karajan-code 4.65.1 → 4.66.0

package/src/harden/sentinel-hooks.js

@@ -8,12 +8,11 @@
  * hooks, which is why the guaranteed level requires Claude as host (ADR).
  */
 
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { join } from "node:path";
-import { CARD_REF_RE } from "../review/card-first.js";
-import { HARNESS_BODIES, mergeClaudeHooks, writeHarnessScript } from "./harness-hooks.js";
+import { HARNESS_BODIES, mergeClaudeHooks, wiringState, writeHarnessScript } from "./harness-hooks.js";
 
 /** The harness lives at the PROJECT root — resolve it even from a subdir. */
 export function resolveSentinelRoot(dir = process.cwd()) {
@@ -26,1182 +25,16 @@ export function resolveSentinelRoot(dir = process.cwd()) {
   }
 }
 
-const LIB_BODY = `// kj sentinel shared lib (KJC-TSK-0714) — managed by \`kj harden\`.
-// Single source for every sentinel script: state, branch, classification,
-// and violations.
-import { readFileSync, writeFileSync } from "node:fs";
-import { execSync, spawnSync } from "node:child_process";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-const here = dirname(fileURLToPath(import.meta.url));
-export const STATE = join(here, "sentinel-state.json");
-export const ROOT = join(here, "..", "..");
-// INF-A (KJC-TSK-0758): infra IS source — terraform/k8s/shell/Docker edits
-// engage the method like app code; *_test.* files (terratest) are tests.
-export const TESTS = /(^|\\/)(tests?|__tests__|spec)\\/|\\.(test|spec)\\.[a-z]+$|_test\\.[a-z]+$/;
-export const CODE = /\\.(m?[jt]sx?|c[jt]s|py|go|rs|java|rb|php|cs|swift|kt|astro|svelte|vue|c|h|cc|cpp|hpp|tf|hcl|ya?ml|sh)$|(^|\\/)(Dockerfile|Makefile|Vagrantfile)$/;
-export const CARD = new RegExp(${JSON.stringify(CARD_REF_RE.source)}, "i");
-export const BASE_BRANCHES = new Set(["main", "master"]);
-export const load = () => { try { return JSON.parse(readFileSync(STATE, "utf8")); } catch { return {}; } };
-export const save = (state) => writeFileSync(STATE, JSON.stringify(state, null, 2));
-export const doc = (a) => " — doc: https://karajancode.com/docs/guides/sentinel/#" + a;
-export const session = (state, sid) => {
-  state.sessions ||= {};
-  return (state.sessions[sid] ||= { edited_sources: [], edited_tests: [], escapes: [], errors: [], blocks: 0 });
-};
-export const branchOf = () => {
-  try { return execSync("git rev-parse --abbrev-ref HEAD", { cwd: ROOT, stdio: ["ignore", "pipe", "ignore"] }).toString().trim(); }
-  catch { return null; }
-};
-const _git = (args, cwd) => {
-  try { return execSync("git " + args, { cwd, stdio: ["ignore", "pipe", "ignore"] }).toString().trim(); } catch { return ""; }
-};
-let _home;
-// MONO-0 (ADR 0002): lane identity = worktree toplevel; repo identity =
-// git-common-dir. Same repo but another toplevel than OUR root => foreign
-// lane (returns its toplevel); anything else => null.
-export const foreignLane = (targetDir) => {
-  const top = _git("rev-parse --show-toplevel", targetDir);
-  if (!top) return null;
-  _home ||= { top: _git("rev-parse --show-toplevel", ROOT), common: _git("rev-parse --path-format=absolute --git-common-dir", ROOT) };
-  if (!_home.top || top === _home.top) return null;
-  const common = _git("rev-parse --path-format=absolute --git-common-dir", targetDir);
-  return common && common === _home.common ? top : null;
-};
-// KJC-TSK-0765 board-sync: cards merged in this session but not yet moved in
-// the tracker. The method does not advance until the board is true.
-export const pendingMoves = (s) => (s && Array.isArray(s.pending_moves) ? s.pending_moves : []);
-export const pendingText = (p) => (p.card ? p.card : "card sin identificar") + " (PR #" + p.pr + ") mergeada sin mover en el tracker — muevela a To Validate / Fixed con sus commits (update_card del PG o kj hu move)";
-// KJC-BUG-0185: bootstrap phase = the repo has no commit yet. There is no base
-// branch to protect and no coverage to demand over a tree that does not exist,
-// and \`git diff HEAD\` cannot even run. The phase is a verifiable FACT, never a
-// flag, and it ends at the first commit.
-export const bootstrapPhase = () => {
-  try { execSync("git rev-parse --verify HEAD", { cwd: ROOT, stdio: ["ignore", "ignore", "ignore"] }); return false; }
-  catch { return true; }
-};
-// KJC-BUG-0198/0262: a card split across PRs is carried while another PR of it is
-// open. kj decides with that checkable fact, the same answer for commit and push
-// (the Stop gate still holds the turn: the board owes the move); when kj does not
-// answer, every pending move blocks.
-export const boardGate = (sid, pend) => {
-  if (!pend.length) return { blocking: [], carried: [] };
-  const bg = spawnSync("kj", ["sentinel", "board-gate", "--session", sid, "--json"], { cwd: ROOT, encoding: "utf8" });
-  if (!bg.error && (bg.status === 0 || bg.status === 2)) {
-    try { const d = JSON.parse(bg.stdout); return { blocking: d.blocking || [], carried: d.carried || [], reason: d.reason || "" }; } catch { /* unreadable: as always */ }
-  }
-  return { blocking: pend, carried: [] };
-};
-// KJC-BUG-0265: on the base branch what counts is work still there (the session's
-// files dirty, or local commits the remote does not have), not the ledger: after a
-// merged PR and a sync of main the ledger stays full while the base holds nothing.
-// Anything git cannot answer (no upstream, odd path) counts as work: fail closed.
-const baseHoldsWork = (files) => {
-  if (files.some((f) => !/^[A-Za-z0-9._/-]+$/.test(f))) return true;
-  try {
-    if (execSync("git status --porcelain -- " + files.join(" "), { cwd: ROOT, stdio: ["ignore", "pipe", "ignore"] }).toString().trim()) return true;
-    return execSync("git rev-list @{u}..HEAD", { cwd: ROOT, stdio: ["ignore", "pipe", "ignore"] }).toString().trim() !== "";
-  } catch { return true; }
-};
-export const violations = (s, branch, pending = pendingMoves(s)) => {
-  const v = pending.map(pendingText);
-  if (!s || !(s.edited_sources || []).length) return v;
-  if (bootstrapPhase()) return v;
-  if (BASE_BRANCHES.has(branch)) { if (baseHoldsWork(s.edited_sources)) v.push("Fuentes editadas en la rama base '" + branch + "' — crea una rama: git checkout -b feat/<CARD-ID>-descripcion"); }
-  else if (branch && !CARD.test(branch)) v.push("La rama '" + branch + "' no referencia ninguna card — usa feat/<CARD-ID>-descripcion (y una card VIVA en el board)");
-  if (!(s.edited_tests || []).length && sessionAddsCode(s)) v.push("Fuentes editadas sin tocar un solo test (" + s.edited_sources.join(", ") + ") — escribe o actualiza el test que prueba el cambio");
-  return v;
-};
-// KJC-TSK-0795 AC1: deleting code adds no behavior to test — a session whose
-// source edits only REMOVED lines owes no test. Unreadable git = conservative
-// (the violation stands): a gate must never stand down on a shrug.
-const sessionAddsCode = (s) => {
-  const files = s.edited_sources || [];
-  // _git builds a shell string: any path outside a strict charset stays out of
-  // it — and the gate stays ARMED for it (conservative, and injection-proof).
-  if (files.some((f) => !/^[A-Za-z0-9._/-]+$/.test(f))) return true;
-  const stat = _git("diff HEAD --numstat -- " + files.join(" "), ROOT);
-  if (!stat) return true;
-  return stat.split(String.fromCharCode(10)).some((l) => {
-    const a = l.trim().replaceAll(String.fromCharCode(9), " ").split(" ").filter(Boolean)[0];
-    return a === "-" || Number(a) > 0;
-  });
-};
-`;
-
-const POST_BODY = `#!/usr/bin/env node
-// kj sentinel state writer (KJC-TSK-0713) — managed by \`kj harden\`.
-// Records deterministic method facts per session; never blocks, never fails
-// a tool call (PostToolUse, always exit 0).
-import console from "node:console";
-import process from "node:process";
-import { realpathSync } from "node:fs";
-import { basename, dirname, join, relative } from "node:path";
-import { spawnSync } from "node:child_process";
-import { CODE, TESTS, ROOT, CARD, branchOf, load, save, session } from "./sentinel-lib.mjs";
-import { remindersFor } from "./sentinel-reminders.mjs";
-let raw = "";
-process.stdin.on("data", (d) => { raw += d; });
-process.stdin.on("end", () => {
-  try {
-    const { session_id: sid = "default", tool_name: tool, tool_input: input = {}, tool_response: response = {} } = JSON.parse(raw);
-    // KJC-TSK-0765 board-sync: a merge that gh CONFIRMS leaves its card pending
-    // in the tracker (the PreToolUse gate then refuses to advance until it is
-    // moved). Recorded here, after the fact, so a failed merge never blocks.
-    const text = typeof response === "string" ? response : JSON.stringify(response);
-    // Closing states that count as "registered in the tracker" (PG statuses and
-    // HU Board moves). The pending entry is cleared by the REAL tool call that
-    // moved the card — never by a promise in the agent's prose.
-    const CLOSING = ["to validate", "to-validate", "fixed", "verified", "closed", "done", "done&validated", "validated"];
-    const clearPending = (cardId) => {
-      const state = load();
-      const s = session(state, sid);
-      s.pending_moves = (s.pending_moves || []).filter((p) => p.card !== null && p.card !== cardId);
-      // KJC-TSK-0774: a card closed this turn is what the Stop hook points the
-      // user at when the focus comes back (the board is where to look).
-      if (cardId && !(s.closed_cards ||= []).includes(cardId)) s.closed_cards.push(cardId);
-      save(state);
-    };
-    // KJC-TSK-0847 (ADR 0010, RAG-A): the ledger of what the RAG answered in
-    // this session — every kj_rag_query (MCP) and kj rag query (CLI) with the
-    // repo-relative sources it returned. Neither the CLI nor the MCP know the
-    // host's session id: the harness records, they do not. Hits outside the
-    // repo (another indexed project) are not ours and are dropped.
-    // KJC-BUG-0190: an index with nothing in it (a brand new project) answers
-    // every question with silence, so the gate would demand what no query can
-    // deliver. kj says so explicitly, in both its human and json forms.
-    const EMPTY_INDEX = /No chunks indexed yet|"empty"\\s*:\\s*true/;
-    // KJC-BUG-0293 (#1996, #1995): the index names its sources through whatever
-    // spelling of the project directory indexed them (a symlinked workspace, an
-    // alias). Compared as TEXT against the harness root, every hit fell outside
-    // the tree and was dropped in silence: rag_hits stayed empty and only new
-    // files passed. Both sides are compared by REAL path, and what still falls
-    // outside is written down for the gate to name.
-    // A path whose file is gone (or not yet there) resolves through its deepest
-    // existing ancestor, so an alias of the directory still lands in the tree.
-    const realOf = (p) => {
-      try { return realpathSync(p); } catch { /* resolve the parent instead */ }
-      const d = dirname(p);
-      return !d || d === p ? p : join(realOf(d), basename(p));
-    };
-    const ROOT_REAL = realOf(ROOT);
-    const recordRag = (query, sources, answer = "") => {
-      const state = load();
-      const s = session(state, sid);
-      s.at = Date.now();
-      if (EMPTY_INDEX.test(String(answer))) s.rag_index_empty = true;
-      const hits = [];
-      const dropped = [];
-      for (const src of sources) {
-        const rel = relative(ROOT_REAL, realOf(String(src))).split(String.fromCharCode(92)).join("/");
-        if (!rel || rel === ".." || rel.startsWith("../") || rel.startsWith("/")) { dropped.push(String(src)); continue; }
-        if (!hits.includes(rel)) hits.push(rel);
-      }
-      (s.rag_queries ||= []).push({ ts: Date.now(), text: String(query || "").slice(0, 200), hits });
-      const all = (s.rag_hits ||= []);
-      for (const h of hits) if (!all.includes(h)) all.push(h);
-      if (hits.length === 0 && dropped.length > 0) s.rag_dropped = { root: ROOT_REAL, count: dropped.length, sample: dropped.slice(0, 3) };
-      else if (hits.length > 0) delete s.rag_dropped; // an answer inside the tree ends the diagnosis
-      save(state);
-    };
-    // Sources are read STRUCTURALLY, never through the stringified response:
-    // a JSON document (the MCP {content:[{text}]} parts, the CLI --json array)
-    // is parsed and its hits[].source / [].source collected.
-    const sourcesOf = (doc) => {
-      const list = Array.isArray(doc) ? doc : Array.isArray(doc?.hits) ? doc.hits : [];
-      return list.map((h) => h?.source).filter((x) => typeof x === "string");
-    };
-    const parseJson = (t) => { try { return JSON.parse(t); } catch { return null; } };
-    if (/__kj_rag_query$/.test(String(tool)) && /^mcp__/.test(String(tool))) {
-      // KJC-BUG-0293: the host may hand the answer as {content:[parts]}, as the
-      // bare array of parts, or as the text itself; all three are the same answer.
-      const parts = Array.isArray(response?.content) ? response.content : Array.isArray(response) ? response : [{ text: typeof response === "string" ? response : "" }];
-      let found = parts.flatMap((p) => sourcesOf(parseJson(String(p?.text || ""))));
-      // KJC-BUG-0365 (#2208): an answer cut short (whole code chunks) is no
-      // longer valid JSON, but every "source" it carries still names a hit.
-      if (found.length === 0) found = [...text.matchAll(/\\\\?"source\\\\?"\\s*:\\s*\\\\?"([^"\\\\]+)\\\\?"/g)].map((m) => m[1]);
-      recordRag(input.text, found, parts.map((p) => String(p?.text || "")).join(String.fromCharCode(10)));
-      process.exit(0);
-    }
-    if (/__update_card$/.test(String(tool)) && /^mcp__/.test(String(tool))) {
-      // The MCP response reaches the hook as {content:[{text:"<json>"}]}: once
-      // stringified, the inner quotes are ESCAPED — match both forms (found live:
-      // the first real update_card did not clear its pending entry).
-      const cid = /\\\\?"cardId\\\\?"\\s*:\\s*\\\\?"([A-Za-z0-9-]+)\\\\?"/.exec(text);
-      const st = /\\\\?"status\\\\?"\\s*:\\s*\\\\?"([^"\\\\]+)\\\\?"/.exec(text);
-      if (cid && st && CLOSING.includes(st[1].toLowerCase())) {
-        clearPending(cid[1].toUpperCase());
-        // KJC-BUG-0157: a pending whose card-id NEVER existed (branch named
-        // before the tracker confirmed the create) could not be cleared by any
-        // verified route. The pending's TRUE identity is its PR: a CONFIRMED
-        // closing update whose request names that PR clears it too — still a
-        // real tracker call seen by this hook, never a promise in prose.
-        const prIn = Number(input?.updates?.pipelineStatus?.prCreated?.prNumber);
-        if (Number.isFinite(prIn) && prIn > 0) {
-          const state = load();
-          const s = session(state, sid);
-          s.pending_moves = (s.pending_moves || []).filter((p) => Number(p.pr) !== prIn);
-          save(state);
-        }
-      }
-      process.exit(0);
-    }
-    if (tool === "Bash") {
-      const cmdText = String(input.command || "");
-      // CLI form of the ledger: the human output lists one hit per line as
-      // "[kind · label · score=…] <path>"; --json prints an array with "source".
-      const ragCmd = /kj +rag +query/.exec(cmdText);
-      if (ragCmd) {
-        const out = typeof response === "string" ? response : String(response.stdout || "") + String(response.stderr || "");
-        const fromLines = out.split(String.fromCharCode(10))
-          .filter((l) => l.includes("score=") && l.includes("] "))
-          .map((l) => l.slice(l.lastIndexOf("] ") + 2).trim())
-          .filter(Boolean);
-        recordRag(cmdText.slice(ragCmd.index), fromLines.concat(sourcesOf(parseJson(out.trim()))), out);
-        process.exit(0);
-      }
-      // gh prints "merged pull request #N" only on a TTY: under a tool call the
-      // success line is ABSENT (found live on the first dogfood merge). The
-      // authoritative signal is the PR state itself: one gh pr view per merge.
-      const mergeCmd = /\\bgh\\s+pr\\s+merge(\\s+(\\d+))?/.exec(cmdText);
-      const said = /merged pull request #(\\d+)/i.exec(text);
-      let mergedPr = said ? Number(said[1]) : null;
-      // KJC-BUG-0148: the card belongs to the PR's HEAD branch, not to whatever
-      // branch the working tree happens to be on (found live: a merge issued
-      // from another card's lane pinned the pending move on the wrong card).
-      let headRef = null;
-      if (mergeCmd || said) {
-        const n = said ? said[1] : mergeCmd[2];
-        const args = ["pr", "view", ...(n ? [n] : []), "--json", "number,state,headRefName"];
-        const r = spawnSync("gh", args, { cwd: ROOT, encoding: "utf8" });
-        try {
-          const v = JSON.parse(r.status === 0 ? r.stdout : "null");
-          if (v && v.state === "MERGED") { mergedPr = Number(v.number); headRef = v.headRefName || null; }
-        } catch { /* unknown = not confirmed (or confirmed only by the printed line) */ }
-      }
-      if (mergedPr !== null) {
-        const state = load();
-        const s = session(state, sid);
-        const ref = CARD.exec(headRef || branchOf() || "");
-        // KJC-BUG-0230: una EPICA (…-PCS-…) no tiene estado que mover: el PG
-        // la deja en To Do por mas status que reciba y kj hu move no la
-        // conoce. Registrarla como pendiente era un bloqueo sin cauce. Se dice
-        // en el momento, para que no parezca que el board dejo de mirar.
-        const epic = ref && /-PCS-/i.test(ref[0]);
-        if (epic) {
-          console.error("karajan sentinel: board-sync — la PR #" + mergedPr + " pertenece a la epica " + ref[0].toUpperCase() + ", que no tiene estado que mover: no queda pendiente (su cierre va en la descripcion de la epica)");
-        } else {
-          (s.pending_moves ||= []).push({ card: ref ? ref[0].toUpperCase() : null, pr: mergedPr, at: Date.now(), ...(headRef ? {} : { head: "unknown" }) });
-        }
-        save(state);
-      }
-      const moved = /kj\\s+hu\\s+move\\s+([A-Za-z0-9-]+)\\s+([a-z&-]+)/i.exec(String(input.command || ""));
-      // "not found" counts as failure (KJC-BUG-0154): a move that moved nothing must not
-      // clear a pending — that would discard a LEGITIMATE one without touching the tracker.
-      if (moved && CLOSING.includes(moved[2].toLowerCase()) && !/error|fail|not found/i.test(text)) clearPending(moved[1].toUpperCase());
-      // KJC-TSK-0917 (ADR 0014): the method's reminders, after the action that precedes
-      // the one each rule is about; at most once every 25 Bash actions each. Never a block.
-      const st = load();
-      const ss = session(st, sid);
-      ss.step = (ss.step || 0) + 1;
-      const due = remindersFor(cmdText, { seen: ss.reminded || {}, step: ss.step });
-      for (const r of due) (ss.reminded ||= {})[r.id] = ss.step;
-      save(st);
-      if (due.length) process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PostToolUse", additionalContext: due.map((r) => r.say).join(" ") } }));
-      process.exit(0);
-    }
-    const file = input.file_path || input.notebook_path;
-    if (!["Write", "Edit", "MultiEdit", "NotebookEdit"].includes(tool) || !file) process.exit(0);
-    const state = load();
-    const s = session(state, sid);
-    s.at = Date.now();
-    const rel = relative(ROOT, file).replaceAll("\\\\", "/");
-    // KJC-BUG-0279 (#1981): a file outside the repository is not one of its sources.
-    const inside = rel && rel !== ".." && !rel.startsWith("../") && !rel.startsWith("/");
-    const bucket = !inside ? null : TESTS.test(rel) ? s.edited_tests : CODE.test(rel) ? s.edited_sources : null;
-    if (bucket && !bucket.includes(rel)) bucket.push(rel);
-    // KJC-TSK-0910: the branch size while it is written, with the CI budget
-    // (kj pr-size), said once per threshold crossed. Context, never a block.
-    let sizeNote = null;
-    if (bucket) {
-      const ps = spawnSync("kj", ["pr-size", "--json"], { cwd: ROOT, encoding: "utf8", timeout: 5000 });
-      let size = null;
-      try { size = JSON.parse(String(ps.stdout || "").trim().split(String.fromCharCode(10)).pop()); } catch { size = null; }
-      const crossed = size ? [200, 150].find((t) => size.added > t) : undefined;
-      if (crossed && (s.size_warned || 0) < crossed) {
-        s.size_warned = crossed;
-        sizeNote = "karajan sentinel: la rama ya suma " + size.added + " lineas contables (" + size.testAdded + " de tests); " + (crossed >= 200 ? "pasa el limite de 200 del CI: parte antes de seguir" : "pasa de 150: planea la particion ahora, no en el stage");
-      }
-    }
-    const ids = Object.keys(state.sessions);
-    if (ids.length > 5) delete state.sessions[ids.sort((a, b) => (state.sessions[a].at || 0) - (state.sessions[b].at || 0))[0]];
-    save(state);
-    if (sizeNote) process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: "PostToolUse", additionalContext: sizeNote } }));
-  } catch { /* fail open — the sentinel never breaks a tool call */ }
-  process.exit(0);
-});
-`;
-
-const STOP_BODY = `#!/usr/bin/env node
-// kj sentinel stop gate (KJC-TSK-0713) — managed by \`kj harden\`. Exit 2
-// BLOCKS ending the turn while method violations are open (stderr lists each
-// one with its remediation). Fails OPEN on corrupt state, git errors, or
-// after 3 unresolved blocks — a sentinel bug never bricks the session — and
-// the fail-open is recorded in the state. \`--status\` prints, never blocks.
-import console from "node:console";
-import process from "node:process";
-import { spawnSync } from "node:child_process";
-import { readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { doc, load, save, branchOf, violations, ROOT } from "./sentinel-lib.mjs";
-// KJC-TSK-0774: when the turn ends green with cards closed, remind the user
-// where to look — the board URL if it runs (pid file alive), else how to start it.
-const boardHint = () => {
-  const home = process.env.KARAJAN_HOME || process.env.KJ_HOME || join(homedir(), ".karajan");
-  try {
-    process.kill(Number(readFileSync(join(home, "hu-board.pid"), "utf8").trim()), 0);
-    return "http://localhost:" + (process.env.KJ_BOARD_PORT || "4000") + "/#governance";
-  } catch { return "no esta arrancado: kj board start (luego http://localhost:4000/#governance)"; }
-};
-if (process.argv.includes("--status")) {
-  const st = load();
-  const branch = branchOf();
-  const sessions = Object.entries(st.sessions || {});
-  if (!sessions.length) console.log("sentinel: sin actividad registrada en esta sesion");
-  for (const [sid, s] of sessions) {
-    console.log("session " + sid + ": sources=[" + (s.edited_sources || []).join(", ") + "] tests=[" + (s.edited_tests || []).join(", ") + "] escapes=[" + (s.escapes || []).join(", ") + "] blocks=" + (s.blocks || 0) + ((s.errors || []).length ? " errors=" + s.errors.length : "") + " rag=" + (s.rag_queries || []).length + " queries/" + (s.rag_hits || []).length + " sources");
-    for (const x of violations(s, branch)) console.log("  ROJO: " + x);
-  }
-  process.exit(0);
-}
-let raw = "";
-process.stdin.on("data", (d) => { raw += d; });
-process.stdin.on("end", () => {
-  try {
-    if (process.env.KJ_SENTINEL_OFF === "1") process.exit(0);
-    const { session_id: sid = "default", transcript_path: transcript = null } = JSON.parse(raw);
-    const state = load();
-    // Tamper check runs regardless of session state: shell indirection leaves
-    // no edit-tool record, but it cannot survive \`kj sentinel verify\`, whose
-    // root of trust is the INSTALLED kj package (outside this project tree) —
-    // nothing under .karajan can vouch for itself. No kj on PATH → fail open.
-    const ver = spawnSync("kj", ["sentinel", "verify", "--json"], { cwd: ROOT, encoding: "utf8" });
-    let tampered = [];
-    if (!ver.error && ver.status !== null && ver.status !== 0) {
-      try { tampered = JSON.parse(ver.stdout).mismatched || ["unknown"]; } catch { tampered = ["unknown"]; }
-    }
-    if (tampered.length) {
-      state.tamper_blocks = (state.tamper_blocks || 0) + 1;
-      save(state);
-      if (state.tamper_blocks > 3) {
-        console.error("karajan sentinel: fail-open tras 3 bloqueos por manipulacion sin restaurar — corre kj harden y avisa a tu usuario" + doc("supervisor"));
-        process.exit(0);
-      }
-      console.error("karajan sentinel: scripts del supervisor modificados fuera de kj harden (" + tampered.join(", ") + ") — restaura con kj harden antes de terminar; si lo cambiaste tu (humano), reinstalar lo deja en verde." + doc("supervisor"));
-      process.exit(2);
-    }
-    state.tamper_blocks = 0;
-    // CLM-B (KJC-TSK-0802, claims-with-evidence ADR): the hard data of the turn's
-    // final message, crossed against that turn's outputs. It runs even without a
-    // tracked session — a turn with no edits still ends with a final message. The
-    // hook carries no policy: kj reads method_gates.claims and answers 0 (off,
-    // clean, or warn) or 2 (a datum DENIED by its own source, in block mode). A
-    // missing kj or an errored spawn fails open.
-    let claimsNote = "";
-    let claimsBlock = null;
-    if (transcript) {
-      const c = spawnSync("kj", ["claims", "gate", "--transcript", transcript], { cwd: ROOT, encoding: "utf8" });
-      if (!c.error && c.status === 2) claimsBlock = "claims: un dato del mensaje final esta DESMENTIDO por las salidas de este turno — verificalo o marcalo como no comprobado. Detalle: kj claims check --transcript " + transcript;
-      else if (!c.error && c.status === 0 && (c.stderr || "").trim()) claimsNote = "kj claims: " + c.stderr.trim().split(String.fromCharCode(10))[0] + " — datos sin respaldo en este turno (informa, no bloquea).";
-    }
-    const s = state.sessions?.[sid];
-    if (!s) {
-      if (claimsBlock) { console.error("karajan sentinel: el turno NO puede terminar:" + String.fromCharCode(10) + "- " + claimsBlock + doc("claims")); process.exit(2); }
-      if (claimsNote) console.log(JSON.stringify({ systemMessage: claimsNote }));
-      process.exit(0);
-    }
-    // KJC-TSK-0868: si el anfitrion ha escrito codigo teniendo otro coder
-    // declarado, eso no se bloquea, se REGISTRA: el usuario eligio quien
-    // escribe y merece enterarse por el decision log, no por casualidad. Una
-    // vez por sesion, y si kj no responde se reintenta en el turno siguiente.
-    if (!s.panel_sealed && (s.edited_sources || []).length > 0) {
-      const p = spawnSync("kj", ["sentinel", "panel-check", "--session", sid], { cwd: ROOT, encoding: "utf8" });
-      if (!p.error && p.status === 0) {
-        s.panel_sealed = true;
-        save(state);
-        if ((p.stdout || "").trim()) console.error(p.stdout.trim());
-      }
-    }
-    const v = violations(s, branchOf());
-    if (claimsBlock) v.push(claimsBlock);
-    if (!v.length) {
-      s.blocks = 0;
-      const notes = [];
-      if (claimsNote) notes.push(claimsNote);
-      if ((s.closed_cards || []).length) {
-        notes.push("karajan sentinel: card(s) cerrada(s) en este turno: " + s.closed_cards.join(", ") + " — el board las muestra: " + boardHint());
-        s.closed_cards = [];
-      }
-      save(state);
-      if (notes.length) console.log(JSON.stringify({ systemMessage: notes.join("\\n") }));
-      process.exit(0);
-    }
-    s.blocks = (s.blocks || 0) + 1;
-    if (s.blocks > 3) {
-      (s.errors ||= []).push("fail-open: 3 bloqueos consecutivos sin resolver — el sentinel se aparta para no colgar la sesion");
-      save(state);
-      console.error("karajan sentinel: fail-open tras 3 bloqueos sin resolver — revisa kj sentinel status con tu usuario" + doc("stop-gate"));
-      process.exit(0);
-    }
-    save(state);
-    console.error("karajan sentinel: el turno NO puede terminar con el metodo en rojo:\\n" + v.map((x) => "- " + x).join("\\n") + "\\nResuelve las violaciones (o pide a tu usuario el escape) y termina de nuevo. Estado: kj sentinel status" + doc("stop-gate"));
-    process.exit(2);
-  } catch { /* fail open */ }
-  process.exit(0);
-});
-`;
-
-const PRETOOL_BODY = `#!/usr/bin/env node
-// kj sentinel pretooluse gate (KJC-TSK-0714) — managed by \`kj harden\`.
-// Consults the session method state BEFORE the tool runs: the rule fires
-// before the damage, not in the post-mortem. Exit 2 blocks (stderr says the
-// remediation); read-only tools are never wired here; every honored escape
-// is recorded as an auditable event. Fails OPEN on anything unexpected.
-import console from "node:console";
-import process from "node:process";
-import { dirname, join, relative, resolve } from "node:path";
-import { appendFileSync, existsSync, readFileSync, realpathSync, statSync } from "node:fs";
-import { spawnSync } from "node:child_process";
-import { homedir } from "node:os";
-import { fileURLToPath } from "node:url";
-import { doc, CODE, TESTS, ROOT, BASE_BRANCHES, CARD, STATE, branchOf, foreignLane, load, save, session, boardGate, pendingMoves, pendingText } from "./sentinel-lib.mjs";
-// KJC-TSK-0915 (ADR 0014): the shell reader is a real, unit-tested module copied here as is.
-import { isGhIssueCreate, isPublishCommand, optionValues, shellSegments, stripInertQuotes, stripTextOptionValues, stripTextOnlyCommandValues } from "./sentinel-shell.mjs";
-import { DISCARD_VERBS, discardOf, foreignLost, removedFiles } from "./sentinel-discard.mjs";
-import { sandboxCovers, shellWrites, writesRepo } from "./sentinel-bash-write.mjs";
-const EDIT_TOOLS = ["Write", "Edit", "MultiEdit", "NotebookEdit"];
-const inOrder = (want, got) => { let i = 0; for (const w of got) if (w === want[i] && ++i === want.length) return true; return false; };
-// KJC-BUG-0333: a publish is read per simple command by the shell reader, so
-// words inside a quoted argument of another command are not a publish.
-const isPublish = isPublishCommand;
-const PROTECTED = /\\.claude\\/settings\\.json\\b|\\.karajan\\/(hooks|harness)\\//;
-let raw = "";
-process.stdin.on("data", (d) => { raw += d; });
-process.stdin.on("end", () => {
-  try {
-    const { session_id: sid = "default", tool_name: tool, tool_input: input = {}, transcript_path: transcript = null } = JSON.parse(raw);
-    // KJC-TSK-0920 (SNT-E): every deny ends with the same line, whatever gate it was.
-    // KJC-TSK-0968 (HUM-E, ADR 0018): and leaves a record next to the state, with the
-    // gate's own words: kj handoff takes the why from here, never from the agent.
-    const said = [];
-    const errOrig = console.error.bind(console);
-    console.error = (m) => { said.push(String(m)); errOrig(m); };
-    process.on("exit", (code) => {
-      if (code !== 2) return;
-      errOrig("karajan: Karajan gobierna y se le obedece. No rodees el gate ni cambies la politica para pasarlo; si te parece injusto, diselo a tu usuario o usa kj report-issue.");
-      // Only what a handoff needs: the exact Bash command, or the path an edit aimed at; never file contents.
-      const what = tool === "Bash" ? { command: input.command } : { file_path: input.file_path || input.notebook_path || null };
-      try { appendFileSync(join(dirname(STATE), "denials.jsonl"), JSON.stringify({ at: new Date().toISOString(), sid, tool, input: what, why: said.join("\\n") }) + "\\n"); } catch { /* the deny stands without its record */ }
-    });
-    // KJC-BUG-0238 (#1886): de quien es cada cambio. La primera vez que la
-    // sesion toca un fichero se anota si estaba limpio: solo entonces un
-    // descarte posterior pierde nada mas que lo de la sesion. Antes de
-    // cualquier escape; git que falla cuenta como sucio (fail-closed).
-    const noteFirstTouch = (relT) => {
-      const st = load();
-      const touch = (session(st, sid).first_touch ||= {});
-      // hasOwn + defineProperty: a file named __proto__ or toString is a path, not a prototype key.
-      if (Object.hasOwn(touch, relT)) return;
-      // --ignored: a user's ignored .env is theirs too (git clean -x deletes it).
-      const gs = spawnSync("git", ["-C", ROOT, "status", "--porcelain", "--ignored", "--", relT], { encoding: "utf8" });
-      const value = gs.status === 0 && String(gs.stdout).trim() === "" ? "clean" : "dirty";
-      Object.defineProperty(touch, relT, { value, enumerable: true, writable: true, configurable: true });
-      save(st);
-    };
-    // Self-protection (KJC-TSK-0715) rules run BEFORE any escape, including
-    // KJ_SENTINEL_OFF: the sentinel is not dismantled from inside a session —
-    // only the human, editing outside it.
-    if (EDIT_TOOLS.includes(tool)) {
-      const target = input.file_path || input.notebook_path;
-      const relT = target ? relative(ROOT, String(target)).replaceAll("\\\\", "/") : "";
-      if (relT && PROTECTED.test(relT)) {
-        console.error("karajan sentinel: ese fichero es parte del supervisor (" + relT + ") — solo el humano desmonta el sentinel, editalo fuera de la sesion." + doc("supervisor"));
-        process.exit(2);
-      }
-      // KJC-TSK-0920 (SNT-E): policies, gate settings and exclusions are the human's,
-      // like the supervisor: a session does not loosen the rules that govern it.
-      // .karajan/rules.yml (KJC-TSK-0947, ADR 0016): the compiled rules are the user's to approve.
-      // .karajan/rules.local.yml (KJC-TSK-0954, ADR 0017): the same rules, the ones from private sources.
-      // .karajan/security-level.json (KJC-TSK-1054, ADR 0020): only kj security writes it, after the human layers.
-      if ([".karajan/policy.yml", ".karajan/kj.config.yml", ".karajan/rules.yml", ".karajan/rules.local.yml", ".karajan/security-level.json", ".ragignore"].includes(relT) || relT.endsWith("/.ragignore")) {
-        console.error("karajan sentinel: " + relT + " es configuracion de gobierno (politicas, gates, exclusiones): la cambia tu usuario, no la sesion. Si un gate te parece injusto, proponselo a tu usuario o usa kj report-issue." + doc("governance"));
-        process.exit(2);
-      }
-      if (relT && !relT.startsWith("..") && !relT.startsWith("/")) noteFirstTouch(relT);
-    }
-    // KJC-BUG-0261: rm / git rm is the session touching those files, noted before they go.
-    if (tool === "Bash") for (const words of shellSegments(String(input.command || ""))) for (const f of removedFiles(words, ROOT)) noteFirstTouch(f);
-    // Any Bash that NAMES the supervisor's files is denied — a write-verb
-    // blocklist is bypassable (cp, dd, one-liners), and reading them is what
-    // the Read/Grep tools are for. Shell indirection (variables, globs,
-    // substitution) cannot be resolved from command text: that vector is
-    // caught by the Stop gate's checksum verification, which blocks the turn.
-    // KJC-TSK-1114: where the host sandbox denies writing them, the sandbox guards them instead.
-    const SUPERVISOR_PATHS = [".claude/settings.json", ".karajan/hooks", ".karajan/harness"];
-    if (tool === "Bash" && PROTECTED.test(String(input.command || "").replaceAll("\\\\", "/")) && !sandboxCovers(ROOT, SUPERVISOR_PATHS)) {
-      console.error("karajan sentinel: los ficheros del supervisor no se tocan desde Bash — consultalos con la tool Read/Grep; solo el humano los modifica, fuera de la sesion." + doc("supervisor"));
-      process.exit(2);
-    }
-    // KJC-BUG-0164: todo gh que PUBLICA texto (pr/issue/release, create/edit/
-    // comment/review) se escanea contra el patron de ATRIBUCION a IA antes de
-    // salir — comando inline Y ficheros --body-file/--notes-file. Regla
-    // determinista del proyecto: prohibido, sin escape. Un fichero ilegible
-    // tampoco publica (fail closed).
-    {
-      // Regex SIN backslashes a proposito (clases de caracteres, emoji
-      // literal): asi la plantilla y el fichero generado son identicos y no
-      // hay doble-escape que leer mal.
-      const ghCmd = String(input.command || "");
-      if (tool === "Bash" && /(^|[^a-zA-Z])gh([^a-zA-Z]|$)/.test(ghCmd) && /(^|[^a-z])(pr|issue|release)([^a-z]|$)/.test(ghCmd) && /(^|[^a-z])(create|edit|comment|review)([^a-z]|$)/.test(ghCmd)) {
-        const attrib = /co-authored-by:.{0,120}(claude|gpt|copilot|gemini)|(generated|written|created) (by|with).{0,120}(claude|gpt|copilot|gemini|codex)|generated with [[]?claude|🤖/is;
-        // KJC-BUG-0340: a body file's PATH is not published text (a scratch dir
-        // under .../claude-1000/... read as an attribution next to a title saying
-        // "generated by kj"); its content is. Each piece is judged on its own, so a
-        // match never spans from the command into a file.
-        const pieces = [];
-        let cmdText = ghCmd;
-        // KJC-BUG-0245: the shell reader ends the path at ; && | (a regex took "pr.md;").
-        for (const bodyPath of optionValues(ghCmd, ["--body-file", "--notes-file", "--comment-file"])) {
-          cmdText = cmdText.split(bodyPath).join(" ");
-          try { pieces.push(readFileSync(bodyPath, "utf8")); } catch {
-            console.error("karajan sentinel: no puedo leer " + bodyPath + " para el escaneo de atribucion — sin escaneo no se publica." + doc("attribution"));
-            process.exit(2);
-          }
-        }
-        pieces.push(cmdText);
-        if (pieces.some((p) => attrib.test(p))) {
-          console.error("karajan sentinel: atribucion a IA detectada en contenido a PUBLICAR (PR/issue/release) — prohibida por regla determinista del proyecto: limpia el texto." + doc("attribution"));
-          process.exit(2);
-        }
-      }
-    }
-    // KJC-BUG-0252 (#1899): una issue para karajan-code sale por kj report-issue
-    // (sanitiza y busca duplicados), nunca por gh issue create a mano.
-    {
-      const ghIssue = String(input.command || "");
-      // KJC-BUG-0306: the subcommand itself (gh, its flags, issue create), not three words
-      // anywhere: "gh pr create --title 'kj report-issue ...'" is not an issue.
-      if (tool === "Bash" && isGhIssueCreate(ghIssue)) {
-        // The target: --repo/-R, an inline or inherited GH_REPO, else the
-        // checkout's own origin, which is what gh takes (review catches).
-        const inlineRepo = /(^|[^A-Z_])GH_REPO=([^ ]+)/.exec(ghIssue);
-        let target = optionValues(ghIssue, ["--repo", "-R"]).at(-1) || (inlineRepo ? inlineRepo[2] : "") || String(process.env.GH_REPO || "");
-        if (!target) {
-          const origin = spawnSync("git", ["config", "--get", "remote.origin.url"], { cwd: ROOT, encoding: "utf8" });
-          target = String(origin.stdout || "").trim();
-        }
-        if (/karajan-code([^a-z0-9]|$)/i.test(target)) {
-          console.error("karajan sentinel: las issues para karajan-code salen por kj report-issue (sanitiza y busca issues parecidas), no por gh issue create." + doc("report-issue"));
-          process.exit(2);
-        }
-      }
-    }
-    // KJC-TSK-0822 v1.1: la clave del movil (capa 5) no se toca desde la sesion.
-    // KJC-TSK-1084 (ADR 0015): los comandos de acto humano (kj harden --commit,
-    // kj identity enroll-phone) ya no se leen aqui: la propia orden rechaza un
-    // proceso que desciende de un agente (src/harden/human-act.js). Queda el
-    // FICHERO de la clave, que solo esto protege hasta que el sandbox lo vete.
-    {
-      // KJC-BUG-0354: un titulo o un mensaje de commit que solo lo MENCIONA no es escribirlo.
-      const namesPhoneFile = stripTextOnlyCommandValues(String(input.command || "")).includes("supervisor-phone.json");
-      const writesEnroll = EDIT_TOOLS.includes(tool) && String(input.file_path || "").includes("supervisor-phone.json");
-      if ((tool === "Bash" && namesPhoneFile) || writesEnroll) {
-        console.error("karajan sentinel: la clave del movil (capa 5) es del humano — supervisor-phone.json no se toca desde la sesion; enrolar es kj identity enroll-phone desde su terminal." + doc("supervisor"));
-        process.exit(2);
-      }
-    }
-    // KJC-BUG-0238 (#1886): un agente no descarta cambios que no hizo. Sin
-    // escape y antes de KJ_SENTINEL_OFF: es perdida de datos del usuario, y
-    // guardarlo (git stash push) nunca pierde nada.
-    if (tool === "Bash") {
-      const cmdD = String(input.command || "");
-      // A git discard nested in $( ), <( ), backticks, eval, xargs or sh -c cannot be read: fail-closed.
-      const nested = ["$(", "<(", ">(", String.fromCharCode(96)].some((n) => cmdD.includes(n)) || /(^|[ ;&|])(eval|xargs|bash|sh|zsh|env)( |$)/.test(cmdD);
-      if (nested && /(^|[^a-z])git([^a-z]|$)/.test(cmdD) && DISCARD_VERBS.some((v) => cmdD.includes(v))) {
-        console.error("karajan sentinel: un descarte git dentro de $( ), backticks, eval, xargs o sh -c no es verificable — ejecutalo como comando simple." + doc("discard"));
-        process.exit(2);
-      }
-      const touch = load().sessions?.[sid]?.first_touch || {};
-      for (const words of shellSegments(cmdD)) {
-        const d = discardOf(words, ROOT);
-        const lost = d ? foreignLost(d, touch, ROOT) : [];
-        if (lost.length === 0) continue;
-        console.error(d.stash
-          ? "karajan sentinel: git stash drop/clear borra trabajo guardado que puede no ser de esta sesion — pideselo a tu usuario." + doc("discard")
-          : "karajan sentinel: ese comando descarta cambios que esta sesion no hizo (" + lost.slice(0, 5).join(", ") + (lost.length > 5 ? ", +" + (lost.length - 5) : "") + ") — pueden ser trabajo sin commitear de tu usuario. Si estorban, guardalos recuperables (git stash push -- <ficheros>) y avisale; si el cambio es tuyo sobre su trabajo, deshazlo con Edit. Sin escape: es perdida de datos." + doc("discard"));
-        process.exit(2);
-      }
-    }
-    if (process.env.KJ_SENTINEL_OFF === "1") process.exit(0);
-    // ADR 0015 (KJC-TSK-0927): no gate has an escape any more, so the command
-    // text is read only by the identity lock below.
-    const CMD_TEXT = tool === "Bash" ? String(input.command || "") : "";
-    const ESC_TAB = String.fromCharCode(9);
-    const ESC_NL = String.fromCharCode(10);
-    // IDN-B (KJC-TSK-0763, ADR 0005): identity lock — gh and mutating git never
-    // run under an account other than the one THIS CLONE declared (the incident:
-    // a gh comment without switch went out as the client account). Deny BEFORE
-    // the damage with the literal remedy; never auto-switch; undeclared = closed.
-    if (tool === "Bash" && CMD_TEXT.length > 0) {
-      const idFile = join(ROOT, ".karajan", "identity.local.yml");
-      const idLine = (key) => {
-        if (!existsSync(idFile)) return null;
-        const line = readFileSync(idFile, "utf8").split(ESC_NL).find((l) => l.startsWith(key + ":"));
-        const v = line ? line.slice(key.length + 1).trim() : "";
-        return v.length > 0 ? v : null;
-      };
-      const declaredGh = idLine("gh_user");
-      const ghHostsPath = join(process.env.GH_CONFIG_DIR || join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "gh"), "hosts.yml");
-      const activeGh = () => {
-        if (!existsSync(ghHostsPath)) return null;
-        const lines = readFileSync(ghHostsPath, "utf8").split(ESC_NL);
-        const start = lines.findIndex((l) => l.startsWith("github.com:"));
-        if (start < 0) return null;
-        for (let k = start + 1; k < lines.length; k += 1) {
-          if (lines[k].length > 0 && lines[k][0] !== " " && lines[k][0] !== ESC_TAB) break;
-          const t = lines[k].trim();
-          if (t.startsWith("user:")) { const u = t.slice(5).trim(); return u.length > 0 ? u : null; }
-        }
-        return null;
-      };
-      const words = (seg) => seg.trim().split(" ").filter((w) => w.length > 0 && w !== ESC_TAB);
-      const headOf = (ws) => { let k = 0; while (k < ws.length && ws[k].indexOf("=") > 0 && ws[k].indexOf("=") < ws[k].length) k += 1; return ws.slice(k); };
-      // Wrapper shells hide the payload in a string (review catch): scan inside.
-      const WRAPPERS =["sh", "bash", "zsh", "dash", "eval", "env", "xargs", "sudo", "nohup", "time", "exec"];
-      let switchedTo = null;
-      const problems = [];
-      // $( and backticks are separators too (review catch): their payload is its own segment.
-      const SEPS = [";", "&&", "||", "|", "$(", String.fromCharCode(96), "(", ")"];
-      const bare = (w) => w.replaceAll(String.fromCharCode(39), "").replaceAll(String.fromCharCode(34), "");
-      const scan = (text, depth) => { if (depth > 3) return; for (const seg of SEPS.reduce((acc, s) => acc.flatMap((l) => l.split(s)), text.split(ESC_NL))) checkSeg(headOf(words(seg)), depth); };
-      const checkSeg = (ws, depth) => {
-        if (ws.length === 0) return;
-        if (WRAPPERS.includes(ws[0])) { // wrapper args have arity (sudo -u bob): scan from the first gh/wrapper token (review catch)
-          const j = ws.findIndex((w, i) => i > 0 && ["gh", ...WRAPPERS].includes(bare(w)));
-          if (j > 0) scan(ws.slice(j).map(bare).join(" "), depth + 1);
-          return;
-        }
-        if (ws[0] === "gh") {
-          if (ws[1] === "auth") {
-            if (ws[2] === "switch") { const u = ws.indexOf("--user"); if (u > 0 && ws[u + 1]) switchedTo = ws[u + 1]; }
-            return; // session commands ARE the remedy — never blocked
-          }
-          if (!declaredGh) { problems.push("gh without a declared identity for this clone — run: kj identity set"); return; }
-          const eff = switchedTo || activeGh();
-          if (eff !== declaredGh) problems.push("gh as '" + (eff || "no session") + "' but this clone is declared as '" + declaredGh + "' — prefix the command: gh auth switch --user " + declaredGh + " && ...");
-        }
-        // KJC-TSK-1085 (ADR 0015): git commit/tag/rebase/push are no longer read here:
-        // pre-commit checks the author, pre-push every pushed commit and the gh session.
-      };
-      scan(CMD_TEXT, 0);
-      if (problems.length > 0) {
-        console.error("karajan sentinel: identity lock (ADR 0005) —" + problems.map((p) => ESC_NL + "- " + p).join("") + ESC_NL + "(sin escape, ADR 0015: pon la cuenta en el comando)" + doc("identity"));
-        process.exit(2);
-      }
-    }
-    // MONO-0 (KJC-TSK-0737, ADR 0002): cada sesion muta solo SU worktree;
-    // otro carril del MISMO repo se deniega ANTES del dano. Lectura libre.
-    const laneOf = (p) => {
-      // Sube al primer ancestro EXISTENTE (un subdir aun no creado escapaba).
-      let d = String(p);
-      if (!(existsSync(d) && statSync(d).isDirectory())) d = dirname(d);
-      while (d && !existsSync(d)) {
-        const up = dirname(d);
-        if (up === d) return null;
-        d = up;
-      }
-      // Canonicaliza (reviewer catch: un symlink local hacia otro carril
-      // esquivaba la clasificacion por ruta literal).
-      try { d = realpathSync(d); } catch { /* se clasifica tal cual */ }
-      return d ? foreignLane(d) : null;
-    };
-    const laneDeny = (what, lane) => {
-      console.error("karajan sentinel: " + what + " vive en otro carril (" + lane + ") de este repo — cada sesion muta solo SU worktree (MONO-0). Sin escape (ADR 0015): un cruce deliberado lo hace tu usuario en su terminal." + doc("cross-lane"));
-      return true;
-    };
-    if (EDIT_TOOLS.includes(tool)) {
-      const target = input.file_path || input.notebook_path;
-      const lane = target ? laneOf(target) : null;
-      if (lane && laneDeny(String(target), lane)) process.exit(2);
-    }
-    if (tool === "Bash") {
-      const cmd = String(input.command || "");
-      // KJC-BUG-0166/0167: gestionar worktrees crudos (add/remove/prune) es
-      // estructura del repo, jamas trabajo de una sesion. 0166: una sesion
-      // intento EN BUCLE retirar el ARBOL PRINCIPAL con remove+CROSS_LANE.
-      // 0167: un coder descarrilado ANADIO un worktree .verify-main rebelde y
-      // de ahi se invento un bootstrap. Deny sin escape en los tres verbos;
-      // el cauce sancionado es kj worktree start|done (corre dentro de kj).
-      if (/(^|[^a-z])git[^a-z]+worktree[^a-z]+(add|remove|prune)/.test(cmd)) {
-        console.error("karajan sentinel: git worktree add/remove/prune no se ejecuta desde una sesion — estructura del repo, sin escape; usa kj worktree start|done." + doc("cross-lane"));
-        process.exit(2);
-      }
-      // KJC-TSK-1114: where the host sandbox denies writing the lanes, it confines Bash itself.
-      if (!sandboxCovers(ROOT, [".kj/worktrees"])) {
-      // Deny-unless-known-read-only: un allowlist de verbos mutadores era
-      // esquivable (dd, interpretes). Solo un comando SIMPLE de lectura (sin
-      // encadenar ni redirigir) puede nombrar otro carril; leer carriles es
-      // trabajo de las tools Read/Grep, como con los ficheros del supervisor.
-      // Solo LITERALES: expansión/sustitución en un comando "de lectura"
-      // puede ejecutar cualquier cosa (reviewer catch: grep foo $(rm ...)).
-      // (find fuera: -delete/-exec mutan — reviewer catch; sus tokens de
-      // carril los caza el escaner de abajo.)
-      // KJC-BUG-0338: kj rag query only reads, and the rag-first gate asks for it
-      // with a quoted question that names the file.
-      const READONLY = /^[ \\t]*(grep|rg|cat|head|tail|less|ls|wc|diff|stat|file|du|tree|git (log|show|diff|status|blame)|kj rag query)\\b[^;|&<>$\`(){}\\n\\r]*$/;
-      // KJC-BUG-0286 (#1982): a command whose EVERY segment only reads mutates
-      // nothing, however it is chained (grep | grep, git show | grep, cd && git
-      // status). A cd with a literal target is one such segment: the paths after
-      // it need no verifying when nothing after it writes. One mutating segment
-      // and the whole command is judged below, as before.
-      const CD_LITERAL = /^[ \\t]*(cd|pushd)([ \\t]+[^ \\t;|&<>$\`(){}\\n\\r]*)?[ \\t]*$/;
-      // KJC-BUG-0365: 2>&1 and 2>/dev/null only fold stderr, they write nothing.
-      const QUIET = /[ \\t]2>(?:&1|\\/dev\\/null)(?=[ \\t]|$)/g;
-      const readsOnly = (s) => s.split(/&&|\\|\\||[;|]/).every((seg) => READONLY.test(seg.replace(QUIET, "")) || CD_LITERAL.test(seg.replace(QUIET, "")));
-      // KJC-BUG-0243: operators inside inert quotes (grep -e "a|b") do not chain anything.
-      if (!readsOnly(stripInertQuotes(cmd))) {
-        // cd/pushd invalida TODO razonamiento textual de rutas posteriores
-        // (carrera de bypasses confirmada en review: destino bare, con $,
-        // relativas post-cd...): en un comando NO-read-only, cambiar de
-        // directorio se deniega conservadoramente — el remedio es no
-        // necesitarlo (git -C, npm --prefix, rutas absolutas).
-        if (/(^|[;&|(\\s])(cd|pushd)([ \\t]|$)/.test(cmd)) {
-          console.error("karajan sentinel: cd/pushd en un comando mutador — las rutas posteriores no son verificables por el guard de carriles (MONO-0); usa git -C / npm --prefix / rutas ABSOLUTAS sin cd." + doc("cross-lane"));
-          process.exit(2);
-        }
-        // Absolute AND dot-relative tokens (../lane escapaba al primer scan —
-        // reviewer catch); relative se resuelve contra el cwd de la sesion.
-        // EVERY token (un tope seria un bypass); dedup acota el coste git.
-        // Fallo de solomon (seguridad no arbitrable) + carrera de bypasses:
-        // la expansion ($, backtick) solo se tolera en segmentos que son
-        // asignaciones puras o runners del toolchain propio (npm/pnpm/yarn/
-        // vitest/jest/kj/gh/echo/printf, git sin -C/--git-dir/--work-tree) —
-        // sus argumentos son datos. En herramientas genericas de fichero o
-        // interpretes el objetivo queda oculto al texto => deny. Los paths
-        // LITERALES (tambien dentro de sustituciones) los escanea el bucle
-        // de tokens de abajo; el residuo (expansion anidada en segmentos
-        // runner) queda documentado como en la regla de ficheros PROTECTED.
-        if (/>{1,2}[ \\t]*["']?[$\`]/.test(cmd)) {
-          console.error("karajan sentinel: redireccion con destino tras variable/sustitucion — el guard de carriles no puede verificarlo (MONO-0); usa una ruta LITERAL." + doc("cross-lane"));
-          process.exit(2);
-        }
-        // Sustitucion de comandos ($(...) o backticks) EJECUTA su contenido
-        // en cualquier posicion, y una ruta entrecomillada con espacios es
-        // invisible al tokenizador: ambas => deny conservador (endpoint
-        // pedido por el reviewer; friccion asumida, el remedio es literal).
-        // KJC-BUG-0140: pares de comillas REALES, no regex sobre el texto —
-        // la comilla de CIERRE de un string + un redirect literal + la de
-        // apertura del siguiente creaban la ilusion de ruta con espacios y
-        // denegaban el flujo estandar commit -m "..." > log && echo "ok".
-        // Se recorre alternando estado (doctrina del parseCommand del motor):
-        // solo el CONTENIDO realmente entrecomillado con slash y espacio
-        // deniega — incluidas comillas a mitad de token (scp host:"/a b/x")
-        // y la comilla sin cerrar (no verificable).
-        // ...y por TOKEN completo, no por span: spans adyacentes concatenan
-        // ("dir with"" spaces/file" es UNA ruta) — catch de codex.
-        const quotedPathWithSpaces = (s) => {
-          // Un backslash pegado a comilla o blanco (comilla escapada,
-          // espacio escapado) altera donde CIERRA el string o esconde
-          // espacios: opaco => deny (doctrina del motor) — catch de codex.
-          // Caracteres construidos con fromCharCode: CERO escaping en este
-          // template — fuente y artefacto identicos, nada que malinterpretar
-          // (el doble-escaping confundio cuatro reviews; solomon desestimo
-          // la primera y las demas se volvieron ilegibles igual).
-          // El punto escapado de un sed y similares siguen libres.
-          const BS = String.fromCharCode(92);
-          const TAB = String.fromCharCode(9);
-          const NL = String.fromCharCode(10);
-          for (let i = s.indexOf(BS); i !== -1; i = s.indexOf(BS, i + 1)) {
-            const n = s[i + 1] || "";
-            if (n === '"' || n === "'" || n === " " || n === TAB) return true;
-          }
-          let q = null;
-          let tok = "";
-          let hadQuote = false;
-          const flush = () => {
-            const bad = hadQuote && tok.includes("/") && tok.includes(" ");
-            tok = "";
-            hadQuote = false;
-            return bad;
-          };
-          for (const ch of s) {
-            if (q) {
-              if (ch === q) q = null;
-              else tok += ch;
-              continue;
-            }
-            if (ch === '"' || ch === "'") {
-              q = ch;
-              hadQuote = true;
-              continue;
-            }
-            if (ch === " " || ch === TAB || ch === NL || ch === ";" || ch === "|" || ch === "&" || ch === "<" || ch === ">" || ch === "(" || ch === ")") {
-              if (flush()) return true;
-              continue;
-            }
-            tok += ch;
-          }
-          if (q !== null) return true; // comilla sin cerrar: no verificable
-          return flush();
-        };
-        // KJC-BUG-0243: inert quoted text is not a substitution, and the prose value
-        // of a text option (--title, -m...) is not a path.
-        if (/\\$\\(|\`/.test(stripInertQuotes(cmd)) || quotedPathWithSpaces(stripTextOptionValues(cmd))) {
-          console.error("karajan sentinel: sustitucion de comandos o ruta entrecomillada con espacios en un comando mutador — no verificable por el guard de carriles (MONO-0); usa valores/rutas LITERALES sin sustitucion. Si es texto (titulo, descripcion, error) con comillas de codigo o dolar, ponlo entre comillas SIMPLES: entre dobles la shell lo ejecuta." + doc("cross-lane"));
-          process.exit(2);
-        }
-        const SAFE_EXP_SEG = /^([A-Za-z_][A-Za-z0-9_]*=[^ \\t]*[ \\t]*)*((npm|pnpm|yarn|vitest|jest|kj|gh|echo|printf|true|test)\\b|git[ \\t](?![^\\n]*(-C[ \\t]|--git-dir|--work-tree)))[^;|&\\n]*$|^[A-Za-z_][A-Za-z0-9_]*=[^;|&\\n]*$/;
-        const segs = cmd.split(/&&|\\|\\||[;|\\n]/).map((s) => s.trim()).filter(Boolean);
-        if (!segs.every((s) => !/[$]/.test(s) || SAFE_EXP_SEG.test(s))) {
-          console.error("karajan sentinel: expansion de shell en una herramienta generica de fichero/interprete — el objetivo no es verificable por el guard de carriles (MONO-0); usa rutas LITERALES o un runner del toolchain." + doc("cross-lane"));
-          process.exit(2);
-        }
-        // ...incluidas relativas A PELO (los carriles kj viven en
-        // .kj/worktrees/). Un falso token (s/a/b/) resuelve al arbol propio
-        // y foreignLane da null — solo deniega lo que CAE en otro carril.
-        const seen = new Set();
-        for (const m of cmd.matchAll(/(?:^|[\\s"'=;(><])((?:\\.\\.?\\/)[^\\s"'\`;|&)]*|\\/[^\\s"'\`;|&)]+|~\\/[^\\s"'\`;|&)]+|[A-Za-z0-9_.@-]+\\/[^\\s"'\`;|&)]+)/g)) {
-          const t = m[1].startsWith("~/") ? (process.env.HOME || "~") + m[1].slice(1) : m[1];
-          const abs = resolve(t);
-          if (seen.has(abs)) continue;
-          seen.add(abs);
-          const lane = laneOf(abs);
-          if (lane && laneDeny(m[1], lane)) process.exit(2);
-        }
-      }
-      }
-    }
-    // KJC-BUG-0237 (#1886): the repo is written through Edit/Write only, the path every gate
-    // guards. After the lane guard, whose message is the precise one for another lane.
-    // KJC-TSK-1114: gates run at commit now; what only this guard kept, the governance
-    // files, the host sandbox denies where it covers them.
-    if (tool === "Bash" && !sandboxCovers(ROOT, ["kj.config.yml", ".ragignore"])) {
-      let moved = false; // after cd/pushd/popd, a relative target cannot be placed: fail-closed
-      // $( ) and backticks run even inside double quotes: their bodies, read from the raw text, are commands too.
-      const raw = String(input.command || "");
-      const subs = [...[...raw.matchAll(/[$][(]([^()]*)[)]/g)].map((m) => m[1]), ...raw.split(String.fromCharCode(96)).filter((_, k) => k % 2 === 1)];
-      for (const words of [...shellSegments(raw), ...subs.flatMap((s) => shellSegments(s))]) {
-        if (["cd", "pushd", "popd"].includes(words[0])) moved = true;
-        const inRepo = shellWrites(words).filter((t) => writesRepo(t, ROOT) || (moved && !t.startsWith("/")));
-        if (inRepo.length === 0) continue;
-        console.error("karajan sentinel: escribir ficheros del repo desde Bash (" + inRepo.slice(0, 3).join(", ") + ") se salta los gates de Edit/Write — usa la tool Edit/Write; para renombrar, git mv; fuera del repo (/tmp, scratchpad) Bash es libre." + doc("bash-write"));
-        process.exit(2);
-      }
-    }
-    // KJC-TSK-0734 (PL-B): con .karajan/policy.yml presente, la evaluacion
-    // la hace el MOTOR via kj policy eval --strict (exit 2 = deny, contrato
-    // PL-A); los defaults del supervisor viven en el motor y el check
-    // PROTECTED inline de arriba queda como red fail-closed si kj falta.
-    // Fail CLOSED por defecto (catches de codex; doctrina KJC-BUG-0095: un
-    // gate no se cae en silencio): solo exit 0 permite. kj inejecutable =
-    // deny duro (el remedio es restaurar kj); cualquier otro fallo de
-    // evaluacion = deny sin escape (ADR 0015): un typo de YAML lo corrige el
-    // usuario fuera de la sesion.
-    if ((EDIT_TOOLS.includes(tool) || tool === "Bash") && existsSync(resolve(ROOT, ".karajan", "policy.yml"))) {
-      // PL-C: el rol que ACTÚA (KJ_POLICY_ROLE, sembrado por los runners de
-      // kj run en los subprocesos) — el anfitrión-brain evalúa como coder.
-      const actorRole = process.env.KJ_POLICY_ROLE || "coder";
-      const pres = spawnSync("kj", ["policy", "eval", "--strict", "--role", actorRole, "--tool", tool, "--input", JSON.stringify(input)], { cwd: ROOT, encoding: "utf8" });
-      if (pres.error || pres.status === null) {
-        console.error("karajan sentinel: .karajan/policy.yml declara enforcement pero kj no es ejecutable — la policy no se puede evaluar; restaura kj en el PATH (npm i -g @karajan-family/code, o el nombre legacy karajan-code) o retira la policy conscientemente." + doc("policy"));
-        process.exit(2);
-      }
-      if (pres.status === 2) {
-        let v = null;
-        try { v = JSON.parse(String(pres.stdout || "").trim().split("\\n").pop()); } catch { /* mensaje generico */ }
-        const secure = !!(v && v.class === "security");
-        // ADR 0015 (KJC-TSK-0932): no escape; a rule that misfires is fixed by PR.
-        console.error("karajan sentinel: policy deny [" + ((v && v.rule_id) || "policy") + "] " + ((v && v.reason) || "la tool call viola la policy del proyecto") + (secure ? " [security — sin escape ni arbitraje]" : " (sin escape: si la regla falla, tu usuario corrige .karajan/policy.yml por PR)") + doc("policy"));
-        process.exit(2);
-      } else if (pres.status !== 0) {
-        // KJC-BUG-0207: un kj que NO ARRANCA no es una violacion de policy. Con
-        // kj linkado al arbol, un error de sintaxis transitorio en src/ dejaba
-        // la sesion sin Edit, sin Write y sin Bash, o sea sin las herramientas
-        // para arreglar el fichero, y el remedio que sugeria (kj policy check)
-        // tampoco arrancaba. Se avisa fuerte y se deja pasar: el resto de este
-        // guard sigue vigente, que es lo que protege el metodo.
-        const broken = /SyntaxError|ReferenceError|Cannot find module|ERR_MODULE_NOT_FOUND|ERR_REQUIRE_ESM/.exec(String(pres.stderr || ""));
-        // Abrir el gate entero seria un bypass a la carta (romper un modulo y
-        // seguir sin policy), catch de la review. Se permite EXACTAMENTE una
-        // cosa: editar el fichero que rompe kj. Lo demas sigue denegado.
-        const at = broken ? (String(pres.stderr || "").split("\\n").map((l) => l.trim()).find((l) => /^[^ ]+\\.(m?js|cjs|ts):\\d+$/.test(l)) || "") : "";
-        // Node localiza los errores de un modulo ESM como file:///ruta.js:124,
-        // y esa forma no es una ruta de fichero (catch de la review).
-        const asPath = (p) => (p.startsWith("file:") ? fileURLToPath(p) : p);
-        const brokenFile = at ? asPath(at.slice(0, at.lastIndexOf(":"))) : "";
-        if (broken) {
-          const target = input.file_path || input.notebook_path || "";
-          const repairing = EDIT_TOOLS.includes(tool) && brokenFile && target && resolve(String(target)) === resolve(brokenFile);
-          if (repairing) console.error("karajan sentinel: kj no arranca (" + broken[0] + " en " + at + ") — la policy no se puede evaluar, asi que solo se permite arreglar ESE fichero. Arreglalo y vuelve." + doc("policy"));
-          else {
-            console.error("karajan sentinel: kj no arranca (" + broken[0] + (at ? " en " + at : "") + "), asi que la policy no se puede evaluar y NADA MAS pasa: edita " + (brokenFile || "el fichero que rompe kj") + " para arreglarlo. No es un deny de policy, es kj roto." + doc("policy"));
-            process.exit(2);
-          }
-        } else {
-          console.error("karajan sentinel: kj policy eval fallo (exit " + pres.status + ") — la policy declarada no se pudo evaluar, deny por defecto; diagnostica con kj policy check; .karajan/policy.yml lo corrige tu usuario fuera de la sesion." + doc("policy"));
-          process.exit(2);
-        }
-      }
-    }
-    if (EDIT_TOOLS.includes(tool)) {
-      // STW-C (KJC-TSK-0791): the sweep's verdict has consequence where work
-      // STARTS. Inform ALWAYS, once per session and impossible to miss; BLOCK
-      // almost never — only security and persistent red main, and only when
-      // the project adopted it (method_gates.steward: block). Unknown is never
-      // treated as broken: nothing is asserted that is not known. No report =
-      // the project does not use the Steward yet — silence, adoption is explicit.
-      try {
-        const rep = JSON.parse(readFileSync(join(ROOT, ".karajan", "steward", "report.json"), "utf8"));
-        const bad = (rep.invariants || []).filter((r) => r.verdict === "broken");
-        const stale = (rep.invariants || []).filter((r) => r.verdict === "unknown");
-        if (bad.length || stale.length) {
-          const hard = bad.filter((r) => r.id === "vulnerable-deps" || r.id === "main-ci");
-          let blockOn = false;
-          try { blockOn = /steward:\\s*["']?block/.test(readFileSync(join(ROOT, ".karajan", "kj.config.yml"), "utf8")); } catch { /* no config — no block */ }
-          if (hard.length && blockOn) {
-            console.error("karajan sentinel: steward — el estado del proyecto bloquea empezar (barrido " + rep.sweptAt + "):" + String.fromCharCode(10) + hard.map((r) => "- " + r.id + ": " + (r.evidence || "") + " -> " + (r.remedy || r.renew || "kj steward sweep")).join(String.fromCharCode(10)) + String.fromCharCode(10) + "(sin escape, ADR 0015: si el trabajo sigue, tu usuario cambia method_gates.steward a inform)" + doc("steward"));
-            process.exit(2);
-          }
-          const st = load();
-          const s = session(st, sid);
-          if (!s.steward_informed) {
-            s.steward_informed = true;
-            save(st);
-            const lines = [...bad.map((r) => "ROTO " + r.id + ": " + (r.remedy || r.evidence || "")), ...stale.map((r) => "desconocido " + r.id + " (no se afirma lo que no se sabe) — refresca: " + (r.renew || "kj steward sweep"))];
-            console.log(JSON.stringify({ systemMessage: "kj steward (barrido " + rep.sweptAt + "): " + lines.join(" | ") + " — detalle: .karajan/steward/report.md" }));
-          }
-        }
-      } catch { /* no report or unreadable — the Steward is not adopted here */ }
-      const file = input.file_path || input.notebook_path;
-      const rel = file ? relative(ROOT, String(file)).replaceAll("\\\\", "/") : "";
-      // KJC-BUG-0279 (#1981): outside the repository there is no source to govern.
-      if (rel && rel !== ".." && !rel.startsWith("../") && !rel.startsWith("/") && CODE.test(rel) && !TESTS.test(rel)) {
-        const branch = branchOf();
-        const why = !branch ? null : BASE_BRANCHES.has(branch) ? "base" : !CARD.test(branch) ? "nocard" : null;
-        // ADR 0015 (KJC-TSK-0925): no escape. Without a card there is no work.
-        if (why) {
-          console.error(why === "base"
-            ? "karajan sentinel: no se editan fuentes en la rama base '" + branch + "' — crea la card (kj hu add) y la rama: git checkout -b feat/<CARD-ID>-descripcion." + doc("card-first")
-            : "karajan sentinel: la rama '" + branch + "' no referencia ninguna card — crea/mueve la card a running (kj hu add | kj hu move) y usa una rama feat/<CARD-ID>-descripcion." + doc("card-first"));
-          process.exit(2);
-        }
-        // KJC-TSK-0848 (ADR 0010, RAG-B): the RAG must have answered about this
-        // zone before the session touches it. Covered = the session ledger
-        // (RAG-A) holds this file or a sibling of its directory; a NEW file only
-        // needs the session to have consulted at all. Same file set as card-first.
-        const rs = load().sessions?.[sid] || {};
-        const hits = rs.rag_hits || [];
-        const dirOf = (p) => (p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "");
-        // KJC-BUG-0210: nuevo no es "no existe en disco". En cuanto la sesion
-        // lo crea, la siguiente edicion exigia una respuesta del RAG sobre un
-        // fichero que el indice NO puede tener. El hecho comprobable: un
-        // fichero que git no conoce no ha podido indexarse.
-        // Solo se pregunta a git en el camino lento, cuando el gate iba a
-        // denegar: exit 1 = git responde que no lo conoce; cualquier otro
-        // resultado se comporta como hasta ahora y bloquea.
-        const fresh = () => !existsSync(String(file)) || spawnSync("git", ["-C", ROOT, "ls-files", "--error-unmatch", "--", rel], { encoding: "utf8" }).status === 1;
-        // A path outside this tree is another lane's business (the lane guard
-        // above rules on it) and the ledger only holds in-repo paths.
-        // KJC-BUG-0190: with nothing indexed, no query can cover anything —
-        // the gate asks for kj rag index instead of denying the impossible.
-        // KJC-BUG-0308: a barrel only re-exports its folder, so the RAG answers with
-        // what it re-exports and never with the barrel: a hit in its own subtree covers it.
-        const BARRELS = ["index.js", "index.ts", "index.mjs", "index.cjs", "index.jsx", "index.tsx", "__init__.py", "mod.rs"];
-        const barrelCovered = dirOf(rel) !== "" && BARRELS.includes(rel.slice(rel.lastIndexOf("/") + 1)) && hits.some((h) => h.startsWith(dirOf(rel) + "/"));
-        const covered = rel.startsWith("..") || hits.includes(rel) || hits.some((h) => dirOf(h) === dirOf(rel)) || barrelCovered || ((rs.rag_queries || []).length > 0 && fresh()) || rs.rag_index_empty === true;
-        // ADR 0015 (KJC-TSK-0925): no escape. The cases it covered (new file, empty
-        // index, not indexable) are decided by the gate itself.
-        if (!covered) {
-          {
-            // KJC-BUG-0216 (issue #1807): un .astro, un .php o cualquier fichero
-            // sin adapter NO puede estar en el indice, asi que exigir una
-            // respuesta del RAG sobre el es pedir lo imposible, y empujaba a
-            // dejar el escape puesto para siempre. La exencion es SOLO
-            // esa: un indice vacio o por detras si tiene arreglo (kj rag index)
-            // y sigue bloqueando, porque si no el gate desapareceria en
-            // cualquier proyecto sin indexar. Nada legible = se bloquea.
-            const cov = spawnSync("kj", ["rag", "covers", rel, "--json"], { cwd: ROOT, encoding: "utf8" });
-            let blind = null;
-            let absent = null;
-            try {
-              const c = JSON.parse(String(cov.stdout || ""));
-              if (c.state === "not-indexable") blind = c.reason;
-              // KJC-TSK-0891: si el indice no tiene el fichero, consultar no puede
-              // devolverlo; el remedio es indexarlo, y se nombra.
-              if (c.state === "stale" || c.state === "index-empty") absent = c.reason;
-            } catch { blind = null; }
-            if (blind) {
-              console.error("karajan sentinel: rag-first — " + blind + " — no se te exige consultar lo que el indice no puede tener; el gate lo anota y sigue" + doc("rag-first"));
-            } else if (absent) {
-              console.error("karajan sentinel: rag-first — el indice aun no tiene " + rel + " (" + absent + "); indexalo y consulta despues: kj_rag_query / kj rag query <que hace " + rel + ">" + doc("rag-first"));
-              process.exit(2);
-            } else {
-              // KJC-BUG-0293 (#1996): hits that fell outside the tree are named, so the
-              // person learns the index was built from another path instead of querying again.
-              const dropped = rs.rag_dropped;
-              const outside = dropped?.count
-                ? " La ultima consulta devolvio " + dropped.count + " hit(s) fuera de este arbol (" + dropped.root + "): " + (dropped.sample || []).join(", ") + " — el indice se construyo desde otra ruta; reindexa desde esta: kj rag index --with-sources."
-                : "";
-              console.error("karajan sentinel: rag-first — el RAG no ha respondido sobre " + rel + " en esta sesion; consulta antes de tocarlo: kj_rag_query / kj rag query <que hace " + rel + " y donde mas vive ese concepto>." + outside + doc("rag-first"));
-              process.exit(2);
-            }
-          }
-        }
-      }
-    }
-    if (tool === "Bash") {
-      const cmd = String(input.command || "");
-      // KJC-TSK-0765 board-sync: a merge leaves its card PENDING in the tracker
-      // and nothing advances (commit, new PR, another merge; push and the end of
-      // the turn go through violations()) until the card is moved. The board is
-      // true at all times or the method stops — never a rule in the agent's memory.
-      // ENF-B (KJC-TSK-0854): el review es obligatorio, no una sugerencia. Una
-      // bandera no puede apagar el gate de commit, y mover core.hooksPath lo
-      // apaga entero. El --no-verify que kj harden --commit usa por dentro no
-      // pasa por aqui: no es una tool call. Escape humano, sellado como el resto.
-      // KJC-BUG-0286 (#1982): judged on the git commit SEGMENT alone, read by the
-      // shell reader: a "commit" inside a grep pattern piped after git show, or
-      // the -n of a grep in the same pipeline, is not a skipped hook.
-      const commitSegments = shellSegments(cmd).map((ws) => ws.map((w) => w.slice(w.lastIndexOf("/") + 1))).filter((ws) => inOrder(["git", "commit"], ws));
-      // git acepta abreviaturas no ambiguas de las opciones largas, asi que
-      // --no-ver salta el hook igual que --no-verify (catch de la review).
-      const shortWithN = (w) => w.length > 1 && w[0] === "-" && w[1] !== "-" && w.includes("n");
-      const skipsVerify = (w) => shortWithN(w) || (w.length >= 5 && "--no-verify".startsWith(w));
-      // Mover core.hooksPath apaga TODOS los hooks. git tiene varias puertas
-      // para lo mismo (config, -c, --config-env, GIT_CONFIG_KEY_n) y no
-      // distingue mayusculas en la llave, asi que lo que se vigila es la LLAVE
-      // en cualquier posicion (dos catches de la review). Leerla no hace nada.
-      // Nombrar la llave basta para denegar: exceptuar las lecturas invitaba a
-      // colar una detras del cambio (git config core.hooksPath /x; cat algo),
-      // catch de la review. Leerla tiene remedio barato, perderla no.
-      // Se busca la llave DENTRO del token y no solo al principio: las formas
-      // de inyeccion la empotran (GIT_CONFIG_KEY_0=core.hooksPath,
-      // --config-env=core.hooksPath=VAR) y una propiedad de seguridad no puede
-      // depender de como parta las palabras el separador (catch de la review).
-      const movesHooks = cmd.toLowerCase().includes("core.hookspath");
-      if (commitSegments.some((ws) => ws.some(skipsVerify)) || movesHooks) {
-        // ADR 0015 (KJC-TSK-0926): no escape. A broken hook is fixed; skipping it,
-        // if it ever must happen, is the user's act in their own terminal.
-        console.error("karajan sentinel: el gate de commit no se apaga con una bandera — el review cruzado y la policy corren en el hook, y saltarselos deja el diff sin veredicto. Si el hook esta roto, arreglalo; si de verdad hace falta saltarlo, lo hace tu usuario en su terminal." + doc("escapes"));
-        process.exit(2);
-      }
-      // KJC-BUG-0296 (#1989): the staged set is reviewed by name. A blanket
-      // git add -A / git add . / git add -u put a Claude scheduler lock into
-      // main; and the agent's runtime files (.claude/*.lock, .kj/, the local
-      // identity, the Sentinel state, the harness) are never staged at all.
-      // (No backticks in this template: they would end the string.)
-      const RUNTIME = /^(\\.\\/)?(\\.claude\\/[^/]*\\.lock|\\.kj\\/|\\.karajan\\/identity\\.local\\.yml|\\.karajan\\/harness\\/sentinel-state\\.json)/;
-      for (const ws of shellSegments(cmd)) {
-        const gi = ws.findIndex((x) => x.slice(x.lastIndexOf("/") + 1) === "git");
-        if (gi < 0) continue;
-        // git's own options come before the verb: -C <dir>, -c k=v, --git-dir=…
-        let vi = gi + 1;
-        while (vi < ws.length && ws[vi].startsWith("-")) vi += ws[vi] === "-C" || ws[vi] === "-c" ? 2 : 1;
-        if (ws[vi] !== "add") continue;
-        const args = ws.slice(vi + 1);
-        // The pathspec: after "--" if present, else every non-option word. "." is
-        // the whole tree whichever way it is written; -A/-u with no pathspec too.
-        const dash = args.indexOf("--");
-        const spec = dash >= 0 ? args.slice(dash + 1) : args.filter((a) => !a.startsWith("-"));
-        const whole = spec.some((a) => a === "." || a === "./");
-        const blanket = whole || (args.some((a) => a === "-A" || a === "--all" || a === "-u" || a === "--update") && spec.length === 0);
-        if (blanket) {
-          console.error("karajan sentinel: git add -A / . / -u stagea lo que no has revisado — stagea por nombre (git add -- <ruta>...) y mira git diff --cached --stat antes de commitear." + doc("commit-gate"));
-          process.exit(2);
-        }
-        // Directories too: .kj is runtime whole; .claude and .karajan hold the
-        // contract, so only a forced add (-f, past the ignore) reaches their locks.
-        const force = args.some((a) => a === "-f" || a === "--force");
-        const runtime = spec.find((a) => RUNTIME.test(a) || /^(\\.\\/)?\\.kj\\/?$/.test(a) || (force && /^(\\.\\/)?(\\.claude|\\.karajan)\\/?$/.test(a)));
-        if (runtime) {
-          console.error("karajan sentinel: " + runtime + " es runtime del agente (locks de .claude, .kj/, identidad local, estado del Sentinel) y no se commitea — fuera del stage." + doc("commit-gate"));
-          process.exit(2);
-        }
-      }
-      const MERGE = /\\bgh\\s+pr\\s+merge(\\s+(\\d+))?/;
-      // KJC-TSK-1089: git push is not read any more; pending moves still stop the turn (stop gate).
-      const ADVANCE = /\\bgit\\s+commit\\b|\\bgh\\s+pr\\s+create\\b/;
-      const mergeM = cmd.match(MERGE);
-      const pend = pendingMoves(load().sessions?.[sid]);
-      if (pend.length > 0 && (mergeM || ADVANCE.test(cmd))) {
-        // KJC-BUG-0198: una card partida en varias PRs no puede quedar bloqueada
-        // por su primera mitad (boardGate, en la lib).
-        const { blocking, carried, reason } = boardGate(sid, pend);
-        for (const c of carried) console.error("karajan sentinel: board-sync arrastra " + c.card + " — " + c.why + ", se movera al cerrarla");
-        // ADR 0015 (KJC-TSK-0925): no escape; an epic and a card split across PRs
-        // are already decided above (KJC-BUG-0230, 0198).
-        // KJC-BUG-0363: when kj could not check, its reason travels with the block.
-        if (blocking.length > 0) {
-          console.error("karajan sentinel: board-sync — el metodo no avanza con cards mergeadas sin mover:\\n" + blocking.map((p) => "- " + pendingText(p)).join("\\n") + (reason ? "\\n(" + reason + ")" : "") + doc("board-sync"));
-          process.exit(2);
-        }
-      }
-      // (the pending entry itself is recorded by the PostToolUse hook, only once
-      // gh confirms "merged pull request #N" — a failed merge never blocks)
-      // CLM-C (KJC-TSK-0803): a PR body outlives the turn — an invented figure
-      // there misleads every future reader. When the command writes one from a
-      // file, kj crosses ITS data against this turn's outputs; the hook carries
-      // no policy (kj reads method_gates.claims; off = this check does not exist).
-      // KJC-BUG-0245: the path is read by the shell reader, so "pr.md;" is "pr.md".
-      const body = /\\bgh\\s+pr\\s+(?:create|edit)\\b/.test(cmd) ? optionValues(cmd, ["--body-file"])[0] : undefined;
-      if (body && transcript) {
-        const g = spawnSync("kj", ["claims", "gate", "--transcript", transcript, "--file", body], { cwd: ROOT, encoding: "utf8" });
-        if (!g.error && g.status === 2) {
-          console.error("karajan sentinel: claims — un dato del cuerpo de la PR esta DESMENTIDO por las salidas de este turno:\\n" + (g.stderr || "").trim() + "\\nVerificalo o marcalo como no comprobado antes de crear la PR. Detalle: kj claims check --transcript " + transcript + " --file " + body + doc("claims"));
-          process.exit(2);
-        }
-      }
-      if (isPublish(cmd)) {
-        // ADR 0015 (KJC-TSK-0932): no escape — KJC-BUG-0204 and 0259 keep the
-        // check from blocking its own fix.
-        // KJC-BUG-0204: el check se evalua PARA este comando. Un item que
-        // declara remedied_by no bloquea el comando que lo repara (desplegar
-        // la landing era justo lo que el check pedia); publicar no se exime.
-        const res = spawnSync("kj", ["release", "check", "--json", "--for-command", cmd], { cwd: ROOT, encoding: "utf8" });
-        if (res.error || res.status === null) process.exit(0);
-        let parsed = null;
-        try { parsed = JSON.parse(res.stdout); } catch { /* raw output */ }
-        const lifted = (parsed && parsed.lifted) || [];
-        if (res.status === 0 && lifted.length > 0) {
-          // En voz alta: una exencion que nadie ve no se distingue de un gate que no mira.
-          console.error("karajan sentinel: release check en rojo SOLO por lo que este comando repara (" + lifted.join(", ") + ") — pasa, y el resto sigue en verde" + doc("release"));
-          process.exit(0);
-        }
-        if (res.status !== 0) {
-          let items = "";
-          try { items = (parsed.checks || []).filter((c) => !c.ok && c.lifted !== true).map((c) => "\\n- " + c.name + ": " + c.detail).join(""); } catch { /* raw output */ }
-          console.error("karajan sentinel: release check en ROJO — no se publica ni despliega hasta resolverlo:" + (items || "\\n- corre kj release check para el detalle") + "\\n(sin escape: se repara lo que el check nombra)" + doc("release"));
-          process.exit(2);
-        }
-      }
-      // KJC-TSK-1089 (ADR 0015): git push is no longer read here. The base branch is
-      // protected (required checks), the card and the tests are judged at commit
-      // (kj review), and pending card moves keep the turn from ending (stop gate).
-    }
-  } catch { /* fail open */ }
-  process.exit(0);
-});
-`;
-
+// KJC-TSK-0915 (ADR 0014), KJC-BUG-0402 (ADR 0030): every guard is a real module,
+// copied byte for byte under the SAME name (so they can import each other in both
+// places). Being here, the installed record, the tamper check and the human seal
+// cover them; being files, they can also run from the installed package.
+// Each read stays a literal: the single-file build inlines exactly that form.
 const SCRIPT_BODIES = {
-  "sentinel-lib.mjs": LIB_BODY,
-  "posttooluse.mjs": POST_BODY,
-  "stop.mjs": STOP_BODY,
-  "pretooluse-sentinel.mjs": PRETOOL_BODY,
-  // KJC-TSK-0915 (ADR 0014): real modules, copied byte for byte under the SAME name
-  // (so they can import each other in both places). Being here, the installed
-  // record, the tamper check and the human seal cover them as well.
+  "sentinel-lib.mjs": readFileSync(new URL("./sentinel/sentinel-lib.mjs", import.meta.url), "utf8"),
+  "posttooluse.mjs": readFileSync(new URL("./sentinel/posttooluse.mjs", import.meta.url), "utf8"),
+  "stop.mjs": readFileSync(new URL("./sentinel/stop.mjs", import.meta.url), "utf8"),
+  "pretooluse-sentinel.mjs": readFileSync(new URL("./sentinel/pretooluse-sentinel.mjs", import.meta.url), "utf8"),
   "sentinel-shell.mjs": readFileSync(new URL("./sentinel/sentinel-shell.mjs", import.meta.url), "utf8"),
   "sentinel-discard.mjs": readFileSync(new URL("./sentinel/sentinel-discard.mjs", import.meta.url), "utf8"),
   "sentinel-bash-write.mjs": readFileSync(new URL("./sentinel/sentinel-bash-write.mjs", import.meta.url), "utf8"),
@@ -1293,6 +126,14 @@ function writeInstalledRecord(dir) {
  */
 export function verifySentinelScripts({ projectDir, readFileFn = readFileSync, gitShowFn = null } = {}) {
   const root = projectDir || resolveSentinelRoot();
+  // KJC-TSK-1206 (ADR 0030): wired to the package runner, the guard that runs is
+  // the installed kj's, so the wiring is what can be tampered with and is checked.
+  // The governing guards; the tool gate (Write over an existing file) is a convenience.
+  const wiring = wiringState({ projectDir: root, entries: SENTINEL_WIRING });
+  if (wiring.missing.length > 0) {
+    return { ok: false, mismatched: wiring.missing, wiring: true, reason: "hooks de .claude/settings.json que ya no llaman a su guardia — restaura con kj harden" };
+  }
+  if (wiring.mode === "wiring") return { ok: true, mismatched: [], wiring: true };
   const dir = join(root, ".karajan", "harness");
   const installed = new Map();
   const mismatched = [];
@@ -1353,17 +194,14 @@ export function verifySentinelScripts({ projectDir, readFileFn = readFileSync, g
 }
 
 /**
- * Write the sentinel scripts (shared lib + state writer + gates) and wire them.
+ * Wire the Sentinel's hooks to the guards of the installed kj (ADR 0030).
  *
- * KJC-BUG-0193: a guard holding exactly what a human sealed is LEFT ALONE. This
- * is the command a session reaches for when it has edited the templates, and
- * rewriting the guards here un-sealed the ones actually running, so the very act
- * of unblocking destroyed the seal that made unblocking unnecessary. Advancing
- * them is a human act: `kj harden --commit` moves guards and seal together.
- * Anything nobody sealed is rewritten as before, because restoring a tampered
- * guard is still the right move.
+ * KJC-TSK-1208: no guard is copied into the project any more; what runs is the
+ * package's. Once the hooks call it, the copies an older kj wrote are dead code
+ * and are retired; the session state and the denial log stay. The next seal
+ * records them as deleted. Not wired (unreadable settings), nothing is removed.
  */
-export function installSentinelHooks({ projectDir = process.cwd(), logger = console, human = false, gitShowFn = null } = {}) {
+export function installSentinelHooks({ projectDir = process.cwd(), logger = console } = {}) {
   // KJC-BUG-0223: instalado desde un subdirectorio, esto sembraba un segundo
   // `.karajan/harness` ahi, y el gate (que mira otro sitio) pasaba a verlo. El
   // ritual quedaba "arreglado" y el arbol se llenaba de arneses huerfanos que
@@ -1371,56 +209,43 @@ export function installSentinelHooks({ projectDir = process.cwd(), logger = cons
   const root = resolveSentinelRoot(projectDir);
   if (root !== projectDir) logger?.info?.(`kj harden: el harness es del proyecto, se instala en su raíz (${root})`);
   projectDir = root;
-  const sealed = human ? new Map() : sealedByPath(projectDir, gitShowFn);
-  const deferred = [];
-  const keepsItsSeal = (name) => {
-    const sealedHash = sealed.get(`.karajan/harness/${name}`);
-    if (!sealedHash) return false;
-    try {
-      return sealedHash === createHash("sha256").update(readFileSync(join(projectDir, ".karajan", "harness", name), "utf8")).digest("hex");
-    } catch {
-      return false; // no hay contenido que un sello pueda cubrir
-    }
-  };
-  const [lib, post, stop, pre] = Object.entries(SCRIPT_BODIES).map(([name, body]) => {
-    if (keepsItsSeal(name)) {
-      const abs = join(projectDir, ".karajan", "harness", name);
-      // KJC-BUG-0325: only a sealed guard the current template would change is
-      // waiting for the human; one identical to it has nothing to advance.
-      if (readFileSync(abs, "utf8") !== body) deferred.push(name);
-      return abs;
-    }
-    return writeHarnessScript(projectDir, name, body);
-  });
-  writeInstalledRecord(join(projectDir, ".karajan", "harness"));
-  if (deferred.length > 0) {
-    logger?.info?.(`kj harden: ${deferred.join(", ")} se queda como está — es lo que un humano selló, y avanzarlo es suyo: kj harden --commit`);
-  }
-  const { wired } = mergeClaudeHooks({
-    projectDir,
-    logger,
-    entries: [
-      { event: "PreToolUse", matcher: "Write|Edit|MultiEdit|NotebookEdit", script: "pretooluse-sentinel.mjs" },
-      { event: "PreToolUse", matcher: "Bash", script: "pretooluse-sentinel.mjs" },
-      // KJC-TSK-0946 (ADR 0016): no matcher. The rules of the MD files are checked
-      // before EVERY tool call, MCP ones included.
-      { event: "PreToolUse", script: "pretooluse-rules.mjs" },
-      { event: "PostToolUse", matcher: "Write|Edit|MultiEdit|NotebookEdit", script: "posttooluse.mjs" },
-      // KJC-TSK-0765 board-sync: the merge (Bash) and the tracker move (MCP
-      // update_card) are observed AFTER the fact — found live: with only the
-      // edit matchers wired, the board-sync recorder never ran in production.
-      { event: "PostToolUse", matcher: "Bash", script: "posttooluse.mjs" },
-      { event: "PostToolUse", matcher: "mcp__.*__update_card", script: "posttooluse.mjs" },
-      // KJC-BUG-0236 (#1886): the rag-first ledger records MCP answers here;
-      // unwired, the official tool never satisfied the gate.
-      { event: "PostToolUse", matcher: "mcp__.*__kj_rag_query", script: "posttooluse.mjs" },
-      { event: "Stop", script: "stop.mjs" },
-      // KJC-TSK-0918 (ADR 0014): the critical rules back after a compaction or a resume.
-      { event: "SessionStart", matcher: "compact", script: "sessionstart.mjs" },
-      { event: "SessionStart", matcher: "resume", script: "sessionstart.mjs" },
-      // KJC-TSK-0949: a new session hears of MD rules with no gate, and nothing else.
-      { event: "SessionStart", matcher: "startup", script: "sessionstart.mjs" },
-    ],
+  mkdirSync(join(projectDir, ".karajan", "harness"), { recursive: true });
+  const { wired } = mergeClaudeHooks({ projectDir, logger, entries: SENTINEL_WIRING });
+  const retired = wired ? retireGuardCopies(projectDir, [...Object.keys(SCRIPT_BODIES), INSTALLED_RECORD]) : [];
+  if (retired.length > 0) logger?.info?.(`kj harden: los guardias corren desde el kj instalado; retiradas las copias del proyecto (${retired.join(", ")})`);
+  return { wired, retired };
+}
+
+/** KJC-TSK-1208: remove the named files from .karajan/harness, returning those that were there. */
+export function retireGuardCopies(projectDir, names) {
+  const dir = join(projectDir, ".karajan", "harness");
+  return names.filter((name) => {
+    if (!existsSync(join(dir, name))) return false;
+    rmSync(join(dir, name));
+    return true;
   });
-  return { scripts: [lib, post, stop, pre], wired, deferred };
 }
+
+/** The Sentinel's place in the host settings: which guard each event runs. */
+export const SENTINEL_WIRING = [
+  { event: "PreToolUse", matcher: "Write|Edit|MultiEdit|NotebookEdit", script: "pretooluse-sentinel.mjs" },
+  { event: "PreToolUse", matcher: "Bash", script: "pretooluse-sentinel.mjs" },
+  // KJC-TSK-0946 (ADR 0016): no matcher. The rules of the MD files are checked
+  // before EVERY tool call, MCP ones included.
+  { event: "PreToolUse", script: "pretooluse-rules.mjs" },
+  { event: "PostToolUse", matcher: "Write|Edit|MultiEdit|NotebookEdit", script: "posttooluse.mjs" },
+  // KJC-TSK-0765 board-sync: the merge (Bash) and the tracker move (MCP
+  // update_card) are observed AFTER the fact — found live: with only the
+  // edit matchers wired, the board-sync recorder never ran in production.
+  { event: "PostToolUse", matcher: "Bash", script: "posttooluse.mjs" },
+  { event: "PostToolUse", matcher: "mcp__.*__update_card", script: "posttooluse.mjs" },
+  // KJC-BUG-0236 (#1886): the rag-first ledger records MCP answers here;
+  // unwired, the official tool never satisfied the gate.
+  { event: "PostToolUse", matcher: "mcp__.*__kj_rag_query", script: "posttooluse.mjs" },
+  { event: "Stop", script: "stop.mjs" },
+  // KJC-TSK-0918 (ADR 0014): the critical rules back after a compaction or a resume.
+  { event: "SessionStart", matcher: "compact", script: "sessionstart.mjs" },
+  { event: "SessionStart", matcher: "resume", script: "sessionstart.mjs" },
+  // KJC-TSK-0949: a new session hears of MD rules with no gate, and nothing else.
+  { event: "SessionStart", matcher: "startup", script: "sessionstart.mjs" },
+];