fix(core): dominant-lang, manifest-scoped scanning, git quotepath -- …

[squid-protocol]

…closes #2555

Three defects observed in a single galaxyscope scan of expressjs/express:

1. Dominant-language inconsistency. MACRO STATE "Dominant Lang" named a documentation language (PLAINTEXT) while the COMPOSITION table showed JAVASCRIPT as the clear majority. Both read the same lang_comp dict but _get_dominant_lang ranks by summed structural impact, and documentation languages draw impact from a full-line-count basis (LOC/50), letting a few large plaintext files out-rank real code. _get_dominant_lang now takes the impact-argmax over code languages, excluding DOCUMENTATION_LANGUAGES, and only falls back to the full set for an all-docs repo -- keeping the deliberate impact-weighting while killing the false negative.

2. .js over-exclusion (same family as Aperture infra_path_pattern drops files whose name merely contains gen/lib/out/test/… (no left boundary) #2415/aperture silently excludes 45% of the sqlite crucible corpus from scanning (generated-file + infra-path heuristics) #2512). The aperture's Semantic Infrastructure & Test Target Shield dropped a real project's own lib/test/examples source because package.json only intent-locks its main entry. A manifest at the scan root now sets GuideStar.has_manifest_scope, propagated to ApertureFilter.manifest_project_scope, which stands down ONLY that shield (Gate 3) -- a separate signal from has_intent so the extension whitelist (Gate 1.5) and minification/machine-generated content gates stay active. node_modules/dist/vendor remain excluded via IGNORED_DIRECTORIES. Root-level detection keeps manifest-less scans (and the language-crucible corpus, scanned at a manifest-less data/ root) fully shielded.

3. Extension quoting artifact. git ls-files without -z wraps paths with unusual bytes in core.quotepath double-quotes, leaking a trailing " into the extracted extension and the exclusion reason ('.txt"'). Switch the census (galaxyscope) and the churn denominator (chronometer) to git ls-files -z and NUL-split; also defensively sanitize the aperture reason string so a malformed extension can never reach user-facing text.

Tests: new tests/core_engine/test_lang_classification_2555.py (9 cases); existing git-output mocks updated to the -z contract. Full suite 8299 passed; golden crucible full_precision + zero_dependency both PASS (no master drift).

Claude-Session: https://claude.ai/code/session_01SpojRfky4j31UMHLDcPdto

Description

Core Engine Modification Checklist

If your PR changes the core parsing engine (language_standards.py, detector.py, prism.py), you MUST complete the following validation gauntlet before merging:

• Golden Master Verification: Ran crucible_check.py to verify diffs, and ran crucible_check.py --update --yes if the baseline changed due to intentional parsing improvements.
• Tri-Comparison Audit: Handled by CI automatically, but you should run python tests/tools/tri_comparison_chart.py --all --ci locally first. If you intentionally improved precision, regenerate the baseline: python tests/tools/tri_comparison_chart.py --regenerate --languages <lang>.
• Tree-Sitter Accuracy: Ran python tests/tools/tree_sitter_accuracy_audit.py --ci --all. If ground truth drifted for valid reasons, regenerated the baseline with python tests/tools/tree_sitter_accuracy_audit.py --regenerate --lang <lang>.

Note for AI Agents: If you are an AI agent generating this PR, you MUST invoke the ci-push-checklist skill to ensure these steps are completed properly.

[github-actions]

🐦‍⬛ Muninn Security Scan

✅ No security issues found.

🐦‍⬛ Powered by Muninn · Skald Lab