pre-push-gates: no-non-ascii-in-source probe (kriskowal #417 directive)

Per the maintainer's review on endojs/endo-but-for-bots#417 (inline
comment r3353301111, 2026-06-04T04:21Z):

  Avoid non-ASCII. This is in the guide. Dispatch a gardener to
  revise the driver to have deterministic automation to keep source
  generally in the ASCII range.

The fixer (bb2325) that addressed the four section-sign instances on
the PR forwarded the gardener-level ask via journal entry
2026-06-04T04:40Z message-fixer-bb2325. This commit lands the
deterministic gate.

skills/pre-push-gates/probes/no-non-ascii-in-source.sh (new): scans
newly-added lines of packages/<pkg>/src/ and packages/<pkg>/lib/
.js/.ts/.mjs/.cjs files for non-ASCII characters. Reports each finding
as file:line: non-ASCII U+XXXX ('char') and exits 1 if any found.

Path exclusions: anything not under src/ or lib/ (so test/ and
fixtures/ are naturally exempt); per-file opt-out via a
/* ascii-exempt */ marker on a line within the first 5 (for the rare
case of a UTF-8-round-trip test living under src/).

Added-lines precision: the probe uses git diff -U0 + perl to track
post-image line numbers and check only the + lines. Pre-existing
non-ASCII in unchanged code does not surface; only new introductions
fail.

skills/pre-push-gates/SKILL.md: probe-table row added with description
and provenance. Notes-from-the-field row for 2026-06-04 cites the
precipitating PR comment and the fixer message.

Composition: the probe runs alongside the existing seven (ascii-banners,
pull-citations, inline-import-jsdoc, test-package-no-main,
security-md-hash-uniform, filename-no-stutter, sentence-per-line-md)
as stage 3 of the pre-push gate. Builder and fixer dispatches that run
`pre-push-gates.sh` before pushing now catch this class at push time
rather than at maintainer review.

Author: endolinbot

skills/pre-push-gates/SKILL.md

@@ -1,6 +1,6 @@
 ---
 created: 2026-05-20
-updated: 2026-05-20
+updated: 2026-06-04
 author: gardener
 ---
 
@@ -75,6 +75,7 @@ Probes shipped with the garden today:
 | `security-md-hash-uniform`    | Every `packages/*/SECURITY.md` has the same SHA-256 hash.                                                          | PR #75 `r3223750050` ("dispatch a builder to create a CI rule"). |
 | `filename-no-stutter`         | No file at `packages/<P>/.../<P>-foo.<ext>` (filename basename does not start with or contain `_<P>_`).            | PR #75 `r3223811705`.                   |
 | `sentence-per-line-md`        | Markdown files in changed paths use sentence-per-line shape (no multi-sentence physical lines outside of code blocks). | PR #75 `r3270500584` + CONTRIBUTING.md style guide. |
+| `no-non-ascii-in-source`      | No non-ASCII characters in newly-added lines of `packages/<pkg>/src/` and `packages/<pkg>/lib/` `.js` / `.ts` / `.mjs` / `.cjs` files. Test paths and fixtures excluded by path. Per-file opt-out via a `/* ascii-exempt */` marker on a line within the first 5. | PR #417 inline `r3353301111` (kriskowal 2026-06-04: "Avoid non-ASCII. This is in the guide. Dispatch a gardener to revise the driver to have deterministic automation to keep source generally in the ASCII range."). |
 
 Each probe is small (typically 5 to 30 lines of shell or awk). A new probe is one new script in `probes/`; the driver picks it up by glob.
 
@@ -145,3 +146,5 @@ The driver does not need to know about the new probe; it walks `probes/*.sh` at
 (Append; terse and dated.)
 
 - _2026-05-20_: initial bootstrap. The seven probes ship with the skill; provenance traces to PR #75 (six items) and PR #238 (the mermaid rule). The next several PRs through the gamut will exercise the gate; expect new probes to land for patterns the maintainer surfaces that the seven do not catch.
+
+- _2026-06-04_: added `no-non-ascii-in-source` probe per the maintainer's inline review on `endojs/endo-but-for-bots#417` (comment `r3353301111`): *"Avoid non-ASCII. This is in the guide. Dispatch a gardener to revise the driver to have deterministic automation to keep source generally in the ASCII range."* The fixer that addressed the four `§` (U+00A7) instances in `packages/ses/src/permits.js` forwarded the gardener-level ask via `journal/entries/2026/06/04/044044Z-message-fixer-bb2325.md`. The probe is the deterministic gate: future builder, fixer, and weaver pushes that introduce a non-ASCII character in `packages/<pkg>/src/` or `lib/` source fail at the gate. The per-file `/* ascii-exempt */` marker opts out a file that legitimately carries non-ASCII (rare under src/lib; the path glob already excludes the typical UTF-8-round-trip test paths).

skills/pre-push-gates/probes/no-non-ascii-in-source.sh

@@ -0,0 +1,62 @@
+#!/bin/bash
+# no-non-ascii-in-source — reject non-ASCII characters introduced in newly-added
+# lines of source code under packages/<pkg>/src/ and packages/<pkg>/lib/. Test
+# paths and fixture paths are excluded by glob; individual files that
+# legitimately carry non-ASCII (UTF-8 round-trip tests living under src/, etc.)
+# opt out via a `/* ascii-exempt */` marker on a line within the first 5.
+#
+# Provenance: PR endojs/endo-but-for-bots#417 inline r3353301111
+# (kriskowal 2026-06-04T04:21Z): "Avoid non-ASCII. This is in the guide.
+# Dispatch a gardener to revise the driver to have deterministic automation
+# to keep source generally in the ASCII range."
+
+set -uo pipefail
+
+base=$(git rev-parse --abbrev-ref --symbolic-full-name '@{u}' 2>/dev/null | sed 's|^origin/||' || echo master)
+
+paths=$(git diff --cached --name-only --diff-filter=AM 2>/dev/null \
+        | grep -E '^packages/[^/]+/(src|lib)/.*\.(js|ts|mjs|cjs)$' || true)
+if [ -z "$paths" ]; then
+  paths=$(git diff "origin/$base...HEAD" --name-only --diff-filter=AM 2>/dev/null \
+          | grep -E '^packages/[^/]+/(src|lib)/.*\.(js|ts|mjs|cjs)$' || true)
+fi
+
+findings=""
+for p in $paths; do
+  [ -f "$p" ] || continue
+  # Opt-out marker for files that legitimately carry non-ASCII (rare under
+  # src/lib; the path glob above already excludes test/ and fixtures/).
+  if head -5 "$p" 2>/dev/null | grep -qE '/\*[[:space:]]*ascii-exempt[[:space:]]*\*/'; then
+    continue
+  fi
+  diff=$(git diff --cached -U0 -- "$p" 2>/dev/null)
+  if [ -z "$diff" ]; then
+    diff=$(git diff "origin/$base...HEAD" -U0 -- "$p" 2>/dev/null)
+  fi
+  hits=$(printf '%s\n' "$diff" | perl -CSAD -ne '
+    BEGIN { our $line = 0; }
+    if (/^\+\+\+/) { next; }
+    if (/^@@.*?\+(\d+)/) { $line = $1 - 1; next; }
+    if (/^\+/) {
+      $line++;
+      my $content = substr($_, 1);
+      if ($content =~ /([^\x00-\x7F])/) {
+        printf "%d: non-ASCII U+%04X (\x27%s\x27)\n", $line, ord($1), $1;
+      }
+    }
+  ')
+  if [ -n "$hits" ]; then
+    while IFS= read -r hit; do
+      findings="$findings$p:$hit
+"
+    done <<< "$hits"
+  fi
+done
+
+if [ -n "$findings" ]; then
+  printf 'fail: non-ASCII characters in added source lines\n'
+  printf '  %s' "$findings"
+  exit 1
+fi
+echo pass
+exit 0