@arbiterforge/ca-pi 0.6.0

package/plugins/ca-pi/hooks/_sensitivelib.py

@@ -0,0 +1,270 @@
+#!/usr/bin/env python3
+# codeArbiter - the H-09b/H-10b sensitive-line scan: crypto/TLS and secret
+# detection, the pinned security diff argv, the path-aware diff walk, and the
+# digests that bind a recorded gate pass to the exact lines it reviewed.
+#
+# Extracted from _hooklib (issue #321, architecture-002) as the first slice.
+# Chosen first because it was the cleanest seam in the module, measured rather
+# than guessed: the cluster referenced exactly ONE symbol from the rest of
+# _hooklib (norm_path, now the _pathnorm floor), and NOTHING in the rest of
+# _hooklib referenced the cluster. A one-way edge with no back-reference is
+# what makes this safe to move without touching a single consumer.
+#
+# _hooklib re-exports every name below, so all 59 consuming files are
+# unchanged and the pre-existing hook suites prove behavioural parity - which
+# is the only proof that means anything for a refactor (the `refactor` skill's
+# Phase 2 rule: parity comes from tests that did not move).
+#
+# WHY THESE BELONG TOGETHER: they are one concern with one failure mode. The
+# regexes decide what counts as sensitive, the pinned argv decides what the
+# diff even looks like, the walk decides which FILE a line belongs to, and the
+# digests decide what a pass covered. #279 showed they fail as a unit: a
+# greedy header parse in the walk un-exempted an unrelated file, and an
+# unpinned prefix config silently re-opened it. Splitting them across modules
+# would let one move without the others.
+
+from __future__ import annotations
+
+import hashlib
+import re
+
+from _pathnorm import norm_path
+
+
+# Crypto/TLS and secret patterns — shared by the post-write reminder (H-09/H-10)
+# and the blocking pre-commit gate (H-09b/H-10b) so the two never drift.
+# Deliberately NOT matched: crypto.randomUUID / crypto.getRandomValues (benign
+# ID generation tripped the gate on routine commits) — the bare `crypto\.`
+# catch-all is narrowed to the members that actually sign, encrypt, derive
+# keys, or produce security-relevant randomness. bcrypt stays: approved or
+# not, a password-hashing change is exactly what crypto-compliance reviews.
+CRYPTO_RE = re.compile(
+    r"(createHash|createCipher|createHmac|\bmd5\b|\bsha1\b|\brc4\b|\bdes\b|3des"
+    r"|\brc2\b|\bblowfish\b"
+    r"|\bRSA\b|x509|bcrypt"
+    r"|crypto\.(subtle|sign|verify|createSign|createVerify|generateKey"
+    r"|publicEncrypt|privateDecrypt|pbkdf2|scrypt|randomBytes|createDiffieHellman)"
+    r"|InsecureSkipVerify|verify=False"
+    # Node/TS TLS-disable forms — all networked first-party code here is TS, so
+    # this is where a verification bypass would actually land (2026-06-22 HIGH).
+    r"|rejectUnauthorized\s*[:=]\s*false|NODE_TLS_REJECT_UNAUTHORIZED)",
+    re.I,
+)
+# Two branches: (1) a secret keyword assigned a quoted literal, via `=` OR `:`
+# (the colon/object form dominates this TS/JSON repo) — the quoted-value
+# requirement keeps it from firing on every bare `token:` reference; (2) known
+# high-entropy key prefixes, keyword-independent (AWS / GitHub / Anthropic).
+# No LEADING word boundary on the keyword group (secrets-002): a `\b` there
+# never fires when the keyword is the trailing segment of a compound identifier
+# (the char left of `api_key` in `FARM_API_KEY` is `_`, a word char), so a
+# hardcoded `FARM_API_KEY = "..."` silently passed the gate. The right-hand
+# quoted-assignment anchor still bounds the match — a bare `token:` reference
+# without a quoted value never matches.
+SECRET_RE = re.compile(
+    r"(?:password|secret|token|api_key|apikey|private_key|passphrase|credential"
+    r"|aws_secret_access_key|client_secret)"
+    r"""["']?\s*[:=]\s*["'][^"']{4,}"""
+    r"|AKIA[0-9A-Z]{16}"
+    r"|ghp_[A-Za-z0-9]{36}"
+    r"|sk-ant-[A-Za-z0-9_-]{16,}",
+    re.I,
+)
+
+
+# Sensitive-scan exemption (H-09b/H-10b, #279). gate-events.log is the durable
+# BLOCK/REMIND/WARN sink block()/remind()/warn() append to (observability-001,
+# #186) — it is machine-written, never source code, and structurally
+# guaranteed to echo the crypto/secret detector's OWN message text back at
+# itself the moment the gate ever fires a crypto/secret REMIND (e.g. "Crypto/
+# TLS pattern detected" itself matches CRYPTO_RE). That makes it a permanent,
+# self-perpetuating false positive with zero disclosure value: nothing
+# written there is a genuine crypto/secret USE, only a report ABOUT one.
+# Deliberately narrow — overrides.log/triage.log/sprint-log.md stay IN SCOPE:
+# they carry human-written prose (an override reason, a triage note) that
+# COULD legitimately contain a leaked secret worth catching. This set is
+# anchored on the REPO-RELATIVE PATH a line belongs to, never a substring
+# match on the line's own text — a secret cannot escape the scan by merely
+# mentioning gate-events.log on its line; only lines that actually LIVE in
+# that file are exempt.
+SENSITIVE_SCAN_EXEMPT_RELPATHS = frozenset({".codearbiter/gate-events.log"})
+
+
+def is_sensitive_scan_exempt(rel):
+    """True iff `rel` (a repo-relative path, as attributed by `diff_added_
+    lines` or as returned by a bare `git ls-files` listing) names a file
+    exempt from the H-09b/H-10b crypto/secret scan. The ONE predicate both
+    the diff walk and the untracked/unborn-branch file listings route
+    through (#279 review LOW) — deliberately strict: no case-folding, no
+    `./`/`//` collapsing. An identifier that isn't an exact, `norm_path`'d
+    match resolves toward IN SCOPE (not exempt), which is the safe
+    direction. See SENSITIVE_SCAN_EXEMPT_RELPATHS."""
+    return norm_path(rel) in SENSITIVE_SCAN_EXEMPT_RELPATHS
+
+
+# Every H-09b/H-10b sensitive-line reader (security-pass.py, pre-bash.py,
+# git-enforce.py) MUST run `git diff` through this pinned argv, never a bare
+# `["diff", ...]` (#279 review MEDIUM-1). Two independent user/global git
+# config knobs change the destination-path prefix `diff_added_lines` below
+# depends on: `diff.mnemonicPrefix=true` emits `c/`/`w/`/`i/`/`o/` instead of
+# `a/`/`b/`, and `diff.noprefix=true` emits no prefix at all. Either one, left
+# unpinned, silently un-exempts the REAL gate-events.log for any dev/CI runner
+# with that config set — bringing back the exact self-DoS this whole change
+# exists to close. `-c` overrides win over any config file (including repo,
+# global, and system config), so pinning both flags to false here forces the
+# standard `a/`/`b/` prefixes regardless of the caller's environment.
+# `--no-ext-diff` additionally blocks a configured `GIT_EXTERNAL_DIFF` /
+# `diff.external` from replacing git's own unified-diff output with something
+# this parser was never designed to read. Centralized so a call site cannot
+# forget to pin it (that was exactly how this hole would keep reopening).
+SECURITY_DIFF_GIT_ARGS = (
+    "-c", "diff.mnemonicPrefix=false", "-c", "diff.noprefix=false",
+    "diff", "--no-ext-diff", "--src-prefix=a/", "--dst-prefix=b/",
+)
+
+# The fixed-width destination-path prefix `diff_added_lines` strips off a
+# preamble `+++ ` line. MUST be a fixed-length slice, never a search for a
+# separator: a greedy/`.+`-based parse of "diff --git a/<path> b/<path>" (the
+# prior approach) resolves ambiguously when <path> itself contains " b/" —
+# e.g. a real repo path `x b/.codearbiter/gate-events.log` renders that
+# header as `diff --git a/x b/.codearbiter/gate-events.log b/x
+# b/.codearbiter/gate-events.log`, and a greedy match backtracks group(1) to
+# `.codearbiter/gate-events.log`, exempting the WHOLE unrelated source file
+# (#279 review HIGH — reproduced end-to-end: an md5() call and a committed
+# password both passed H-09b with no marker). Stripping a FIXED 6-character
+# prefix has no such ambiguity: `"+++ b/x b/.codearbiter/gate-events.log"[6:]`
+# is unconditionally `"x b/.codearbiter/gate-events.log"`, the correct full
+# path, no matter what the path itself contains.
+_PLUS_B_PREFIX = "+++ b/"
+_PLUS_DEV_NULL = "+++ /dev/null"
+
+
+
+
+def diff_added_lines(diff_text):
+    """Added (`+`) lines of a unified `git diff`-style text (produced via
+    SECURITY_DIFF_GIT_ARGS — pinned `a/`/`b/` prefixes, no external diff), as
+    `(path, line)` tuples — a PATH-AWARE walk so a caller can exclude lines by
+    the FILE they live in, never by matching the line's own text (which a
+    hidden secret could otherwise dodge by naming the excluded file).
+
+    Two-phase state machine per file section, `path`/`in_hunk`/`seen_section`:
+
+    1. A bare, UNPREFIXED `diff ` line (`diff --git`, `diff --cc`, `diff
+       --combined`, ...) starts a new section: `path` resets to `None` and
+       `in_hunk` resets to False. Content can NEVER forge this line at column
+       0 — every diff-body line (context/added/removed) carries a leading
+       ' '/'+'/'-'/'\\' character, so a file whose own content is literally
+       "diff --git a/x b/y" renders as "+diff --git a/x b/y" (added), never as
+       a bare match. Resetting `path` to None (not inheriting the PREVIOUS
+       section's path) on ANY `diff ` spelling matters for combined/merge
+       diffs (#279 review MEDIUM-2): git-enforce.py's `git diff --cached` at a
+       merge commit emits `diff --cc <path>` sections, which the prior
+       `diff --git`-only reset missed, letting a `--cc` section's added lines
+       silently inherit whatever path the section before it had — failing
+       toward EXEMPTION if that was gate-events.log.
+    2. While NOT yet `in_hunk` (the section's preamble, before its first `@@`
+       / `@@@` hunk header), a `+++ b/<path>` line sets `path` by stripping
+       the FIXED 6-character prefix `_PLUS_B_PREFIX` — never a regex search
+       for a separator (see `_PLUS_B_PREFIX`'s comment for the ambiguity a
+       greedy `diff --git` parse had). `+++ /dev/null` (a deleted
+       destination) sets `path` back to None explicitly — no added lines are
+       expected in a deletion's hunk body anyway. Every other preamble line
+       (`--- a/<path>`, `index ...`, `new/deleted file mode`, `rename
+       from/to`, `similarity index`, `Binary files ... differ`) is inert
+       noise. A `+++ b/...`-shaped line can ONLY be trusted here, before the
+       section's first `@@`: once `in_hunk` is True, an apparently identical
+       `+++ b/...` string is body CONTENT (it carries the hunk body's own
+       leading `+`, i.e. the underlying source line was "++ b/..." or "+++
+       b/..." before diff-prefixing) and is captured as an added line like any
+       other, never re-parsed as an attribution header (closes the #279
+       review's own earlier finding: an added content line forging `+++
+       b/<path>` used to hijack attribution for the rest of the file).
+    3. Once `in_hunk`, `+`-prefixed lines are collected as `(path, content)`;
+       `-`/` `/`\\` (no-newline-marker) lines are skipped; anything else ends
+       the hunk (not producible by well-formed `git diff` output there, but
+       handled rather than guessed at).
+
+    FAILS SAFE: a `+` line seen before ANY `diff ` section header at all (not
+    producible by real `git diff` output) is attributed to `path=None` and
+    STILL COLLECTED, never silently dropped. `sensitive_scan_added_lines`
+    treats an unattributed (`None`) path as NOT exempt — in scope for
+    scanning. Exempting, or discarding, an unattributable line would be the
+    dangerous direction; over-scanning only risks a false positive, the
+    harmless failure mode here.
+
+    The shared primitive behind the H-09b/H-10b crypto/secret gate's producer
+    (security-pass.py) and both consumers (pre-bash.py, git-enforce.py) —
+    implemented once here so the gate-events.log exemption can never drift
+    between the three independent line-collectors that used to each do their
+    own flat `[ln[1:] for ln in text.splitlines() if ln.startswith("+") ...]`
+    walk with no path information (and no forgery-resistance) at all."""
+    path = None
+    in_hunk = False
+    seen_section = False  # True once the first `diff ` section header is seen
+    out = []
+    for line in diff_text.splitlines():
+        if line.startswith("diff "):
+            path = None
+            in_hunk = False
+            seen_section = True
+            continue
+        if line.startswith("@@"):
+            in_hunk = True
+            continue
+        if not in_hunk:
+            if not seen_section:
+                # No `diff ` section header seen yet at all: not producible
+                # by real `git diff` output. Fail SAFE (see docstring) rather
+                # than silently dropping a line that cannot be confidently
+                # classed as header noise either.
+                if line.startswith("+"):
+                    out.append((None, line[1:]))
+                continue
+            # Section preamble: only a genuine `+++ b/<path>` (or `+++
+            # /dev/null`) line here can set `path` — see point 2 above.
+            if line.startswith(_PLUS_B_PREFIX):
+                path = line[len(_PLUS_B_PREFIX):]
+            elif line == _PLUS_DEV_NULL:
+                path = None
+            continue
+        if line.startswith("+"):
+            out.append((path, line[1:]))
+        elif line.startswith(("-", " ", "\\")):
+            pass  # removed / context / ""
+        else:
+            # Not producible by well-formed `git diff` output (a hunk body
+            # line is always one of the four prefixes above); treat it as the
+            # hunk having ended rather than guessing.
+            in_hunk = False
+    return out
+
+
+def sensitive_scan_added_lines(diff_text):
+    """`diff_added_lines(diff_text)` narrowed to the H-09b/H-10b crypto/secret
+    scan's candidate set: every added line EXCEPT those belonging to a
+    sensitive-scan-exempt path (currently only gate-events.log). Call this
+    instead of a raw `+`-line filter anywhere the crypto/secret scan reads a
+    diff, so the exemption is applied uniformly."""
+    return [ln for path, ln in diff_added_lines(diff_text)
+            if not (path and is_sensitive_scan_exempt(path))]
+
+
+def line_digest(line):
+    """Digest of one added diff line, for the security-gate binding
+    (H-09b/H-10b). The gate-pass marker stores these digests instead of being
+    an empty `touch`d file, so a recorded pass admits only the exact sensitive
+    lines it reviewed — not whatever lands in the next 30 minutes. Trailing
+    whitespace is stripped so CRLF translation between worktree and index
+    never breaks the match."""
+    return hashlib.sha256(line.rstrip().encode("utf-8", "replace")).hexdigest()
+
+
+def content_digest(text):
+    """Digest of a whole migration file's content, for the H-14 migration-gate
+    binding. Lines are rstripped and rejoined with \\n so CRLF translation
+    between worktree and index never breaks the match (same rationale as
+    line_digest). The producer (migration-pass.py) and the backstop
+    (pre-bash.py) both digest worktree content this way, so the two never
+    disagree on what a recorded pass covers."""
+    norm = "\n".join(line.rstrip() for line in text.splitlines())
+    return hashlib.sha256(norm.encode("utf-8", "replace")).hexdigest()

package/plugins/ca-pi/hooks/_sessionlib.py

@@ -0,0 +1,78 @@
+#!/usr/bin/env python3
+# codeArbiter — statusline true-session-start resolver (extracted from
+# statusline.py, architecture-004).
+#
+# Owns resolving the wall-clock session start from Claude Code's own session
+# metadata (~/.claude/sessions/<pid>.json, matched on sessionId) — the same start
+# time /usage reports, including idle/suspend gaps the current transcript alone
+# can't show. The result is cached into the caller's ledger record so the O(N)
+# directory scan runs at most once per session.
+#
+# Design principles (mirroring _ledgerlib.py):
+#   - Stdlib only; no third-party imports ever.
+#   - Zero side effects at import time.
+#   - Never raise on malformed input — degrade to None.
+#
+# Public API:
+#   session_start(sid, rec=None) -> float|None
+
+import json
+import os
+
+
+def num(x, default=0.0):
+    """Coerce any host value to float; tolerate strings, None, and containers."""
+    try:
+        return float(x)
+    except (TypeError, ValueError):
+        return default
+
+
+def _session_start_scan(sid):
+    """The O(N) fallback: scan ~/.claude/sessions/*.json for the one whose
+    sessionId matches `sid` and read its startedAt. The metadata file is named by
+    the host PID, not the sessionId, so a direct name lookup isn't possible from
+    here — a match-on-content scan is the only correct resolver. The caller caches
+    the result in the ledger so this scan runs at most once per session."""
+    d = os.path.join(os.path.expanduser("~"), ".claude", "sessions")
+    try:
+        names = os.listdir(d)
+    except OSError:
+        return None
+    for nm in names:
+        if not nm.endswith(".json"):
+            continue
+        fp = os.path.join(d, nm)
+        try:
+            if os.path.getsize(fp) > 65536:   # metadata is <1KB; never read a large file
+                continue
+            with open(fp, encoding="utf-8") as f:
+                meta = json.load(f)
+        except (OSError, ValueError):
+            continue
+        if isinstance(meta, dict) and meta.get("sessionId") == sid:
+            sa = num(meta.get("startedAt"), None)
+            if sa:
+                return sa / 1000.0 if sa > 1e12 else sa   # ms epoch -> seconds
+    return None
+
+
+def session_start(sid, rec=None):
+    """True session start (epoch seconds) from Claude Code's own session metadata
+    (~/.claude/sessions/<pid>.json, matched on sessionId). This is the wall-clock
+    start /usage reports, INCLUDING idle/suspend gaps the current transcript can't
+    show. None if unavailable -> caller falls back to the transcript.
+
+    Fast path: the resolved value is cached in the ledger record (`rec["sess_start"]`),
+    which ledger_update persists, so subsequent renders skip the per-render directory
+    scan entirely. On a cache miss the full scan runs once and seeds the cache."""
+    if not sid:
+        return None
+    if isinstance(rec, dict):
+        cached = num(rec.get("sess_start"), None)
+        if cached:
+            return cached
+    sa = _session_start_scan(sid)
+    if sa and isinstance(rec, dict):
+        rec["sess_start"] = sa   # seed the ledger cache; ledger_update persists it
+    return sa

package/plugins/ca-pi/hooks/_sloplib.py

@@ -0,0 +1,244 @@
+# codeArbiter v2 — anti-slop copy-law detector (advisory).
+#
+# A lightweight guard for the single highest-signal AI tell: the em-dash / en-dash
+# used as a PROSE sentence-separator (anti-slop-design core §3.A). It backs the
+# PostToolUse reminder in post-write-edit.py and is the mechanical aid #60 asks
+# for, so the PR #59 regression class (user-facing docs shipping with separator
+# dashes) cannot recur silently.
+#
+# This is a heuristic, not a parser, and it is advisory — it nudges the producer
+# to run the §3.A/§3.B copy self-audit; it never blocks. It honors the §3.A
+# exemptions it can detect cheaply (fenced/inline code, URLs, numeric/date ranges)
+# and errs toward silence on the rest.
+#
+# Public API:
+#   find_prose_separator_dashes(text) -> list[dict]   findings per line; each
+#                                        {"line": int, "context": str}; empty when clean
+#   in_antislop_doc_scope(rel_path) -> bool   True for user-facing Markdown the
+#                                        anti-slop bundle governs (repo-root + docs/**)
+
+import re
+
+EM_DASH = "—"
+EN_DASH = "–"
+_DASHES = (EM_DASH, EN_DASH)
+
+_FENCE_RE = re.compile(r"^\s*(```|~~~)")
+_INLINE_CODE_RE = re.compile(r"`[^`]*`")
+# Strip URLs, autolinks/HTML tags and comments, and markdown link targets so a
+# dash inside any of them is never read as prose.
+_URL_RE = re.compile(r"https?://\S+|<[^>]*>|\]\([^)]*\)")
+# Numeric / date range: a dash flanked by digits (pp. 12–18, 2019–2024). Correct
+# typography per §3.A, never a finding.
+_RANGE_RE = re.compile(r"\d\s*[–—]\s*\d")
+# A letter or digit (Unicode), used to confirm a dash actually joins two text
+# spans rather than standing alone (e.g. a lone "—" N/A marker in a table cell).
+_WORD_RE = re.compile(r"[^\W_]", re.UNICODE)
+# A DEFINITION-LIST dash: `- **term** — meaning`. Structural, not a sentence
+# separator, and the rule this detector enforces says "sentence separators" -
+# site/VOICE.md's own Terminology anchors section is written in exactly this
+# form, so flagging it would make the gate contradict the style guide it exists
+# to enforce (#338). Anchored to the start of the line and to a bolded lead-in,
+# so an ordinary sentence that happens to contain bold text is untouched.
+#
+# The TERM is captured and kept; only the dash is dropped. Blanking the whole
+# lead-in was the first cut and it was a false-negative generator: on
+#     - **The gate-enforcement hooks** — `a.py`, `b.py` — make zero calls.
+# it removed the left-hand words, then _INLINE_CODE_RE blanked the backticks,
+# and the SECOND dash - a real separator - was left with no word character on
+# its left and escaped. That loosened the shared detector for docs/** and
+# repo-root too, not only for site prose.
+_DEFINITION_RE = re.compile(r"^(\s*(?:[-*+]\s+)?\*\*[^*]+\*\*\s*)[–—]")
+
+
+def _prose_only(line):
+    """Drop the spans §3.A exempts so only candidate prose remains."""
+    # Only the definition DASH is dropped; the term is kept (group 1), so a
+    # later separator on the same line still has its left-hand context.
+    line = _DEFINITION_RE.sub(r"\1 ", line)
+    line = _INLINE_CODE_RE.sub(" ", line)
+    line = _URL_RE.sub(" ", line)
+    line = _RANGE_RE.sub(" ", line)
+    return line
+
+
+def _segment_separates(seg):
+    """True if `seg` contains an em/en dash with word characters on BOTH sides —
+    i.e. it joins two text spans (a prose separator), not a lone filler dash."""
+    return _separating_dash_in(seg)
+
+
+# Block openers: a line matching any of these starts a new markdown block, so
+# the line before it is NOT soft-wrapped into it (#484 AC-2). Joining across one
+# of these would invent findings a reader never sees as a single sentence.
+_HEADING_RE = re.compile(r"^\s{0,3}#{1,6}\s")
+_LIST_ITEM_RE = re.compile(r"^\s*(?:[-*+]|\d+[.)])\s")
+_BLOCKQUOTE_RE = re.compile(r"^\s*>")
+_THEMATIC_RE = re.compile(r"^\s{0,3}(?:-{3,}|\*{3,}|_{3,})\s*$")
+# A range split BY the wrap: `12–` / `18`. _RANGE_RE only sees one line, so the
+# same-line exemption cannot reach it and it has to be re-checked on the join.
+_RANGE_LEFT_RE = re.compile(r"\d\s*$")
+_RANGE_RIGHT_RE = re.compile(r"^\s*\d")
+
+
+def _starts_new_block(raw):
+    """True if `raw` opens a new markdown block rather than continuing the
+    previous line's paragraph. A `|` anywhere makes a line un-joinable: table
+    rows are scanned cell-by-cell, and joining one to its neighbour would give a
+    lone N/A marker the word context the cell split exists to deny it."""
+    return bool(not raw.strip()
+                or "|" in raw
+                or _FENCE_RE.match(raw)
+                or _HEADING_RE.match(raw)
+                or _LIST_ITEM_RE.match(raw)
+                or _THEMATIC_RE.match(raw)
+                or _BLOCKQUOTE_RE.match(raw))
+
+
+def _separating_dash_in(head, *, words_before=False, words_after=False,
+                        tail_before="", head_after=""):
+    """True if a dash INSIDE `head` joins two text spans, where its left context
+    may reach back into the preceding lines of its paragraph and its right
+    context forward into the following ones.
+
+    #484: `_segment_separates` required word characters on both sides of the
+    dash on the SAME line, so a separator at a soft-wrap boundary scored zero —
+    in both directions. `…three states —` / `listed below.` has its right-hand
+    span on the next line; `A tribunal is the heavyweight audit` / `— checkpoints
+    are the lean sweep.` has its left-hand span on the previous one. Both were
+    real, unreported VOICE.md violations in the site's own pages.
+
+    Only dashes inside `head` are considered, so attribution stays on the line
+    that actually holds the dash (AC-1) no matter how wide the paragraph is.
+
+    The surrounding context arrives PRE-REDUCED rather than as joined text:
+    `words_before`/`words_after` are booleans the caller accumulates once per
+    paragraph, and `tail_before`/`head_after` are only the nearest neighbours,
+    which is all the numeric-range adjacency check can see. Building the joined
+    strings here instead was quadratic in paragraph length - 14x slower at 3000
+    lines, measured - and this runs on every write and edit through H-13."""
+    for d in _DASHES:
+        idx = head.find(d)
+        while idx != -1:
+            left, right = head[:idx], head[idx + 1:]
+            if ((words_before or _WORD_RE.search(left))
+                    and (_WORD_RE.search(right) or words_after)):
+                # A range split BY the wrap: the digit adjacency lives on the
+                # neighbouring line, so fall back to it only when this line
+                # contributes nothing on that side.
+                near_left = left if left.strip() else tail_before
+                near_right = right if right.strip() else head_after
+                if not (_RANGE_LEFT_RE.search(near_left)
+                        and _RANGE_RIGHT_RE.search(near_right)):
+                    return True
+            idx = head.find(d, idx + 1)
+    return False
+
+
+def find_prose_separator_dashes(text):
+    """Return a finding per line that uses an em/en dash as a prose separator.
+
+    Each finding is {"line": <1-based int>, "context": <stripped line text>}.
+    Exempt: fenced code blocks, inline code, URLs, numeric/date ranges, and a
+    lone dash that joins no text (split on `|` so a table-cell N/A marker is not
+    mistaken for a separator).
+    """
+    findings = []
+    in_fence = False
+    lines = text.splitlines()
+    # Each paragraph is scanned as a unit so a separator that lands at a
+    # soft-wrap boundary is visible (#484), while every finding is still
+    # attributed to the line holding its dash. `_prose_only` runs PER LINE and
+    # before the join, so inline code, URLs, ranges and the definition-list
+    # lead-in are stripped exactly as they were.
+    index = 0
+    while index < len(lines):
+        raw = lines[index]
+        if _FENCE_RE.match(raw):
+            in_fence = not in_fence
+            index += 1
+            continue
+        if in_fence:
+            index += 1
+            continue
+        # The paragraph: this line, plus every following line that continues it.
+        group = [index]
+        following = index + 1
+        while following < len(lines) and not _starts_new_block(lines[following]):
+            group.append(following)
+            following += 1
+        prose = [_prose_only(lines[i]) for i in group]
+        # Reduce the paragraph's context to what the dash test actually needs,
+        # in one pass each direction. `word_before[k]` is "some EARLIER line in
+        # this paragraph has a word character", `word_after[k]` the same looking
+        # forward. It has to accumulate over the whole group rather than peek at
+        # the neighbour: a line that is entirely inline code strips to
+        # whitespace, so the real continuation can sit two lines from the dash.
+        word_before = [False] * len(prose)
+        for k in range(1, len(prose)):
+            word_before[k] = word_before[k - 1] or bool(_WORD_RE.search(prose[k - 1]))
+        word_after = [False] * len(prose)
+        for k in range(len(prose) - 2, -1, -1):
+            word_after[k] = word_after[k + 1] or bool(_WORD_RE.search(prose[k + 1]))
+        for position, i in enumerate(group):
+            head = prose[position]
+            if "|" in lines[i]:
+                # A table row: keep the cell-by-cell scan, and never let a
+                # neighbouring row lend it context.
+                hit = any(_segment_separates(cell) for cell in head.split("|"))
+            else:
+                hit = _separating_dash_in(
+                    head,
+                    words_before=word_before[position],
+                    words_after=word_after[position],
+                    tail_before=prose[position - 1] if position else "",
+                    head_after=(prose[position + 1]
+                                if position + 1 < len(prose) else ""),
+                )
+            if hit:
+                findings.append({"line": i + 1, "context": lines[i].strip()})
+        index = following
+    return findings
+
+
+# Authored site prose (#338). site/VOICE.md has banned em-dashes as sentence
+# separators since 2026-07-02, and nothing enforced it: this predicate covered
+# repo-root docs and docs/**, never site/. A rule with no gate, violated in 16
+# of its own 36 authored files, is worse than no rule - reviewers cite it and it
+# is wrong.
+#
+# Scope is AUTHORED prose only. Everything under content/docs/reference/ is
+# generated on every build (91 of the 128 files there), changelog.md is a
+# verbatim pass-through of the repo CHANGELOG, and site/src/curated/** mirrors
+# plugins/ca bodies - which are framework prose under a different register, and
+# already excluded via plugins/. Flagging any of those would report a finding
+# nobody wrote and nobody can fix in place.
+_SITE_PROSE_ROOT = "site/src/content/docs/"
+_SITE_PROSE_EXCLUDED = ("reference/", "changelog.md")
+
+
+def in_antislop_doc_scope(rel_path):
+    """True for user-facing Markdown the anti-slop bundle governs: repo-root
+    community docs, docs/**, and AUTHORED site prose under
+    site/src/content/docs/ (#338). Excludes codeArbiter's own framework bodies
+    (everything under plugins/), machine-managed .codearbiter/ state, and every
+    generated site page."""
+    if not rel_path:
+        return False
+    p = rel_path.replace("\\", "/")
+    if p.startswith("./"):
+        p = p[2:]
+    # `.mdx` counts: the rule is about prose, not about a file extension, and
+    # two authored site pages are .mdx.
+    if not p.lower().endswith((".md", ".mdx")):
+        return False
+    if p.startswith("plugins/") or p.startswith(".codearbiter/"):
+        return False
+    if p.startswith(_SITE_PROSE_ROOT):
+        rest = p[len(_SITE_PROSE_ROOT):]
+        return not rest.startswith(_SITE_PROSE_EXCLUDED)
+    if p.startswith("site/"):
+        return False
+    if p.startswith("docs/"):
+        return True
+    return "/" not in p