) && !root.endsWith("node_modules");
+  const v = version ? `kj ${version}` : "an unknown kj";
+  const label = linked
+    ? `${v} LINKED from ${root} (a development tree: its templates move with every edit there, in every project on this machine)`
+    : `${v} (${root})`;
+  return { version, root, linked, label };
+}

package/src/review/rag-ledger.js

@@ -9,7 +9,7 @@
  */
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
-import { verifySentinelScripts } from "../harden/sentinel-hooks.js";
+import { resolveSentinelRoot, verifySentinelScripts } from "../harden/sentinel-hooks.js";
 
 /**
  * @param {string} projectDir
@@ -22,10 +22,18 @@ import { verifySentinelScripts } from "../harden/sentinel-hooks.js";
  *   the requirement fails closed until the human re-runs `kj harden`.
  */
 export function readRagLedger(projectDir) {
-  const harnessDir = path.join(projectDir, ".karajan", "harness");
+  // KJC-BUG-0223: el harness vive en la RAIZ del proyecto. Este modulo miraba
+  // el directorio recibido (en la practica, process.cwd()) mientras el
+  // verificador resolvia el toplevel de git, asi que desde un subdirectorio los
+  // dos juzgaban sobre arboles distintos y el gate bloqueaba siempre.
+  const root = resolveSentinelRoot(projectDir);
+  const harnessDir = path.join(root, ".karajan", "harness");
   const harness = existsSync(harnessDir);
-  const check = harness ? verifySentinelScripts({ projectDir }) : { ok: false, mismatched: [] };
-  const base = { harness, verified: harness && check.ok === true, mismatched: check.mismatched || [], queries: [], hits: [] };
+  const check = harness ? verifySentinelScripts({ projectDir: root }) : { ok: false, mismatched: [] };
+  // KJC-BUG-0222: `drift` viaja hasta el mensaje. Un guard sellado que se ha
+  // quedado atras NO lo arregla `kj harden` (lo deja en paz a proposito), asi
+  // que mandar ese comando para ese fichero es un bucle.
+  const base = { root, harness, verified: harness && check.ok === true, mismatched: check.mismatched || [], drift: check.drift || [], queries: [], hits: [] };
   let state;
   try {
     state = JSON.parse(readFileSync(path.join(harnessDir, "sentinel-state.json"), "utf8"));

package/src/review/rag-requirement.js

@@ -12,6 +12,7 @@
  * concepts that are not in the diff. That list travels to the reviewer,
  * because the bugs of 2026-09-16 were exactly the twin nobody touched.
  */
+import { kjProvenance } from "./kj-provenance.js";
 import { sourceFilesOf } from "./tests-with-code.js";
 
 export const RAG_RULE_ID = "method.rag.code";
@@ -30,6 +31,17 @@ function liveGrant(standingExceptions, now) {
  * @param {{available: boolean, reason?: string, queries: object[], hits: string[]}} [args.ledger]
  * @returns {{ok: boolean, mode: "docs-only"|"pass"|"granted"|"block", reason?: string, grant?: object, sources?: string[], queries?: number, covered?: string[], uncovered?: string[], twinsUntouched?: string[]}}
  */
+/**
+ * KJC-BUG-0222 — el comando que resuelve ESTE estado. `kj harden` repone lo que
+ * nadie sello; un guard sellado que se ha quedado atras lo deja en paz a
+ * proposito (KJC-BUG-0193), y avanzarlo es acto humano.
+ */
+function harnessRemedy(drift = []) {
+  return drift.length > 0
+    ? `the human runs \`kj harden\` to restore them, and \`kj harden --commit\` for the sealed ones (${drift.join(", ")}), which \`kj harden\` leaves untouched on purpose`
+    : "the human runs `kj harden` to regenerate it";
+}
+
 export function checkRagRequirement({ config = {}, stagedFiles = [], newFiles = [], ledger, standingExceptions = [], now = new Date(), env = {} }) {
   const { sources } = sourceFilesOf(config, stagedFiles);
   if (sources.length === 0) return { ok: true, mode: "docs-only" };
@@ -55,7 +67,9 @@ export function checkRagRequirement({ config = {}, stagedFiles = [], newFiles =
   // than the ledger) cannot vouch for anything: fail closed, like the tamper
   // check does, until the human regenerates it.
   if (ledger?.harness === true && ledger?.verified === false) {
-    return { ok: false, mode: "block", sources, reason: `${head} — the Sentinel harness does not match the installed kj (${(ledger.mismatched || []).join(", ") || "scripts missing"}): the human runs \`kj harden\` to regenerate it before code is reviewed. ${GRANT_HINT}` };
+    // KJC-BUG-0222: decir CONTRA QUE no coincide. Sin ese dato el aviso se lee
+    // como "kj se desincroniza solo" y se automatiza el sintoma.
+    return { ok: false, mode: "block", sources, reason: `${head} — the installed Sentinel harness does not match the templates of ${kjProvenance().label} (${(ledger.mismatched || []).join(", ") || "scripts missing"}): ${harnessRemedy(ledger.drift)} before code is reviewed. ${GRANT_HINT}` };
   }
   if (!ledger?.available) {
     return { ok: false, mode: "block", sources, reason: `${head} — ${ledger?.reason || "no session ledger"}: consult the RAG about the change (kj_rag_query / kj rag query) and run \`kj review --staged\` again. ${GRANT_HINT}` };
@@ -82,7 +96,7 @@ export function checkRagRequirement({ config = {}, stagedFiles = [], newFiles =
  * block — the diff hash pins the file set, so a source missing from
  * `covered` was never answered about, whatever the block claims.
  */
-export function checkRagVerdict({ config = {}, stagedFiles = [], rag, harness = true, verified = true, mismatched = [], standingExceptions = [], now = new Date() }) {
+export function checkRagVerdict({ config = {}, stagedFiles = [], rag, harness = true, verified = true, mismatched = [], drift = [], standingExceptions = [], now = new Date() }) {
   const { sources } = sourceFilesOf(config, stagedFiles);
   if (sources.length === 0) return { ok: true, mode: "docs-only" };
   const grant = liveGrant(standingExceptions, now);
@@ -94,7 +108,7 @@ export function checkRagVerdict({ config = {}, stagedFiles = [], rag, harness =
     return { ok: false, mode: "block", sources, reason: `${head} — no Sentinel harness in this tree, so no session ledger can exist: install it with \`kj harden\`. ${GRANT_HINT}` };
   }
   if (!verified) {
-    return { ok: false, mode: "block", sources, reason: `${head} — the Sentinel harness does not match the installed kj (${mismatched.join(", ") || "scripts missing"}): the human runs \`kj harden\` to regenerate it. ${GRANT_HINT}` };
+    return { ok: false, mode: "block", sources, reason: `${head} — the installed Sentinel harness does not match the templates of ${kjProvenance().label} (${mismatched.join(", ") || "scripts missing"}): ${harnessRemedy(drift)}. ${GRANT_HINT}` };
   }
   if (!rag) {
     return { ok: false, mode: "block", sources, reason: `${head} — the verdict carries no rag block; run \`kj review --staged\` again. ${GRANT_HINT}` };

package/src/sonar/api.js

@@ -82,8 +82,17 @@ async function sonarFetch(config, urlPath) {
   );
 }
 
+/**
+ * KJC-BUG-0226 (issue #1838) — de donde sale la clave que se CONSULTA. El
+ * scanner sube el analisis con la que el repo declara en su
+ * sonar-project.properties; preguntando por otra (la derivada del remote), el
+ * audit acababa listando issues de repos ajenos del mismo SonarQube. Pasando
+ * el directorio, la resolucion lee esa misma clave declarada.
+ */
+const queryCwd = (config) => config?.projectDir || process.cwd();
+
 export async function getQualityGateStatus(config, projectKey = null) {
-  const effectiveProjectKey = await resolveSonarProjectKey(config, { projectKey });
+  const effectiveProjectKey = await resolveSonarProjectKey(config, { projectKey, cwd: queryCwd(config) });
   const body = await sonarFetch(config, `/api/qualitygates/project_status?projectKey=${effectiveProjectKey}`);
 
   try {
@@ -95,7 +104,7 @@ export async function getQualityGateStatus(config, projectKey = null) {
 }
 
 export async function getOpenIssues(config, projectKey = null) {
-  const effectiveProjectKey = await resolveSonarProjectKey(config, { projectKey });
+  const effectiveProjectKey = await resolveSonarProjectKey(config, { projectKey, cwd: queryCwd(config) });
   const body = await sonarFetch(config, `/api/issues/search?projectKeys=${effectiveProjectKey}&statuses=OPEN`);
 
   let parsedIssues = [];

package/src/sonar/project-key.js

@@ -1,4 +1,7 @@
 import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
 import { runCommand } from "../utils/process.js";
 
 function slug(value) {
@@ -55,6 +58,27 @@ function canonicalRepoId(remoteUrl) {
   return `${host}/${segments.join("/")}`;
 }
 
+/**
+ * KJC-BUG-0226 (issue #1838) — la clave que el REPO declara en su
+ * sonar-project.properties es la que el servidor conoce, porque es con la que
+ * el scanner sube el analisis. Sin leerla aqui, kj escaneaba un proyecto y
+ * preguntaba por otro (una clave derivada del remote), y el audit acababa
+ * listando issues de repos ajenos del mismo SonarQube.
+ *
+ * Sincrono y tolerante: sin fichero, ilegible o sin la clave, se sigue por
+ * donde se iba.
+ */
+function declaredProjectKey(cwd) {
+  try {
+    const raw = fs.readFileSync(path.join(cwd, "sonar-project.properties"), "utf8");
+    for (const line of raw.split("\n")) {
+      const m = /^\s*sonar\.projectKey\s*=\s*(.+?)\s*$/.exec(line);
+      if (m) return m[1];
+    }
+  } catch { /* sin properties legible: se deriva como siempre */ }
+  return null;
+}
+
 export async function resolveSonarProjectKey(config, options = {}) {
   const explicit = String(
     options.projectKey || process.env.KJ_SONAR_PROJECT_KEY || config?.sonarqube?.project_key || ""
@@ -63,6 +87,15 @@ export async function resolveSonarProjectKey(config, options = {}) {
     return normalizeProjectKey(explicit);
   }
 
+  // KJC-BUG-0226: lo que el repo declara manda sobre lo que kj derivaria, que
+  // es justo lo que el scanner ya hace al subir el analisis. Solo con un `cwd`
+  // explicito: quien no dice que directorio le importa se queda como estaba, y
+  // asi esto no cambia el comportamiento de nadie mas que el de la consulta.
+  if (options.cwd) {
+    const declared = declaredProjectKey(options.cwd);
+    if (declared) return normalizeProjectKey(declared);
+  }
+
   const remote = await runCommand("git", ["config", "--get", "remote.origin.url"]);
   const remoteUrl = String(remote.stdout || "").trim();
   if (remote.exitCode !== 0 || !remoteUrl) {

package/src/sonar/scanner.js

@@ -50,8 +50,38 @@ export function indexedFilesFrom(scanOutput) {
   return files;
 }
 
-export function buildScannerOpts(projectKey, scanner = {}) {
+/**
+ * KJC-BUG-0225 — `.git` es un fichero (no un directorio) en un worktree
+ * enlazado y en un submodulo: exactamente los dos casos que JGit no sabe abrir.
+ * Sin proceso y sin depender de que git responda.
+ */
+export function isLinkedWorktree(dir) {
+  try {
+    return fs.statSync(path.join(dir, ".git")).isFile();
+  } catch {
+    return false; // sin .git no hay SCM que desactivar
+  }
+}
+
+/**
+ * KJC-BUG-0225 (issue #1839) — dentro de un carril de `kj worktree start`, el
+ * plugin SCM del scanner (JGit) no sabe abrir un worktree enlazado (`.git` es
+ * un fichero que apunta a `.git/worktrees/<carril>`) y revienta el analisis
+ * entero. El pre-gate lo reportaba como "UNAVAILABLE" y la ejecucion seguia:
+ * todo cambio hecho como el metodo manda, un carril por tarea, se quedaba sin
+ * quality gate y sin un rojo que lo dijera.
+ *
+ * Se desactiva SOLO el SCM, que en un carril no aporta nada (alimenta blame y
+ * asignacion de autoria); las reglas, la cobertura y el resto del analisis se
+ * quedan exactamente igual.
+ *
+ * @param {string} projectKey
+ * @param {object} scanner  config del scanner (scm_disabled lo fuerza siempre)
+ * @param {{linkedWorktree?: boolean}} [where]
+ */
+export function buildScannerOpts(projectKey, scanner = {}, where = {}) {
   const opts = [`-Dsonar.projectKey=${projectKey}`];
+  if (scanner.scm_disabled || where.linkedWorktree) opts.push("-Dsonar.scm.disabled=true");
   // KJC-TSK-0838: verbose is what makes the scanner name every indexed file.
   if (scanner.verbose) opts.push("-Dsonar.verbose=true");
   if (scanner.sources) opts.push(`-Dsonar.sources=${scanner.sources}`);
@@ -317,11 +347,16 @@ export async function runSonarScan(config, projectKey = null, { verbose = false,
     : null;
 
   const pick = await pickSonarScanner(sonarConfig.scanner);
+  // KJC-BUG-0225: en un carril, el plugin SCM del scanner (JGit) no sabe abrir
+  // el worktree enlazado y tumba el analisis entero. La senal es la causa
+  // literal del error y no necesita proceso: en un worktree enlazado (y en un
+  // submodulo, que JGit trata igual) `.git` es un FICHERO, no un directorio.
+  const linkedWorktree = isLinkedWorktree(scanCwd);
   const env = {
     ...process.env,
     SONAR_HOST_URL: pick.type === "native" ? rawHost : host,
     SONAR_TOKEN: token || "",
-    SONAR_SCANNER_OPTS: buildScannerOpts(effectiveProjectKey, scannerConfig)
+    SONAR_SCANNER_OPTS: buildScannerOpts(effectiveProjectKey, scannerConfig, { linkedWorktree })
   };
 
   let cmd, args;