fix(hooks): two enforcement papercuts - commit-graph and wrapped dashes

[SUaDtL]

What

Two enforcement papercuts, both shared-core changes projected to all three hosts. Grouped because they share the version bump — a fourth contended ca-pi number for two small independent fixes is churn.

#485 — git commit-graph was gated as git commit

COMMIT_RE spelled the subcommand commit\b, and a word boundary sits between commit and -, so every commit-* verb matched.

The annoyance was not the cost. The gate told the operator to run the crypto-compliance gate for a command that writes no objects, creates no commit, and can introduce neither a crypto nor a secret change — leaving two escapes, both wrong: record a security-gate pass that certifies nothing, or reach for /ca:override, which is precisely the override-invented-to-cover-a-coverage-hole that ADR-0022 and #308 exist to prevent. It also bites at the worst possible moment, since a stale commit-graph is what a batch of --delete-branch merges leaves behind — which is how it was found.

The exclusion is an explicit ALLOW of the one verb proven safe, not an allowlist of gated ones, so the failure direction stays closed: a commit-* name the matcher has never seen is still gated. commit-tree deliberately stays in scope — it creates a commit object, and a crafted commit plus update-ref is a real path around H-01.

AC-4: the sibling-matcher audit

push has no push-* subcommand to over-match onto. git add--interactive genuinely does stage, so add\b reaching it is correct rather than a false positive. Neither needs the treatment, and both were left alone.

What the audit did surface is recorded in the code and knowingly not fixed: these matchers scan command text, so a git command quoted inside another command's arguments is gated as if it were being run — a grep "git add" trips H-03, which happened twice during this work. Exempting quoted occurrences would be a real bypass, not a loosening: sh -c "git add ." executes what it quotes. Telling the two apart needs actual shell tokenization, and over-blocking a mention is the fail-CLOSED side of that trade (ORCHESTRATOR §2). Left as-is with the reasoning in place, so the next reader doesn't "fix" it unsafely.

#484 — a separator dash at a line-wrap boundary was invisible

The detector read one line at a time and required word characters on both sides of the dash on the same line, so a separator at a soft-wrap boundary scored zero in both directions:

...one of three states —          ← right-hand span on the next line
listed below.

...the heavyweight audit
— checkpoints are the lean sweep.  ← left-hand span on the previous line

All three fixtures are real misses, found by hand in the site's own codearbiter-directory.md while fixing #338's 118 flagged lines — violations a reader sees that the gate did not report.

It now scans a paragraph at a time. _prose_only still runs per line and before the join, so inline code, URLs, ranges, and the definition-list lead-in are stripped exactly as they were, and each finding still carries the line of its own dash rather than the paragraph's. Joining stops at every block boundary — blank line, list item, heading, table row, thematic break, fence — and a table row is never joined at all, because lending a neighbouring row's words to a lone N/A marker is the exact thing the cell split exists to prevent. A range split by the wrap (12– / 18) is re-checked on the join, since the same-line exemption cannot reach it.

Verification

Unit tests are the easy part for a detector this widely wired; the risk is regression on real prose and vacuous boundary tests. Both were checked.

Monotone, and measured to be. Across the 23 in-scope prose files: no finding the old detector reported was lost, and 19 were gained. Every one sampled is a genuine wrap separator, e.g. CONTRIBUTING.md:121, CHANGELOG.md:42.

Nothing new blocks. check_site_voice.py — the blocking CI gate — is still clean on all 36 authored site pages. H-13 is a remind(), so the 19 are reminders on a doc edit, not a new block on files like CHANGELOG.md.

The boundary tests are not vacuous. They assert [], so they would pass against an implementation that never joins. Mutating _starts_new_block to always return False (join across every boundary) turns 7 of them red, so they genuinely constrain the implementation rather than just agreeing with it.

test_hook_guards.py 146 assertions / 0 failed (4 new, RED-proven first: commit-graph write and commit-graph verify were blocked before the fix). test_sloplib.py 47 tests OK (14 new). test_hooklib, test_hooks_cold_install, test_migration_backstop, test_pre_read, test_ci_impact all green.

Versions

ca-pi advances 0.1.27 → 0.1.30: #491 claims 0.1.28 and #493 claims 0.1.29, and two branches must never claim one ca-pi number. Merge after both. ca (2.9.1) and ca-codex (0.3.0) carry no tag yet, so their entries join the open sections.

Closes #485
Closes #484

https://claude.ai/code/session_01Y8UPz5RZwgnda3NbAVfd6L