Your AI agent (Claude Code, Codex, Gemini CLI, Cursor…) writes the code — Karajan governs how it happens. kj installs a method your agent follows on every task (RAG before assuming, card first, tests first) and enforces it with git gates: every commit requires a verdict from a different AI, security findings are never overridable, and the base branch only moves via PR. The maker never grades its own work — and a false green is structurally impossible.
Prompt engineering got one good answer from one good prompt. Context engineering curated what the model saw. The 2026 frontier is loop engineering: you stop prompting the agent by hand and design the system that prompts it, checks it, and decides what happens next — until the goal is met or it hands back to you. Karajan was built around that loop before the term caught on:
interactive | assisted | autonomous axis (v3.7.0). Report, then assisted fixes, then unattended kj autorun — defaulting to interactive, so you opt in.kj resume keep the loop alive across runs.The caveat loop engineering insists on — unattended loops make unattended mistakes — is designed in: autonomous runs list their residual defects, every story lands behind a PR, and kj-trash snapshots destructive operations. Read the full building-block mapping →
One-liner setup
Tell your agent: “read karajancode.com/start.md and do what it says”. It installs the full stack, detects new vs existing project, activates the environment — and stops to WAIT for you whenever a step needs sudo or an account. Install →
Your agent, governed
The playbook lands in CLAUDE.md, AGENTS.md and GEMINI.md from one source: RAG first, card first (kj hu), TDD, ADRs in git (kj adr). Role briefs (kj brief) give your agent the distilled method of triage, planner, architect, tester, security and audit. Work with your agent →
Cross-AI review + git gates
kj review --staged binds a verdict from a different AI to the exact diff — change the code and it must be reviewed again. Disagree? A third AI arbitrates (kj solomon); security findings nobody overrides. The pre-commit gate makes it law. The gates →
RAG over your codebase
Built on install, refreshed on drift: kj rag query answers what the code does so no agent guesses. On existing projects, kj onboard produces an Architecture Brief before anyone touches anything.
Self-healing ecosystem
Your agent hits a kj bug? kj report-issue diagnoses and files it upstream — sanitized, deduped, and only with your approval. Fixes ship back to everyone. Command reference →
Headless mode
The classic multiagent pipeline lives on for CI and automation: kj run orchestrates coder/reviewer/tester subprocess roles unattended, with the same gates. Headless mode →
Governed tournament (v4.15)
One task, N coders in isolated worktree lanes: kj tournament fans out, --score builds a deterministic zero-LLM scoreboard, a cross-AI judge with no conflict of interest picks the winner, and --crown promotes it through the normal review gate — winning earns a candidacy, not a bypass.
The most recent releases, newest first. Older versions live in Architecture › History and the CHANGELOG.
Minor where Karajan learns to govern the STATE of a project, not just its acts — because decay happens precisely on the days nobody looks. The Karajan Steward ships whole: every declared guarantee answers ONE of four verdicts — ok, broken, unknown (the evidence expired → refresh) and not observable (there was never anywhere to look → instrument), the two honest answers whose absence let a real project degrade for weeks behind a green facade. kj steward sweep leaves the verdict versioned IN the repo (shared memory, never one machine’s record), seals every sweep in the hash-chained decision log, and cards each break as PROPOSED work — evidence, since-when, and a remedy plan that nothing executes unreviewed; the Sentinel says what is broken at the start of work, once per session and impossible to miss, and blocks almost never (only security and persistent red main, only where the project opted in). Phantom coverage gets its two detectors — a call graph for unit tests and LITERAL crossing for E2E, the case a graph cannot see: a spec looking for an aria-label that only existed inside an unreachable method. The whole credibility epic lands with it: member reachability inside a field-validated perimeter with static/instance slots and constructor fields, dead-code reports leading with the DERIVATIVE, delete-only diffs owing no test, sonar vetoing only the lines a PR adds, generated budgets ignoring lockfiles, and a privacy scan that knows a git SHA is not a phone number. Claims-with-evidence reaches written artifacts: a PR body with a datum denied by its own source is refused before the PR exists. Plus an external security contribution — the HU Board token compared in constant time (thank you, @ofri-peretz) — and three field fixes: the Sonar scanner now respects the repo’s own sonar-project.properties, kj board no longer starts a server the config said to keep off, and Windows paths reach ~/.codex/config.toml as valid TOML.
Minor where the family gains its most privileged piece and the method learns to doubt the AI itself. The Karajan Console is born (@karajan-family/console, shipped 0.1.0 → 0.3.0 during this cycle): the admin web console of a family instance — corpus health, people’s access as the service’s real IAM binding, operations as GitHub App workflow runs, all sealed in a hash-chained audit trail, with a no-build static page and two identity providers: Google Sign-In, or Identity-Aware Proxy fully provisioned by terraform — and the console verifies the assertion even behind IAP, because a second layer that trusts the first is decoration. Driven by a real instance from day one: its field reports fixed a concurrency race in the audit chain and shaped the deployment notes. And claims with evidence (accepted ADR): the transcript is the register of sources, kj claims check crosses every hard datum the AI states against what actually ran — backed, unbacked, or denied by its own source, which is a proven hallucination. Plus a guard for a bug JavaScript refuses to report (a class member declared twice: the last one wins in silence — 17 days of an empty tab in production at a real instance), the kj review verdict parser fixed at the path it actually walks, two same-day fixes for a Windows field reporter, a shell-injection hole closed in a reusable workflow, and this repo’s own actions pinned to commit SHAs — what kj generates was already pinned; what kj is had not caught up.
Minor where two rules stop living in the agent’s memory and become gates. Identity lock: every clone declares who works it (kj identity set — gh account + git email, per developer, never tracked; the next kj harden asks, with a human confirming), and the Sentinel refuses gh, git push and any commit-authoring git command under another account BEFORE it runs — authorship resolved by git var under the command’s own environment, wrapper shells and substitutions scanned inside, never an auto-switch. Born from a real incident: one gh call without an explicit switch posted as a client account on a public repo. Board-sync gate: a merged card must be moved in the tracker before anything advances — the Sentinel leaves the branch’s card pending on a verified merge and refuses commit, push, new PR, another merge and the end of the turn until the REAL tracker call clears it (update_card via MCP or kj hu move). It found three production gaps in its first hour and governed the card of its own creation on its first real merge. Plus v4.20.1’s field fix: kj start finally sees the project it is standing in.
Minor born from one field project (a kubernetes demo with its code under backend/): the method was language-agnostic on paper, but three concrete pieces still assumed application code — now the Sentinel counts terraform/k8s/shell/Docker edits as sources (card-first, Stop gate and push gate fire exactly like on a .js), infra has real suites (terraform validate, helm lint, kustomize build, ansible-lint, with checkov chained as the additive deep scan — a missing tool is declared with its install command, never a fake green), and kj audit --security runs checkov through the same best-effort channel as semgrep, because misconfigs ARE security surface. Plus three fixes reported from the field and shipped within hours: codex exec lost --full-auto upstream (now --sandbox workspace-write with a legacy retry), kj start passed the Claude-only haiku to agy (models now filter by provider FAMILY at the chokepoint), and the Sentinel’s own escape hatch existed only in its error message — every KJ_ALLOW_X=1 prefix now works on a simple command, fail-closed on chains, proven the same night it deadlocked its author’s release.
Minor where the method stops trusting a green suite at face value: the mutation pre-gate joins the review — a suite can pass with weak asserts, and surviving mutants prove it. Opt-in (method_gates.mutation: warn|block, it never runs undeclared) and staged-only: warn ships survivors as an advisory inside the reviewer’s task, block rejects BEFORE spending a reviewer token, listing each survivor with its remediation. kj doctor now declares its guarantee level per host — the coupling to Claude Code is not a bug, it is a DISCLOSED gradient: tier A tool-time needs the Sentinel’s synchronous hooks, tier B commit-time git gates are the floor on ANY host, tier C re-checks in CI; run kj from codex or gemini and it tells you exactly which guarantees you kept. A week of field findings lands fixed: kj start no longer calls an infra project empty (nested backend/app/… code and yaml/tf/sh/Dockerfile now count as source), kj agents --help enumerates its real roles and providers self-fed from the constants, and the lane guard learned what a quote pair is after gating its own author. And the family migration turns real: @karajan-family/code ships the same bits as karajan-code — the first dual-publish under the family scope.
Minor where governance stops being a feature of kj and becomes a PACKAGE: @karajan-family/governance ships on npm — Policy, Decision and Exception as first-class abstract objects (deterministic, local, no LLM), with karajan-code as its first consumer, not its owner. The policy layer completes its three tiers: rules fire BEFORE the damage at tool time (with the acting agent’s role), the violating diff never enters at commit time, and CI re-checks the PR against the same policy — covering even a tampered local hook. Exceptions carry the full evidentiary model: who (identity), the exact rule, a justification written at the moment, and a MANDATORY expiry the system executes — an expired exception blocks again on its own, and a rule granted three times gets told to its face that it is no longer an exception but the real policy asking to be changed. Every chokepoint decision leaves a hash-chained, git-anchored trail: rewriting yesterday’s log requires rewriting yesterday’s repo. Plus kj policy add: speak the rule, the engine validates it, nothing lands without your confirmation.
Minor where the whole Karajan family moves under one roof: radar, rag, watch and the landing itself merge into the monorepo with their FULL histories (rewritten under each package path — git log packages/rag tells the whole story; source repos stay frozen as immutable references, and every imported authorship signs the noreply address). The safety prerequisite shipped first: lane isolation — each session mutates only ITS worktree, enforced by the Sentinel’s PreToolUse gate before the damage, with an audited escape (two sessions colliding on one tree was a real incident, never again). And the third pillar: policy as code — .karajan/policy.yml declares per-role rules in a closed, fail-loud vocabulary (a rule the engine cannot enforce is a load error, never a silently dead rule) and kj policy check/eval evaluate them deterministically in warn mode; the deny wiring arrives next. Proof of the roof: this very release updated its landing in the same repository, same PR — the release→landing delegation dance is dead.