fix(ai-slop): fix ten audit-run defects, re-enable rule-em-dash, and purge the corpus

.claude/ai-slop.json

@@ -1,12 +1,11 @@
 {
-  "_comment": "Three rules are disabled here, each for a measured, repo-specific reason; the shipped defaults stay neutral and this is the consuming repo's own decision, which is what the config layer is for. (1) rule-em-dash: this marketplace's house style uses em dashes deliberately, measured 34,999 matching lines across 1229 tracked markdown files (2026-08-19), which is a style choice, not a defect backlog. Disabling beats enumerating em_dash_allowed_paths, which would need near-total path coverage to be useful. (2) rule-curly-artifacts: punctuation glyphs were already ruled out of scope by the repo owner, twice in writing, and the rule's yield is almost entirely the material those rulings protect. Measured 2026-08-20 over 1214 tracked markdown files: 72 findings, of which 39 are quoted Pat Pattison book text, 32 are a verbatim pasted external Codex review, and exactly 1 was genuine paste residue (a stray curly apostrophe in plugins/disk-hygiene/README.md, fixed rather than suppressed in the same change as this entry). The rulings: plugins/songwriting/context/pat-pattison/research/book-references.md ('Do not sweep, measure, audit, or open work items on punctuation glyphs' - a session was spent on exactly that before the owner ruled it out of scope; it also notes the four books disagree with each other, so there is no fidelity axis to restore toward) and the songwriting CHANGELOG entry 'PUNCTUATION GLYPHS ARE NOT A FIDELITY AXIS - DO NOT SWEEP FOR THEM', which records a prior session normalizing 470 lines before the ruling landed. (3) rule-emoji-formatting: measured 2026-08-20 over the same corpus, all 21 findings are SEMANTIC markers and none is decoration - 7 wrong/right teaching pairs in docs-hygiene extract-ssot citation-form.md and planning interview loop.md, 4 coaching pairs in the pat-pattison coaching-protocol.md, 9 warning headings across kindle-dedrm README.md, the songwriting CHANGELOG and book-references.md, and 1 severity-legend marker in REVIEW.md that belongs to the same table as its two siblings. The rule is doing its job; this repo simply uses these glyphs as vocabulary rather than ornament. In-file block markers were the first choice and were rejected on cost: the marked files span four plugins, and the changelog-parity gate treats any edit under plugins/<name>/ as version reuse, so silencing cosmetic audit noise would have published four plugin releases. A per-rule path exemption (rule_allowed_paths) is now supported for every rule (generalized 2026-08-25); these three entries stay whole-rule disables anyway because each is a repo-wide ruling rather than a path-scoped one. Revisit any of the three if a corpus of genuine LLM residue ever lands here. Separately, two excluded_paths entries name files that CONTAIN the tells on purpose and would otherwise be scanned as if they were defects: reference/catalog.md quotes the tells it catalogues, and skills/audit/evals/fixtures/** are the eval suite's committed slop samples (#3041 - a prose scenario cannot be checked against the detector and disagreed with it three times, so the input is a file now). Excluding the fixture path rather than marking each fixture with an in-file ai-slop-ignore-file marker is what keeps them measurable: a file marker declines the file unconditionally, including under the empty HOME + CLAUDE_PROJECT_DIR isolation the detector's own tests use, so `detect.sh <fixture>` would print nothing and the eval author would be back to trusting prose. An excluded_paths glob is a layer of THIS repo's config, so that same isolation lifts it and the fixture reports its real findings.",
+  "_comment": "Em dashes are not this repository's house style: rule-em-dash runs at its shipped zero-tolerance default, and the existing em dashes in tracked markdown are a backlog worked in per-plugin tranches under #2891, never a style to exempt by volume. Vendored upstream material is the only prose this repository does not author, so plugins/*/skills/*/vendor/** is excluded. Two rules stay disabled, each on a specific owner ruling rather than a count: (1) rule-curly-artifacts, because punctuation glyphs were ruled out of scope twice in writing (plugins/songwriting/context/pat-pattison/research/book-references.md 'Do not sweep, measure, audit, or open work items on punctuation glyphs', and the songwriting CHANGELOG entry 'PUNCTUATION GLYPHS ARE NOT A FIDELITY AXIS'), and the rule's yield is almost entirely the quoted book text and the pasted external review those rulings protect; (2) rule-emoji-formatting, because every measured hit is a semantic marker (wrong/right teaching pairs, coaching pairs, warning headings, a severity legend) and none is decoration; this repository uses those glyphs as vocabulary. Both stay whole-rule disables because each is a repo-wide ruling, not a path-scoped one; revisit either if genuine LLM residue of that kind lands here. skills/audit/evals/fixtures/** is excluded because those files are the eval suite's committed slop samples: an excluded_paths glob is a layer of THIS repo's config, so the detector's own empty-HOME isolation lifts it and a fixture still reports its real findings, where an in-file ignore marker would silence it everywhere. The catalog is not excluded: it documents tells inside quotes and code spans, which the quotation exemption already declines, and its own prose is subject to every rule like any other authored file.",
   "rule_allowed_paths": {
     "rule-ai-vocabulary": ["plugins/architecture/skills/improve/research/deepening/**"]
   },
   "excluded_paths": [
     "plugins/*/skills/*/vendor/**",
-    "plugins/ai-slop/skills/audit/reference/catalog.md",
     "plugins/ai-slop/skills/audit/evals/fixtures/**"
   ],
-  "disabled_rules": ["rule-em-dash", "rule-curly-artifacts", "rule-emoji-formatting"]
+  "disabled_rules": ["rule-curly-artifacts", "rule-emoji-formatting"]
 }

.claude/source-control.md

@@ -5,7 +5,7 @@ Commit-subject / PR-title convention for the source-control plugin, resolved by
 CLAUDE.md/rules/commit-msg hook or fall back to the bundled Conventional Commits default.
 Re-run `/source-control:setup` to change these values.
 
-Of the convention keys, only `pr_body_required_sections` is set here — every other one falls through
+Of the convention keys, only `pr_body_required_sections` is set here. Every other one falls through
 to `/source-control:setup`'s inference (this repo's commit history is already
 Conventional-Commits-shaped) per config-resolution.md's per-key fallthrough, so this file
 deliberately does not restate them. The `babysit_loop_*` keys below are the other key family this

.github/pull_request_template.md

@@ -33,7 +33,7 @@ line with: No linked issue
 
 <!--
 Issues, PRs, ADRs, or decision-log entries this PR references but does NOT close.
-Required non-empty even when the closing-keyword line above is `No linked issue`
-— if nothing applies, put `N/A`. Use `Refs #N` to link an issue without closing
+Required non-empty even when the closing-keyword line above is `No linked issue`.
+If nothing applies, put `N/A`. Use `Refs #N` to link an issue without closing
 it.
 -->

SECURITY.md

@@ -1,8 +1,8 @@
 # Security Policy
 
-This marketplace distributes plugins — skills, hooks, and agents — that run code on a consumer's machine and
-can wire Claude Code to external systems. Security reports about a published plugin, the marketplace catalog, or
-this repository's own tooling are all in scope.
+This marketplace distributes plugins, and a plugin's skills, hooks, and agents run code on a
+consumer's machine and can wire Claude Code to external systems. Security reports about a published
+plugin, the marketplace catalog, or this repository's own tooling are all in scope.
 
 ## Reporting a Vulnerability
 

docs/CATALOG-TAXONOMY.md

@@ -2,25 +2,26 @@
 
 This document is the single owner of the marketplace's category vocabulary. Each plugin entry in
 `.claude-plugin/marketplace.json` carries one `category` value drawn from the controlled set below, and
-the generated catalog groups plugins by it. Consumers of this vocabulary — the marketplace file, the
-catalog generator, `docs/CATALOG.md` — conform to this document and cite it; they never restate its definitions.
+the generated catalog groups plugins by it. Three consumers of this vocabulary conform to this document
+and cite it, never restating its definitions: the marketplace file, the catalog generator, and
+`docs/CATALOG.md`.
 
 Category is display-and-grouping metadata only. It never appears in an install identifier
 (`plugin-name@marketplace`) or a skill invocation (`/plugin-name:skill`). Physical layout stays flat
 (`plugins/<name>`); grouping lives here, not in directories or names.
 
 ## Form rule
 
-Every category value is a lowercase noun or gerund-noun naming a domain of activity or subject matter —
+Every category value is a lowercase noun or gerund-noun naming a domain of activity or subject matter,
 never a bare-verb imperative (`development`, not `build`; `deployment`, not `deploy`; `maintenance`, not
 `support`). This matches the controlled-vocabulary convention (ANSI/NISO Z39.19 §6.4.1), every value in
 the official Claude Code marketplace, and the VS Code and Chrome category enumerations.
 
 ## Assignment principle
 
 The taxonomy is **lifecycle-primary with a subject catch-all**. A plugin that serves the general software
-lifecycle is filed by its lifecycle **activity**. A plugin whose defining trait is a special **subject** —
-Claude Code itself, the workstation, music, personal life — is filed by that subject.
+lifecycle is filed by its lifecycle **activity**. A plugin whose defining trait is a special **subject**,
+such as Claude Code itself, the workstation, music, or personal life, is filed by that subject.
 
 When a plugin is an activity applied to a special subject, **subject wins if the subject is the salient
 reason the plugin exists**. `skill-quality` audits (activity) Claude Code skills (subject) and is filed
@@ -29,20 +30,20 @@ under `quality`; `codebase-health` audits the general codebase and is filed unde
 
 ## Vocabulary
 
-Lifecycle tier — the SDLC spine:
+Lifecycle tier, the SDLC spine:
 
 | Category | Scope |
 |---|---|
 | `discovery` | Explore code, research, ingest external sources. |
 | `design` | Plan, model, architect, prototype before building. |
-| `development` | Implement, format, lint, commit — the construction inner loop. |
+| `development` | Implement, format, lint, commit: the construction inner loop. |
 | `testing` | Design, author, run, and diagnose tests. |
 | `verification` | Prove a change achieved its intended outcome against baseline and intent. |
 | `quality` | Reviews and audits of artifacts (SWEBOK software-quality reviews-and-audits). |
 | `maintenance` | Fix, tidy, and keep an existing codebase healthy (SWEBOK maintenance). |
-| `deployment` | CI/CD, environments, releases. Not yet populated — see triggers. |
+| `deployment` | CI/CD, environments, releases. Not yet populated. See triggers. |
 
-Domain-and-cross-cutting tier — filed by subject:
+Domain-and-cross-cutting tier, filed by subject:
 
 | Category | Scope |
 |---|---|
@@ -52,7 +53,7 @@ Domain-and-cross-cutting tier — filed by subject:
 | `workflow` | Conducting the development session and process: staging, handoff, retrospective, orchestration priming. |
 | `presentation` | Shaping how information is presented to the reader: visual form, medium, rendering, and output register. |
 | `project-management` | Tracking, triaging, and decomposing the work backlog. |
-| `operations` | Workstation day-2 operations — monitoring and remediation. |
+| `operations` | Workstation day-2 operations: monitoring and remediation. |
 | `learning` | Coaching the human through a subject. |
 | `music` | Songwriting and music craft. |
 | `personal` | The owner's personal-life tooling, outside the software-delivery lifecycle. |
@@ -64,7 +65,7 @@ renders them.
 
 A category with one member is legitimate when its label positively predicts its member (Nielsen Norman
 Group: a category name must predict its contents). A value earns its place by naming a genuinely distinct
-discipline — not by balancing bucket sizes. Do not merge a singleton into a broader category if the merge
+discipline, not by balancing bucket sizes. Do not merge a singleton into a broader category if the merge
 would force a vague or junk label onto the combined set; the distinct, honest label is preferred. Revisit
 a singleton only if it would otherwise need a misleading label to survive.
 
@@ -79,7 +80,7 @@ Category-level:
 | Trigger | Action |
 |---|---|
 | First deployment plugin lands | Populate the `deployment` category (already reserved above). |
-| A non-music creative plugin lands | Broaden `music` — rename to `creative` or add a sibling creative category — rather than filing the newcomer under `music`. |
+| A non-music creative plugin lands | Broaden `music`, by renaming it to `creative` or adding a sibling creative category, rather than filing the newcomer under `music`. |
 | A broader automation plugin lands (automation that is not governed-autonomy-scoped) | Broaden `autonomy` or add a sibling category rather than filing the newcomer under `autonomy`. |
 
 Plugin-scoped (owned by the named plugin's README):
@@ -103,4 +104,4 @@ keeps the grouped view and the manifests from diverging.
 The generator's render order is held to this document the same way: on every run it parses the two
 Vocabulary tables above (the backticked first-column values, in order) and fails when its own list
 disagrees, so a value added, dropped, renamed, or reordered on either side is loud. Keep that row shape
-when editing the tables — a reshaping the parse cannot read fails the check rather than passing silently.
+when editing the tables. A reshaping the parse cannot read fails the check rather than passing silently.