karajan-code 4.70.3 → 5.0.0

package/src/config/secrets.js

@@ -0,0 +1,36 @@
+/**
+ * KJC-TSK-1234 (ADR 0032): the project's kj.config.yml travels with the repo, so it must never
+ * hold a secret. It is judged by its parsed YAML (escaped keys, flow mappings, anchors and merge
+ * keys all resolved), never by its raw text. The parse is strict: a duplicated key fails, since a
+ * second empty value could hide a secret written before it.
+ */
+import fs from "node:fs";
+import yaml from "js-yaml";
+
+export const SECRET_PATHS = [["sonarqube", "token"], ["sonarqube", "admin_password"], ["sonarcloud", "token"]];
+
+/** @returns {string[]} the secret paths that hold a value (empty, null and absent are fine) */
+export function configSecrets(text) {
+  const doc = yaml.load(text) ?? {};
+  return SECRET_PATHS
+    .filter(([section, key]) => {
+      const value = doc?.[section]?.[key];
+      return value !== undefined && value !== null && value !== "";
+    })
+    .map((path) => path.join("."));
+}
+
+/** `kj config --check-secrets <file|->`: exit 1 naming each secret, or when the file cannot be read. */
+export function checkSecretsCommand(file, { logger = console } = {}) {
+  let found;
+  try {
+    found = configSecrets(fs.readFileSync(file === "-" ? 0 : file, "utf8"));
+  } catch (err) {
+    logger.error(`kj: cannot check ${file} for secrets (${err.message})`);
+    process.exitCode = 1;
+    return;
+  }
+  if (found.length === 0) return;
+  logger.error(`kj: ${file} holds a secret (${found.join(", ")}): move it to .karajan/kj.config.local.yml or ~/.karajan`);
+  process.exitCode = 1;
+}

package/src/config.js

@@ -25,6 +25,7 @@ export { DEFAULTS } from "./config/defaults.js";
 export {
   getConfigPath,
   getProjectConfigPath,
+  getLocalConfigPath,
   loadProjectConfig,
   loadConfig,
   writeConfig,

package/src/environment/adr.js

@@ -6,6 +6,8 @@
  */
 import fs from "node:fs/promises";
 import path from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
 
 const ADR_DIR = path.join(".karajan", "adrs");
 // KJC-BUG-0272: whoever records a decision proposes it. Accepting is the user's:
@@ -28,12 +30,24 @@ export async function listAdrs(projectDir) {
   return adrs;
 }
 
-export async function addAdr(projectDir, { title, decision, context = "", consequences = "" }) {
+const realGit = (cwd) => async (args) => (await promisify(execFile)("git", args, { cwd })).stdout;
+
+// HU-2792: numbers that open branches hold, read from the local origin/* refs
+// (no network). Not a git repo, or no remotes: nothing taken, as before.
+async function remoteAdrNumbers(run) {
+  try {
+    const refs = (await run(["for-each-ref", "--format=%(refname)", "refs/remotes/origin"])).split("\n").filter(Boolean);
+    const trees = await Promise.all(refs.map((ref) => run(["ls-tree", "--name-only", ref, `${ADR_DIR}/`]).catch(() => "")));
+    return trees.flatMap((t) => t.split("\n")).map((f) => /\/(\d{4})-[^/]*\.md$/.exec(f)?.[1]).filter(Boolean).map(Number);
+  } catch { return []; }
+}
+
+export async function addAdr(projectDir, { title, decision, context = "", consequences = "" }, run = realGit(projectDir)) {
   if (!title?.trim() || !decision?.trim()) {
     throw new Error("kj adr add requires a title and --decision");
   }
   const existing = await listAdrs(projectDir);
-  const number = (existing.at(-1)?.number || 0) + 1;
+  const number = Math.max(0, ...existing.map((a) => a.number), ...await remoteAdrNumbers(run)) + 1;
   const file = path.join(ADR_DIR, `${String(number).padStart(4, "0")}-${slugify(title)}.md`);
   const body = [
     `# ${title}`, "",

package/src/environment/board-access.js

@@ -14,6 +14,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { claudeConfigFile, codexHome } from "../utils/agent-home.js";
 
 const TOKEN_CONVENTIONS = {
   linear: ["LINEAR_API_KEY"],
@@ -23,18 +24,19 @@ const TOKEN_CONVENTIONS = {
   asana: ["ASANA_ACCESS_TOKEN"],
 };
 
-function mcpConfigPaths(projectDir, home) {
+// KJC-TSK-1344: claude and codex configs of the account CLAUDE_CONFIG_DIR / CODEX_HOME select.
+function mcpConfigPaths(projectDir, home, env = process.env) {
   return [
     path.join(projectDir, ".mcp.json"),
-    path.join(home, ".claude.json"),
-    path.join(home, ".codex", "config.toml"),
+    claudeConfigFile({ home, env }),
+    path.join(codexHome({ home, env }), "config.toml"),
     path.join(home, ".gemini", "settings.json"),
   ];
 }
 
-function mcpConfigsMention(slug, projectDir, home) {
+function mcpConfigsMention(slug, projectDir, home, env) {
   const needle = slug.toLowerCase();
-  for (const p of mcpConfigPaths(projectDir, home)) {
+  for (const p of mcpConfigPaths(projectDir, home, env)) {
     try {
       if (existsSync(p) && readFileSync(p, "utf8").toLowerCase().includes(needle)) return p;
     } catch { /* unreadable config — keep looking */ }
@@ -50,13 +52,13 @@ function mcpConfigsMention(slug, projectDir, home) {
  */
 export function detectAvailableBoards({ projectDir = process.cwd(), env = process.env, home = os.homedir() } = {}) {
   const boards = [{ value: "hu-board", label: "HU Board (bundled, zero setup)" }];
-  if (mcpConfigsMention("planning-game", projectDir, home)) {
+  if (mcpConfigsMention("planning-game", projectDir, home, env)) {
     boards.push({ value: "planning-game", label: "Planning Game (MCP detected)" });
   }
   for (const [slug, envs] of Object.entries(TOKEN_CONVENTIONS)) {
     const token = envs.find((k) => env[k]);
     if (token) boards.push({ value: `external:${slug}`, label: `${slug} (token ${token})` });
-    else if (mcpConfigsMention(slug, projectDir, home)) boards.push({ value: `external:${slug}`, label: `${slug} (MCP detected)` });
+    else if (mcpConfigsMention(slug, projectDir, home, env)) boards.push({ value: `external:${slug}`, label: `${slug} (MCP detected)` });
   }
   return boards;
 }
@@ -65,7 +67,7 @@ export function verifyBoardAccess({ config = {}, projectDir = process.cwd(), env
   const backend = config.state_backend || "hu-board";
 
   if (backend === "planning-game") {
-    const hit = mcpConfigsMention("planning-game", projectDir, home);
+    const hit = mcpConfigsMention("planning-game", projectDir, home, env);
     if (hit) return { ok: true, backend, via: `planning-game MCP (${hit})` };
     return {
       ok: false, backend,
@@ -77,7 +79,7 @@ export function verifyBoardAccess({ config = {}, projectDir = process.cwd(), env
     const name = String(config.board?.name || "").trim();
     if (!name) return { ok: false, backend, needed: ["declare board.name in kj.config.yml (e.g. Linear, Trello, Jira, GitHub Issues)"] };
     const slug = name.toLowerCase().split(/\s+/)[0];
-    const hit = mcpConfigsMention(slug, projectDir, home);
+    const hit = mcpConfigsMention(slug, projectDir, home, env);
     if (hit) return { ok: true, backend, via: `${name} MCP detected (${hit})` };
     const tokenEnvs = config.board?.token_env ? [config.board.token_env] : (TOKEN_CONVENTIONS[slug] || []);
     const found = tokenEnvs.find((k) => env[k]);

package/src/git/karajan-label.js

@@ -1,10 +1,11 @@
 /**
- * KJC-TSK-1123 (#2315): every PR Karajan opens carries the «Karajan» label, so
+ * KJC-TSK-1123 (#2315): every PR Karajan governs carries the «Karajan» label, so
  * a team can measure how much of its change goes through the governor. It means
  * "went through Karajan", never "written by an AI": Karajan governs AIs, and the
  * PR may be a person's work it reviewed. The signal lives only in the PR's
  * metadata, never in commits or the PR body. Labelling never costs the PR: a
- * failure is logged and the work goes on.
+ * failure is logged and the work goes on. KJC-BUG-0461: since 5.0 (no kj run opening PRs)
+ * kj review --publish-pr adds it, the step of the method that runs on every PR.
  */
 import { runCommand } from "../utils/process.js";
 
@@ -12,20 +13,31 @@ export const KARAJAN_LABEL = "Karajan";
 const LABEL_COLOR = "1f6feb";
 const LABEL_DESCRIPTION = "Went through Karajan (governed and reviewed); not a claim that an AI wrote it";
 
-/** owner/repo of a GitHub PR URL, or null when the URL has another shape. */
-const repoOf = (url) => /^https:\/\/[^/]+\/([^/]+\/[^/]+)\/pull\/\d+/.exec(url)?.[1] ?? null;
+/** The PR a URL or a bare number names: { repo: "owner/repo" or null for the repo gh runs in, number }. */
+function prOf(ref) {
+  const url = /^https:\/\/[^/]+\/([^/]+\/[^/]+)\/pull\/(\d+)/.exec(String(ref ?? ""));
+  if (url) return { repo: url[1], number: url[2] };
+  return /^\d+$/.test(String(ref ?? "")) ? { repo: null, number: String(ref) } : null;
+}
 
 /**
  * Add the label to the PR, creating it first when the repo lacks it.
+ * @param {{url: string|number}} args a PR URL, or its number in the repo gh runs in
  * @returns {Promise<boolean>} true when the PR carries the label.
  */
 export async function labelKarajanPr({ url, cwd = null, run = runCommand, warn = (msg) => process.stderr.write(`${msg}\n`) }) {
   const opts = cwd ? { cwd } : {};
-  const repo = repoOf(url);
+  const pr = prOf(url);
+  if (!pr) {
+    warn(`kj: could not add the Karajan label to ${url}: not a pull request URL or number`);
+    return false;
+  }
   try {
-    // Fails when the label exists; the edit below says whether the PR got it.
-    await run("gh", ["label", "create", KARAJAN_LABEL, "--color", LABEL_COLOR, "--description", LABEL_DESCRIPTION, ...(repo ? ["--repo", repo] : [])], opts);
-    const res = await run("gh", ["pr", "edit", url, "--add-label", KARAJAN_LABEL], opts);
+    // Fails when the label exists; the call below says whether the PR got it.
+    await run("gh", ["label", "create", KARAJAN_LABEL, "--color", LABEL_COLOR, "--description", LABEL_DESCRIPTION, ...(pr.repo ? ["--repo", pr.repo] : [])], opts);
+    // KJC-BUG-0462: REST. `gh pr edit --add-label` asks GraphQL for the PR's classic project
+    // cards and fails since GitHub sunset Projects (classic), so no PR got the label.
+    const res = await run("gh", ["api", "-X", "POST", `repos/${pr.repo ?? "{owner}/{repo}"}/issues/${pr.number}/labels`, "-f", `labels[]=${KARAJAN_LABEL}`], opts);
     if (res.exitCode === 0) return true;
     warn(`kj: could not add the Karajan label to ${url}: ${(res.stderr || res.stdout || "").trim()}`);
   } catch (err) {

package/src/guards/main-guard.js

@@ -0,0 +1,54 @@
+/**
+ * main-guard (KJC-TSK-1368, ADR 0037 layer 2): after a push to the protected branch, what
+ * reached it without its required checks, and whether the protection still enforces them on
+ * admins. It cannot prevent an abuse by someone holding the maintainer's credentials; it makes
+ * it visible. GitHub is reached through an injected api, so the logic runs without network.
+ *
+ * api.pullsOf(sha)   → pull requests associated with a commit (GitHub's commits/{sha}/pulls)
+ * api.checksOf(sha)  → [{ name, conclusion }] for a commit (check runs and statuses)
+ * api.protection()   → the branch protection, or null when the branch is not protected
+ */
+
+// GitHub counts these as passing for a required check.
+const PASSING = new Set(["success", "neutral", "skipped"]);
+
+/** The pull request that merged this commit into the branch, if any. */
+function mergedInto(pulls, branch) {
+  return pulls.find((p) => p.merged_at && p.base?.ref === branch) ?? null;
+}
+
+async function auditCommit(sha, { branch, requiredChecks, api }) {
+  const pull = mergedInto(await api.pullsOf(sha), branch);
+  if (!pull) return { sha, kind: "direct-push", detail: `no pull request merged into ${branch}` };
+  const results = await api.checksOf(pull.head.sha);
+  const passed = new Set(results.filter((c) => PASSING.has(c.conclusion)).map((c) => c.name));
+  const missing = requiredChecks.filter((name) => !passed.has(name));
+  if (missing.length === 0) return null;
+  return { sha, kind: "checks-skipped", pr: pull.number, mergedBy: pull.merged_by?.login ?? "unknown", missing };
+}
+
+/** What changed in the protection against what is declared. */
+function auditProtection(protection, { branch, requiredChecks }) {
+  if (!protection) return [`${branch} is not protected`];
+  const changes = [];
+  if (!protection.enforce_admins?.enabled) changes.push("enforce_admins is off: admins can merge past the required checks");
+  const rules = protection.required_status_checks ?? {};
+  const enforced = new Set([...(rules.contexts ?? []), ...(rules.checks ?? []).map((c) => c.context)]);
+  for (const name of requiredChecks) if (!enforced.has(name)) changes.push(`required check removed: ${name}`);
+  return changes;
+}
+
+/**
+ * @param {{ branch: string, commits: string[], requiredChecks: string[], api: object }} opts
+ * @returns {Promise<{ ok: boolean, merges: object[], protection: string[] }>}
+ */
+export async function auditMain({ branch, commits, requiredChecks, api }) {
+  if (!requiredChecks?.length) throw new Error("main-guard: declare at least one required check to audit against");
+  const merges = [];
+  for (const sha of commits) {
+    const finding = await auditCommit(sha, { branch, requiredChecks, api });
+    if (finding) merges.push(finding);
+  }
+  const protection = auditProtection(await api.protection(), { branch, requiredChecks });
+  return { ok: merges.length === 0 && protection.length === 0, merges, protection };
+}

package/src/harden/branch-protection.js

@@ -43,6 +43,34 @@ const addCommand = ({ missing, ...target }) =>
   `gh api -X POST ${protectionPath(target)}/required_status_checks/contexts ${missing.map((c) => `-f ${shellQuote(`contexts[]=${c}`)}`).join(" ")}`;
 
 const settingsUrl = ({ owner, repo }) => `https://github.com/${owner}/${repo}/settings/branches`;
+const rulesUrl = ({ owner, repo }) => `https://github.com/${owner}/${repo}/settings/rules`;
+
+/**
+ * KJC-BUG-0449 (#2787): every rule that applies to the branch, rulesets included.
+ * [] when none applies (a 404 included); null when it cannot be read.
+ */
+async function branchRules({ owner, repo, branch }, run) {
+  let res;
+  try { res = await run("gh", ["api", `repos/${owner}/${repo}/rules/branches/${encodeURIComponent(branch)}`]); } catch { return null; }
+  if (res.exitCode !== 0) return /404/.test(`${res.stderr}${res.stdout}`) ? [] : null;
+  try {
+    const rules = JSON.parse(res.stdout || "[]");
+    return Array.isArray(rules) ? rules : null;
+  } catch { return null; }
+}
+
+const rulesetChecks = (rules) => rules
+  .filter((r) => r?.type === "required_status_checks")
+  .flatMap((r) => (r.parameters?.required_status_checks ?? []).map((c) => c.context));
+
+/** No classic protection: the rulesets decide, and they are fixed in their own page, never with a PUT. */
+function rulesetAdvice({ rules, checks, target }) {
+  if (rules === null) return { status: "unverified", reason: "the branch rules could not be read", settings: rulesUrl(target), missing: checks };
+  if (rules.length === 0) return { status: "unprotected", command: protectCommand({ ...target, checks }) };
+  const required = new Set(rulesetChecks(rules));
+  const missing = checks.filter((c) => !required.has(c));
+  return missing.length > 0 ? { status: "ruleset-missing", missing, settings: rulesUrl(target) } : { status: "ok", via: "ruleset" };
+}
 
 /**
  * What the base branch needs for the checks to be required, and how. A command
@@ -61,14 +89,18 @@ export async function protectionAdvice({ owner, repo, branch, checks, run = runC
     return { status: "unverified", reason: err.message, settings: settingsUrl(target), missing: checks };
   }
   if (res.exitCode !== 0) {
-    if (/404|not protected/i.test(`${res.stderr}${res.stdout}`)) return { status: "unprotected", command: protectCommand({ ...target, checks }) };
+    if (/404|not protected/i.test(`${res.stderr}${res.stdout}`)) return rulesetAdvice({ rules: await branchRules(target, run), checks, target });
     return { status: "unverified", reason: (res.stderr || res.stdout || "gh failed").trim(), settings: settingsUrl(target), missing: checks };
   }
   const protection = JSON.parse(res.stdout || "{}");
+  const rules = await branchRules(target, run);
+  const fromRules = rulesetChecks(rules ?? []);
   const statusChecks = protection.required_status_checks;
-  if (!statusChecks) return { status: "no-checks", settings: settingsUrl(target), missing: checks };
-  const existing = new Set(statusChecks.contexts ?? []);
+  const existing = new Set([...(statusChecks?.contexts ?? []), ...fromRules]);
   const missing = checks.filter((c) => !existing.has(c));
+  // Unreadable rules: a ruleset may require what the classic layer lacks, so nothing is "missing" for sure.
+  if (rules === null && missing.length > 0) return { status: "unverified", reason: "the branch rules could not be read", settings: rulesUrl(target), missing };
+  if (!statusChecks && fromRules.length === 0) return { status: "no-checks", settings: settingsUrl(target), missing: checks };
   // KJC-BUG-0401: required checks an admin skips are not required for an agent holding an admin's token.
   const bindAdmins = protection.enforce_admins?.enabled === false ? `gh api -X POST ${protectionPath(target)}/enforce_admins` : null;
   if (missing.length > 0) return { status: "missing", missing, command: [addCommand({ ...target, missing }), bindAdmins].filter(Boolean).join(" && ") };
@@ -105,6 +137,7 @@ export async function adviseBranchProtection({ projectDir, branch, logger, run =
     missing: `${branch} does not require ${advice.missing?.length} kj check(s) (${list}). An admin runs (kj never does):`,
     "no-checks": `${branch} is protected but requires no status checks. An admin enables "Require status checks" and adds ${list} in:`,
     unverified: `could not read the protection of ${branch} (${advice.reason}). An admin checks that ${list} are required in:`,
+    "ruleset-missing": `${branch} is protected by a ruleset that does not require ${advice.missing?.length} kj check(s) (${list}). An admin adds them to the ruleset (no second protection layer) in:`,
     "admins-exempt": `${branch} requires the kj checks, but admins can merge without them, and an agent working with an admin's token would. An admin runs (kj never does):`,
   }[advice.status];
   logger.warn?.(`  ⚠ branch protection: ${why}`);

package/src/harden/hook-templates.js

@@ -109,9 +109,17 @@ function identityGuard(hook) {
     "  fi",
     "  kj_declared_gh=$(sed -n 's/^gh_user:[[:space:]]*//p' .karajan/identity.local.yml | head -n1)",
     '  kj_hosts="${GH_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/gh}/hosts.yml"',
+    // KJC-BUG-0459: a per-account gh (gh-tribbu, ADR 0040) as the credential helper is the account
+    // git pushes as. The accounts guide makes gh-<account> use ~/.config/gh-<account>: read it.
+    "  kj_helper=$(git config --get-urlmatch credential.helper https://github.com 2>/dev/null)",
+    '  case "$kj_helper" in',
+    "    '!'*/gh-*' auth git-credential'*|'!'gh-*' auth git-credential'*)",
+    '      kj_ghbin=${kj_helper#!}; kj_ghbin=${kj_ghbin%% *}',
+    '      kj_hosts="${XDG_CONFIG_HOME:-$HOME/.config}/${kj_ghbin##*/}/hosts.yml" ;;',
+    "  esac",
     "  kj_active_gh=$(awk '/^github.com:/{f=1;next} f&&/^[^[:space:]]/{f=0} f&&/^[[:space:]]*user:/{sub(/^[[:space:]]*user:[[:space:]]*/,\"\");print;exit}' \"$kj_hosts\" 2>/dev/null)",
     '  if [ -n "$kj_declared_gh" ] && [ "$kj_active_gh" != "$kj_declared_gh" ]; then',
-    '    echo "kj harden: identity lock — gh session is ${kj_active_gh:-none} but this clone is declared as $kj_declared_gh — run: gh auth switch --user $kj_declared_gh"; exit 1',
+    '    echo "kj harden: identity lock — gh session is ${kj_active_gh:-none} but this clone is declared as $kj_declared_gh — run: gh auth switch --user $kj_declared_gh (or set the gh of that account, e.g. gh-<account>, as the credential helper)"; exit 1',
     "  fi",
     ...tail,
   ];
@@ -147,6 +155,13 @@ export function hookBody(hook, cmds = {}, { baseBranch = null } = {}) {
         "if git diff --cached --name-only --diff-filter=d | grep -qE '^(\\.claude/[^/]*\\.lock|\\.claude/scheduled_tasks\\.lock|\\.kj/|\\.karajan/identity\\.local\\.yml|\\.karajan/harness/sentinel-state\\.json)'; then",
         "  echo 'kj harden: agent runtime files are staged (.claude/*.lock, .kj/, identity.local.yml, sentinel-state.json) — unstage them: git restore --staged <path>'; exit 1",
         "fi",
+        "# KJC-TSK-1234 (ADR 0032): the project's kj.config.yml travels with the repo, so its staged",
+        "# version is checked for secrets by kj, which parses the YAML (raw text can spell a key in",
+        "# too many ways). Without kj nothing can check it, so it does not enter.",
+        "if git diff --cached --name-only --diff-filter=d | grep -qx '.karajan/kj.config.yml'; then",
+        "  command -v kj >/dev/null 2>&1 || { echo 'kj harden: .karajan/kj.config.yml is staged but kj is not installed to check it holds no secret'; exit 1; }",
+        "  git show ':.karajan/kj.config.yml' | kj config --check-secrets - || { echo 'kj harden: keep tokens and passwords out of the shared kj.config.yml'; exit 1; }",
+        "fi",
         "# KJC-TSK-1205 (ADR 0030): a tampered Sentinel is caught before each commit,",
         "# not only when the turn ends. Only where it is installed; no kj, no check.",
         "if [ -d .karajan/harness ] && command -v kj >/dev/null 2>&1; then",

package/src/harden/sentinel/posttooluse.mjs

@@ -7,13 +7,14 @@ import process from "node:process";
 import { realpathSync } from "node:fs";
 import { basename, dirname, join, relative } from "node:path";
 import { spawnSync } from "node:child_process";
-import { CODE, TESTS, ROOT, CARD, branchOf, load, save, session } from "./sentinel-lib.mjs";
+import { CODE, TESTS, ROOT, CARD, branchOf, enterLane, laneFor, laneTop, load, save, session } from "./sentinel-lib.mjs";
 import { remindersFor } from "./sentinel-reminders.mjs";
 let raw = "";
 process.stdin.on("data", (d) => { raw += d; });
 process.stdin.on("end", () => {
   try {
-    const { session_id: sid = "default", tool_name: tool, tool_input: input = {}, tool_response: response = {} } = JSON.parse(raw);
+    const { session_id: sid = "default", tool_name: tool, tool_input: input = {}, tool_response: response = {}, cwd = null } = JSON.parse(raw);
+    enterLane(load(), sid, cwd);
     // KJC-TSK-0765 board-sync: a merge that gh CONFIRMS leaves its card pending
     // in the tracker (the PreToolUse gate then refuses to advance until it is
     // moved). Recorded here, after the fact, so a failed merge never blocks.
@@ -76,7 +77,10 @@ process.stdin.on("end", () => {
     // Sources are read STRUCTURALLY, never through the stringified response:
     // a JSON document (the MCP {content:[{text}]} parts, the CLI --json array)
     // is parsed and its hits[].source / [].source collected.
-    const sourcesOf = (doc) => {
+    // KJC-BUG-0440 (#2830): the MCP tool may wrap its answer again (the part's
+    // text is itself {content:[parts]}); unwrapped up to three levels.
+    const sourcesOf = (doc, depth = 0) => {
+      if (Array.isArray(doc?.content) && depth < 3) return doc.content.flatMap((p) => sourcesOf(parseJson(String(p?.text || "")), depth + 1));
       const list = Array.isArray(doc) ? doc : Array.isArray(doc?.hits) ? doc.hits : [];
       return list.map((h) => h?.source).filter((x) => typeof x === "string");
     };
@@ -88,7 +92,7 @@ process.stdin.on("end", () => {
       let found = parts.flatMap((p) => sourcesOf(parseJson(String(p?.text || ""))));
       // KJC-BUG-0365 (#2208): an answer cut short (whole code chunks) is no
       // longer valid JSON, but every "source" it carries still names a hit.
-      if (found.length === 0) found = [...text.matchAll(/\\?"source\\?"\s*:\s*\\?"([^"\\]+)\\?"/g)].map((m) => m[1]);
+      if (found.length === 0) found = [...text.matchAll(/\\*"source\\*"\s*:\s*\\*"([^"\\]+)\\*"/g)].map((m) => m[1]);
       recordRag(input.text, found, parts.map((p) => String(p?.text || "")).join(String.fromCharCode(10)));
       process.exit(0);
     }
@@ -184,10 +188,18 @@ process.stdin.on("end", () => {
     const state = load();
     const s = session(state, sid);
     s.at = Date.now();
-    const rel = relative(ROOT, file).replaceAll("\\", "/");
+    // ADR 0034 (KJC-TSK-1245): a write in another lane is recorded under that lane, relative to it,
+    // so the Stop gate judges it with that lane's branch and tree.
+    const top = laneFor(file);
+    const rec = top === laneTop() ? s : (((s.lanes ||= {})[top]) ||= { edited_sources: [], edited_tests: [] });
+    const rel = relative(top, file).replaceAll("\\", "/");
     // KJC-BUG-0279 (#1981): a file outside the repository is not one of its sources.
     const inside = rel && rel !== ".." && !rel.startsWith("../") && !rel.startsWith("/");
-    const bucket = !inside ? null : TESTS.test(rel) ? s.edited_tests : CODE.test(rel) ? s.edited_sources : null;
+    const bucketOf = () => {
+      if (TESTS.test(rel)) return rec.edited_tests;
+      return CODE.test(rel) ? rec.edited_sources : null;
+    };
+    const bucket = inside ? bucketOf() : null;
     if (bucket && !bucket.includes(rel)) bucket.push(rel);
     // KJC-TSK-0910: the branch size while it is written, with the CI budget
     // (kj pr-size), said once per threshold crossed. Context, never a block.