karajan-code 4.38.0 → 4.40.0

package/src/harden/sentinel-hooks.js

@@ -28,8 +28,7 @@ export function resolveSentinelRoot(dir = process.cwd()) {
 
 const LIB_BODY = `// kj sentinel shared lib (KJC-TSK-0714) — managed by \`kj harden\`.
 // Single source for every sentinel script: state, branch, classification,
-// violations, and escape recording.
-import console from "node:console";
+// and violations.
 import { readFileSync, writeFileSync } from "node:fs";
 import { execSync, spawnSync } from "node:child_process";
 import { dirname, join } from "node:path";
@@ -81,11 +80,34 @@ export const bootstrapPhase = () => {
   try { execSync("git rev-parse --verify HEAD", { cwd: ROOT, stdio: ["ignore", "ignore", "ignore"] }); return false; }
   catch { return true; }
 };
-export const violations = (s, branch) => {
-  const v = pendingMoves(s).map(pendingText);
+// KJC-BUG-0198/0262: a card split across PRs is carried while another PR of it is
+// open. kj decides with that checkable fact, the same answer for commit and push
+// (the Stop gate still holds the turn: the board owes the move); when kj does not
+// answer, every pending move blocks.
+export const boardGate = (sid, pend) => {
+  if (!pend.length) return { blocking: [], carried: [] };
+  const bg = spawnSync("kj", ["sentinel", "board-gate", "--session", sid, "--json"], { cwd: ROOT, encoding: "utf8" });
+  if (!bg.error && (bg.status === 0 || bg.status === 2)) {
+    try { const d = JSON.parse(bg.stdout); return { blocking: d.blocking || [], carried: d.carried || [] }; } catch { /* unreadable: as always */ }
+  }
+  return { blocking: pend, carried: [] };
+};
+// KJC-BUG-0265: on the base branch what counts is work still there (the session's
+// files dirty, or local commits the remote does not have), not the ledger: after a
+// merged PR and a sync of main the ledger stays full while the base holds nothing.
+// Anything git cannot answer (no upstream, odd path) counts as work: fail closed.
+const baseHoldsWork = (files) => {
+  if (files.some((f) => !/^[A-Za-z0-9._/-]+$/.test(f))) return true;
+  try {
+    if (execSync("git status --porcelain -- " + files.join(" "), { cwd: ROOT, stdio: ["ignore", "pipe", "ignore"] }).toString().trim()) return true;
+    return execSync("git rev-list @{u}..HEAD", { cwd: ROOT, stdio: ["ignore", "pipe", "ignore"] }).toString().trim() !== "";
+  } catch { return true; }
+};
+export const violations = (s, branch, pending = pendingMoves(s)) => {
+  const v = pending.map(pendingText);
   if (!s || !(s.edited_sources || []).length) return v;
   if (bootstrapPhase()) return v;
-  if (BASE_BRANCHES.has(branch)) v.push("Fuentes editadas en la rama base '" + branch + "' — crea una rama: git checkout -b feat/<CARD-ID>-descripcion");
+  if (BASE_BRANCHES.has(branch)) { if (baseHoldsWork(s.edited_sources)) v.push("Fuentes editadas en la rama base '" + branch + "' — crea una rama: git checkout -b feat/<CARD-ID>-descripcion"); }
   else if (branch && !CARD.test(branch)) v.push("La rama '" + branch + "' no referencia ninguna card — usa feat/<CARD-ID>-descripcion (y una card VIVA en el board)");
   if (!(s.edited_tests || []).length && sessionAddsCode(s)) v.push("Fuentes editadas sin tocar un solo test (" + s.edited_sources.join(", ") + ") — escribe o actualiza el test que prueba el cambio");
   return v;
@@ -105,26 +127,6 @@ const sessionAddsCode = (s) => {
     return a === "-" || Number(a) > 0;
   });
 };
-export const recordEscape = (sid, escape, tool) => {
-  const state = load();
-  const s = session(state, sid);
-  s.at = Date.now();
-  if (!s.escapes.includes(escape)) s.escapes.push(escape);
-  (state.escape_events ||= []).push({ escape, tool, sid, ts: Date.now() });
-  save(state);
-  // GOV-F (KJC-TSK-0768): el escape es una excepcion consciente — entra en el
-  // decision log hash-encadenado (kj policy seal), no solo en este estado.
-  // Best-effort CON aviso: fail-closed aqui encerraria la sesion justo cuando
-  // kj no carga, que es cuando mas se usa el escape (restaurar con git).
-  try {
-    const args = ["policy", "seal", "--escape", escape];
-    if (tool) args.push("--tool", String(tool));
-    const r = spawnSync("kj", args, { cwd: ROOT, encoding: "utf8" });
-    if (r.error || r.status !== 0) console.error("karajan sentinel: escape " + escape + " usado pero NO sellado en el decision log (kj policy seal " + (r.error ? r.error.message : "exit " + r.status) + ") — revisa kj; el escape queda solo en sentinel-state.json" + doc("escapes"));
-  } catch (e) {
-    console.error("karajan sentinel: escape " + escape + " usado pero NO sellado en el decision log: " + e.message + doc("escapes"));
-  }
-};
 `;
 
 const POST_BODY = `#!/usr/bin/env node
@@ -137,7 +139,6 @@ import { relative } from "node:path";
 import { spawnSync } from "node:child_process";
 import { CODE, TESTS, ROOT, CARD, branchOf, load, save, session } from "./sentinel-lib.mjs";
 import { remindersFor } from "./sentinel-reminders.mjs";
-const ESCAPES = ["KJ_ALLOW_WRITE", "KJ_ALLOW_REWRITE", "KJ_ALLOW_NO_CARD", "KJ_ALLOW_NO_TESTS", "KJ_ALLOW_PII", "KJ_ALLOW_POLICY", "KJ_ALLOW_IDENTITY", "KJ_ALLOW_BOARD", "KJ_ALLOW_NO_RAG", "KJ_ALLOW_NO_VERIFY"];
 let raw = "";
 process.stdin.on("data", (d) => { raw += d; });
 process.stdin.on("end", () => {
@@ -293,11 +294,6 @@ process.stdin.on("end", () => {
     const rel = relative(ROOT, file).replaceAll("\\\\", "/");
     const bucket = TESTS.test(rel) ? s.edited_tests : CODE.test(rel) ? s.edited_sources : null;
     if (bucket && !bucket.includes(rel)) bucket.push(rel);
-    for (const e of ESCAPES)
-      if (process.env[e] === "1" && !s.escapes.includes(e)) {
-        s.escapes.push(e);
-        (state.escape_events ||= []).push({ escape: e, tool, sid, ts: Date.now() });
-      }
     // KJC-TSK-0910: the branch size while it is written, with the CI budget
     // (kj pr-size), said once per threshold crossed. Context, never a block.
     let sizeNote = null;
@@ -417,7 +413,6 @@ process.stdin.on("end", () => {
       s.blocks = 0;
       const notes = [];
       if (claimsNote) notes.push(claimsNote);
-      if ((s.escapes || []).length) notes.push("karajan sentinel: esta sesion uso " + s.escapes.length + " escape(s): " + s.escapes.join(", ") + " — decision registrada; detalle en kj sentinel status.");
       if ((s.closed_cards || []).length) {
         notes.push("karajan sentinel: card(s) cerrada(s) en este turno: " + s.closed_cards.join(", ") + " — el board las muestra: " + boardHint());
         s.closed_cards = [];
@@ -454,10 +449,10 @@ import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
-import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, branchOf, foreignLane, load, save, session, violations, recordEscape, pendingMoves, pendingText } from "./sentinel-lib.mjs";
+import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, branchOf, foreignLane, load, save, session, violations, boardGate, pendingMoves, pendingText } from "./sentinel-lib.mjs";
 // KJC-TSK-0915 (ADR 0014): the shell reader is a real, unit-tested module copied here as is.
-import { shellSegments, stripInertQuotes, stripTextOptionValues } from "./sentinel-shell.mjs";
-import { DISCARD_VERBS, discardOf, foreignLost } from "./sentinel-discard.mjs";
+import { optionValues, shellSegments, stripInertQuotes, stripTextOptionValues } from "./sentinel-shell.mjs";
+import { DISCARD_VERBS, discardOf, foreignLost, removedFiles } from "./sentinel-discard.mjs";
 import { shellWrites, writesRepo } from "./sentinel-bash-write.mjs";
 const EDIT_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
 // KJC-BUG-0204: el comando real lleva flags EN MEDIO del verbo
@@ -481,6 +476,21 @@ process.stdin.on("end", () => {
     process.on("exit", (code) => {
       if (code === 2) console.error("karajan: Karajan gobierna y se le obedece. No rodees el gate ni cambies la politica para pasarlo; si te parece injusto, diselo a tu usuario o usa kj report-issue.");
     });
+    // KJC-BUG-0238 (#1886): de quien es cada cambio. La primera vez que la
+    // sesion toca un fichero se anota si estaba limpio: solo entonces un
+    // descarte posterior pierde nada mas que lo de la sesion. Antes de
+    // cualquier escape; git que falla cuenta como sucio (fail-closed).
+    const noteFirstTouch = (relT) => {
+      const st = load();
+      const touch = (session(st, sid).first_touch ||= {});
+      // hasOwn + defineProperty: a file named __proto__ or toString is a path, not a prototype key.
+      if (Object.hasOwn(touch, relT)) return;
+      // --ignored: a user's ignored .env is theirs too (git clean -x deletes it).
+      const gs = spawnSync("git", ["-C", ROOT, "status", "--porcelain", "--ignored", "--", relT], { encoding: "utf8" });
+      const value = gs.status === 0 && String(gs.stdout).trim() === "" ? "clean" : "dirty";
+      Object.defineProperty(touch, relT, { value, enumerable: true, writable: true, configurable: true });
+      save(st);
+    };
     // Self-protection (KJC-TSK-0715) rules run BEFORE any escape, including
     // KJ_SENTINEL_OFF: the sentinel is not dismantled from inside a session —
     // only the human, editing outside it.
@@ -493,27 +503,16 @@ process.stdin.on("end", () => {
       }
       // KJC-TSK-0920 (SNT-E): policies, gate settings and exclusions are the human's,
       // like the supervisor: a session does not loosen the rules that govern it.
-      if ([".karajan/policy.yml", ".karajan/kj.config.yml", ".ragignore"].includes(relT) || relT.endsWith("/.ragignore")) {
+      // .karajan/rules.yml (KJC-TSK-0947, ADR 0016): the compiled rules are the user's to approve.
+      // .karajan/rules.local.yml (KJC-TSK-0954, ADR 0017): the same rules, the ones from private sources.
+      if ([".karajan/policy.yml", ".karajan/kj.config.yml", ".karajan/rules.yml", ".karajan/rules.local.yml", ".ragignore"].includes(relT) || relT.endsWith("/.ragignore")) {
         console.error("karajan sentinel: " + relT + " es configuracion de gobierno (politicas, gates, exclusiones): la cambia tu usuario, no la sesion. Si un gate te parece injusto, proponselo a tu usuario o usa kj report-issue." + doc("governance"));
         process.exit(2);
       }
-      // KJC-BUG-0238 (#1886): de quien es cada cambio. La primera vez que la
-      // sesion toca un fichero se anota si estaba limpio: solo entonces un
-      // descarte posterior pierde nada mas que lo de la sesion. Antes de
-      // cualquier escape; git que falla cuenta como sucio (fail-closed).
-      if (relT && !relT.startsWith("..") && !relT.startsWith("/")) {
-        const st = load();
-        const touch = (session(st, sid).first_touch ||= {});
-        // hasOwn + defineProperty: a file named __proto__ or toString is a path, not a prototype key.
-        if (!Object.hasOwn(touch, relT)) {
-          // --ignored: a user's ignored .env is theirs too (git clean -x deletes it).
-          const gs = spawnSync("git", ["-C", ROOT, "status", "--porcelain", "--ignored", "--", relT], { encoding: "utf8" });
-          const value = gs.status === 0 && String(gs.stdout).trim() === "" ? "clean" : "dirty";
-          Object.defineProperty(touch, relT, { value, enumerable: true, writable: true, configurable: true });
-          save(st);
-        }
-      }
+      if (relT && !relT.startsWith("..") && !relT.startsWith("/")) noteFirstTouch(relT);
     }
+    // KJC-BUG-0261: rm / git rm is the session touching those files, noted before they go.
+    if (tool === "Bash") for (const words of shellSegments(String(input.command || ""))) for (const f of removedFiles(words, ROOT)) noteFirstTouch(f);
     // Any Bash that NAMES the supervisor's files is denied — a write-verb
     // blocklist is bypassable (cp, dd, one-liners), and reading them is what
     // the Read/Grep tools are for. Shell indirection (variables, globs,
@@ -536,8 +535,8 @@ process.stdin.on("end", () => {
       if (tool === "Bash" && /(^|[^a-zA-Z])gh([^a-zA-Z]|$)/.test(ghCmd) && /(^|[^a-z])(pr|issue|release)([^a-z]|$)/.test(ghCmd) && /(^|[^a-z])(create|edit|comment|review)([^a-z]|$)/.test(ghCmd)) {
         const attrib = /co-authored-by:.{0,120}(claude|gpt|copilot|gemini)|(generated|written|created) (by|with).{0,120}(claude|gpt|copilot|gemini|codex)|generated with [[]?claude|🤖/is;
         let corpus = ghCmd;
-        for (const m of ghCmd.matchAll(/--(?:body-file|notes-file|comment-file)[= ]+("([^"]+)"|'([^']+)'|([^ ]+))/g)) {
-          const bodyPath = m[2] || m[3] || m[4];
+        // KJC-BUG-0245: the shell reader ends the path at ; && | (a regex took "pr.md;").
+        for (const bodyPath of optionValues(ghCmd, ["--body-file", "--notes-file", "--comment-file"])) {
           try { corpus += "\\n" + readFileSync(bodyPath, "utf8"); } catch {
             console.error("karajan sentinel: no puedo leer " + bodyPath + " para el escaneo de atribucion — sin escaneo no se publica." + doc("attribution"));
             process.exit(2);
@@ -598,68 +597,11 @@ process.stdin.on("end", () => {
       }
     }
     if (process.env.KJ_SENTINEL_OFF === "1") process.exit(0);
-    // KJC-BUG-0142: cada deny anuncia su escape como prefijo del comando
-    // (KJ_ALLOW_X=1 cmd), pero el hook corre con el env del HOST — el
-    // prefijo jamas llegaba a process.env y el escape era inalcanzable
-    // (deadlock real del gate de release: la landing solo se pone verde
-    // tras el deploy y el deploy estaba bloqueado por el mismo gate). Un
-    // escape es una excepcion CONSCIENTE y auditada, no un boundary de
-    // seguridad (security sigue sin escape y la autoprotecion corre antes),
-    // asi que el TEXTO del comando es fuente valida: solo asignaciones
-    // LITERALES al inicio (tokens VAR=VAL antes del primer verbo) y solo
-    // sobre un comando SIMPLE — con ;|& $() backtick o salto de linea el
-    // prefijo shell no alcanzaria a los comandos posteriores (catch de
-    // codex: "X=1 true && npm publish" escaparia sin serlo), asi que el
-    // escape por texto se rechaza y queda la via env de siempre.
+    // ADR 0015 (KJC-TSK-0927): no gate has an escape any more, so the command
+    // text is read only by the identity lock below.
     const CMD_TEXT = tool === "Bash" ? String(input.command || "") : "";
     const ESC_TAB = String.fromCharCode(9);
     const ESC_NL = String.fromCharCode(10);
-    const ESC_BT = String.fromCharCode(96);
-    const escOn = (name) => {
-      if (process.env[name] === "1") return true;
-      let found = false;
-      let i = 0;
-      while (i < CMD_TEXT.length) {
-        while (i < CMD_TEXT.length && (CMD_TEXT[i] === " " || CMD_TEXT[i] === ESC_TAB)) i += 1;
-        const start = i;
-        while (i < CMD_TEXT.length && CMD_TEXT[i] !== " " && CMD_TEXT[i] !== ESC_TAB && CMD_TEXT[i] !== ESC_NL) i += 1;
-        const tok = CMD_TEXT.slice(start, i);
-        const eq = tok.indexOf("=");
-        if (eq <= 0 || !/^[A-Z][A-Z0-9_]*$/.test(tok.slice(0, eq))) break;
-        if (tok === name + "=1") found = true;
-      }
-      if (!found) return false;
-      // KJC-BUG-0147: lo que va ENTRE COMILLAS no encadena comandos — un
-      // mensaje "fix(x): ... (KJC-TSK-1)" es un comando simple. Dentro de
-      // comillas dobles $ y backtick siguen expandiendo (se rechazan); en
-      // comillas simples todo es literal. Y si el escape esta pero se ignora,
-      // SE DICE: un escape ignorado en silencio era el bug.
-      const bad = escSimple();
-      if (bad === null) return true;
-      if (!escNoted.has(name)) {
-        escNoted.add(name);
-        console.error("karajan sentinel: " + name + "=1 presente pero IGNORADO — el escape solo vale en un comando simple y este contiene " + JSON.stringify(bad) + " fuera de comillas simples (sin ; | & $ ( ) backtick ni salto de linea: parte el comando o usa -F fichero)" + doc("escapes"));
-      }
-      return false;
-    };
-    const escNoted = new Set();
-    const escSimple = () => {
-      let q = null;
-      for (let i = 0; i < CMD_TEXT.length; i += 1) {
-        const c = CMD_TEXT[i];
-        if (q === "'") { if (c === "'") q = null; continue; }
-        if (q === '"') {
-          if (c === '"') q = null;
-          else if (c === "$" || c === ESC_BT) return c;
-          else if (c === "\\\\") i += 1;
-          continue;
-        }
-        if (c === "\\\\") { i += 1; continue; }
-        if (c === "'" || c === '"') { q = c; continue; }
-        if (c === ";" || c === "|" || c === "&" || c === ESC_NL || c === ESC_BT || c === "$" || c === "(" || c === ")") return c;
-      }
-      return q === null ? null : "comilla sin cerrar";
-    };
     // IDN-B (KJC-TSK-0763, ADR 0005): identity lock — gh and mutating git never
     // run under an account other than the one THIS CLONE declared (the incident:
     // a gh comment without switch went out as the client account). Deny BEFORE
@@ -755,11 +697,8 @@ process.stdin.on("end", () => {
       };
       scan(CMD_TEXT, 0);
       if (problems.length > 0) {
-        if (escOn("KJ_ALLOW_IDENTITY")) { recordEscape(sid, "KJ_ALLOW_IDENTITY", tool); }
-        else {
-          console.error("karajan sentinel: identity lock (ADR 0005) —" + problems.map((p) => ESC_NL + "- " + p).join("") + ESC_NL + "(KJ_ALLOW_IDENTITY=1 = excepcion consciente, queda registrada)" + doc("identity"));
-          process.exit(2);
-        }
+        console.error("karajan sentinel: identity lock (ADR 0005) —" + problems.map((p) => ESC_NL + "- " + p).join("") + ESC_NL + "(sin escape, ADR 0015: pon la cuenta en el comando)" + doc("identity"));
+        process.exit(2);
       }
     }
     // MONO-0 (KJC-TSK-0737, ADR 0002): cada sesion muta solo SU worktree;
@@ -779,8 +718,7 @@ process.stdin.on("end", () => {
       return d ? foreignLane(d) : null;
     };
     const laneDeny = (what, lane) => {
-      if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); return false; }
-      console.error("karajan sentinel: " + what + " vive en otro carril (" + lane + ") de este repo — cada sesion muta solo SU worktree (MONO-0). Cruce deliberado: KJ_ALLOW_CROSS_LANE=1, queda registrado." + doc("cross-lane"));
+      console.error("karajan sentinel: " + what + " vive en otro carril (" + lane + ") de este repo — cada sesion muta solo SU worktree (MONO-0). Sin escape (ADR 0015): un cruce deliberado lo hace tu usuario en su terminal." + doc("cross-lane"));
       return true;
     };
     if (EDIT_TOOLS.includes(tool)) {
@@ -817,11 +755,8 @@ process.stdin.on("end", () => {
         // directorio se deniega conservadoramente — el remedio es no
         // necesitarlo (git -C, npm --prefix, rutas absolutas).
         if (/(^|[;&|(\\s])(cd|pushd)([ \\t]|$)/.test(cmd)) {
-          if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); }
-          else {
-            console.error("karajan sentinel: cd/pushd en un comando mutador — las rutas posteriores no son verificables por el guard de carriles (MONO-0); usa git -C / npm --prefix / rutas ABSOLUTAS sin cd (o KJ_ALLOW_CROSS_LANE=1, queda registrado)." + doc("cross-lane"));
-            process.exit(2);
-          }
+          console.error("karajan sentinel: cd/pushd en un comando mutador — las rutas posteriores no son verificables por el guard de carriles (MONO-0); usa git -C / npm --prefix / rutas ABSOLUTAS sin cd." + doc("cross-lane"));
+          process.exit(2);
         }
         // Absolute AND dot-relative tokens (../lane escapaba al primer scan —
         // reviewer catch); relative se resuelve contra el cwd de la sesion.
@@ -836,11 +771,8 @@ process.stdin.on("end", () => {
         // de tokens de abajo; el residuo (expansion anidada en segmentos
         // runner) queda documentado como en la regla de ficheros PROTECTED.
         if (/>{1,2}[ \\t]*["']?[$\`]/.test(cmd)) {
-          if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); }
-          else {
-            console.error("karajan sentinel: redireccion con destino tras variable/sustitucion — el guard de carriles no puede verificarlo (MONO-0); usa una ruta LITERAL (o KJ_ALLOW_CROSS_LANE=1, queda registrado)." + doc("cross-lane"));
-            process.exit(2);
-          }
+          console.error("karajan sentinel: redireccion con destino tras variable/sustitucion — el guard de carriles no puede verificarlo (MONO-0); usa una ruta LITERAL." + doc("cross-lane"));
+          process.exit(2);
         }
         // Sustitucion de comandos ($(...) o backticks) EJECUTA su contenido
         // en cualquier posicion, y una ruta entrecomillada con espacios es
@@ -904,20 +836,14 @@ process.stdin.on("end", () => {
         // KJC-BUG-0243: inert quoted text is not a substitution, and the prose value
         // of a text option (--title, -m...) is not a path.
         if (/\\$\\(|\`/.test(stripInertQuotes(cmd)) || quotedPathWithSpaces(stripTextOptionValues(cmd))) {
-          if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); }
-          else {
-            console.error("karajan sentinel: sustitucion de comandos o ruta entrecomillada con espacios en un comando mutador — no verificable por el guard de carriles (MONO-0); usa valores/rutas LITERALES sin sustitucion (o KJ_ALLOW_CROSS_LANE=1, queda registrado)." + doc("cross-lane"));
-            process.exit(2);
-          }
+          console.error("karajan sentinel: sustitucion de comandos o ruta entrecomillada con espacios en un comando mutador — no verificable por el guard de carriles (MONO-0); usa valores/rutas LITERALES sin sustitucion." + doc("cross-lane"));
+          process.exit(2);
         }
         const SAFE_EXP_SEG = /^([A-Za-z_][A-Za-z0-9_]*=[^ \\t]*[ \\t]*)*((npm|pnpm|yarn|vitest|jest|kj|gh|echo|printf|true|test)\\b|git[ \\t](?![^\\n]*(-C[ \\t]|--git-dir|--work-tree)))[^;|&\\n]*$|^[A-Za-z_][A-Za-z0-9_]*=[^;|&\\n]*$/;
         const segs = cmd.split(/&&|\\|\\||[;|\\n]/).map((s) => s.trim()).filter(Boolean);
         if (!segs.every((s) => !/[$]/.test(s) || SAFE_EXP_SEG.test(s))) {
-          if (escOn("KJ_ALLOW_CROSS_LANE")) { recordEscape(sid, "KJ_ALLOW_CROSS_LANE", tool); }
-          else {
-            console.error("karajan sentinel: expansion de shell en una herramienta generica de fichero/interprete — el objetivo no es verificable por el guard de carriles (MONO-0); usa rutas LITERALES o un runner del toolchain (o KJ_ALLOW_CROSS_LANE=1, queda registrado)." + doc("cross-lane"));
-            process.exit(2);
-          }
+          console.error("karajan sentinel: expansion de shell en una herramienta generica de fichero/interprete — el objetivo no es verificable por el guard de carriles (MONO-0); usa rutas LITERALES o un runner del toolchain." + doc("cross-lane"));
+          process.exit(2);
         }
         // ...incluidas relativas A PELO (los carriles kj viven en
         // .kj/worktrees/). Un falso token (s/a/b/) resuelve al arbol propio
@@ -955,8 +881,8 @@ process.stdin.on("end", () => {
     // Fail CLOSED por defecto (catches de codex; doctrina KJC-BUG-0095: un
     // gate no se cae en silencio): solo exit 0 permite. kj inejecutable =
     // deny duro (el remedio es restaurar kj); cualquier otro fallo de
-    // evaluacion = deny con escape humano registrable — la sesion no queda
-    // presa de un typo de YAML, pero abrirla es decision del usuario.
+    // evaluacion = deny sin escape (ADR 0015): un typo de YAML lo corrige el
+    // usuario fuera de la sesion.
     if ((EDIT_TOOLS.includes(tool) || tool === "Bash") && existsSync(resolve(ROOT, ".karajan", "policy.yml"))) {
       // PL-C: el rol que ACTÚA (KJ_POLICY_ROLE, sembrado por los runners de
       // kj run en los subprocesos) — el anfitrión-brain evalúa como coder.
@@ -970,11 +896,9 @@ process.stdin.on("end", () => {
         let v = null;
         try { v = JSON.parse(String(pres.stdout || "").trim().split("\\n").pop()); } catch { /* mensaje generico */ }
         const secure = !!(v && v.class === "security");
-        if (!secure && escOn("KJ_ALLOW_POLICY")) { recordEscape(sid, "KJ_ALLOW_POLICY", tool); }
-        else {
-          console.error("karajan sentinel: policy deny [" + ((v && v.rule_id) || "policy") + "] " + ((v && v.reason) || "la tool call viola la policy del proyecto") + (secure ? " [security — sin escape ni arbitraje]" : " (KJ_ALLOW_POLICY=1 = excepcion consciente, queda registrada; el commit exigira ademas KJ_POLICY_REASON)") + doc("policy"));
-          process.exit(2);
-        }
+        // ADR 0015 (KJC-TSK-0932): no escape; a rule that misfires is fixed by PR.
+        console.error("karajan sentinel: policy deny [" + ((v && v.rule_id) || "policy") + "] " + ((v && v.reason) || "la tool call viola la policy del proyecto") + (secure ? " [security — sin escape ni arbitraje]" : " (sin escape: si la regla falla, tu usuario corrige .karajan/policy.yml por PR)") + doc("policy"));
+        process.exit(2);
       } else if (pres.status !== 0) {
         // KJC-BUG-0207: un kj que NO ARRANCA no es una violacion de policy. Con
         // kj linkado al arbol, un error de sintaxis transitorio en src/ dejaba
@@ -999,9 +923,8 @@ process.stdin.on("end", () => {
             console.error("karajan sentinel: kj no arranca (" + broken[0] + (at ? " en " + at : "") + "), asi que la policy no se puede evaluar y NADA MAS pasa: edita " + (brokenFile || "el fichero que rompe kj") + " para arreglarlo. No es un deny de policy, es kj roto." + doc("policy"));
             process.exit(2);
           }
-        } else if (escOn("KJ_ALLOW_POLICY")) { recordEscape(sid, "KJ_ALLOW_POLICY", tool); }
-        else {
-          console.error("karajan sentinel: kj policy eval fallo (exit " + pres.status + ") — la policy declarada no se pudo evaluar, deny por defecto; diagnostica con kj policy check y corrige .karajan/policy.yml fuera de la sesion (o KJ_ALLOW_POLICY=1 = excepcion consciente, queda registrada)." + doc("policy"));
+        } else {
+          console.error("karajan sentinel: kj policy eval fallo (exit " + pres.status + ") — la policy declarada no se pudo evaluar, deny por defecto; diagnostica con kj policy check; .karajan/policy.yml lo corrige tu usuario fuera de la sesion." + doc("policy"));
           process.exit(2);
         }
       }
@@ -1022,11 +945,8 @@ process.stdin.on("end", () => {
           let blockOn = false;
           try { blockOn = /steward:\\s*["']?block/.test(readFileSync(join(ROOT, ".karajan", "kj.config.yml"), "utf8")); } catch { /* no config — no block */ }
           if (hard.length && blockOn) {
-            if (escOn("KJ_ALLOW_STEWARD")) { recordEscape(sid, "KJ_ALLOW_STEWARD", tool); }
-            else {
-              console.error("karajan sentinel: steward — el estado del proyecto bloquea empezar (barrido " + rep.sweptAt + "):" + String.fromCharCode(10) + hard.map((r) => "- " + r.id + ": " + (r.evidence || "") + " -> " + (r.remedy || r.renew || "kj steward sweep")).join(String.fromCharCode(10)) + String.fromCharCode(10) + "(KJ_ALLOW_STEWARD=1 = excepcion consciente de esta sesion, queda registrada)" + doc("steward"));
-              process.exit(2);
-            }
+            console.error("karajan sentinel: steward — el estado del proyecto bloquea empezar (barrido " + rep.sweptAt + "):" + String.fromCharCode(10) + hard.map((r) => "- " + r.id + ": " + (r.evidence || "") + " -> " + (r.remedy || r.renew || "kj steward sweep")).join(String.fromCharCode(10)) + String.fromCharCode(10) + "(sin escape, ADR 0015: si el trabajo sigue, tu usuario cambia method_gates.steward a inform)" + doc("steward"));
+            process.exit(2);
           }
           const st = load();
           const s = session(st, sid);
@@ -1043,11 +963,11 @@ process.stdin.on("end", () => {
       if (rel && CODE.test(rel) && !TESTS.test(rel)) {
         const branch = branchOf();
         const why = !branch ? null : BASE_BRANCHES.has(branch) ? "base" : !CARD.test(branch) ? "nocard" : null;
+        // ADR 0015 (KJC-TSK-0925): no escape. Without a card there is no work.
         if (why) {
-          if (escOn("KJ_ALLOW_NO_CARD")) { recordEscape(sid, "KJ_ALLOW_NO_CARD", tool); process.exit(0); }
           console.error(why === "base"
-            ? "karajan sentinel: no se editan fuentes en la rama base '" + branch + "' — crea la card (kj hu add) y la rama: git checkout -b feat/<CARD-ID>-descripcion. (KJ_ALLOW_NO_CARD=1 = excepcion consciente, queda registrada)" + doc("card-first")
-            : "karajan sentinel: la rama '" + branch + "' no referencia ninguna card — crea/mueve la card a running (kj hu add | kj hu move) y usa una rama feat/<CARD-ID>-descripcion. (KJ_ALLOW_NO_CARD=1 = excepcion consciente, queda registrada)" + doc("card-first"));
+            ? "karajan sentinel: no se editan fuentes en la rama base '" + branch + "' — crea la card (kj hu add) y la rama: git checkout -b feat/<CARD-ID>-descripcion." + doc("card-first")
+            : "karajan sentinel: la rama '" + branch + "' no referencia ninguna card — crea/mueve la card a running (kj hu add | kj hu move) y usa una rama feat/<CARD-ID>-descripcion." + doc("card-first"));
           process.exit(2);
         }
         // KJC-TSK-0848 (ADR 0010, RAG-B): the RAG must have answered about this
@@ -1070,15 +990,14 @@ process.stdin.on("end", () => {
         // KJC-BUG-0190: with nothing indexed, no query can cover anything —
         // the gate asks for kj rag index instead of denying the impossible.
         const covered = rel.startsWith("..") || hits.includes(rel) || hits.some((h) => dirOf(h) === dirOf(rel)) || ((rs.rag_queries || []).length > 0 && fresh()) || rs.rag_index_empty === true;
+        // ADR 0015 (KJC-TSK-0925): no escape. The cases it covered (new file, empty
+        // index, not indexable) are decided by the gate itself.
         if (!covered) {
-          if (escOn("KJ_ALLOW_NO_RAG")) {
-            // Recorded ONCE per session: the escape is a conscious exception, not a per-edit tax.
-            if (!(rs.escapes || []).includes("KJ_ALLOW_NO_RAG")) recordEscape(sid, "KJ_ALLOW_NO_RAG", tool);
-          } else {
+          {
             // KJC-BUG-0216 (issue #1807): un .astro, un .php o cualquier fichero
             // sin adapter NO puede estar en el indice, asi que exigir una
             // respuesta del RAG sobre el es pedir lo imposible, y empujaba a
-            // dejar KJ_ALLOW_NO_RAG puesta para siempre. La exencion es SOLO
+            // dejar el escape puesto para siempre. La exencion es SOLO
             // esa: un indice vacio o por detras si tiene arreglo (kj rag index)
             // y sigue bloqueando, porque si no el gate desapareceria en
             // cualquier proyecto sin indexar. Nada legible = se bloquea.
@@ -1098,7 +1017,7 @@ process.stdin.on("end", () => {
               console.error("karajan sentinel: rag-first — el indice aun no tiene " + rel + " (" + absent + "); indexalo y consulta despues: kj_rag_query / kj rag query <que hace " + rel + ">" + doc("rag-first"));
               process.exit(2);
             } else {
-              console.error("karajan sentinel: rag-first — el RAG no ha respondido sobre " + rel + " en esta sesion; consulta antes de tocarlo: kj_rag_query / kj rag query <que hace " + rel + " y donde mas vive ese concepto>. (KJ_ALLOW_NO_RAG=1 = excepcion consciente, queda registrada)" + doc("rag-first"));
+              console.error("karajan sentinel: rag-first — el RAG no ha respondido sobre " + rel + " en esta sesion; consulta antes de tocarlo: kj_rag_query / kj rag query <que hace " + rel + " y donde mas vive ese concepto>." + doc("rag-first"));
               process.exit(2);
             }
           }
@@ -1133,11 +1052,10 @@ process.stdin.on("end", () => {
       // depender de como parta las palabras el separador (catch de la review).
       const movesHooks = cmd.toLowerCase().includes("core.hookspath");
       if ((inOrder(["git", "commit"], words) && words.some(skipsVerify)) || movesHooks) {
-        if (escOn("KJ_ALLOW_NO_VERIFY")) { recordEscape(sid, "KJ_ALLOW_NO_VERIFY", tool); }
-        else {
-          console.error("karajan sentinel: el gate de commit no se apaga con una bandera — el review cruzado y la policy corren en el hook, y saltarselos deja el diff sin veredicto. Si el hook esta roto, arreglalo; si de verdad hace falta, es una decision de tu usuario. (KJ_ALLOW_NO_VERIFY=1 = excepcion consciente, queda registrada)" + doc("escapes"));
-          process.exit(2);
-        }
+        // ADR 0015 (KJC-TSK-0926): no escape. A broken hook is fixed; skipping it,
+        // if it ever must happen, is the user's act in their own terminal.
+        console.error("karajan sentinel: el gate de commit no se apaga con una bandera — el review cruzado y la policy corren en el hook, y saltarselos deja el diff sin veredicto. Si el hook esta roto, arreglalo; si de verdad hace falta saltarlo, lo hace tu usuario en su terminal." + doc("escapes"));
+        process.exit(2);
       }
       const MERGE = /\\bgh\\s+pr\\s+merge(\\s+(\\d+))?/;
       const ADVANCE = /\\bgit\\s+commit\\b|\\bgit\\s+push\\b|\\bgh\\s+pr\\s+create\\b/; // push also falls under violations() — explicit here too (review catch)
@@ -1145,20 +1063,14 @@ process.stdin.on("end", () => {
       const pend = pendingMoves(load().sessions?.[sid]);
       if (pend.length > 0 && (mergeM || ADVANCE.test(cmd))) {
         // KJC-BUG-0198: una card partida en varias PRs no puede quedar bloqueada
-        // por su primera mitad. kj decide con un hecho comprobable (otra PR
-        // abierta de la card); si kj no responde, se bloquea como siempre.
-        const bg = spawnSync("kj", ["sentinel", "board-gate", "--session", sid, "--json"], { cwd: ROOT, encoding: "utf8" });
-        let blocking = pend, carried = [];
-        if (!bg.error && (bg.status === 0 || bg.status === 2)) {
-          try { const d = JSON.parse(bg.stdout); blocking = d.blocking || []; carried = d.carried || []; } catch { /* sin respuesta legible: como siempre */ }
-        }
+        // por su primera mitad (boardGate, en la lib).
+        const { blocking, carried } = boardGate(sid, pend);
         for (const c of carried) console.error("karajan sentinel: board-sync arrastra " + c.card + " — " + c.why + ", se movera al cerrarla");
+        // ADR 0015 (KJC-TSK-0925): no escape; an epic and a card split across PRs
+        // are already decided above (KJC-BUG-0230, 0198).
         if (blocking.length > 0) {
-          if (escOn("KJ_ALLOW_BOARD")) { recordEscape(sid, "KJ_ALLOW_BOARD", tool); }
-          else {
-            console.error("karajan sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + blocking.map((p) => "- " + pendingText(p)).join("\\n") + "\\n(KJ_ALLOW_BOARD=1 = excepcion consciente, queda registrada)" + doc("board-sync"));
-            process.exit(2);
-          }
+          console.error("karajan sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + blocking.map((p) => "- " + pendingText(p)).join("\\n") + doc("board-sync"));
+          process.exit(2);
         }
       }
       // (the pending entry itself is recorded by the PostToolUse hook, only once
@@ -1167,9 +1079,9 @@ process.stdin.on("end", () => {
       // there misleads every future reader. When the command writes one from a
       // file, kj crosses ITS data against this turn's outputs; the hook carries
       // no policy (kj reads method_gates.claims; off = this check does not exist).
-      const bodyFile = /\\bgh\\s+pr\\s+(?:create|edit)\\b/.test(cmd) ? /--body-file[= ]+("([^"]+)"|'([^']+)'|([^\\s"']+))/.exec(cmd) : null;
-      if (bodyFile && transcript) {
-        const body = bodyFile[2] || bodyFile[3] || bodyFile[4];
+      // KJC-BUG-0245: the path is read by the shell reader, so "pr.md;" is "pr.md".
+      const body = /\\bgh\\s+pr\\s+(?:create|edit)\\b/.test(cmd) ? optionValues(cmd, ["--body-file"])[0] : undefined;
+      if (body && transcript) {
         const g = spawnSync("kj", ["claims", "gate", "--transcript", transcript, "--file", body], { cwd: ROOT, encoding: "utf8" });
         if (!g.error && g.status === 2) {
           console.error("karajan sentinel: claims — un dato del cuerpo de la PR esta DESMENTIDO por las salidas de este turno:\\n" + (g.stderr || "").trim() + "\\nVerificalo o marcalo como no comprobado antes de crear la PR. Detalle: kj claims check --transcript " + transcript + " --file " + body + doc("claims"));
@@ -1177,7 +1089,8 @@ process.stdin.on("end", () => {
         }
       }
       if (isPublish(cmd)) {
-        if (escOn("KJ_ALLOW_RELEASE")) { recordEscape(sid, "KJ_ALLOW_RELEASE", tool); process.exit(0); }
+        // ADR 0015 (KJC-TSK-0932): no escape — KJC-BUG-0204 and 0259 keep the
+        // check from blocking its own fix.
         // KJC-BUG-0204: el check se evalua PARA este comando. Un item que
         // declara remedied_by no bloquea el comando que lo repara (desplegar
         // la landing era justo lo que el check pedia); publicar no se exime.
@@ -1194,19 +1107,15 @@ process.stdin.on("end", () => {
         if (res.status !== 0) {
           let items = "";
           try { items = (parsed.checks || []).filter((c) => !c.ok && c.lifted !== true).map((c) => "\\n- " + c.name + ": " + c.detail).join(""); } catch { /* raw output */ }
-          console.error("karajan sentinel: release check en ROJO — no se publica ni despliega hasta resolverlo:" + (items || "\\n- corre kj release check para el detalle") + "\\n(KJ_ALLOW_RELEASE=1 = excepcion consciente, queda registrada)" + doc("release"));
+          console.error("karajan sentinel: release check en ROJO — no se publica ni despliega hasta resolverlo:" + (items || "\\n- corre kj release check para el detalle") + "\\n(sin escape: se repara lo que el check nombra)" + doc("release"));
           process.exit(2);
         }
       } else if (PUSH.test(cmd)) {
-        // KJC-BUG-0147: the board escape covers the push too — a pending move
-        // blocks the push like it blocks the commit, and the SAME conscious,
-        // recorded escape opens both (multi-PR cards are a legitimate plan).
+        // KJC-BUG-0147: a pending move blocks the push like it blocks the commit.
+        // ADR 0015 (KJC-TSK-0925): with no escape.
+        // KJC-BUG-0262: a carried card does not block the push the commit let through.
         const sess = load().sessions?.[sid];
-        let v = violations(sess, branchOf());
-        if (v.length && pendingMoves(sess).length && escOn("KJ_ALLOW_BOARD")) {
-          recordEscape(sid, "KJ_ALLOW_BOARD", tool);
-          v = violations({ ...sess, pending_moves: [] }, branchOf());
-        }
+        const v = violations(sess, branchOf(), boardGate(sid, pendingMoves(sess)).blocking);
         if (v.length) {
           console.error("karajan sentinel: git push con el metodo en rojo:\\n" + v.map((x) => "- " + x).join("\\n") + "\\nResuelve antes de empujar. Estado: kj sentinel status" + doc("push-gate"));
           process.exit(2);
@@ -1231,6 +1140,9 @@ const SCRIPT_BODIES = {
   "sentinel-bash-write.mjs": readFileSync(new URL("./sentinel/sentinel-bash-write.mjs", import.meta.url), "utf8"),
   "sentinel-reminders.mjs": readFileSync(new URL("./sentinel/sentinel-reminders.mjs", import.meta.url), "utf8"),
   "sessionstart.mjs": readFileSync(new URL("./sentinel/sessionstart.mjs", import.meta.url), "utf8"),
+  // KJC-TSK-0946 (ADR 0016): the rules gate and its hook, for every tool call.
+  "sentinel-rules.mjs": readFileSync(new URL("./sentinel/sentinel-rules.mjs", import.meta.url), "utf8"),
+  "pretooluse-rules.mjs": readFileSync(new URL("./sentinel/pretooluse-rules.mjs", import.meta.url), "utf8"),
 };
 
 /**
@@ -1420,6 +1332,9 @@ export function installSentinelHooks({ projectDir = process.cwd(), logger = cons
     entries: [
       { event: "PreToolUse", matcher: "Write|Edit|MultiEdit|NotebookEdit", script: "pretooluse-sentinel.mjs" },
       { event: "PreToolUse", matcher: "Bash", script: "pretooluse-sentinel.mjs" },
+      // KJC-TSK-0946 (ADR 0016): no matcher. The rules of the MD files are checked
+      // before EVERY tool call, MCP ones included.
+      { event: "PreToolUse", script: "pretooluse-rules.mjs" },
       { event: "PostToolUse", matcher: "Write|Edit|MultiEdit|NotebookEdit", script: "posttooluse.mjs" },
       // KJC-TSK-0765 board-sync: the merge (Bash) and the tracker move (MCP
       // update_card) are observed AFTER the fact — found live: with only the
@@ -1433,6 +1348,8 @@ export function installSentinelHooks({ projectDir = process.cwd(), logger = cons
       // KJC-TSK-0918 (ADR 0014): the critical rules back after a compaction or a resume.
       { event: "SessionStart", matcher: "compact", script: "sessionstart.mjs" },
       { event: "SessionStart", matcher: "resume", script: "sessionstart.mjs" },
+      // KJC-TSK-0949: a new session hears of MD rules with no gate, and nothing else.
+      { event: "SessionStart", matcher: "startup", script: "sessionstart.mjs" },
     ],
   });
   return { scripts: [lib, post, stop, pre], wired, deferred };