karajan-code 4.54.0 → 4.56.0

package/src/harden/sentinel-hooks.js

@@ -475,7 +475,7 @@ import { appendFileSync, existsSync, readFileSync, realpathSync, statSync } from
 import { spawnSync } from "node:child_process";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
-import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, STATE, branchOf, foreignLane, load, save, session, violations, boardGate, pendingMoves, pendingText } from "./sentinel-lib.mjs";
+import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, STATE, branchOf, foreignLane, load, save, session, boardGate, pendingMoves, pendingText } from "./sentinel-lib.mjs";
 // KJC-TSK-0915 (ADR 0014): the shell reader is a real, unit-tested module copied here as is.
 import { isGhIssueCreate, isPublishCommand, optionValues, shellSegments, stripInertQuotes, stripTextOptionValues, stripTextOnlyCommandValues } from "./sentinel-shell.mjs";
 import { DISCARD_VERBS, discardOf, foreignLost, removedFiles } from "./sentinel-discard.mjs";
@@ -485,7 +485,6 @@ const inOrder = (want, got) => { let i = 0; for (const w of got) if (w === want[
 // KJC-BUG-0333: a publish is read per simple command by the shell reader, so
 // words inside a quoted argument of another command are not a publish.
 const isPublish = isPublishCommand;
-const PUSH = /\\bgit\\s+push\\b/;
 const PROTECTED = /\\.claude\\/settings\\.json\\b|\\.karajan\\/(hooks|harness)\\//;
 let raw = "";
 process.stdin.on("data", (d) => { raw += d; });
@@ -606,32 +605,17 @@ process.stdin.on("end", () => {
         }
       }
     }
-    // KJC-TSK-0822 v1.1: enrolar (o pisar) la clave del movil es acto humano
-    // — si un agente pudiera enrolar una clave SUYA, contestaria la capa 5 el
-    // solo. Ni el comando ni el fichero de enrolamiento desde la sesion.
+    // KJC-TSK-0822 v1.1: la clave del movil (capa 5) no se toca desde la sesion.
+    // KJC-TSK-1084 (ADR 0015): los comandos de acto humano (kj harden --commit,
+    // kj identity enroll-phone) ya no se leen aqui: la propia orden rechaza un
+    // proceso que desciende de un agente (src/harden/human-act.js). Queda el
+    // FICHERO de la clave, que solo esto protege hasta que el sandbox lo vete.
     {
-      // KJC-BUG-0354: un titulo o un mensaje de commit que solo lo MENCIONA no es enrolar.
-      const enrollCmd = stripTextOnlyCommandValues(String(input.command || ""));
-      const namesEnroll = (enrollCmd.includes("identity") && enrollCmd.includes("enroll-phone")) || enrollCmd.includes("supervisor-phone.json");
+      // KJC-BUG-0354: un titulo o un mensaje de commit que solo lo MENCIONA no es escribirlo.
+      const namesPhoneFile = stripTextOnlyCommandValues(String(input.command || "")).includes("supervisor-phone.json");
       const writesEnroll = EDIT_TOOLS.includes(tool) && String(input.file_path || "").includes("supervisor-phone.json");
-      if ((tool === "Bash" && namesEnroll) || writesEnroll) {
-        console.error("karajan sentinel: el enrolamiento del movil (capa 5) es un acto humano — pideselo a tu usuario; supervisor-phone.json no se toca desde la sesion." + doc("supervisor"));
-        process.exit(2);
-      }
-    }
-    // ADR 0009 (KJC-BUG-0161): kj harden --commit es un ACTO HUMANO — la
-    // sesion ni lo intenta. Sin escape (superficie de supervisor). includes()
-    // a proposito: cero ambiguedad de escapes en plantilla, y fail-closed
-    // (mencionarlo en un argumento tambien bloquea: preferible a un hueco).
-    // KJC-BUG-0354: salvo en el texto entrecomillado de kj hu add, kj adr add y
-    // git commit, que solo guardan texto (decision del usuario, 16-oct).
-    // ANTES de KJ_SENTINEL_OFF a proposito, como el guard PROTECTED de
-    // arriba: un env var lo pone tambien un agente — el supervisor no se
-    // apaga con interruptores al alcance del supervisado.
-    {
-      const kjCmd = stripTextOnlyCommandValues(String(input.command || ""));
-      if (tool === "Bash" && kjCmd.includes("harden") && kjCmd.includes("--commit")) {
-        console.error("karajan sentinel: kj harden --commit es un acto humano (ADR 0009) — pideselo a tu usuario; ninguna sesion de agente lo ejecuta." + doc("supervisor"));
+      if ((tool === "Bash" && namesPhoneFile) || writesEnroll) {
+        console.error("karajan sentinel: la clave del movil (capa 5) es del humano — supervisor-phone.json no se toca desde la sesion; enrolar es kj identity enroll-phone desde su terminal." + doc("supervisor"));
         process.exit(2);
       }
     }
@@ -676,7 +660,6 @@ process.stdin.on("end", () => {
         return v.length > 0 ? v : null;
       };
       const declaredGh = idLine("gh_user");
-      const declaredEmail = idLine("git_email");
       const ghHostsPath = join(process.env.GH_CONFIG_DIR || join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "gh"), "hosts.yml");
       const activeGh = () => {
         if (!existsSync(ghHostsPath)) return null;
@@ -699,11 +682,11 @@ process.stdin.on("end", () => {
       // $( and backticks are separators too (review catch): their payload is its own segment.
       const SEPS = [";", "&&", "||", "|", "$(", String.fromCharCode(96), "(", ")"];
       const bare = (w) => w.replaceAll(String.fromCharCode(39), "").replaceAll(String.fromCharCode(34), "");
-      const scan = (text, depth) => { if (depth > 3) return; for (const seg of SEPS.reduce((acc, s) => acc.flatMap((l) => l.split(s)), text.split(ESC_NL))) checkSeg(headOf(words(seg)), depth, words(seg)); };
-      const checkSeg = (ws, depth, raw) => {
+      const scan = (text, depth) => { if (depth > 3) return; for (const seg of SEPS.reduce((acc, s) => acc.flatMap((l) => l.split(s)), text.split(ESC_NL))) checkSeg(headOf(words(seg)), depth); };
+      const checkSeg = (ws, depth) => {
         if (ws.length === 0) return;
-        if (WRAPPERS.includes(ws[0])) { // wrapper args have arity (sudo -u bob): scan from the first gh/git/wrapper token (review catch)
-          const j = ws.findIndex((w, i) => i > 0 && ["gh", "git", ...WRAPPERS].includes(bare(w)));
+        if (WRAPPERS.includes(ws[0])) { // wrapper args have arity (sudo -u bob): scan from the first gh/wrapper token (review catch)
+          const j = ws.findIndex((w, i) => i > 0 && ["gh", ...WRAPPERS].includes(bare(w)));
           if (j > 0) scan(ws.slice(j).map(bare).join(" "), depth + 1);
           return;
         }
@@ -715,46 +698,9 @@ process.stdin.on("end", () => {
           if (!declaredGh) { problems.push("gh without a declared identity for this clone — run: kj identity set"); return; }
           const eff = switchedTo || activeGh();
           if (eff !== declaredGh) problems.push("gh as '" + (eff || "no session") + "' but this clone is declared as '" + declaredGh + "' — prefix the command: gh auth switch --user " + declaredGh + " && ...");
-          return;
-        }
-        if (ws[0] === "git") {
-          // Global options (-C, -c, --git-dir, --work-tree...) are NOT re-implemented: they
-          // are forwarded verbatim to git var, so git resolves identity exactly as the real
-          // command would (review catches: -C cumulative, --git-dir, --opt=value forms).
-          const TWO = ["-c", "-C", "--git-dir", "--work-tree", "--namespace", "--super-prefix", "--exec-path", "--config-env"];
-          let k = 1;
-          while (k < ws.length && ws[k].startsWith("-")) k += TWO.includes(ws[k]) && ws[k + 1] ? 2 : 1;
-          const globals = ws.slice(1, k).map(bare);
-          const sub = ws[k];
-          if (sub === "push") { // push authenticates with the gh session, not user.email (review catch)
-            if (!declaredGh) { problems.push("git push without a declared identity for this clone — run: kj identity set"); return; }
-            const eff = switchedTo || activeGh();
-            if (eff !== declaredGh) problems.push("git push with gh session '" + (eff || "no session") + "' but this clone is declared as '" + declaredGh + "' — prefix: gh auth switch --user " + declaredGh + " && ...");
-            return;
-          }
-          // IDN-B2: anything that authors or rewrites commits carries an identity (review catch).
-          if (!["commit", "tag", "merge", "rebase", "cherry-pick", "am", "revert"].includes(sub)) return; // am: the COMMITTER is still this user
-          if (!declaredEmail) { problems.push("git " + sub + " without a declared identity for this clone — run: kj identity set"); return; }
-          // Let GIT resolve author and committer under the command's own environment
-          // (review catch: user.email, -c, GIT_*_EMAIL, EMAIL, GIT_CONFIG_*, includeIf are
-          // its business): git var is the single source of truth.
-          const assigns = raw.slice(0, raw.length - ws.length).filter((w) => w.indexOf("=") > 0);
-          const env = Object.assign({}, process.env);
-          for (const w of assigns) env[w.slice(0, w.indexOf("="))] = bare(w.slice(w.indexOf("=") + 1));
-          const ident = (v) => {
-            const r = spawnSync("git", [...globals, "var", v], { cwd: ROOT, encoding: "utf8", env });
-            const s = r.status === 0 ? String(r.stdout) : "";
-            const a = s.indexOf("<");
-            const b = s.indexOf(">");
-            return a >= 0 && b > a ? s.slice(a + 1, b) : null;
-          };
-          const ai = ws.findIndex((w) => w.startsWith("--author"));
-          const authorRaw = ai < 0 ? null : ws[ai].includes("=") ? ws[ai].slice(ws[ai].indexOf("=") + 1) : ws.slice(ai + 1).join(" ");
-          const authorMail = authorRaw === null ? null : bare(authorRaw.includes("<") ? authorRaw.slice(authorRaw.indexOf("<") + 1, authorRaw.indexOf(">")) : authorRaw.trim());
-          const mails = [authorMail ?? ident("GIT_AUTHOR_IDENT"), ident("GIT_COMMITTER_IDENT")]; // --author overrides the author (review catch); the committer is always git's
-          const offender = mails.find((m) => m !== null && m !== declaredEmail) ?? (mails[0] === null ? "none" : null);
-          if (offender !== null) problems.push("git " + sub + " as '" + offender + "' but this clone is declared as '" + declaredEmail + "' — use: git -c user.email=" + declaredEmail + " " + sub + " ... (or git config user.email " + declaredEmail + ")");
         }
+        // KJC-TSK-1085 (ADR 0015): git commit/tag/rebase/push are no longer read here:
+        // pre-commit checks the author, pre-push every pushed commit and the gh session.
       };
       scan(CMD_TEXT, 0);
       if (problems.length > 0) {
@@ -1177,17 +1123,14 @@ process.stdin.on("end", () => {
         }
       }
       const MERGE = /\\bgh\\s+pr\\s+merge(\\s+(\\d+))?/;
-      const ADVANCE = /\\bgit\\s+commit\\b|\\bgit\\s+push\\b|\\bgh\\s+pr\\s+create\\b/; // push also falls under violations() — explicit here too (review catch)
+      // KJC-TSK-1089: git push is not read any more; pending moves still stop the turn (stop gate).
+      const ADVANCE = /\\bgit\\s+commit\\b|\\bgh\\s+pr\\s+create\\b/;
       const mergeM = cmd.match(MERGE);
       const pend = pendingMoves(load().sessions?.[sid]);
-      // KJC-BUG-0364: one board-gate decision per command; the push gate below
-      // reuses it, so a second slow gh cannot contradict the first answer.
-      let boardDecision = null;
       if (pend.length > 0 && (mergeM || ADVANCE.test(cmd))) {
         // KJC-BUG-0198: una card partida en varias PRs no puede quedar bloqueada
         // por su primera mitad (boardGate, en la lib).
-        boardDecision = boardGate(sid, pend);
-        const { blocking, carried, reason } = boardDecision;
+        const { blocking, carried, reason } = boardGate(sid, pend);
         for (const c of carried) console.error("karajan sentinel: board-sync arrastra " + c.card + " — " + c.why + ", se movera al cerrarla");
         // ADR 0015 (KJC-TSK-0925): no escape; an epic and a card split across PRs
         // are already decided above (KJC-BUG-0230, 0198).
@@ -1234,18 +1177,10 @@ process.stdin.on("end", () => {
           console.error("karajan sentinel: release check en ROJO — no se publica ni despliega hasta resolverlo:" + (items || "\\n- corre kj release check para el detalle") + "\\n(sin escape: se repara lo que el check nombra)" + doc("release"));
           process.exit(2);
         }
-      } else if (PUSH.test(cmd)) {
-        // KJC-BUG-0147: a pending move blocks the push like it blocks the commit.
-        // ADR 0015 (KJC-TSK-0925): with no escape.
-        // KJC-BUG-0262: a carried card does not block the push the commit let through.
-        const sess = load().sessions?.[sid];
-        const decision = boardDecision || boardGate(sid, pendingMoves(sess));
-        const v = violations(sess, branchOf(), decision.blocking);
-        if (v.length) {
-          console.error("karajan sentinel: git push con el metodo en rojo:\\n" + v.map((x) => "- " + x).join("\\n") + (decision.reason ? "\\n(" + decision.reason + ")" : "") + "\\nResuelve antes de empujar. Estado: kj sentinel status" + doc("push-gate"));
-          process.exit(2);
-        }
       }
+      // KJC-TSK-1089 (ADR 0015): git push is no longer read here. The base branch is
+      // protected (required checks), the card and the tests are judged at commit
+      // (kj review), and pending card moves keep the turn from ending (stop gate).
     }
   } catch { /* fail open */ }
   process.exit(0);

package/src/hu/coder-routing.js

@@ -0,0 +1,66 @@
+/**
+ * KJC-TSK-0701 (MR-D): the model and effort the coder of an HU runs on. Its
+ * tier (MR-A) picks them on the first iteration; after a failed one the coder
+ * climbs to the most capable model. A model the user chose always wins, the
+ * reviewer and Solomon are never routed, and model_routing.enabled: false turns
+ * it off; model_routing.by_provider picks other models per level.
+ */
+import { getDefaultModelTiers, resolveModelForRole } from "../utils/model-selector.js";
+
+const TIER_ROUTE = { trivial: { level: "trivial", effort: "low" }, standard: { level: "medium", effort: "medium" } };
+const ESCALATED = { level: "complex", effort: "max" };
+// Only claude's CLI takes --effort.
+const EFFORT_PROVIDERS = new Set(["claude"]);
+
+const userChoice = (config) => {
+  if (config.model_routing?.enabled === false) return "model_routing.enabled is false";
+  if (config.model_routing?.fixed?.coder) return `model_routing.fixed.coder is ${config.model_routing.fixed.coder}`;
+  if (config.roles?.coder?.model) return `the coder model was chosen (${config.roles.coder.model})`;
+  if (config.coder_options?.model) return `the coder model was chosen (${config.coder_options.model})`;
+  if (config.model_profile) return `the model profile ${config.model_profile} was chosen`;
+  return null;
+};
+
+const routed = ({ model, effort, escalated, why }) => ({ skip: false, model, effort, escalated, reason: `${why} -> ${model}${effort ? ` (effort ${effort})` : ""}` });
+
+/**
+ * KJC-TSK-1070: huModel is the HU's coder_model (kj plan fills it from the
+ * tier, the user may change it on the board); it drives the first iteration.
+ * @param {{ tier?: string, huModel?: string|null, attempt: number, config: object }} args
+ * @returns {{ skip: true, reason: string } | { skip: false, model: string, effort: string|null, escalated: boolean, reason: string }}
+ */
+export function routeCoder({ tier, huModel = null, attempt, config }) {
+  const chosen = userChoice(config);
+  if (chosen) return { skip: true, reason: chosen };
+  const provider = config.roles?.coder?.provider || config.coder;
+  const effortOf = (route) => (EFFORT_PROVIDERS.has(provider) ? route?.effort ?? null : null);
+  const escalated = attempt > 1;
+  if (!escalated && huModel) return routed({ model: huModel, effort: effortOf(TIER_ROUTE[tier]), escalated, why: "the HU's coder_model" });
+  const route = escalated ? ESCALATED : TIER_ROUTE[tier];
+  if (!route) return { skip: true, reason: tier === "deep" ? "deep HU: the usual model and effort" : `no tier to route by (${tier ?? "none"})` };
+  const tierMap = getDefaultModelTiers();
+  for (const [name, levels] of Object.entries(config.model_routing?.by_provider ?? {})) tierMap[name] = { ...tierMap[name], ...levels };
+  const model = resolveModelForRole({ role: "coder", provider, level: route.level, tierMap });
+  if (!model) return { skip: true, reason: `${provider} has no known model for the ${route.level} level` };
+  const why = escalated ? `iteration ${attempt} after a failed one: the most capable model` : `${tier} HU`;
+  return routed({ model, effort: effortOf(route), escalated, why });
+}
+
+/**
+ * KJC-TSK-1070: the route of an HU's coder for this attempt, on its lane
+ * config (coder_route, read by the coder stage); a skipped route clears it.
+ */
+export function applyCoderRoute({ laneConfig, story, attempt, config, logger }) {
+  const route = routeCoder({ tier: story.complexity?.tier, huModel: story.coder_model || null, attempt, config });
+  laneConfig.coder_route = route.skip ? null : { model: route.model, effort: route.effort };
+  // KJC-TSK-1071 (MR-D3): the HU keeps its last decision, and whether it ever climbed.
+  story.coder_routing = {
+    tier: story.complexity?.tier ?? null,
+    model: route.skip ? null : route.model,
+    effort: route.skip ? null : route.effort,
+    escalated: Boolean(story.coder_routing?.escalated || route.escalated),
+    reason: route.reason,
+  };
+  logger.info(`HU ${story.id}: coder ${route.skip ? "not routed" : "routed"}: ${route.reason}`);
+  return route;
+}

package/src/hu/model-router.js

@@ -1,4 +1,6 @@
 import { getDefaultModelTiers } from "../utils/model-selector.js";
+import { huComplexity } from "./complexity-tier.js";
+import { routeCoder } from "./coder-routing.js";
 
 // KJC-TSK-0405: dado un HU con complexity score, recomienda coder_model y
 // reviewer_model. El reviewer por defecto usa el provider alternativo al
@@ -35,26 +37,6 @@ const CROSS_PROVIDER_REVIEWER = {
   aider: "claude",
 };
 
-// KJC-TSK-0405 step 2: heurística para inferir complexity desde
-// task_type cuando el planner no emite un score explícito. Permite
-// que el model-router asigne modelos razonables sin un triage explícito.
-const TASK_TYPE_COMPLEXITY = {
-  sw: "medium",
-  refactor: "medium",
-  "add-tests": "simple",
-  infra: "trivial",
-  doc: "trivial",
-  spike: "complex",
-  research: "complex",
-  audit: "complex",
-  analysis: "medium",
-  "no-code": "trivial",
-};
-
-export function complexityFromTaskType(taskType) {
-  return TASK_TYPE_COMPLEXITY[taskType] || "medium";
-}
-
 export function complexityToLevel(complexity) {
   if (typeof complexity === "string" && LEVELS.includes(complexity)) return complexity;
   if (typeof complexity === "number" && SCORE_TO_LEVEL[complexity]) return SCORE_TO_LEVEL[complexity];
@@ -97,3 +79,19 @@ export function recommendModelsForHu({ complexity, coderProvider, config = {} })
     reviewer_provider,
   };
 }
+
+const TIER_LEVEL = { trivial: "trivial", standard: "medium", deep: "complex" };
+
+/**
+ * KJC-TSK-1072 (MR-D4): the models kj plan writes on an HU. coder_model comes
+ * from the HU's tier (MR-A) through routeCoder, the criterion the run uses;
+ * empty for a deep HU or a model the config already chose. The reviewer keeps
+ * its cross-provider recommendation. The tier travels as `complexity`.
+ */
+export function planHuModels({ title = "", goal = "", acceptanceCriteria = [], tier = null, tierReason = null, config = {} }) {
+  const complexity = huComplexity({ title, goal, acceptanceCriteria, tier, tierReason });
+  const coderProvider = config.roles?.coder?.provider || config.coder || "claude";
+  const route = routeCoder({ tier: complexity.tier, attempt: 1, config });
+  const reviewer = recommendModelsForHu({ complexity: TIER_LEVEL[complexity.tier], coderProvider, config });
+  return { ...reviewer, coder_model: route.skip ? null : route.model, complexity };
+}

package/src/hu/routing-metrics.js

@@ -4,7 +4,8 @@
  * fixed set of fields, so the measured ones are kept here, in the plan, where
  * kj report reads them. Unmeasured fields stay out rather than written as null.
  */
-export const ROUTING_FIELDS = ["cost_usd", "tokens_in", "tokens_out", "cached_tokens", "coder", "reviewer_rejections"];
+// KJC-TSK-1071 (MR-D3): coder_routing is the coder's routing decision for the HU.
+export const ROUTING_FIELDS = ["cost_usd", "tokens_in", "tokens_out", "cached_tokens", "coder", "reviewer_rejections", "coder_routing"];
 
 export function keepRoutingMetrics(plan, huId, outcome) {
   const hu = plan?.hus?.find((h) => h.id === huId);

package/src/orchestrator/drivers/iteration-loop.js

@@ -210,6 +210,8 @@ export async function runIterationLoop(ctx, { task: loopTask, askQuestion, emitt
 
     ctx.eventBase.iteration = i;
     ctx.iteration = i;
+    // KJC-TSK-1070 (MR-D2): an HU lane picks its coder's route per iteration.
+    ctx.beforeIteration?.(i);
 
     let iterResult;
     try {

package/src/orchestrator/drivers/run-hu-batch.js

@@ -36,6 +36,7 @@ import { createHuSnapshot } from "../../git/hu-snapshot.js";
 import { generateDiff } from "../../review/diff-generator.js";
 import { runAcceptanceCoverageStage } from "../stages/acceptance-coverage-stage.js";
 import { criteriaOfCard } from "../../roles/acceptance-coverage-role.js";
+import { applyCoderRoute } from "../../hu/coder-routing.js";
 
 /**
  * @param {object} args
@@ -180,6 +181,7 @@ export async function runHuBatch({ ctx, task, askQuestion, emitter, logger }) {
 
         for (let attempt = 1; attempt <= laneConfig.max_iterations; attempt++) {
           logger.info(`HU ${story.id}: coder iteration ${attempt}/${laneConfig.max_iterations}`);
+          applyCoderRoute({ laneConfig, story, attempt, config: ctx.config, logger });
           emitProgress(emitter, makeEvent("iteration:start", { ...ctx.eventBase, stage: "iteration" }, {
             message: `Iteration ${attempt}/${laneConfig.max_iterations}`,
             detail: { iteration: attempt, maxIterations: laneConfig.max_iterations }
@@ -386,7 +388,8 @@ export async function runHuBatch({ ctx, task, askQuestion, emitter, logger }) {
       // Fallback: no acceptance_tests → standard pipeline (reviewer/tester).
       // The loop reads everything through ctx.* — handing it a lane view
       // keeps the shared ctx untouched (no more mutate-and-restore dance).
-      const laneCtx = { ...ctx, config: laneConfig, pipelineFlags: laneFlags, session: laneSession, brainCtx: laneBrain, plannedTask: lanePlannedTask };
+      const laneCtx = { ...ctx, config: laneConfig, pipelineFlags: laneFlags, session: laneSession, brainCtx: laneBrain, plannedTask: lanePlannedTask,
+        beforeIteration: (attempt) => applyCoderRoute({ laneConfig, story, attempt, config: ctx.config, logger }) };
       const result = await runIterationLoop(laneCtx, { task: huTask, askQuestion, emitter, logger });
       if (result?.approved) {
         // KJC-BUG-0248: what the HU's push or PR said joins what the loop recorded.

package/src/orchestrator/hu-sub-pipeline.js

@@ -156,7 +156,7 @@ function sumTokenField(entries, field) {
  *   entries recorded during this HU. Cost D (KJC-TSK-0515).
  * @returns {object}
  */
-function buildHuOutcome({ story: _story, iterResult, status, startedAt, huBudgetEntries }) {
+function buildHuOutcome({ story, iterResult, status, startedAt, huBudgetEntries }) {
   const r = iterResult || {};
   const git = r.git || {};
   // Iterations are tracked in the standard pipeline as
@@ -198,6 +198,8 @@ function buildHuOutcome({ story: _story, iterResult, status, startedAt, huBudget
     // KJC-TSK-0702 (MR-E): the baseline model routing is measured against.
     tokens_out: sumTokenField(huBudgetEntries, 'tokens_out'),
     ...routingBaseline(huBudgetEntries, status),
+    // KJC-TSK-1071 (MR-D3): the routing decision applyCoderRoute left on the HU.
+    coder_routing: story?.coder_routing ?? null,
     finishedAt: new Date().toISOString(),
   };
 }

package/src/orchestrator/stages/coder-stage.js

@@ -79,6 +79,8 @@ export async function runCoderStage({ coderRoleInstance, coderRole, config, logg
       // PAR-H (KJC-TSK-0631): lane env (KJ_LANE_SLOT / KJ_PORT_OFFSET)
       // reaches the coder subprocess so services it starts don't collide.
       env: config?.lane_env || null,
+      // KJC-TSK-1070 (MR-D2): the model and effort of this HU's coder.
+      route: config?.coder_route || null,
       onOutput: coderStall.onOutput,
       // Lets Brain Recovery persist a standby snapshot if the coder's
       // provider hits a quota cap mid-run (KJC hibernation wiring).
@@ -87,7 +89,8 @@ export async function runCoderStage({ coderRoleInstance, coderRole, config, logg
   } finally {
     coderStall.stop();
   }
-  trackBudget({ role: "coder", provider: coderRole.provider, model: coderRole.model, result: coderExecResult.result, duration_ms: Date.now() - coderStart });
+  // KJC-TSK-1071 (MR-D3): the model the HU's route ran the coder on, so kj report measures the real one.
+  trackBudget({ role: "coder", provider: coderRole.provider, model: config?.coder_route?.model ?? coderRole.model, result: coderExecResult.result, duration_ms: Date.now() - coderStart });
   applyQuotaSimulation(coderExecResult, { iteration, agent: coderRole.provider });
   // KJC-BUG-0285 (#1982): a commit the coder made on its own carried the error the
   // reviewer then rejected, and stayed on the branch. Undone softly: the changes

package/src/prompts/reviewer.js

@@ -54,6 +54,8 @@ export async function buildReviewerPromptLayout({ task, diff, reviewRules, mode,
     section(`You are a code reviewer in ${mode} mode.`, STABLE),
     section("CRITICAL SCOPE RULE: Only review changes that are part of the diff below. Do NOT flag issues in unchanged code, missing features planned for future tasks, or improvements outside the scope of this task. If the diff is correct for what the task asks, approve it — even if the broader codebase has other issues.", STABLE),
     section("Only block approval for issues IN THE DIFF that are bugs, security vulnerabilities, or clear violations of the review rules.", STABLE),
+    // KJC-BUG-0369 (#2196): a reviewer blocked GitHub's on.schedule timezone, which exists.
+    section("A claim that a tool, platform or API does not support something the diff uses is not a blocking issue on its own: your training data may predate the feature. Block only when the diff or the task context shows it fails; otherwise put it in non_blocking_suggestions.", STABLE),
     section("Return only one valid JSON object and nothing else.", STABLE),
     section("JSON schema:", STABLE),
     section('{"approved":boolean,"blocking_issues":[{"id":string,"severity":"critical|high|medium|low","category":"security|correctness|performance|style|other","file":string,"line":number,"description":string,"suggested_fix":string}],"non_blocking_suggestions":[string],"summary":string,"confidence":number}', STABLE),

package/src/rag/indexer.js

@@ -173,7 +173,7 @@ export async function indexProject(projectDir, { db, embedder, karajanHome, logg
       if (source.startsWith(prefix) && outOf(source) !== null) deleteChunksBySource(db, source);
     }
     for (const s of sources) {
-      const r = await indexFile(s, { db, embedder, logger, project: slug, kind: sourceKind(s) });
+      const r = await indexFile(s, { db, embedder, logger, project: slug, kind: sourceKind() });
       totals.indexed += r.indexed; totals.failed += r.failed; totals.files += 1;
     }
   }
@@ -211,7 +211,7 @@ export async function indexProjectDelta(projectDir, { db, embedder, since, logge
       logger.info?.(`[rag-indexer] delta delete ${relative(process.cwd(), abs)}`);
     } else if (indexableReason(relative(projectDir, abs), abs, { exclude, projectDir }) === null) {
       // KJC-TSK-0891: the same criterion as the full walk, not a list of extensions.
-      const r = await indexFile(abs, { db, embedder, logger, project: slug, kind: sourceKind(abs) });
+      const r = await indexFile(abs, { db, embedder, logger, project: slug, kind: sourceKind() });
       totals.indexed += r.indexed; totals.failed += r.failed; totals.files += 1;
     }
   }

package/src/report/model-tally.js

@@ -23,11 +23,14 @@ export function modelTally(hus) {
       failure_rate: round(failed / rows.length, 4),
     };
   });
-  return { models, unmeasured: (hus ?? []).length - measured.length };
+  // KJC-TSK-1071 (MR-D3): how many HUs routing moved off the usual model, and how many climbed.
+  const routed = (hus ?? []).filter((h) => h?.outcome?.coder_routing?.model);
+  const routing = { routed: routed.length, escalated: routed.filter((h) => h.outcome.coder_routing.escalated).length };
+  return { models, unmeasured: (hus ?? []).length - measured.length, routing };
 }
 
 /** The kj report block, or null when no HU was run at all. */
-export function formatModelTally({ models, unmeasured }) {
+export function formatModelTally({ models, unmeasured, routing = null }) {
   if (models.length === 0 && unmeasured === 0) return null;
   const lines = ["Coder models (per HU, from the plans):"];
   for (const m of models) {
@@ -35,5 +38,6 @@ export function formatModelTally({ models, unmeasured }) {
     lines.push(`  ${m.model.padEnd(24)} ${m.hus} HU · $${m.cost_usd.toFixed(4)} · ${m.tokens_in} in / ${m.tokens_out} out · ${iterations} iter · ${Math.round(m.failure_rate * 100)}% failed first time`);
   }
   if (unmeasured > 0) lines.push(`  ${unmeasured} HU(s) before the measurement (baseline, unmeasured)`);
+  if (routing?.routed) lines.push(`  Routing: ${routing.routed} HU routed, ${routing.escalated} climbed to the top model (model_routing.enabled: false turns it off)`);
   return lines.join("\n");
 }

package/src/review/one-shot-review.js

@@ -55,12 +55,17 @@ export async function runOneShotReview({
   createAgentFn = createAgent,
   detectAgents = detectAvailableAgents,
   candidateStatusFn = candidateStatus,
+  // KJC-TSK-1075: a third-party PR is not the host's own work, so the reviewer
+  // it names runs even if it is the host; and nothing is stored, so the
+  // review can never unlock a commit of one's own.
+  reviewerOverride = null,
+  persist = true,
 }) {
   if (!diff || !diff.trim()) {
     throw new Error("nothing to review — the diff is empty (stage your changes or pass --range)");
   }
 
-  const reviewer = await pickCrossReviewer({ config, hostAgent, detectAgents });
+  const reviewer = reviewerOverride || await pickCrossReviewer({ config, hostAgent, detectAgents });
   if (!reviewer) {
     throw new Error(
       `cross-AI review requires an agent other than the host (${hostAgent || "unknown"}) — install codex, claude or another supported CLI`
@@ -123,7 +128,7 @@ export async function runOneShotReview({
     throw new Error(await reportUnparseableVerdict({ projectDir, reviewer: activeReviewer, output: result.output, hash: diffHash(diff) }));
   }
 
-  return saveVerdict(projectDir, diff, {
+  const record = {
     verdict: parsed.approved ? "approved" : "rejected",
     reviewer: activeReviewer,
     host: hostAgent || null,
@@ -140,5 +145,6 @@ export async function runOneShotReview({
     // the verdict, bound to this diff, like the other two proofs.
     ...(ui ? { ui } : {}),
     confidence: parsed.confidence ?? null,
-  });
+  };
+  return persist ? saveVerdict(projectDir, diff, record) : record;
 }

package/src/review/pr-requirements.js

@@ -0,0 +1,87 @@
+/**
+ * KJC-TSK-1076: the requirements of a third-party PR, checked with no tokens.
+ * Each check is {id, ok, detail}; none stops the review (the agent decides).
+ * The rules are the own-work ones: the same budget, Conventional Commits and
+ * attribution patterns, and tests-with-code.
+ */
+import { AI_ATTRIBUTION, CONVENTIONAL_TYPES } from "../harden/hook-templates.js";
+import { loadPolicy } from "../policy/engine.js";
+import { runCommand } from "../utils/process.js";
+import { budgetedAdded } from "./loc-budget.js";
+import { checkTestsWithCode } from "./tests-with-code.js";
+
+const HEADER_MAX = 100;
+const CONVENTIONAL = new RegExp(String.raw`^(${CONVENTIONAL_TYPES})(\([^)]+\))?!?: \S`);
+const ATTRIBUTION = new RegExp(AI_ATTRIBUTION, "i");
+
+const rowsOf = (numstat) => numstat.split("\n").map((l) => l.trim()).filter(Boolean).map((l) => {
+  const [a, r, ...f] = l.split(/\s+/);
+  return { file: f.join(" "), added: a === "-" ? 1 : Number(a) || 0, removed: r === "-" ? 0 : Number(r) || 0 };
+});
+
+/**
+ * The PR size budget, one source for every gate (PL-C, KJC-TSK-0735): the
+ * policy's net_lines_added invariant, else method_gates.pr_size_max, 200.
+ */
+export function prSizeLimit({ projectDir, config }) {
+  const pol = loadPolicy({ projectDir });
+  const inv = pol.errors.length === 0
+    ? (pol.policy.invariants || []).find((i) => i.kind === "diff-threshold" && i.metric === "net_lines_added")
+    : null;
+  return {
+    ideal: config?.method_gates?.pr_size_warn ?? 150,
+    limit: inv?.max ?? config?.method_gates?.pr_size_max ?? 200,
+    source: inv ? `policy [${inv.id}]` : "method_gates",
+  };
+}
+
+/** Lines added that count against the budget (generated output and human docs exempt). */
+export function sizeCheck({ numstat, limit }) {
+  const { added, exempt } = budgetedAdded(numstat);
+  const exemptNote = exempt > 0 ? ` (${exempt} exempt)` : "";
+  return added > limit
+    ? { id: "size", ok: false, detail: `${added} lines added${exemptNote}, over the ${limit}-line limit: partition the PR` }
+    : { id: "size", ok: true, detail: `${added} lines added${exemptNote}, within the ${limit}-line limit` };
+}
+
+/** Conventional Commits headers (at most 100 characters) and no AI attribution in base..head. */
+export function commitChecks(commits) {
+  const badHeader = commits.filter((c) => !CONVENTIONAL.test(c.subject) || c.subject.length > HEADER_MAX);
+  const attributed = commits.filter((c) => ATTRIBUTION.test(`${c.subject}\n${c.body}`));
+  const list = (cs) => cs.map((c) => `${c.sha.slice(0, 8)} "${c.subject}"`).join(", ");
+  return [
+    badHeader.length
+      ? { id: "conventional-commits", ok: false, detail: `not Conventional Commits or over ${HEADER_MAX} characters: ${list(badHeader)}` }
+      : { id: "conventional-commits", ok: true, detail: `${commits.length} commit(s) with Conventional Commits headers` },
+    attributed.length
+      ? { id: "ai-attribution", ok: false, detail: `AI attribution in: ${list(attributed)}` }
+      : { id: "ai-attribution", ok: true, detail: "no AI attribution in the commits" },
+  ];
+}
+
+/** Source changed with no test changed (a delete-only change needs none). */
+export function testsCheck({ config, numstat }) {
+  const rows = rowsOf(numstat);
+  const res = checkTestsWithCode({ config, stagedFiles: rows.map((r) => r.file), numstat: rows });
+  const ok = res.ok && res.mode !== "warn";
+  return { id: "tests", ok, detail: ok ? `tests: ${res.mode}` : res.reason || "source changed with no test changed" };
+}
+
+const git = async (projectDir, args) => {
+  const res = await runCommand("git", args, { cwd: projectDir });
+  if (res.exitCode !== 0) throw new Error(`git ${args.join(" ")} failed: ${(res.stderr || "").trim()}`);
+  return res.stdout;
+};
+
+/** Size, commits and tests of base...head, read from git. */
+export async function prRequirementChecks({ range, projectDir, config, run = git }) {
+  const numstat = await run(projectDir, ["diff", "--numstat", range]);
+  // The commits of a PR are base..head, whichever range notation was given.
+  const [base, head] = range.split(/\.{2,3}/);
+  const log = await run(projectDir, ["log", "--format=%H%x1f%s%x1f%b%x1e", `${base}..${head || "HEAD"}`]);
+  const commits = log.split("\x1e").map((r) => r.trim()).filter(Boolean).map((r) => {
+    const [sha, subject = "", body = ""] = r.split("\x1f");
+    return { sha, subject, body };
+  });
+  return [sizeCheck({ numstat, limit: prSizeLimit({ projectDir, config }).limit }), ...commitChecks(commits), testsCheck({ config, numstat })];
+}

package/src/review/pr-security.js

@@ -0,0 +1,70 @@
+/**
+ * KJC-TSK-1077: the security and privacy requirements of a third-party PR,
+ * with no tokens. Each check is {id, ok, detail} and never stops the review.
+ * They reuse the scanners kj applies to its own work: the output guard's
+ * credential patterns, the privacy scan, the prompt-injection catalog, the
+ * supply-chain cooldown and semgrep, limited to the PR's files.
+ */
+import { CREDENTIAL_PATTERNS, scanDiff as scanGuards } from "../guards/output-guard.js";
+import { scanDiff as scanInjection } from "../utils/injection-guard.js";
+import { loadPrivacyList, scanText } from "../privacy/scan.js";
+import { isGeneratedPath, splitAddedByFile } from "../privacy/diff-scope.js";
+import { collectSemgrepFindings } from "../audit/semgrep-findings.js";
+import { cooldownAdvisories } from "./dep-cooldown.js";
+
+const CREDENTIAL_IDS = new Set(CREDENTIAL_PATTERNS.map((p) => p.id));
+const BLOCKING_SEMGREP = new Set(["ERROR", "WARNING"]);
+const check = (id, problems, okDetail) => (problems.length
+  ? { id, ok: false, detail: problems.join("; ") }
+  : { id, ok: true, detail: okDetail });
+
+/** Credentials in added lines (AWS, private keys, tokens, URLs with passwords...). */
+export function secretsCheck(diff, config) {
+  const found = scanGuards(diff, config).violations.filter((v) => CREDENTIAL_IDS.has(v.id));
+  return check("secrets", found.map((v) => `${v.file}:${v.line} ${v.id}`), "no secrets in the added lines");
+}
+
+/** Personal data in added lines, masked; generated output only for denylist hits. */
+export function privacyCheck(diff, { list = loadPrivacyList() } = {}) {
+  const found = splitAddedByFile(diff).flatMap(({ file, added }) => {
+    const hits = scanText(added, { list, source: file });
+    return isGeneratedPath(file) ? hits.filter((f) => f.severity === "block") : hits;
+  });
+  return check("privacy", found.map((f) => `${f.source}:${f.line} ${f.type} ${f.masked}`), "no personal data in the added lines");
+}
+
+/** Prompt-injection patterns in the added lines (text an AI will read). */
+export function injectionCheck(diff) {
+  const res = scanInjection(diff);
+  return check("prompt-injection", res.clean ? [] : [res.summary], "no prompt-injection patterns");
+}
+
+/** Dependencies the lockfile adds that were published under the threshold. */
+export async function cooldownCheck(diff, { advisories = cooldownAdvisories, thresholdHours } = {}) {
+  const { young = [], unverified = [], skipped = 0 } = await advisories(diff, thresholdHours ? { thresholdHours } : {});
+  const problems = young.map((p) => `${p.name}@${p.version} published ${p.hours} h ago`);
+  const notes = [...unverified.map((p) => `${p.name}@${p.version} unverified`), ...(skipped ? [`${skipped} packages changed, none checked`] : [])];
+  const res = check("dependency-cooldown", problems, "no dependency published in the last hours");
+  return notes.length ? { ...res, detail: `${res.detail} (${notes.join("; ")})` } : res;
+}
+
+/** semgrep (the static part of kj audit --security), counted on the PR's files only. */
+export async function semgrepCheck({ projectDir, files, collect = collectSemgrepFindings }) {
+  const res = await collect(projectDir);
+  if (!res.available) return { id: "semgrep", ok: true, detail: `not available: ${res.reason}` };
+  const inPr = new Set(files);
+  const found = (res.findings ?? []).filter((f) => inPr.has(f.file) && BLOCKING_SEMGREP.has(f.severity));
+  return check("semgrep", found.map((f) => `${f.file}:${f.line} ${f.rule}`), "no semgrep findings in the PR's files");
+}
+
+/** Every security and privacy check of the PR's diff. */
+export async function prSecurityChecks({ diff, projectDir, config }) {
+  const files = splitAddedByFile(diff).map((f) => f.file);
+  return [
+    secretsCheck(diff, config),
+    privacyCheck(diff),
+    injectionCheck(diff),
+    await cooldownCheck(diff, { thresholdHours: config?.supply_chain?.cooldown_hours }),
+    await semgrepCheck({ projectDir, files }),
+  ];
+}