karajan-code 4.55.0 → 4.56.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "karajan-code",
-  "version": "4.55.0",
+  "version": "4.56.0",
   "description": "Local multi-agent coding orchestrator with TDD, SonarQube, and code review pipeline",
   "type": "module",
   "license": "AGPL-3.0",

package/src/cli/register-pipeline.js

@@ -15,6 +15,7 @@ import { statusCommand } from "../commands/status.js";
 import { loadPlan } from "../plan/plan-store.js";
 import { withConfig } from "./_shared.js";
 import { publishPrReview } from "../review/publish-pr.js";
+import { thirdPartyReviewCommand } from "../review/third-party-review.js";
 
 /**
  * Register the "core pipeline" commands: everything the user runs day-to-day
@@ -257,8 +258,15 @@ export function registerPipeline(program, { pkgVersion }) {
     .option("--walked <route>", "Recorrido comprobado como lo haría una persona (repetible) — queda en el veredicto", (v, prev) => [...(prev || []), v], [])
     .option("--walked-with <tool>", "Con qué se comprobó el recorrido (por ejemplo chrome-devtools)")
     .option("--publish-pr <n>", "Publish the cross-AI verdicts of a PR's commits on it as one GitHub review")
+    .option("--third-party", "Review someone else's PR (--range base...head): reviewer only, no own-work gates, no verdict stored")
+    .option("--json", "With --third-party: print the review as one JSON document on stdout")
     .action(async (task, flags) => {
       await withConfig(pkgVersion, "review", flags, async ({ config, logger }) => {
+        // KJC-TSK-1075 (#2227): a third-party PR, for reviewer agents; own work keeps every gate.
+        if (flags.thirdParty) {
+          process.exitCode = await thirdPartyReviewCommand({ flags: { ...flags, task: task ?? null }, config });
+          return;
+        }
         // KJC-TSK-0913: the verdicts kj already holds, published on the PR as one review.
         if (flags.publishPr) {
           const r = await publishPrReview({ projectDir: config.projectDir || process.cwd(), pr: flags.publishPr });

package/src/commands/harden.js

@@ -16,6 +16,7 @@ import { interactiveHarden } from "../harden/interactive.js";
 import { createWizard, isTTY } from "../utils/wizard.js";
 import { commitSupervisorRegeneration } from "../harden/supervisor-commit.js";
 import { installConfigsForRoots } from "../harden/config-engine.js";
+import { readHardenConfig } from "../harden/harden-scope.js";
 import { installGuidelines } from "../harden/guidelines-engine.js";
 import { maybeRulesyncGenerate } from "../utils/rulesync.js";
 import { commandsForLanguage } from "../harden/hook-commands.js";
@@ -35,21 +36,6 @@ const JS_TEST_CMD = {
   mocha: "npx mocha",
 };
 
-/**
- * Per-repo harden scope, persisted in package.json `kj.harden` so a repo with
- * sub-tools (e.g. a python wrapper) excludes them once instead of on every
- * invocation (KJC-TSK-0564). CLI flags are merged on top.
- */
-function readHardenConfig(projectDir) {
-  const pkgPath = join(projectDir, "package.json");
-  if (!existsSync(pkgPath)) return {};
-  try {
-    return JSON.parse(readFileSync(pkgPath, "utf8")).kj?.harden ?? {};
-  } catch {
-    return {};
-  }
-}
-
 /**
  * Resolve the hook's lint/format/test commands for the primary language.
  * Non-JS stacks use their native toolchain (go/ruff/…); JS/TS is built from

package/src/commands/rag.js

@@ -38,7 +38,7 @@ async function indexFiles({ files, projectDir, db, embedder, slug, logger, json,
       logger.warn?.(`[rag] ${out}: not indexed`);
       continue;
     }
-    const r = await indexFile(abs, { db, embedder, logger, project: slug, kind: sourceKind(abs) });
+    const r = await indexFile(abs, { db, embedder, logger, project: slug, kind: sourceKind() });
     totals.indexed += r.indexed; totals.failed += r.failed; totals.files += 1;
   }
   const deleted = totals.deleted ? `, ${totals.deleted} chunks deleted` : "";

package/src/commands/review-gate.js

@@ -26,6 +26,8 @@ import { loadPrivacyList, scanText } from "../privacy/scan.js";
 import { isGeneratedPath, splitAddedByFile } from "../privacy/diff-scope.js";
 import { budgetedAdded, budgetedNet } from "../review/loc-budget.js";
 import { checkStagedDiff, loadPolicy } from "../policy/engine.js";
+import { prSizeLimit } from "../review/pr-requirements.js";
+import { stewardBlocking } from "../steward/gate.js";
 import { loadStandingExceptions, recordPolicyException } from "../policy/exceptions.js";
 import { policyFileHash, recordGateDecision } from "../policy/decisions.js";
 import { evaluatePolicyGate } from "../review/policy-gate.js";
@@ -227,6 +229,14 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
   const card = await enforceCardFirst({ config, projectDir });
   if (!card.ok) return { verdict: "rejected", reviewer: "card-first", issues: [{ severity: "high", description: card.reason }] };
 
+  // KJC-TSK-1086: the Steward's block at commit too, not only where Edit starts work.
+  const steward = stewardBlocking({ projectDir, config });
+  if (steward) {
+    console.log(`✗ ${steward.reason}`);
+    process.exitCode = 1;
+    return { verdict: "rejected", reviewer: "steward", issues: [{ severity: "high", description: steward.reason }] };
+  }
+
   // KJC-TSK-0687 (MG-B): the verifiable half of TDD — sources without a
   // single test change warn (block via method_gates.tests_with_code).
   const changedFiles = (await rawDiff(flags.range, ["--name-only"])).split("\n").map((f) => f.trim()).filter(Boolean);
@@ -246,16 +256,12 @@ export async function reviewGateCommand({ config, logger = null, flags = {} }) {
   // PL-C (KJC-TSK-0735), fuente única de umbrales: si la policy declara el
   // invariante net_lines_added, SU max es el umbral — el mismo número que
   // aplican kj policy check y el tier C de CI; method_gates queda de fallback.
-  const pol = loadPolicy({ projectDir });
-  const locInv = pol.errors.length === 0
-    ? (pol.policy.invariants || []).find((i) => i.kind === "diff-threshold" && i.metric === "net_lines_added")
-    : null;
   // KJC-BUG-0326 (#2085): two tiers. ~150 is the ideal (method_gates.pr_size_warn);
   // up to the limit (the policy's net_lines_added max, else method_gates.pr_size_max,
-  // 200) is allowed without asking; above the limit, partition.
-  const sizeIdeal = config?.method_gates?.pr_size_warn ?? 150;
-  const sizeWarn = locInv?.max ?? config?.method_gates?.pr_size_max ?? 200;
-  const sizeSource = locInv ? `policy [${locInv.id}]` : "method_gates";
+  // 200) is allowed without asking; above the limit, partition. KJC-TSK-1076: one
+  // source, shared with the third-party PR checks.
+  const pol = loadPolicy({ projectDir });
+  const { ideal: sizeIdeal, limit: sizeWarn, source: sizeSource } = prSizeLimit({ projectDir, config });
   if (sizeWarn > 0) {
     const numstat = await rawDiff(flags.range, ["--numstat"]);
     // KJC-BUG-0205: the budget caps CODE growth, so generated output and human

package/src/harden/check.js

@@ -11,8 +11,9 @@ import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 
 import { runCommand } from "../utils/process.js";
-import { artifactIdForConfig, findAlternative } from "./alternatives.js";
+import { configLeftAlone } from "./config-engine.js";
 import { CONFIGS_BY_LANGUAGE, UNIVERSAL_CONFIGS } from "./config-templates.js";
+import { readHardenConfig } from "./harden-scope.js";
 import { PROFILE_HOOKS } from "./hook-templates.js";
 import { detectStackRoots } from "./stack-roots.js";
 import { qualityWorkflowFor, WORKFLOWS } from "./workflow-templates.js";
@@ -49,24 +50,24 @@ export async function checkHarden({ projectDir = process.cwd(), profile = "stand
   // Config + workflows ship with standard+ — and surface the greenfield gap:
   // a language now present but never hardened ⇒ its config shows as missing.
   if (profile !== "minimal") {
-    const roots = detectStackRoots(projectDir);
+    // KJC-BUG-0370: the same scope (package.json kj.harden) and the same verdict on a
+    // missing config as kj harden, so check never calls drift what harden leaves alone.
+    const { only = [], exclude = [] } = readHardenConfig(projectDir);
+    const roots = detectStackRoots(projectDir, { only, exclude });
+    const configCheck = (cfg, rel, altDirs, missing) => {
+      const leftAlone = existsSync(join(projectDir, rel)) ? null : configLeftAlone(cfg, altDirs);
+      if (!leftAlone) return presence(projectDir, rel, `config:${rel}`, missing);
+      const detail = leftAlone.action === "covered" ? `covered by ${leftAlone.by}` : `omitted: ${leftAlone.note}`;
+      return { id: `config:${rel}`, ok: true, detail };
+    };
     for (const cfg of UNIVERSAL_CONFIGS) {
-      checks.push(presence(projectDir, cfg.file, `config:${cfg.file}`, "missing — run kj harden"));
+      checks.push(configCheck(cfg, cfg.file, [projectDir], "missing — run kj harden"));
     }
     for (const { dir, language } of roots) {
       const rootDir = dir === "." ? projectDir : join(projectDir, dir);
       for (const cfg of CONFIGS_BY_LANGUAGE[language] ?? []) {
         const rel = dir === "." ? cfg.file : join(dir, cfg.file);
-        // A config covered by the user's own tool (biome.json ⇒ eslint+prettier)
-        // is not drift — kj must not demand a second linter/formatter (KJC-TSK-0614).
-        if (!existsSync(join(projectDir, rel))) {
-          const alt = findAlternative([rootDir, projectDir], artifactIdForConfig(cfg));
-          if (alt) {
-            checks.push({ id: `config:${rel}`, ok: true, detail: `covered by ${alt.foundAt} (${alt.tool})` });
-            continue;
-          }
-        }
-        checks.push(presence(projectDir, rel, `config:${rel}`, `missing for ${language} — run kj harden`));
+        checks.push(configCheck(cfg, rel, [rootDir, projectDir], `missing for ${language} — run kj harden`));
       }
     }
     const expectedWf = [...WORKFLOWS];

package/src/harden/config-engine.js

@@ -33,6 +33,27 @@ function hasTool(dirs, tool) {
   return false;
 }
 
+/**
+ * Why kj leaves a missing config alone, or null when it seeds it. KJC-BUG-0370:
+ * kj check reads the same answer, so it never calls drift what harden skips.
+ */
+export function configLeftAlone(cfg, altDirs) {
+  const id = artifactIdForConfig(cfg);
+  const alt = findAlternative(altDirs, id);
+  if (alt) return { action: "covered", by: alt.foundAt };
+  // KJC-BUG-0119: a same-tool variant (eslint.config.mjs, .eslintrc.json,
+  // package.json#eslintConfig…) means the config already EXISTS — seeding
+  // kj's default filename next to it would silently ECLIPSE the user's
+  // real config (eslint resolves eslint.config.js before .mjs).
+  const variant = findEquivalentIn(altDirs, id);
+  if (variant) return { action: "covered", by: variant };
+  // KJC-BUG-0137: no tool ⇒ no config — report the actionable gap instead.
+  if (cfg.requires && !hasTool(altDirs, cfg.requires)) {
+    return { action: "omitted", note: `${cfg.requires} is not installed — npm i -D ${cfg.requires}, then re-run kj harden` };
+  }
+  return null;
+}
+
 function writeFile(target, content) {
   mkdirSync(dirname(target), { recursive: true });
   writeFileSync(target, content);
@@ -50,30 +71,10 @@ function seedInto(targetDir, configs, dryRun, prefix, results, altDirs = [target
     const exists = existsSync(target);
     const file = prefix === "." ? cfg.file : join(prefix, cfg.file);
 
-    if (!exists) {
-      const alt = findAlternative(altDirs, artifactIdForConfig(cfg));
-      if (alt) {
-        results.push({ file, action: "covered", by: alt.foundAt });
-        continue;
-      }
-      // KJC-BUG-0119: a same-tool variant (eslint.config.mjs, .eslintrc.json,
-      // package.json#eslintConfig…) means the config already EXISTS — seeding
-      // kj's default filename next to it would silently ECLIPSE the user's
-      // real config (eslint resolves eslint.config.js before .mjs).
-      const variant = findEquivalentIn(altDirs, artifactIdForConfig(cfg));
-      if (variant) {
-        results.push({ file, action: "covered", by: variant });
-        continue;
-      }
-      // KJC-BUG-0137: no tool ⇒ no config — report the actionable gap instead.
-      if (cfg.requires && !hasTool(altDirs, cfg.requires)) {
-        results.push({
-          file,
-          action: "omitted",
-          note: `${cfg.requires} is not installed — npm i -D ${cfg.requires}, then re-run kj harden`,
-        });
-        continue;
-      }
+    const leftAlone = exists ? null : configLeftAlone(cfg, altDirs);
+    if (leftAlone) {
+      results.push({ file, ...leftAlone });
+      continue;
     }
 
     if (cfg.json) {

package/src/harden/harden-scope.js

@@ -0,0 +1,18 @@
+/**
+ * Per-repo harden scope, persisted in package.json `kj.harden` so a repo with
+ * sub-tools (e.g. a python wrapper) excludes them once instead of on every
+ * invocation (KJC-TSK-0564). KJC-BUG-0370: kj harden and kj check read it from
+ * here, so check never asks for configs harden was told to leave out.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+export function readHardenConfig(projectDir) {
+  const pkgPath = join(projectDir, "package.json");
+  if (!existsSync(pkgPath)) return {};
+  try {
+    return JSON.parse(readFileSync(pkgPath, "utf8")).kj?.harden ?? {};
+  } catch {
+    return {};
+  }
+}

package/src/harden/hook-templates.js

@@ -10,8 +10,9 @@
 
 import { homedir } from "node:os";
 
-const CONVENTIONAL_TYPES = "feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert";
-const AI_ATTRIBUTION = "co-authored-by:.*(claude|gpt|copilot|gemini)|(generated|written) (by|with) .*(claude|gpt|copilot)";
+// KJC-TSK-1076: exported so the third-party PR checks apply the same rules.
+export const CONVENTIONAL_TYPES = "feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert";
+export const AI_ATTRIBUTION = "co-authored-by:.*(claude|gpt|copilot|gemini)|(generated|written) (by|with) .*(claude|gpt|copilot)";
 
 export const SHEBANG = "#!/usr/bin/env sh";
 
@@ -45,10 +46,12 @@ export function toPortableHooksDir(dir, home = homedir()) {
 function chainToGlobal(hook, globalHooksDir) {
   if (!globalHooksDir) return [];
   const dir = toPortableHooksDir(globalHooksDir);
+  // KJC-TSK-1085: pre-push already read the refs from stdin; the chained hook gets them back.
+  const call = hook === "pre-push" ? `printf '%s\\n' "$kj_push_refs" | "${dir}/${hook}" "$@"; rc=$?` : `"${dir}/${hook}" "$@"; rc=$?`;
   return [
     "# Chain the machine's previous global hook (kj harden keeps it active).",
     `if [ -x "${dir}/${hook}" ]; then`,
-    `  "${dir}/${hook}" "$@"; rc=$?`,
+    `  ${call}`,
     '  [ "$rc" -eq 0 ] || exit "$rc"',
     "fi",
   ];
@@ -100,6 +103,22 @@ function identityGuard(hook) {
   }
   return [
     ...head,
+    // KJC-TSK-1085: every commit the push brings carries the declared identity
+    // (a rebase, cherry-pick, merge or tag never ran pre-commit).
+    "  kj_declared_email=$(sed -n 's/^git_email:[[:space:]]*//p' .karajan/identity.local.yml | head -n1)",
+    '  if [ -n "$kj_declared_email" ]; then',
+    '    printf "%s\\n" "$kj_push_refs" | while read -r kj_lref kj_lsha kj_rref kj_rsha; do',
+    '      case "$kj_lsha" in *[!0]*) ;; *) continue ;; esac',
+    // A new ref: what the PUSH TARGET ($1, the remote git hands the hook) does not have yet.
+    '      case "$kj_rsha" in *[!0]*) kj_new=$(git rev-list "$kj_rsha..$kj_lsha") ;; *) kj_new=$(git rev-list "$kj_lsha" --not --remotes="${1:-origin}") ;; esac',
+    "      for kj_c in $kj_new; do",
+    '        kj_who=$(git log -1 --format="%ae %ce" "$kj_c")',
+    '        if [ "$kj_who" != "$kj_declared_email $kj_declared_email" ]; then',
+    '          echo "kj harden: identity lock — commit $(git log -1 --format=%h "$kj_c") is authored/committed as $kj_who but this clone is declared as $kj_declared_email"; exit 1',
+    "        fi",
+    "      done",
+    "    done || exit 1",
+    "  fi",
     "  kj_declared_gh=$(sed -n 's/^gh_user:[[:space:]]*//p' .karajan/identity.local.yml | head -n1)",
     '  kj_hosts="${GH_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/gh}/hosts.yml"',
     "  kj_active_gh=$(awk '/^github.com:/{f=1;next} f&&/^[^[:space:]]/{f=0} f&&/^[[:space:]]*user:/{sub(/^[[:space:]]*user:[[:space:]]*/,\"\");print;exit}' \"$kj_hosts\" 2>/dev/null)",
@@ -178,6 +197,8 @@ export function hookBody(hook, cmds = {}, { globalHooksDir = null, baseBranch =
       ].join("\n");
     case "pre-push": {
       const lines = [
+        // KJC-TSK-1085: git hands the pushed refs on stdin; kept for the identity check and the chained hook.
+        "[ -t 0 ] || kj_push_refs=$(cat)",
         "# Identity guard — never push without a configured git identity.",
         'if [ -z "$(git config user.email)" ] || [ -z "$(git config user.name)" ]; then',
         "  echo 'kj harden: git user.name/user.email not set — refusing to push'; exit 1",

package/src/harden/human-act.js

@@ -8,18 +8,36 @@
  *  4.   a random nonce typed back, read from the real controlling terminal.
  */
 import { randomBytes } from "node:crypto";
-import { closeSync, openSync, readFileSync, readSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { closeSync, existsSync, openSync, readFileSync, readSync } from "node:fs";
 
 const AGENT_PROC = /claude|codex|copilot|gemini|opencode|\bagy\b/i;
 
-export function agentAncestry({ pid = process.pid, readProc = null, maxDepth = 40 } = {}) {
-  const read = readProc || ((p) => {
-    const stat = readFileSync(`/proc/${p}/stat`, "utf8");
-    const ppid = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
-    let cmd = "";
-    try { cmd = readFileSync(`/proc/${p}/cmdline`).toString("utf8").replaceAll("\0", " "); } catch { /* gone */ }
-    return { ppid, cmd };
-  });
+const procRead = (p) => {
+  const stat = readFileSync(`/proc/${p}/stat`, "utf8");
+  const ppid = Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
+  let cmd = "";
+  try { cmd = readFileSync(`/proc/${p}/cmdline`).toString("utf8").replaceAll("\0", " "); } catch { /* gone */ }
+  return { ppid, cmd };
+};
+
+// KJC-TSK-1084: without /proc (macOS) the chain comes from ps, so a human
+// there is not refused for an ancestry nobody could read.
+// The system binary by absolute path: a ps resolved through PATH could be the
+// agent's own forgery prepended to it.
+const PS_BIN = ["/bin/ps", "/usr/bin/ps"].find((p) => existsSync(p)) ?? null;
+const psOutput = (p) => {
+  if (!PS_BIN) throw new Error("no system ps (/bin/ps, /usr/bin/ps)");
+  return execFileSync(PS_BIN, ["-o", "ppid=", "-o", "command=", "-p", String(p)], { encoding: "utf8", env: {} });
+};
+const psRead = (ps) => (p) => {
+  const m = /^\s*(\d+)\s+(.*)$/s.exec(String(ps(p) ?? ""));
+  if (!m) throw new Error(`ps gave nothing for pid ${p}`);
+  return { ppid: Number(m[1]), cmd: m[2].trim() };
+};
+
+export function agentAncestry({ pid = process.pid, readProc = null, maxDepth = 40, hasProc = existsSync("/proc/self/stat"), ps = psOutput } = {}) {
+  const read = readProc || (hasProc ? procRead : psRead(ps));
   let cur = pid;
   for (let i = 0; i < maxDepth && cur > 1; i += 1) {
     let info;
@@ -37,6 +55,11 @@ export function refuseAgentSession(what, { env = process.env, tty = process.stdo
     throw new Error(`${what} es un acto humano: córrelo desde TU terminal, fuera de una sesión de agente (ADR 0009)`);
   }
   const anc = agentAncestry(ancestry);
+  // KJC-TSK-1084: fail closed. Nothing else stops a human act any more (the
+  // Sentinel does not read its text), so an ancestry that cannot be read is no pass.
+  if (anc.unknown) {
+    throw new Error(`${what} es un acto humano y no se pudo comprobar la ascendencia de procesos — córrelo desde TU terminal (ADR 0009)`);
+  }
   if (anc.agent) {
     throw new Error(`${what} es un acto humano y este proceso desciende de un agente (${anc.match}) — ni con pty falso ni con el entorno limpio (ADR 0009)`);
   }

package/src/harden/sentinel-hooks.js

@@ -475,7 +475,7 @@ import { appendFileSync, existsSync, readFileSync, realpathSync, statSync } from
 import { spawnSync } from "node:child_process";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
-import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, STATE, branchOf, foreignLane, load, save, session, violations, boardGate, pendingMoves, pendingText } from "./sentinel-lib.mjs";
+import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, STATE, branchOf, foreignLane, load, save, session, boardGate, pendingMoves, pendingText } from "./sentinel-lib.mjs";
 // KJC-TSK-0915 (ADR 0014): the shell reader is a real, unit-tested module copied here as is.
 import { isGhIssueCreate, isPublishCommand, optionValues, shellSegments, stripInertQuotes, stripTextOptionValues, stripTextOnlyCommandValues } from "./sentinel-shell.mjs";
 import { DISCARD_VERBS, discardOf, foreignLost, removedFiles } from "./sentinel-discard.mjs";
@@ -485,7 +485,6 @@ const inOrder = (want, got) => { let i = 0; for (const w of got) if (w === want[
 // KJC-BUG-0333: a publish is read per simple command by the shell reader, so
 // words inside a quoted argument of another command are not a publish.
 const isPublish = isPublishCommand;
-const PUSH = /\\bgit\\s+push\\b/;
 const PROTECTED = /\\.claude\\/settings\\.json\\b|\\.karajan\\/(hooks|harness)\\//;
 let raw = "";
 process.stdin.on("data", (d) => { raw += d; });
@@ -606,32 +605,17 @@ process.stdin.on("end", () => {
         }
       }
     }
-    // KJC-TSK-0822 v1.1: enrolar (o pisar) la clave del movil es acto humano
-    // — si un agente pudiera enrolar una clave SUYA, contestaria la capa 5 el
-    // solo. Ni el comando ni el fichero de enrolamiento desde la sesion.
+    // KJC-TSK-0822 v1.1: la clave del movil (capa 5) no se toca desde la sesion.
+    // KJC-TSK-1084 (ADR 0015): los comandos de acto humano (kj harden --commit,
+    // kj identity enroll-phone) ya no se leen aqui: la propia orden rechaza un
+    // proceso que desciende de un agente (src/harden/human-act.js). Queda el
+    // FICHERO de la clave, que solo esto protege hasta que el sandbox lo vete.
     {
-      // KJC-BUG-0354: un titulo o un mensaje de commit que solo lo MENCIONA no es enrolar.
-      const enrollCmd = stripTextOnlyCommandValues(String(input.command || ""));
-      const namesEnroll = (enrollCmd.includes("identity") && enrollCmd.includes("enroll-phone")) || enrollCmd.includes("supervisor-phone.json");
+      // KJC-BUG-0354: un titulo o un mensaje de commit que solo lo MENCIONA no es escribirlo.
+      const namesPhoneFile = stripTextOnlyCommandValues(String(input.command || "")).includes("supervisor-phone.json");
       const writesEnroll = EDIT_TOOLS.includes(tool) && String(input.file_path || "").includes("supervisor-phone.json");
-      if ((tool === "Bash" && namesEnroll) || writesEnroll) {
-        console.error("karajan sentinel: el enrolamiento del movil (capa 5) es un acto humano — pideselo a tu usuario; supervisor-phone.json no se toca desde la sesion." + doc("supervisor"));
-        process.exit(2);
-      }
-    }
-    // ADR 0009 (KJC-BUG-0161): kj harden --commit es un ACTO HUMANO — la
-    // sesion ni lo intenta. Sin escape (superficie de supervisor). includes()
-    // a proposito: cero ambiguedad de escapes en plantilla, y fail-closed
-    // (mencionarlo en un argumento tambien bloquea: preferible a un hueco).
-    // KJC-BUG-0354: salvo en el texto entrecomillado de kj hu add, kj adr add y
-    // git commit, que solo guardan texto (decision del usuario, 16-oct).
-    // ANTES de KJ_SENTINEL_OFF a proposito, como el guard PROTECTED de
-    // arriba: un env var lo pone tambien un agente — el supervisor no se
-    // apaga con interruptores al alcance del supervisado.
-    {
-      const kjCmd = stripTextOnlyCommandValues(String(input.command || ""));
-      if (tool === "Bash" && kjCmd.includes("harden") && kjCmd.includes("--commit")) {
-        console.error("karajan sentinel: kj harden --commit es un acto humano (ADR 0009) — pideselo a tu usuario; ninguna sesion de agente lo ejecuta." + doc("supervisor"));
+      if ((tool === "Bash" && namesPhoneFile) || writesEnroll) {
+        console.error("karajan sentinel: la clave del movil (capa 5) es del humano — supervisor-phone.json no se toca desde la sesion; enrolar es kj identity enroll-phone desde su terminal." + doc("supervisor"));
         process.exit(2);
       }
     }
@@ -676,7 +660,6 @@ process.stdin.on("end", () => {
         return v.length > 0 ? v : null;
       };
       const declaredGh = idLine("gh_user");
-      const declaredEmail = idLine("git_email");
       const ghHostsPath = join(process.env.GH_CONFIG_DIR || join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "gh"), "hosts.yml");
       const activeGh = () => {
         if (!existsSync(ghHostsPath)) return null;
@@ -699,11 +682,11 @@ process.stdin.on("end", () => {
       // $( and backticks are separators too (review catch): their payload is its own segment.
       const SEPS = [";", "&&", "||", "|", "$(", String.fromCharCode(96), "(", ")"];
       const bare = (w) => w.replaceAll(String.fromCharCode(39), "").replaceAll(String.fromCharCode(34), "");
-      const scan = (text, depth) => { if (depth > 3) return; for (const seg of SEPS.reduce((acc, s) => acc.flatMap((l) => l.split(s)), text.split(ESC_NL))) checkSeg(headOf(words(seg)), depth, words(seg)); };
-      const checkSeg = (ws, depth, raw) => {
+      const scan = (text, depth) => { if (depth > 3) return; for (const seg of SEPS.reduce((acc, s) => acc.flatMap((l) => l.split(s)), text.split(ESC_NL))) checkSeg(headOf(words(seg)), depth); };
+      const checkSeg = (ws, depth) => {
         if (ws.length === 0) return;
-        if (WRAPPERS.includes(ws[0])) { // wrapper args have arity (sudo -u bob): scan from the first gh/git/wrapper token (review catch)
-          const j = ws.findIndex((w, i) => i > 0 && ["gh", "git", ...WRAPPERS].includes(bare(w)));
+        if (WRAPPERS.includes(ws[0])) { // wrapper args have arity (sudo -u bob): scan from the first gh/wrapper token (review catch)
+          const j = ws.findIndex((w, i) => i > 0 && ["gh", ...WRAPPERS].includes(bare(w)));
           if (j > 0) scan(ws.slice(j).map(bare).join(" "), depth + 1);
           return;
         }
@@ -715,46 +698,9 @@ process.stdin.on("end", () => {
           if (!declaredGh) { problems.push("gh without a declared identity for this clone — run: kj identity set"); return; }
           const eff = switchedTo || activeGh();
           if (eff !== declaredGh) problems.push("gh as '" + (eff || "no session") + "' but this clone is declared as '" + declaredGh + "' — prefix the command: gh auth switch --user " + declaredGh + " && ...");
-          return;
-        }
-        if (ws[0] === "git") {
-          // Global options (-C, -c, --git-dir, --work-tree...) are NOT re-implemented: they
-          // are forwarded verbatim to git var, so git resolves identity exactly as the real
-          // command would (review catches: -C cumulative, --git-dir, --opt=value forms).
-          const TWO = ["-c", "-C", "--git-dir", "--work-tree", "--namespace", "--super-prefix", "--exec-path", "--config-env"];
-          let k = 1;
-          while (k < ws.length && ws[k].startsWith("-")) k += TWO.includes(ws[k]) && ws[k + 1] ? 2 : 1;
-          const globals = ws.slice(1, k).map(bare);
-          const sub = ws[k];
-          if (sub === "push") { // push authenticates with the gh session, not user.email (review catch)
-            if (!declaredGh) { problems.push("git push without a declared identity for this clone — run: kj identity set"); return; }
-            const eff = switchedTo || activeGh();
-            if (eff !== declaredGh) problems.push("git push with gh session '" + (eff || "no session") + "' but this clone is declared as '" + declaredGh + "' — prefix: gh auth switch --user " + declaredGh + " && ...");
-            return;
-          }
-          // IDN-B2: anything that authors or rewrites commits carries an identity (review catch).
-          if (!["commit", "tag", "merge", "rebase", "cherry-pick", "am", "revert"].includes(sub)) return; // am: the COMMITTER is still this user
-          if (!declaredEmail) { problems.push("git " + sub + " without a declared identity for this clone — run: kj identity set"); return; }
-          // Let GIT resolve author and committer under the command's own environment
-          // (review catch: user.email, -c, GIT_*_EMAIL, EMAIL, GIT_CONFIG_*, includeIf are
-          // its business): git var is the single source of truth.
-          const assigns = raw.slice(0, raw.length - ws.length).filter((w) => w.indexOf("=") > 0);
-          const env = Object.assign({}, process.env);
-          for (const w of assigns) env[w.slice(0, w.indexOf("="))] = bare(w.slice(w.indexOf("=") + 1));
-          const ident = (v) => {
-            const r = spawnSync("git", [...globals, "var", v], { cwd: ROOT, encoding: "utf8", env });
-            const s = r.status === 0 ? String(r.stdout) : "";
-            const a = s.indexOf("<");
-            const b = s.indexOf(">");
-            return a >= 0 && b > a ? s.slice(a + 1, b) : null;
-          };
-          const ai = ws.findIndex((w) => w.startsWith("--author"));
-          const authorRaw = ai < 0 ? null : ws[ai].includes("=") ? ws[ai].slice(ws[ai].indexOf("=") + 1) : ws.slice(ai + 1).join(" ");
-          const authorMail = authorRaw === null ? null : bare(authorRaw.includes("<") ? authorRaw.slice(authorRaw.indexOf("<") + 1, authorRaw.indexOf(">")) : authorRaw.trim());
-          const mails = [authorMail ?? ident("GIT_AUTHOR_IDENT"), ident("GIT_COMMITTER_IDENT")]; // --author overrides the author (review catch); the committer is always git's
-          const offender = mails.find((m) => m !== null && m !== declaredEmail) ?? (mails[0] === null ? "none" : null);
-          if (offender !== null) problems.push("git " + sub + " as '" + offender + "' but this clone is declared as '" + declaredEmail + "' — use: git -c user.email=" + declaredEmail + " " + sub + " ... (or git config user.email " + declaredEmail + ")");
         }
+        // KJC-TSK-1085 (ADR 0015): git commit/tag/rebase/push are no longer read here:
+        // pre-commit checks the author, pre-push every pushed commit and the gh session.
       };
       scan(CMD_TEXT, 0);
       if (problems.length > 0) {
@@ -1177,17 +1123,14 @@ process.stdin.on("end", () => {
         }
       }
       const MERGE = /\\bgh\\s+pr\\s+merge(\\s+(\\d+))?/;
-      const ADVANCE = /\\bgit\\s+commit\\b|\\bgit\\s+push\\b|\\bgh\\s+pr\\s+create\\b/; // push also falls under violations() — explicit here too (review catch)
+      // KJC-TSK-1089: git push is not read any more; pending moves still stop the turn (stop gate).
+      const ADVANCE = /\\bgit\\s+commit\\b|\\bgh\\s+pr\\s+create\\b/;
       const mergeM = cmd.match(MERGE);
       const pend = pendingMoves(load().sessions?.[sid]);
-      // KJC-BUG-0364: one board-gate decision per command; the push gate below
-      // reuses it, so a second slow gh cannot contradict the first answer.
-      let boardDecision = null;
       if (pend.length > 0 && (mergeM || ADVANCE.test(cmd))) {
         // KJC-BUG-0198: una card partida en varias PRs no puede quedar bloqueada
         // por su primera mitad (boardGate, en la lib).
-        boardDecision = boardGate(sid, pend);
-        const { blocking, carried, reason } = boardDecision;
+        const { blocking, carried, reason } = boardGate(sid, pend);
         for (const c of carried) console.error("karajan sentinel: board-sync arrastra " + c.card + " — " + c.why + ", se movera al cerrarla");
         // ADR 0015 (KJC-TSK-0925): no escape; an epic and a card split across PRs
         // are already decided above (KJC-BUG-0230, 0198).
@@ -1234,18 +1177,10 @@ process.stdin.on("end", () => {
           console.error("karajan sentinel: release check en ROJO — no se publica ni despliega hasta resolverlo:" + (items || "\\n- corre kj release check para el detalle") + "\\n(sin escape: se repara lo que el check nombra)" + doc("release"));
           process.exit(2);
         }
-      } else if (PUSH.test(cmd)) {
-        // KJC-BUG-0147: a pending move blocks the push like it blocks the commit.
-        // ADR 0015 (KJC-TSK-0925): with no escape.
-        // KJC-BUG-0262: a carried card does not block the push the commit let through.
-        const sess = load().sessions?.[sid];
-        const decision = boardDecision || boardGate(sid, pendingMoves(sess));
-        const v = violations(sess, branchOf(), decision.blocking);
-        if (v.length) {
-          console.error("karajan sentinel: git push con el metodo en rojo:\\n" + v.map((x) => "- " + x).join("\\n") + (decision.reason ? "\\n(" + decision.reason + ")" : "") + "\\nResuelve antes de empujar. Estado: kj sentinel status" + doc("push-gate"));
-          process.exit(2);
-        }
       }
+      // KJC-TSK-1089 (ADR 0015): git push is no longer read here. The base branch is
+      // protected (required checks), the card and the tests are judged at commit
+      // (kj review), and pending card moves keep the turn from ending (stop gate).
     }
   } catch { /* fail open */ }
   process.exit(0);

package/src/rag/indexer.js

@@ -173,7 +173,7 @@ export async function indexProject(projectDir, { db, embedder, karajanHome, logg
       if (source.startsWith(prefix) && outOf(source) !== null) deleteChunksBySource(db, source);
     }
     for (const s of sources) {
-      const r = await indexFile(s, { db, embedder, logger, project: slug, kind: sourceKind(s) });
+      const r = await indexFile(s, { db, embedder, logger, project: slug, kind: sourceKind() });
       totals.indexed += r.indexed; totals.failed += r.failed; totals.files += 1;
     }
   }
@@ -211,7 +211,7 @@ export async function indexProjectDelta(projectDir, { db, embedder, since, logge
       logger.info?.(`[rag-indexer] delta delete ${relative(process.cwd(), abs)}`);
     } else if (indexableReason(relative(projectDir, abs), abs, { exclude, projectDir }) === null) {
       // KJC-TSK-0891: the same criterion as the full walk, not a list of extensions.
-      const r = await indexFile(abs, { db, embedder, logger, project: slug, kind: sourceKind(abs) });
+      const r = await indexFile(abs, { db, embedder, logger, project: slug, kind: sourceKind() });
       totals.indexed += r.indexed; totals.failed += r.failed; totals.files += 1;
     }
   }

package/src/review/one-shot-review.js

@@ -55,12 +55,17 @@ export async function runOneShotReview({
   createAgentFn = createAgent,
   detectAgents = detectAvailableAgents,
   candidateStatusFn = candidateStatus,
+  // KJC-TSK-1075: a third-party PR is not the host's own work, so the reviewer
+  // it names runs even if it is the host; and nothing is stored, so the
+  // review can never unlock a commit of one's own.
+  reviewerOverride = null,
+  persist = true,
 }) {
   if (!diff || !diff.trim()) {
     throw new Error("nothing to review — the diff is empty (stage your changes or pass --range)");
   }
 
-  const reviewer = await pickCrossReviewer({ config, hostAgent, detectAgents });
+  const reviewer = reviewerOverride || await pickCrossReviewer({ config, hostAgent, detectAgents });
   if (!reviewer) {
     throw new Error(
       `cross-AI review requires an agent other than the host (${hostAgent || "unknown"}) — install codex, claude or another supported CLI`
@@ -123,7 +128,7 @@ export async function runOneShotReview({
     throw new Error(await reportUnparseableVerdict({ projectDir, reviewer: activeReviewer, output: result.output, hash: diffHash(diff) }));
   }
 
-  return saveVerdict(projectDir, diff, {
+  const record = {
     verdict: parsed.approved ? "approved" : "rejected",
     reviewer: activeReviewer,
     host: hostAgent || null,
@@ -140,5 +145,6 @@ export async function runOneShotReview({
     // the verdict, bound to this diff, like the other two proofs.
     ...(ui ? { ui } : {}),
     confidence: parsed.confidence ?? null,
-  });
+  };
+  return persist ? saveVerdict(projectDir, diff, record) : record;
 }

package/src/review/pr-requirements.js

@@ -0,0 +1,87 @@
+/**
+ * KJC-TSK-1076: the requirements of a third-party PR, checked with no tokens.
+ * Each check is {id, ok, detail}; none stops the review (the agent decides).
+ * The rules are the own-work ones: the same budget, Conventional Commits and
+ * attribution patterns, and tests-with-code.
+ */
+import { AI_ATTRIBUTION, CONVENTIONAL_TYPES } from "../harden/hook-templates.js";
+import { loadPolicy } from "../policy/engine.js";
+import { runCommand } from "../utils/process.js";
+import { budgetedAdded } from "./loc-budget.js";
+import { checkTestsWithCode } from "./tests-with-code.js";
+
+const HEADER_MAX = 100;
+const CONVENTIONAL = new RegExp(String.raw`^(${CONVENTIONAL_TYPES})(\([^)]+\))?!?: \S`);
+const ATTRIBUTION = new RegExp(AI_ATTRIBUTION, "i");
+
+const rowsOf = (numstat) => numstat.split("\n").map((l) => l.trim()).filter(Boolean).map((l) => {
+  const [a, r, ...f] = l.split(/\s+/);
+  return { file: f.join(" "), added: a === "-" ? 1 : Number(a) || 0, removed: r === "-" ? 0 : Number(r) || 0 };
+});
+
+/**
+ * The PR size budget, one source for every gate (PL-C, KJC-TSK-0735): the
+ * policy's net_lines_added invariant, else method_gates.pr_size_max, 200.
+ */
+export function prSizeLimit({ projectDir, config }) {
+  const pol = loadPolicy({ projectDir });
+  const inv = pol.errors.length === 0
+    ? (pol.policy.invariants || []).find((i) => i.kind === "diff-threshold" && i.metric === "net_lines_added")
+    : null;
+  return {
+    ideal: config?.method_gates?.pr_size_warn ?? 150,
+    limit: inv?.max ?? config?.method_gates?.pr_size_max ?? 200,
+    source: inv ? `policy [${inv.id}]` : "method_gates",
+  };
+}
+
+/** Lines added that count against the budget (generated output and human docs exempt). */
+export function sizeCheck({ numstat, limit }) {
+  const { added, exempt } = budgetedAdded(numstat);
+  const exemptNote = exempt > 0 ? ` (${exempt} exempt)` : "";
+  return added > limit
+    ? { id: "size", ok: false, detail: `${added} lines added${exemptNote}, over the ${limit}-line limit: partition the PR` }
+    : { id: "size", ok: true, detail: `${added} lines added${exemptNote}, within the ${limit}-line limit` };
+}
+
+/** Conventional Commits headers (at most 100 characters) and no AI attribution in base..head. */
+export function commitChecks(commits) {
+  const badHeader = commits.filter((c) => !CONVENTIONAL.test(c.subject) || c.subject.length > HEADER_MAX);
+  const attributed = commits.filter((c) => ATTRIBUTION.test(`${c.subject}\n${c.body}`));
+  const list = (cs) => cs.map((c) => `${c.sha.slice(0, 8)} "${c.subject}"`).join(", ");
+  return [
+    badHeader.length
+      ? { id: "conventional-commits", ok: false, detail: `not Conventional Commits or over ${HEADER_MAX} characters: ${list(badHeader)}` }
+      : { id: "conventional-commits", ok: true, detail: `${commits.length} commit(s) with Conventional Commits headers` },
+    attributed.length
+      ? { id: "ai-attribution", ok: false, detail: `AI attribution in: ${list(attributed)}` }
+      : { id: "ai-attribution", ok: true, detail: "no AI attribution in the commits" },
+  ];
+}
+
+/** Source changed with no test changed (a delete-only change needs none). */
+export function testsCheck({ config, numstat }) {
+  const rows = rowsOf(numstat);
+  const res = checkTestsWithCode({ config, stagedFiles: rows.map((r) => r.file), numstat: rows });
+  const ok = res.ok && res.mode !== "warn";
+  return { id: "tests", ok, detail: ok ? `tests: ${res.mode}` : res.reason || "source changed with no test changed" };
+}
+
+const git = async (projectDir, args) => {
+  const res = await runCommand("git", args, { cwd: projectDir });
+  if (res.exitCode !== 0) throw new Error(`git ${args.join(" ")} failed: ${(res.stderr || "").trim()}`);
+  return res.stdout;
+};
+
+/** Size, commits and tests of base...head, read from git. */
+export async function prRequirementChecks({ range, projectDir, config, run = git }) {
+  const numstat = await run(projectDir, ["diff", "--numstat", range]);
+  // The commits of a PR are base..head, whichever range notation was given.
+  const [base, head] = range.split(/\.{2,3}/);
+  const log = await run(projectDir, ["log", "--format=%H%x1f%s%x1f%b%x1e", `${base}..${head || "HEAD"}`]);
+  const commits = log.split("\x1e").map((r) => r.trim()).filter(Boolean).map((r) => {
+    const [sha, subject = "", body = ""] = r.split("\x1f");
+    return { sha, subject, body };
+  });
+  return [sizeCheck({ numstat, limit: prSizeLimit({ projectDir, config }).limit }), ...commitChecks(commits), testsCheck({ config, numstat })];
+}

package/src/review/pr-security.js

@@ -0,0 +1,70 @@
+/**
+ * KJC-TSK-1077: the security and privacy requirements of a third-party PR,
+ * with no tokens. Each check is {id, ok, detail} and never stops the review.
+ * They reuse the scanners kj applies to its own work: the output guard's
+ * credential patterns, the privacy scan, the prompt-injection catalog, the
+ * supply-chain cooldown and semgrep, limited to the PR's files.
+ */
+import { CREDENTIAL_PATTERNS, scanDiff as scanGuards } from "../guards/output-guard.js";
+import { scanDiff as scanInjection } from "../utils/injection-guard.js";
+import { loadPrivacyList, scanText } from "../privacy/scan.js";
+import { isGeneratedPath, splitAddedByFile } from "../privacy/diff-scope.js";
+import { collectSemgrepFindings } from "../audit/semgrep-findings.js";
+import { cooldownAdvisories } from "./dep-cooldown.js";
+
+const CREDENTIAL_IDS = new Set(CREDENTIAL_PATTERNS.map((p) => p.id));
+const BLOCKING_SEMGREP = new Set(["ERROR", "WARNING"]);
+const check = (id, problems, okDetail) => (problems.length
+  ? { id, ok: false, detail: problems.join("; ") }
+  : { id, ok: true, detail: okDetail });
+
+/** Credentials in added lines (AWS, private keys, tokens, URLs with passwords...). */
+export function secretsCheck(diff, config) {
+  const found = scanGuards(diff, config).violations.filter((v) => CREDENTIAL_IDS.has(v.id));
+  return check("secrets", found.map((v) => `${v.file}:${v.line} ${v.id}`), "no secrets in the added lines");
+}
+
+/** Personal data in added lines, masked; generated output only for denylist hits. */
+export function privacyCheck(diff, { list = loadPrivacyList() } = {}) {
+  const found = splitAddedByFile(diff).flatMap(({ file, added }) => {
+    const hits = scanText(added, { list, source: file });
+    return isGeneratedPath(file) ? hits.filter((f) => f.severity === "block") : hits;
+  });
+  return check("privacy", found.map((f) => `${f.source}:${f.line} ${f.type} ${f.masked}`), "no personal data in the added lines");
+}
+
+/** Prompt-injection patterns in the added lines (text an AI will read). */
+export function injectionCheck(diff) {
+  const res = scanInjection(diff);
+  return check("prompt-injection", res.clean ? [] : [res.summary], "no prompt-injection patterns");
+}
+
+/** Dependencies the lockfile adds that were published under the threshold. */
+export async function cooldownCheck(diff, { advisories = cooldownAdvisories, thresholdHours } = {}) {
+  const { young = [], unverified = [], skipped = 0 } = await advisories(diff, thresholdHours ? { thresholdHours } : {});
+  const problems = young.map((p) => `${p.name}@${p.version} published ${p.hours} h ago`);
+  const notes = [...unverified.map((p) => `${p.name}@${p.version} unverified`), ...(skipped ? [`${skipped} packages changed, none checked`] : [])];
+  const res = check("dependency-cooldown", problems, "no dependency published in the last hours");
+  return notes.length ? { ...res, detail: `${res.detail} (${notes.join("; ")})` } : res;
+}
+
+/** semgrep (the static part of kj audit --security), counted on the PR's files only. */
+export async function semgrepCheck({ projectDir, files, collect = collectSemgrepFindings }) {
+  const res = await collect(projectDir);
+  if (!res.available) return { id: "semgrep", ok: true, detail: `not available: ${res.reason}` };
+  const inPr = new Set(files);
+  const found = (res.findings ?? []).filter((f) => inPr.has(f.file) && BLOCKING_SEMGREP.has(f.severity));
+  return check("semgrep", found.map((f) => `${f.file}:${f.line} ${f.rule}`), "no semgrep findings in the PR's files");
+}
+
+/** Every security and privacy check of the PR's diff. */
+export async function prSecurityChecks({ diff, projectDir, config }) {
+  const files = splitAddedByFile(diff).map((f) => f.file);
+  return [
+    secretsCheck(diff, config),
+    privacyCheck(diff),
+    injectionCheck(diff),
+    await cooldownCheck(diff, { thresholdHours: config?.supply_chain?.cooldown_hours }),
+    await semgrepCheck({ projectDir, files }),
+  ];
+}

package/src/review/pr-sonar.js

@@ -0,0 +1,22 @@
+/**
+ * KJC-TSK-1078: Sonar on a third-party PR, when SonarQube is reachable. The
+ * own-work pre-gate scans the PR's files and only issues on the lines the PR
+ * adds can fail the check; without Sonar the check says "not available" and
+ * passes (decision of the user: Sonar if available, never demanded).
+ */
+import { addedLinesByFile, issueFile, runSonarPregate } from "./sonar-pregate.js";
+
+export async function sonarCheck({ diff, config, projectDir = process.cwd(), pregate = runSonarPregate }) {
+  const touchedLines = addedLinesByFile(diff);
+  let res;
+  try {
+    res = await pregate({ config, stagedFiles: [...touchedLines.keys()], touchedLines, projectDir });
+  } catch (err) {
+    res = { available: false, reason: err.message };
+  }
+  if (!res.available) return { id: "sonar", ok: true, detail: `not available: ${res.reason}` };
+  const blocking = res.blocking ?? [];
+  return blocking.length
+    ? { id: "sonar", ok: false, detail: blocking.map((i) => `${issueFile(i)}:${i.line} ${i.rule} ${i.severity}`).join("; ") }
+    : { id: "sonar", ok: true, detail: `no blocking Sonar issue on the added lines (${(res.advisory ?? []).length} advisory)` };
+}

package/src/review/sonar-pregate.js

@@ -82,7 +82,8 @@ export function groupByScanRoot(files, { root = process.cwd(), exists = existsSy
   return groups;
 }
 
-export async function runSonarPregate({ config, stagedFiles = [], touchedLines = null, logger = null, exists = existsSync }) {
+// KJC-TSK-1078: projectDir is where the files live (a third-party PR's clone may not be the cwd).
+export async function runSonarPregate({ config, stagedFiles = [], touchedLines = null, logger = null, exists = existsSync, projectDir = process.cwd() }) {
   if (config?.review_gate?.sonar === false) {
     return { available: false, reason: "disabled in config (review_gate.sonar: false)" };
   }
@@ -94,7 +95,9 @@ export async function runSonarPregate({ config, stagedFiles = [], touchedLines =
   let lock = null;
   try {
     lock = await acquireToolLock("sonar-scanner", { timeoutMs: 300_000, slots });
-    const groups = groupByScanRoot(stagedFiles, { exists });
+    const groups = groupByScanRoot(stagedFiles, { root: projectDir, exists });
+    // The root keeps the scanner's own default (cwd) unless the project lives elsewhere.
+    const rootCwd = projectDir === process.cwd() ? null : projectDir;
     if (groups.size === 0) groups.set("", []);
     const indexed = new Set();
     const issues = [];
@@ -103,7 +106,8 @@ export async function runSonarPregate({ config, stagedFiles = [], touchedLines =
     for (const dir of groups.keys()) {
       const prefix = dir ? `${dir}/` : "";
       // KJC-TSK-0838: verbose, so the scanner names every file it indexed.
-      const scan = await runSonarScan(config, null, { verbose: true, ...(dir ? { cwd: join(process.cwd(), dir) } : {}) });
+      const scanCwd = dir ? join(projectDir, dir) : rootCwd;
+      const scan = await runSonarScan(config, null, { verbose: true, ...(scanCwd ? { cwd: scanCwd } : {}) });
       if (scan.note) logger?.warn?.(scan.note); // KJC-BUG-0156: precedence is said, never silent
       if (!scan.ok) {
         return { available: false, reason: (scan.stderr || scan.stdout || "sonar scan failed").trim() };

package/src/review/third-party-review.js

@@ -0,0 +1,67 @@
+/**
+ * KJC-TSK-1075 (#2227): review someone else's PR. kj's reviewer, the target
+ * repo's rules (.karajan) and the provider the agent picks run over
+ * base...head; no own-work gate applies (card, tests, policy, session RAG) and
+ * no verdict is stored, so this mode never unlocks a commit (ADR 0015). The
+ * own-work gate, reviewGateCommand, stays untouched.
+ */
+import { runCommand } from "../utils/process.js";
+import { resolveRole } from "../config/role-resolver.js";
+import { runOneShotReview } from "./one-shot-review.js";
+import { prRequirementChecks } from "./pr-requirements.js";
+import { prSecurityChecks } from "./pr-security.js";
+import { sonarCheck } from "./pr-sonar.js";
+
+const gitDiffOf = async (projectDir, range) => {
+  const res = await runCommand("git", ["diff", range], { cwd: projectDir });
+  if (res.exitCode !== 0) throw new Error(`git diff ${range} failed: ${(res.stderr || "").trim()}`);
+  return res.stdout;
+};
+
+const finding = (i) => ({
+  file: i.file ?? null, line: i.line ?? null, severity: i.severity ?? null,
+  description: i.description ?? "", suggested_fix: i.suggested_fix ?? null,
+});
+
+/** The review as data: verdict, findings, suggestions and the PR-requirement checks. */
+export async function thirdPartyReview({ range, config, projectDir, logger, task = null, gitDiff = gitDiffOf, run = runOneShotReview, requirements = prRequirementChecks, security = prSecurityChecks, sonar = sonarCheck }) {
+  const diff = await gitDiff(projectDir, range);
+  // KJC-TSK-1076/1077: the PR's requirements and its security, with no tokens; they never stop the review.
+  const checks = [...await requirements({ range, projectDir, config }), ...await security({ diff, projectDir, config }), await sonar({ diff, config, projectDir })];
+  const record = await run({
+    diff, task, config, logger, projectDir,
+    reviewerOverride: resolveRole(config, "reviewer").provider || null,
+    persist: false,
+  });
+  return {
+    mode: "third-party",
+    range,
+    reviewer: record.reviewer,
+    verdict: { approved: record.verdict === "approved", summary: record.summary ?? "" },
+    findings: (record.issues ?? []).map(finding),
+    suggestions: record.suggestions ?? [],
+    checks,
+  };
+}
+
+/**
+ * The CLI side: stdout carries exactly one JSON document, logs go to stderr.
+ * Exit 0 whatever the PR's verdict (the agent decides what to post); non-zero
+ * only when kj itself fails.
+ */
+export async function thirdPartyReviewCommand({ flags, config, out = process.stdout, err = process.stderr, review = thirdPartyReview }) {
+  const print = (doc) => out.write(`${JSON.stringify(doc)}\n`);
+  if (!flags.range) {
+    print({ error: "--third-party reviews a range: pass --range <base>...<head>" });
+    return 1;
+  }
+  const log = (msg) => err.write(`${msg}\n`);
+  const logger = { info: log, warn: log, error: log, debug: () => {} };
+  try {
+    print(await review({ range: flags.range, config, projectDir: config.projectDir || process.cwd(), logger, task: flags.task ?? null }));
+    return 0;
+  } catch (e) {
+    print({ error: e.message });
+    return 1;
+  }
+}

package/src/steward/gate.js

@@ -0,0 +1,31 @@
+/**
+ * KJC-TSK-1086: the Steward's block (STW-C, KJC-TSK-0791) at commit too. Only
+ * where the project adopted it (method_gates.steward: block), only the hard
+ * invariants (vulnerable dependencies, a persistently red main), and never on
+ * an invariant whose verdict is unknown. Having declared block, a missing or
+ * unreadable report blocks too: the sweep has to run.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const HARD = new Set(["vulnerable-deps", "main-ci"]);
+
+/** @returns {{ sweptAt: string, hard: object[], reason: string } | null} */
+export function stewardBlocking({ projectDir, config }) {
+  if (config?.method_gates?.steward !== "block") return null;
+  const file = join(projectDir, ".karajan", "steward", "report.json");
+  let rep;
+  try {
+    rep = JSON.parse(readFileSync(file, "utf8"));
+  } catch (err) {
+    // block was adopted explicitly: a missing or unreadable report is never a silent pass.
+    return { sweptAt: null, hard: [], reason: `steward cannot read ${file} (${err.message}) — rerun kj steward sweep; while it is unreadable the block stands` };
+  }
+  if (!Array.isArray(rep?.invariants)) {
+    return { sweptAt: rep?.sweptAt ?? null, hard: [], reason: `steward report ${file} has no invariants list — rerun kj steward sweep; while it is malformed the block stands` };
+  }
+  const hard = rep.invariants.filter((r) => r?.verdict === "broken" && HARD.has(r.id));
+  if (hard.length === 0) return null;
+  const lines = hard.map((r) => `${r.id}: ${r.evidence || ""} -> ${r.remedy || r.renew || "kj steward sweep"}`);
+  return { sweptAt: rep.sweptAt, hard, reason: `steward (sweep ${rep.sweptAt}) blocks: ${lines.join("; ")} — if the work goes on, your user sets method_gates.steward to inform` };
+}