karajan-code 4.37.0 → 4.39.0

package/src/harden/sentinel-hooks.js

@@ -8,7 +8,7 @@
  * hooks, which is why the guaranteed level requires Claude as host (ADR).
  */
 
-import { readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { join } from "node:path";
@@ -28,8 +28,7 @@ export function resolveSentinelRoot(dir = process.cwd()) {
 
 const LIB_BODY = `// kj sentinel shared lib (KJC-TSK-0714) — managed by \`kj harden\`.
 // Single source for every sentinel script: state, branch, classification,
-// violations, and escape recording.
-import console from "node:console";
+// and violations.
 import { readFileSync, writeFileSync } from "node:fs";
 import { execSync, spawnSync } from "node:child_process";
 import { dirname, join } from "node:path";
@@ -81,8 +80,20 @@ export const bootstrapPhase = () => {
   try { execSync("git rev-parse --verify HEAD", { cwd: ROOT, stdio: ["ignore", "ignore", "ignore"] }); return false; }
   catch { return true; }
 };
-export const violations = (s, branch) => {
-  const v = pendingMoves(s).map(pendingText);
+// KJC-BUG-0198/0262: a card split across PRs is carried while another PR of it is
+// open. kj decides with that checkable fact, the same answer for commit and push
+// (the Stop gate still holds the turn: the board owes the move); when kj does not
+// answer, every pending move blocks.
+export const boardGate = (sid, pend) => {
+  if (!pend.length) return { blocking: [], carried: [] };
+  const bg = spawnSync("kj", ["sentinel", "board-gate", "--session", sid, "--json"], { cwd: ROOT, encoding: "utf8" });
+  if (!bg.error && (bg.status === 0 || bg.status === 2)) {
+    try { const d = JSON.parse(bg.stdout); return { blocking: d.blocking || [], carried: d.carried || [] }; } catch { /* unreadable: as always */ }
+  }
+  return { blocking: pend, carried: [] };
+};
+export const violations = (s, branch, pending = pendingMoves(s)) => {
+  const v = pending.map(pendingText);
   if (!s || !(s.edited_sources || []).length) return v;
   if (bootstrapPhase()) return v;
   if (BASE_BRANCHES.has(branch)) v.push("Fuentes editadas en la rama base '" + branch + "' — crea una rama: git checkout -b feat/<CARD-ID>-descripcion");
@@ -105,26 +116,6 @@ const sessionAddsCode = (s) => {
     return a === "-" || Number(a) > 0;
   });
 };
-export const recordEscape = (sid, escape, tool) => {
-  const state = load();
-  const s = session(state, sid);
-  s.at = Date.now();
-  if (!s.escapes.includes(escape)) s.escapes.push(escape);
-  (state.escape_events ||= []).push({ escape, tool, sid, ts: Date.now() });
-  save(state);
-  // GOV-F (KJC-TSK-0768): el escape es una excepcion consciente — entra en el
-  // decision log hash-encadenado (kj policy seal), no solo en este estado.
-  // Best-effort CON aviso: fail-closed aqui encerraria la sesion justo cuando
-  // kj no carga, que es cuando mas se usa el escape (restaurar con git).
-  try {
-    const args = ["policy", "seal", "--escape", escape];
-    if (tool) args.push("--tool", String(tool));
-    const r = spawnSync("kj", args, { cwd: ROOT, encoding: "utf8" });
-    if (r.error || r.status !== 0) console.error("karajan sentinel: escape " + escape + " usado pero NO sellado en el decision log (kj policy seal " + (r.error ? r.error.message : "exit " + r.status) + ") — revisa kj; el escape queda solo en sentinel-state.json" + doc("escapes"));
-  } catch (e) {
-    console.error("karajan sentinel: escape " + escape + " usado pero NO sellado en el decision log: " + e.message + doc("escapes"));
-  }
-};
 `;
 
 const POST_BODY = `#!/usr/bin/env node
@@ -136,7 +127,7 @@ import process from "node:process";
 import { relative } from "node:path";
 import { spawnSync } from "node:child_process";
 import { CODE, TESTS, ROOT, CARD, branchOf, load, save, session } from "./sentinel-lib.mjs";
-const ESCAPES = ["KJ_ALLOW_WRITE", "KJ_ALLOW_REWRITE", "KJ_ALLOW_NO_CARD", "KJ_ALLOW_NO_TESTS", "KJ_ALLOW_PII", "KJ_ALLOW_POLICY", "KJ_ALLOW_IDENTITY", "KJ_ALLOW_BOARD", "KJ_ALLOW_NO_RAG", "KJ_ALLOW_NO_VERIFY"];
+import { remindersFor } from "./sentinel-reminders.mjs";
 let raw = "";
 process.stdin.on("data", (d) => { raw += d; });
 process.stdin.on("end", () => {
@@ -273,6 +264,15 @@ process.stdin.on("end", () => {
       // "not found" counts as failure (KJC-BUG-0154): a move that moved nothing must not
       // clear a pending — that would discard a LEGITIMATE one without touching the tracker.
       if (moved && CLOSING.includes(moved[2].toLowerCase()) && !/error|fail|not found/i.test(text)) clearPending(moved[1].toUpperCase());
+      // KJC-TSK-0917 (ADR 0014): the method's reminders, after the action that precedes
+      // the one each rule is about; at most once every 25 Bash actions each. Never a block.
+      const st = load();
+      const ss = session(st, sid);
+      ss.step = (ss.step || 0) + 1;
+      const due = remindersFor(cmdText, { seen: ss.reminded || {}, step: ss.step });
+      for (const r of due) (ss.reminded ||= {})[r.id] = ss.step;
+      save(st);
+      if (due.length) process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PostToolUse", additionalContext: due.map((r) => r.say).join(" ") } }));
       process.exit(0);
     }
     const file = input.file_path || input.notebook_path;
@@ -283,11 +283,6 @@ process.stdin.on("end", () => {
     const rel = relative(ROOT, file).replaceAll("\\\\", "/");
     const bucket = TESTS.test(rel) ? s.edited_tests : CODE.test(rel) ? s.edited_sources : null;
     if (bucket && !bucket.includes(rel)) bucket.push(rel);
-    for (const e of ESCAPES)
-      if (process.env[e] === "1" && !s.escapes.includes(e)) {
-        s.escapes.push(e);
-        (state.escape_events ||= []).push({ escape: e, tool, sid, ts: Date.now() });
-      }
     // KJC-TSK-0910: the branch size while it is written, with the CI budget
     // (kj pr-size), said once per threshold crossed. Context, never a block.
     let sizeNote = null;
@@ -407,7 +402,6 @@ process.stdin.on("end", () => {
       s.blocks = 0;
       const notes = [];
       if (claimsNote) notes.push(claimsNote);
-      if ((s.escapes || []).length) notes.push("karajan sentinel: esta sesion uso " + s.escapes.length + " escape(s): " + s.escapes.join(", ") + " — decision registrada; detalle en kj sentinel status.");
       if ((s.closed_cards || []).length) {
         notes.push("karajan sentinel: card(s) cerrada(s) en este turno: " + s.closed_cards.join(", ") + " — el board las muestra: " + boardHint());
         s.closed_cards = [];
@@ -444,7 +438,11 @@ import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
-import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, branchOf, foreignLane, load, save, session, violations, recordEscape, pendingMoves, pendingText } from "./sentinel-lib.mjs";
+import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, branchOf, foreignLane, load, save, session, violations, boardGate, pendingMoves, pendingText } from "./sentinel-lib.mjs";
+// KJC-TSK-0915 (ADR 0014): the shell reader is a real, unit-tested module copied here as is.
+import { optionValues, shellSegments, stripInertQuotes, stripTextOptionValues } from "./sentinel-shell.mjs";
+import { DISCARD_VERBS, discardOf, foreignLost, removedFiles } from "./sentinel-discard.mjs";
+import { shellWrites, writesRepo } from "./sentinel-bash-write.mjs";
 const EDIT_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
 // KJC-BUG-0204: el comando real lleva flags EN MEDIO del verbo
 // (firebase --account a@b --project p deploy --only hosting:main), asi que la
@@ -463,6 +461,25 @@ process.stdin.on("data", (d) => { raw += d; });
 process.stdin.on("end", () => {
   try {
     const { session_id: sid = "default", tool_name: tool, tool_input: input = {}, transcript_path: transcript = null } = JSON.parse(raw);
+    // KJC-TSK-0920 (SNT-E): every deny ends with the same line, whatever gate it was.
+    process.on("exit", (code) => {
+      if (code === 2) console.error("karajan: Karajan gobierna y se le obedece. No rodees el gate ni cambies la politica para pasarlo; si te parece injusto, diselo a tu usuario o usa kj report-issue.");
+    });
+    // KJC-BUG-0238 (#1886): de quien es cada cambio. La primera vez que la
+    // sesion toca un fichero se anota si estaba limpio: solo entonces un
+    // descarte posterior pierde nada mas que lo de la sesion. Antes de
+    // cualquier escape; git que falla cuenta como sucio (fail-closed).
+    const noteFirstTouch = (relT) => {
+      const st = load();
+      const touch = (session(st, sid).first_touch ||= {});
+      // hasOwn + defineProperty: a file named __proto__ or toString is a path, not a prototype key.
+      if (Object.hasOwn(touch, relT)) return;
+      // --ignored: a user's ignored .env is theirs too (git clean -x deletes it).
+      const gs = spawnSync("git", ["-C", ROOT, "status", "--porcelain", "--ignored", "--", relT], { encoding: "utf8" });
+      const value = gs.status === 0 && String(gs.stdout).trim() === "" ? "clean" : "dirty";
+      Object.defineProperty(touch, relT, { value, enumerable: true, writable: true, configurable: true });
+      save(st);
+    };
     // Self-protection (KJC-TSK-0715) rules run BEFORE any escape, including
     // KJ_SENTINEL_OFF: the sentinel is not dismantled from inside a session —
     // only the human, editing outside it.
@@ -473,7 +490,16 @@ process.stdin.on("end", () => {
         console.error("karajan sentinel: ese fichero es parte del supervisor (" + relT + ") — solo el humano desmonta el sentinel, editalo fuera de la sesion." + doc("supervisor"));
         process.exit(2);
       }
+      // KJC-TSK-0920 (SNT-E): policies, gate settings and exclusions are the human's,
+      // like the supervisor: a session does not loosen the rules that govern it.
+      if ([".karajan/policy.yml", ".karajan/kj.config.yml", ".ragignore"].includes(relT) || relT.endsWith("/.ragignore")) {
+        console.error("karajan sentinel: " + relT + " es configuracion de gobierno (politicas, gates, exclusiones): la cambia tu usuario, no la sesion. Si un gate te parece injusto, proponselo a tu usuario o usa kj report-issue." + doc("governance"));
+        process.exit(2);
+      }
+      if (relT && !relT.startsWith("..") && !relT.startsWith("/")) noteFirstTouch(relT);
     }
+    // KJC-BUG-0261: rm / git rm is the session touching those files, noted before they go.
+    if (tool === "Bash") for (const words of shellSegments(String(input.command || ""))) for (const f of removedFiles(words, ROOT)) noteFirstTouch(f);
     // Any Bash that NAMES the supervisor's files is denied — a write-verb
     // blocklist is bypassable (cp, dd, one-liners), and reading them is what
     // the Read/Grep tools are for. Shell indirection (variables, globs,
@@ -496,8 +522,8 @@ process.stdin.on("end", () => {
       if (tool === "Bash" && /(^|[^a-zA-Z])gh([^a-zA-Z]|$)/.test(ghCmd) && /(^|[^a-z])(pr|issue|release)([^a-z]|$)/.test(ghCmd) && /(^|[^a-z])(create|edit|comment|review)([^a-z]|$)/.test(ghCmd)) {
         const attrib = /co-authored-by:.{0,120}(claude|gpt|copilot|gemini)|(generated|written|created) (by|with).{0,120}(claude|gpt|copilot|gemini|codex)|generated with [[]?claude|🤖/is;
         let corpus = ghCmd;
-        for (const m of ghCmd.matchAll(/--(?:body-file|notes-file|comment-file)[= ]+("([^"]+)"|'([^']+)'|([^ ]+))/g)) {
-          const bodyPath = m[2] || m[3] || m[4];
+        // KJC-BUG-0245: the shell reader ends the path at ; && | (a regex took "pr.md;").
+        for (const bodyPath of optionValues(ghCmd, ["--body-file", "--notes-file", "--comment-file"])) {
           try { corpus += "\\n" + readFileSync(bodyPath, "utf8"); } catch {
             console.error("karajan sentinel: no puedo leer " + bodyPath + " para el escaneo de atribucion — sin escaneo no se publica." + doc("attribution"));
             process.exit(2);
@@ -535,69 +561,34 @@ process.stdin.on("end", () => {
         process.exit(2);
       }
     }
+    // KJC-BUG-0238 (#1886): un agente no descarta cambios que no hizo. Sin
+    // escape y antes de KJ_SENTINEL_OFF: es perdida de datos del usuario, y
+    // guardarlo (git stash push) nunca pierde nada.
+    if (tool === "Bash") {
+      const cmdD = String(input.command || "");
+      // A git discard nested in $( ), <( ), backticks, eval, xargs or sh -c cannot be read: fail-closed.
+      const nested = ["$(", "<(", ">(", String.fromCharCode(96)].some((n) => cmdD.includes(n)) || /(^|[ ;&|])(eval|xargs|bash|sh|zsh|env)( |$)/.test(cmdD);
+      if (nested && /(^|[^a-z])git([^a-z]|$)/.test(cmdD) && DISCARD_VERBS.some((v) => cmdD.includes(v))) {
+        console.error("karajan sentinel: un descarte git dentro de $( ), backticks, eval, xargs o sh -c no es verificable — ejecutalo como comando simple." + doc("discard"));
+        process.exit(2);
+      }
+      const touch = load().sessions?.[sid]?.first_touch || {};
+      for (const words of shellSegments(cmdD)) {
+        const d = discardOf(words, ROOT);
+        const lost = d ? foreignLost(d, touch, ROOT) : [];
+        if (lost.length === 0) continue;
+        console.error(d.stash
+          ? "karajan sentinel: git stash drop/clear borra trabajo guardado que puede no ser de esta sesion — pideselo a tu usuario." + doc("discard")
+          : "karajan sentinel: ese comando descarta cambios que esta sesion no hizo (" + lost.slice(0, 5).join(", ") + (lost.length > 5 ? ", +" + (lost.length - 5) : "") + ") — pueden ser trabajo sin commitear de tu usuario. Si estorban, guardalos recuperables (git stash push -- <ficheros>) y avisale; si el cambio es tuyo sobre su trabajo, deshazlo con Edit. Sin escape: es perdida de datos." + doc("discard"));
+        process.exit(2);
+      }
+    }
     if (process.env.KJ_SENTINEL_OFF === "1") process.exit(0);
-    // KJC-BUG-0142: cada deny anuncia su escape como prefijo del comando
-    // (KJ_ALLOW_X=1 cmd), pero el hook corre con el env del HOST — el
-    // prefijo jamas llegaba a process.env y el escape era inalcanzable
-    // (deadlock real del gate de release: la landing solo se pone verde
-    // tras el deploy y el deploy estaba bloqueado por el mismo gate). Un
-    // escape es una excepcion CONSCIENTE y auditada, no un boundary de
-    // seguridad (security sigue sin escape y la autoprotecion corre antes),
-    // asi que el TEXTO del comando es fuente valida: solo asignaciones
-    // LITERALES al inicio (tokens VAR=VAL antes del primer verbo) y solo
-    // sobre un comando SIMPLE — con ;|& $() backtick o salto de linea el
-    // prefijo shell no alcanzaria a los comandos posteriores (catch de
-    // codex: "X=1 true && npm publish" escaparia sin serlo), asi que el
-    // escape por texto se rechaza y queda la via env de siempre.
+    // ADR 0015 (KJC-TSK-0927): no gate has an escape any more, so the command
+    // text is read only by the identity lock below.
     const CMD_TEXT = tool === "Bash" ? String(input.command || "") : "";
     const ESC_TAB = String.fromCharCode(9);
     const ESC_NL = String.fromCharCode(10);
-    const ESC_BT = String.fromCharCode(96);
-    const escOn = (name) => {
-      if (process.env[name] === "1") return true;
-      let found = false;
-      let i = 0;
-      while (i < CMD_TEXT.length) {
-        while (i < CMD_TEXT.length && (CMD_TEXT[i] === " " || CMD_TEXT[i] === ESC_TAB)) i += 1;
-        const start = i;
-        while (i < CMD_TEXT.length && CMD_TEXT[i] !== " " && CMD_TEXT[i] !== ESC_TAB && CMD_TEXT[i] !== ESC_NL) i += 1;
-        const tok = CMD_TEXT.slice(start, i);
-        const eq = tok.indexOf("=");
-        if (eq <= 0 || !/^[A-Z][A-Z0-9_]*$/.test(tok.slice(0, eq))) break;
-        if (tok === name + "=1") found = true;
-      }
-      if (!found) return false;
-      // KJC-BUG-0147: lo que va ENTRE COMILLAS no encadena comandos — un
-      // mensaje "fix(x): ... (KJC-TSK-1)" es un comando simple. Dentro de
-      // comillas dobles $ y backtick siguen expandiendo (se rechazan); en
-      // comillas simples todo es literal. Y si el escape esta pero se ignora,
-      // SE DICE: un escape ignorado en silencio era el bug.
-      const bad = escSimple();
-      if (bad === null) return true;
-      if (!escNoted.has(name)) {
-        escNoted.add(name);
-        console.error("karajan sentinel: " + name + "=1 presente pero IGNORADO — el escape solo vale en un comando simple y este contiene " + JSON.stringify(bad) + " fuera de comillas simples (sin ; | & $ ( ) backtick ni salto de linea: parte el comando o usa -F fichero)" + doc("escapes"));
-      }
-      return false;
-    };
-    const escNoted = new Set();
-    const escSimple = () => {
-      let q = null;
-      for (let i = 0; i < CMD_TEXT.length; i += 1) {
-        const c = CMD_TEXT[i];
-        if (q === "'") { if (c === "'") q = null; continue; }
-        if (q === '"') {
-          if (c === '"') q = null;
-          else if (c === "$" || c === ESC_BT) return c;
-          else if (c === "\\\\") i += 1;
-          continue;
-        }
-        if (c === "\\\\") { i += 1; continue; }
-        if (c === "'" || c === '"') { q = c; continue; }
-        if (c === ";" || c === "|" || c === "&" || c === ESC_NL || c === ESC_BT || c === "$" || c === "(" || c === ")") return c;
-      }
-      return q === null ? null : "comilla sin cerrar";
-    };
     // IDN-B (KJC-TSK-0763, ADR 0005): identity lock — gh and mutating git never
     // run under an account other than the one THIS CLONE declared (the incident:
     // a gh comment without switch went out as the client account). Deny BEFORE
@@ -693,11 +684,8 @@ process.stdin.on("end", () => {
       };
       scan(CMD_TEXT, 0);
       if (problems.length > 0) {
-        if (escOn("KJ_ALLOW_IDENTITY")) { recordEscape(sid, "KJ_ALLOW_IDENTITY", tool); }
-        else {
-          console.error("karajan sentinel: identity lock (ADR 0005) —" + problems.map((p) => ESC_NL + "- " + p).join("") + ESC_NL + "(KJ_ALLOW_IDENTITY=1 = excepcion consciente, queda registrada)" + doc("identity"));
-          process.exit(2);
-        }
+        console.error("karajan sentinel: identity lock (ADR 0005) —" + problems.map((p) => ESC_NL + "- " + p).join("") + ESC_NL + "(sin escape, ADR 0015: pon la cuenta en el comando)" + doc("identity"));
+        process.exit(2);
       }
     }
     // MONO-0 (KJC-TSK-0737, ADR 0002): cada sesion muta solo SU worktree;
@@ -717,8 +705,7 @@ process.stdin.on("end", () => {
       return d ? foreignLane(d) : null;
     };
     const laneDeny = (what, lane) => {
-      if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); return false; }
-      console.error("karajan sentinel: " + what + " vive en otro carril (" + lane + ") de este repo — cada sesion muta solo SU worktree (MONO-0). Cruce deliberado: KJ_ALLOW_CROSS_LANE=1, queda registrado." + doc("cross-lane"));
+      console.error("karajan sentinel: " + what + " vive en otro carril (" + lane + ") de este repo — cada sesion muta solo SU worktree (MONO-0). Sin escape (ADR 0015): un cruce deliberado lo hace tu usuario en su terminal." + doc("cross-lane"));
       return true;
     };
     if (EDIT_TOOLS.includes(tool)) {
@@ -747,18 +734,16 @@ process.stdin.on("end", () => {
       // (find fuera: -delete/-exec mutan — reviewer catch; sus tokens de
       // carril los caza el escaner de abajo.)
       const READONLY = /^[ \\t]*(grep|rg|cat|head|tail|less|ls|wc|diff|stat|file|du|tree|git (log|show|diff|status|blame))\\b[^;|&<>$\`(){}\\n\\r]*$/;
-      if (!READONLY.test(cmd)) {
+      // KJC-BUG-0243: operators inside inert quotes (grep -e "a|b") do not chain anything.
+      if (!READONLY.test(stripInertQuotes(cmd))) {
         // cd/pushd invalida TODO razonamiento textual de rutas posteriores
         // (carrera de bypasses confirmada en review: destino bare, con $,
         // relativas post-cd...): en un comando NO-read-only, cambiar de
         // directorio se deniega conservadoramente — el remedio es no
         // necesitarlo (git -C, npm --prefix, rutas absolutas).
         if (/(^|[;&|(\\s])(cd|pushd)([ \\t]|$)/.test(cmd)) {
-          if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); }
-          else {
-            console.error("karajan sentinel: cd/pushd en un comando mutador — las rutas posteriores no son verificables por el guard de carriles (MONO-0); usa git -C / npm --prefix / rutas ABSOLUTAS sin cd (o KJ_ALLOW_CROSS_LANE=1, queda registrado)." + doc("cross-lane"));
-            process.exit(2);
-          }
+          console.error("karajan sentinel: cd/pushd en un comando mutador — las rutas posteriores no son verificables por el guard de carriles (MONO-0); usa git -C / npm --prefix / rutas ABSOLUTAS sin cd." + doc("cross-lane"));
+          process.exit(2);
         }
         // Absolute AND dot-relative tokens (../lane escapaba al primer scan —
         // reviewer catch); relative se resuelve contra el cwd de la sesion.
@@ -773,11 +758,8 @@ process.stdin.on("end", () => {
         // de tokens de abajo; el residuo (expansion anidada en segmentos
         // runner) queda documentado como en la regla de ficheros PROTECTED.
         if (/>{1,2}[ \\t]*["']?[$\`]/.test(cmd)) {
-          if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); }
-          else {
-            console.error("karajan sentinel: redireccion con destino tras variable/sustitucion — el guard de carriles no puede verificarlo (MONO-0); usa una ruta LITERAL (o KJ_ALLOW_CROSS_LANE=1, queda registrado)." + doc("cross-lane"));
-            process.exit(2);
-          }
+          console.error("karajan sentinel: redireccion con destino tras variable/sustitucion — el guard de carriles no puede verificarlo (MONO-0); usa una ruta LITERAL." + doc("cross-lane"));
+          process.exit(2);
         }
         // Sustitucion de comandos ($(...) o backticks) EJECUTA su contenido
         // en cualquier posicion, y una ruta entrecomillada con espacios es
@@ -838,21 +820,17 @@ process.stdin.on("end", () => {
           if (q !== null) return true; // comilla sin cerrar: no verificable
           return flush();
         };
-        if (/\\$\\(|\`/.test(cmd) || quotedPathWithSpaces(cmd)) {
-          if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); }
-          else {
-            console.error("karajan sentinel: sustitucion de comandos o ruta entrecomillada con espacios en un comando mutador — no verificable por el guard de carriles (MONO-0); usa valores/rutas LITERALES sin sustitucion (o KJ_ALLOW_CROSS_LANE=1, queda registrado)." + doc("cross-lane"));
-            process.exit(2);
-          }
+        // KJC-BUG-0243: inert quoted text is not a substitution, and the prose value
+        // of a text option (--title, -m...) is not a path.
+        if (/\\$\\(|\`/.test(stripInertQuotes(cmd)) || quotedPathWithSpaces(stripTextOptionValues(cmd))) {
+          console.error("karajan sentinel: sustitucion de comandos o ruta entrecomillada con espacios en un comando mutador — no verificable por el guard de carriles (MONO-0); usa valores/rutas LITERALES sin sustitucion." + doc("cross-lane"));
+          process.exit(2);
         }
         const SAFE_EXP_SEG = /^([A-Za-z_][A-Za-z0-9_]*=[^ \\t]*[ \\t]*)*((npm|pnpm|yarn|vitest|jest|kj|gh|echo|printf|true|test)\\b|git[ \\t](?![^\\n]*(-C[ \\t]|--git-dir|--work-tree)))[^;|&\\n]*$|^[A-Za-z_][A-Za-z0-9_]*=[^;|&\\n]*$/;
         const segs = cmd.split(/&&|\\|\\||[;|\\n]/).map((s) => s.trim()).filter(Boolean);
         if (!segs.every((s) => !/[$]/.test(s) || SAFE_EXP_SEG.test(s))) {
-          if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); }
-          else {
-            console.error("karajan sentinel: expansion de shell en una herramienta generica de fichero/interprete — el objetivo no es verificable por el guard de carriles (MONO-0); usa rutas LITERALES o un runner del toolchain (o KJ_ALLOW_CROSS_LANE=1, queda registrado)." + doc("cross-lane"));
-            process.exit(2);
-          }
+          console.error("karajan sentinel: expansion de shell en una herramienta generica de fichero/interprete — el objetivo no es verificable por el guard de carriles (MONO-0); usa rutas LITERALES o un runner del toolchain." + doc("cross-lane"));
+          process.exit(2);
         }
         // ...incluidas relativas A PELO (los carriles kj viven en
         // .kj/worktrees/). Un falso token (s/a/b/) resuelve al arbol propio
@@ -868,6 +846,21 @@ process.stdin.on("end", () => {
         }
       }
     }
+    // KJC-BUG-0237 (#1886): the repo is written through Edit/Write only, the path every gate
+    // guards. After the lane guard, whose message is the precise one for another lane.
+    if (tool === "Bash") {
+      let moved = false; // after cd/pushd/popd, a relative target cannot be placed: fail-closed
+      // $( ) and backticks run even inside double quotes: their bodies, read from the raw text, are commands too.
+      const raw = String(input.command || "");
+      const subs = [...[...raw.matchAll(/[$][(]([^()]*)[)]/g)].map((m) => m[1]), ...raw.split(String.fromCharCode(96)).filter((_, k) => k % 2 === 1)];
+      for (const words of [...shellSegments(raw), ...subs.flatMap((s) => shellSegments(s))]) {
+        if (["cd", "pushd", "popd"].includes(words[0])) moved = true;
+        const inRepo = shellWrites(words).filter((t) => writesRepo(t, ROOT) || (moved && !t.startsWith("/")));
+        if (inRepo.length === 0) continue;
+        console.error("karajan sentinel: escribir ficheros del repo desde Bash (" + inRepo.slice(0, 3).join(", ") + ") se salta los gates de Edit/Write — usa la tool Edit/Write; para renombrar, git mv; fuera del repo (/tmp, scratchpad) Bash es libre." + doc("bash-write"));
+        process.exit(2);
+      }
+    }
     // KJC-TSK-0734 (PL-B): con .karajan/policy.yml presente, la evaluacion
     // la hace el MOTOR via kj policy eval --strict (exit 2 = deny, contrato
     // PL-A); los defaults del supervisor viven en el motor y el check
@@ -875,8 +868,8 @@ process.stdin.on("end", () => {
     // Fail CLOSED por defecto (catches de codex; doctrina KJC-BUG-0095: un
     // gate no se cae en silencio): solo exit 0 permite. kj inejecutable =
     // deny duro (el remedio es restaurar kj); cualquier otro fallo de
-    // evaluacion = deny con escape humano registrable — la sesion no queda
-    // presa de un typo de YAML, pero abrirla es decision del usuario.
+    // evaluacion = deny sin escape (ADR 0015): un typo de YAML lo corrige el
+    // usuario fuera de la sesion.
     if ((EDIT_TOOLS.includes(tool) || tool === "Bash") && existsSync(resolve(ROOT, ".karajan", "policy.yml"))) {
       // PL-C: el rol que ACTÚA (KJ_POLICY_ROLE, sembrado por los runners de
       // kj run en los subprocesos) — el anfitrión-brain evalúa como coder.
@@ -890,11 +883,9 @@ process.stdin.on("end", () => {
         let v = null;
         try { v = JSON.parse(String(pres.stdout || "").trim().split("\\n").pop()); } catch { /* mensaje generico */ }
         const secure = !!(v && v.class === "security");
-        if (!secure && escOn("KJ_ALLOW_POLICY")) { recordEscape(sid, "KJ_ALLOW_POLICY", tool); }
-        else {
-          console.error("karajan sentinel: policy deny [" + ((v && v.rule_id) || "policy") + "] " + ((v && v.reason) || "la tool call viola la policy del proyecto") + (secure ? " [security — sin escape ni arbitraje]" : " (KJ_ALLOW_POLICY=1 = excepcion consciente, queda registrada; el commit exigira ademas KJ_POLICY_REASON)") + doc("policy"));
-          process.exit(2);
-        }
+        // ADR 0015 (KJC-TSK-0932): no escape; a rule that misfires is fixed by PR.
+        console.error("karajan sentinel: policy deny [" + ((v && v.rule_id) || "policy") + "] " + ((v && v.reason) || "la tool call viola la policy del proyecto") + (secure ? " [security — sin escape ni arbitraje]" : " (sin escape: si la regla falla, tu usuario corrige .karajan/policy.yml por PR)") + doc("policy"));
+        process.exit(2);
       } else if (pres.status !== 0) {
         // KJC-BUG-0207: un kj que NO ARRANCA no es una violacion de policy. Con
         // kj linkado al arbol, un error de sintaxis transitorio en src/ dejaba
@@ -919,9 +910,8 @@ process.stdin.on("end", () => {
             console.error("karajan sentinel: kj no arranca (" + broken[0] + (at ? " en " + at : "") + "), asi que la policy no se puede evaluar y NADA MAS pasa: edita " + (brokenFile || "el fichero que rompe kj") + " para arreglarlo. No es un deny de policy, es kj roto." + doc("policy"));
             process.exit(2);
           }
-        } else if (escOn("KJ_ALLOW_POLICY")) { recordEscape(sid, "KJ_ALLOW_POLICY", tool); }
-        else {
-          console.error("karajan sentinel: kj policy eval fallo (exit " + pres.status + ") — la policy declarada no se pudo evaluar, deny por defecto; diagnostica con kj policy check y corrige .karajan/policy.yml fuera de la sesion (o KJ_ALLOW_POLICY=1 = excepcion consciente, queda registrada)." + doc("policy"));
+        } else {
+          console.error("karajan sentinel: kj policy eval fallo (exit " + pres.status + ") — la policy declarada no se pudo evaluar, deny por defecto; diagnostica con kj policy check; .karajan/policy.yml lo corrige tu usuario fuera de la sesion." + doc("policy"));
           process.exit(2);
         }
       }
@@ -942,11 +932,8 @@ process.stdin.on("end", () => {
           let blockOn = false;
           try { blockOn = /steward:\\s*["']?block/.test(readFileSync(join(ROOT, ".karajan", "kj.config.yml"), "utf8")); } catch { /* no config — no block */ }
           if (hard.length && blockOn) {
-            if (escOn("KJ_ALLOW_STEWARD")) { recordEscape(sid, "KJ_ALLOW_STEWARD", tool); }
-            else {
-              console.error("karajan sentinel: steward — el estado del proyecto bloquea empezar (barrido " + rep.sweptAt + "):" + String.fromCharCode(10) + hard.map((r) => "- " + r.id + ": " + (r.evidence || "") + " -> " + (r.remedy || r.renew || "kj steward sweep")).join(String.fromCharCode(10)) + String.fromCharCode(10) + "(KJ_ALLOW_STEWARD=1 = excepcion consciente de esta sesion, queda registrada)" + doc("steward"));
-              process.exit(2);
-            }
+            console.error("karajan sentinel: steward — el estado del proyecto bloquea empezar (barrido " + rep.sweptAt + "):" + String.fromCharCode(10) + hard.map((r) => "- " + r.id + ": " + (r.evidence || "") + " -> " + (r.remedy || r.renew || "kj steward sweep")).join(String.fromCharCode(10)) + String.fromCharCode(10) + "(sin escape, ADR 0015: si el trabajo sigue, tu usuario cambia method_gates.steward a inform)" + doc("steward"));
+            process.exit(2);
           }
           const st = load();
           const s = session(st, sid);
@@ -963,11 +950,11 @@ process.stdin.on("end", () => {
       if (rel && CODE.test(rel) && !TESTS.test(rel)) {
         const branch = branchOf();
         const why = !branch ? null : BASE_BRANCHES.has(branch) ? "base" : !CARD.test(branch) ? "nocard" : null;
+        // ADR 0015 (KJC-TSK-0925): no escape. Without a card there is no work.
         if (why) {
-          if (escOn("KJ_ALLOW_NO_CARD")) { recordEscape(sid, "KJ_ALLOW_NO_CARD", tool); process.exit(0); }
           console.error(why === "base"
-            ? "karajan sentinel: no se editan fuentes en la rama base '" + branch + "' — crea la card (kj hu add) y la rama: git checkout -b feat/<CARD-ID>-descripcion. (KJ_ALLOW_NO_CARD=1 = excepcion consciente, queda registrada)" + doc("card-first")
-            : "karajan sentinel: la rama '" + branch + "' no referencia ninguna card — crea/mueve la card a running (kj hu add | kj hu move) y usa una rama feat/<CARD-ID>-descripcion. (KJ_ALLOW_NO_CARD=1 = excepcion consciente, queda registrada)" + doc("card-first"));
+            ? "karajan sentinel: no se editan fuentes en la rama base '" + branch + "' — crea la card (kj hu add) y la rama: git checkout -b feat/<CARD-ID>-descripcion." + doc("card-first")
+            : "karajan sentinel: la rama '" + branch + "' no referencia ninguna card — crea/mueve la card a running (kj hu add | kj hu move) y usa una rama feat/<CARD-ID>-descripcion." + doc("card-first"));
           process.exit(2);
         }
         // KJC-TSK-0848 (ADR 0010, RAG-B): the RAG must have answered about this
@@ -990,15 +977,14 @@ process.stdin.on("end", () => {
         // KJC-BUG-0190: with nothing indexed, no query can cover anything —
         // the gate asks for kj rag index instead of denying the impossible.
         const covered = rel.startsWith("..") || hits.includes(rel) || hits.some((h) => dirOf(h) === dirOf(rel)) || ((rs.rag_queries || []).length > 0 && fresh()) || rs.rag_index_empty === true;
+        // ADR 0015 (KJC-TSK-0925): no escape. The cases it covered (new file, empty
+        // index, not indexable) are decided by the gate itself.
         if (!covered) {
-          if (escOn("KJ_ALLOW_NO_RAG")) {
-            // Recorded ONCE per session: the escape is a conscious exception, not a per-edit tax.
-            if (!(rs.escapes || []).includes("KJ_ALLOW_NO_RAG")) recordEscape(sid, "KJ_ALLOW_NO_RAG", tool);
-          } else {
+          {
             // KJC-BUG-0216 (issue #1807): un .astro, un .php o cualquier fichero
             // sin adapter NO puede estar en el indice, asi que exigir una
             // respuesta del RAG sobre el es pedir lo imposible, y empujaba a
-            // dejar KJ_ALLOW_NO_RAG puesta para siempre. La exencion es SOLO
+            // dejar el escape puesto para siempre. La exencion es SOLO
             // esa: un indice vacio o por detras si tiene arreglo (kj rag index)
             // y sigue bloqueando, porque si no el gate desapareceria en
             // cualquier proyecto sin indexar. Nada legible = se bloquea.
@@ -1018,7 +1004,7 @@ process.stdin.on("end", () => {
               console.error("karajan sentinel: rag-first — el indice aun no tiene " + rel + " (" + absent + "); indexalo y consulta despues: kj_rag_query / kj rag query <que hace " + rel + ">" + doc("rag-first"));
               process.exit(2);
             } else {
-              console.error("karajan sentinel: rag-first — el RAG no ha respondido sobre " + rel + " en esta sesion; consulta antes de tocarlo: kj_rag_query / kj rag query <que hace " + rel + " y donde mas vive ese concepto>. (KJ_ALLOW_NO_RAG=1 = excepcion consciente, queda registrada)" + doc("rag-first"));
+              console.error("karajan sentinel: rag-first — el RAG no ha respondido sobre " + rel + " en esta sesion; consulta antes de tocarlo: kj_rag_query / kj rag query <que hace " + rel + " y donde mas vive ese concepto>." + doc("rag-first"));
               process.exit(2);
             }
           }
@@ -1053,11 +1039,10 @@ process.stdin.on("end", () => {
       // depender de como parta las palabras el separador (catch de la review).
       const movesHooks = cmd.toLowerCase().includes("core.hookspath");
       if ((inOrder(["git", "commit"], words) && words.some(skipsVerify)) || movesHooks) {
-        if (escOn("KJ_ALLOW_NO_VERIFY")) { recordEscape(sid, "KJ_ALLOW_NO_VERIFY", tool); }
-        else {
-          console.error("karajan sentinel: el gate de commit no se apaga con una bandera — el review cruzado y la policy corren en el hook, y saltarselos deja el diff sin veredicto. Si el hook esta roto, arreglalo; si de verdad hace falta, es una decision de tu usuario. (KJ_ALLOW_NO_VERIFY=1 = excepcion consciente, queda registrada)" + doc("escapes"));
-          process.exit(2);
-        }
+        // ADR 0015 (KJC-TSK-0926): no escape. A broken hook is fixed; skipping it,
+        // if it ever must happen, is the user's act in their own terminal.
+        console.error("karajan sentinel: el gate de commit no se apaga con una bandera — el review cruzado y la policy corren en el hook, y saltarselos deja el diff sin veredicto. Si el hook esta roto, arreglalo; si de verdad hace falta saltarlo, lo hace tu usuario en su terminal." + doc("escapes"));
+        process.exit(2);
       }
       const MERGE = /\\bgh\\s+pr\\s+merge(\\s+(\\d+))?/;
       const ADVANCE = /\\bgit\\s+commit\\b|\\bgit\\s+push\\b|\\bgh\\s+pr\\s+create\\b/; // push also falls under violations() — explicit here too (review catch)
@@ -1065,20 +1050,14 @@ process.stdin.on("end", () => {
       const pend = pendingMoves(load().sessions?.[sid]);
       if (pend.length > 0 && (mergeM || ADVANCE.test(cmd))) {
         // KJC-BUG-0198: una card partida en varias PRs no puede quedar bloqueada
-        // por su primera mitad. kj decide con un hecho comprobable (otra PR
-        // abierta de la card); si kj no responde, se bloquea como siempre.
-        const bg = spawnSync("kj", ["sentinel", "board-gate", "--session", sid, "--json"], { cwd: ROOT, encoding: "utf8" });
-        let blocking = pend, carried = [];
-        if (!bg.error && (bg.status === 0 || bg.status === 2)) {
-          try { const d = JSON.parse(bg.stdout); blocking = d.blocking || []; carried = d.carried || []; } catch { /* sin respuesta legible: como siempre */ }
-        }
+        // por su primera mitad (boardGate, en la lib).
+        const { blocking, carried } = boardGate(sid, pend);
         for (const c of carried) console.error("karajan sentinel: board-sync arrastra " + c.card + " — " + c.why + ", se movera al cerrarla");
+        // ADR 0015 (KJC-TSK-0925): no escape; an epic and a card split across PRs
+        // are already decided above (KJC-BUG-0230, 0198).
         if (blocking.length > 0) {
-          if (escOn("KJ_ALLOW_BOARD")) { recordEscape(sid, "KJ_ALLOW_BOARD", tool); }
-          else {
-            console.error("karajan sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + blocking.map((p) => "- " + pendingText(p)).join("\\n") + "\\n(KJ_ALLOW_BOARD=1 = excepcion consciente, queda registrada)" + doc("board-sync"));
-            process.exit(2);
-          }
+          console.error("karajan sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + blocking.map((p) => "- " + pendingText(p)).join("\\n") + doc("board-sync"));
+          process.exit(2);
         }
       }
       // (the pending entry itself is recorded by the PostToolUse hook, only once
@@ -1087,9 +1066,9 @@ process.stdin.on("end", () => {
       // there misleads every future reader. When the command writes one from a
       // file, kj crosses ITS data against this turn's outputs; the hook carries
       // no policy (kj reads method_gates.claims; off = this check does not exist).
-      const bodyFile = /\\bgh\\s+pr\\s+(?:create|edit)\\b/.test(cmd) ? /--body-file[= ]+("([^"]+)"|'([^']+)'|([^\\s"']+))/.exec(cmd) : null;
-      if (bodyFile && transcript) {
-        const body = bodyFile[2] || bodyFile[3] || bodyFile[4];
+      // KJC-BUG-0245: the path is read by the shell reader, so "pr.md;" is "pr.md".
+      const body = /\\bgh\\s+pr\\s+(?:create|edit)\\b/.test(cmd) ? optionValues(cmd, ["--body-file"])[0] : undefined;
+      if (body && transcript) {
         const g = spawnSync("kj", ["claims", "gate", "--transcript", transcript, "--file", body], { cwd: ROOT, encoding: "utf8" });
         if (!g.error && g.status === 2) {
           console.error("karajan sentinel: claims — un dato del cuerpo de la PR esta DESMENTIDO por las salidas de este turno:\\n" + (g.stderr || "").trim() + "\\nVerificalo o marcalo como no comprobado antes de crear la PR. Detalle: kj claims check --transcript " + transcript + " --file " + body + doc("claims"));
@@ -1097,7 +1076,8 @@ process.stdin.on("end", () => {
         }
       }
       if (isPublish(cmd)) {
-        if (escOn("KJ_ALLOW_RELEASE")) { recordEscape(sid, "KJ_ALLOW_RELEASE", tool); process.exit(0); }
+        // ADR 0015 (KJC-TSK-0932): no escape — KJC-BUG-0204 and 0259 keep the
+        // check from blocking its own fix.
         // KJC-BUG-0204: el check se evalua PARA este comando. Un item que
         // declara remedied_by no bloquea el comando que lo repara (desplegar
         // la landing era justo lo que el check pedia); publicar no se exime.
@@ -1114,19 +1094,15 @@ process.stdin.on("end", () => {
         if (res.status !== 0) {
           let items = "";
           try { items = (parsed.checks || []).filter((c) => !c.ok && c.lifted !== true).map((c) => "\\n- " + c.name + ": " + c.detail).join(""); } catch { /* raw output */ }
-          console.error("karajan sentinel: release check en ROJO — no se publica ni despliega hasta resolverlo:" + (items || "\\n- corre kj release check para el detalle") + "\\n(KJ_ALLOW_RELEASE=1 = excepcion consciente, queda registrada)" + doc("release"));
+          console.error("karajan sentinel: release check en ROJO — no se publica ni despliega hasta resolverlo:" + (items || "\\n- corre kj release check para el detalle") + "\\n(sin escape: se repara lo que el check nombra)" + doc("release"));
           process.exit(2);
         }
       } else if (PUSH.test(cmd)) {
-        // KJC-BUG-0147: the board escape covers the push too — a pending move
-        // blocks the push like it blocks the commit, and the SAME conscious,
-        // recorded escape opens both (multi-PR cards are a legitimate plan).
+        // KJC-BUG-0147: a pending move blocks the push like it blocks the commit.
+        // ADR 0015 (KJC-TSK-0925): with no escape.
+        // KJC-BUG-0262: a carried card does not block the push the commit let through.
         const sess = load().sessions?.[sid];
-        let v = violations(sess, branchOf());
-        if (v.length && pendingMoves(sess).length && escOn("KJ_ALLOW_BOARD")) {
-          recordEscape(sid, "KJ_ALLOW_BOARD", tool);
-          v = violations({ ...sess, pending_moves: [] }, branchOf());
-        }
+        const v = violations(sess, branchOf(), boardGate(sid, pendingMoves(sess)).blocking);
         if (v.length) {
           console.error("karajan sentinel: git push con el metodo en rojo:\\n" + v.map((x) => "- " + x).join("\\n") + "\\nResuelve antes de empujar. Estado: kj sentinel status" + doc("push-gate"));
           process.exit(2);
@@ -1143,6 +1119,14 @@ const SCRIPT_BODIES = {
   "posttooluse.mjs": POST_BODY,
   "stop.mjs": STOP_BODY,
   "pretooluse-sentinel.mjs": PRETOOL_BODY,
+  // KJC-TSK-0915 (ADR 0014): real modules, copied byte for byte under the SAME name
+  // (so they can import each other in both places). Being here, the installed
+  // record, the tamper check and the human seal cover them as well.
+  "sentinel-shell.mjs": readFileSync(new URL("./sentinel/sentinel-shell.mjs", import.meta.url), "utf8"),
+  "sentinel-discard.mjs": readFileSync(new URL("./sentinel/sentinel-discard.mjs", import.meta.url), "utf8"),
+  "sentinel-bash-write.mjs": readFileSync(new URL("./sentinel/sentinel-bash-write.mjs", import.meta.url), "utf8"),
+  "sentinel-reminders.mjs": readFileSync(new URL("./sentinel/sentinel-reminders.mjs", import.meta.url), "utf8"),
+  "sessionstart.mjs": readFileSync(new URL("./sentinel/sessionstart.mjs", import.meta.url), "utf8"),
 };
 
 /**
@@ -1246,6 +1230,7 @@ export function verifySentinelScripts({ projectDir, readFileFn = readFileSync, g
   // first attempt at this fix, and the review was right to reject it.
   const sealed = sealedByPath(root, gitShowFn);
   const ownRecord = readInstalledRecord(dir);
+  const hasRecord = existsSync(join(dir, INSTALLED_RECORD));
   const drift = [];
   const tampered = [];
   const regenerated = [];
@@ -1254,6 +1239,10 @@ export function verifySentinelScripts({ projectDir, readFileFn = readFileSync, g
     const hash = text === undefined ? null : sha256(text);
     if (hash && sealed.get(`.karajan/harness/${name}`) === hash) drift.push(name);
     else if (hash && ownRecord[name] === hash) regenerated.push(name);
+    // KJC-TSK-0915: absent from an install kj RECORDED (installed.json exists), never
+    // recorded and never sealed = a guard newer than this install, not a deleted
+    // one. Writing it only adds. A dir with no record is not a kj install at all.
+    else if (!hash && hasRecord && !Object.hasOwn(ownRecord, name) && !sealed.has(`.karajan/harness/${name}`)) regenerated.push(name);
     else tampered.push(name);
   }
   // KJC-BUG-0224 caso 1: lo que kj escribio y nadie sello ni toco se pone al
@@ -1333,7 +1322,13 @@ export function installSentinelHooks({ projectDir = process.cwd(), logger = cons
       // edit matchers wired, the board-sync recorder never ran in production.
       { event: "PostToolUse", matcher: "Bash", script: "posttooluse.mjs" },
       { event: "PostToolUse", matcher: "mcp__.*__update_card", script: "posttooluse.mjs" },
+      // KJC-BUG-0236 (#1886): the rag-first ledger records MCP answers here;
+      // unwired, the official tool never satisfied the gate.
+      { event: "PostToolUse", matcher: "mcp__.*__kj_rag_query", script: "posttooluse.mjs" },
       { event: "Stop", script: "stop.mjs" },
+      // KJC-TSK-0918 (ADR 0014): the critical rules back after a compaction or a resume.
+      { event: "SessionStart", matcher: "compact", script: "sessionstart.mjs" },
+      { event: "SessionStart", matcher: "resume", script: "sessionstart.mjs" },
     ],
   });
   return { scripts: [lib, post, stop, pre], wired, deferred };