CLAUDE.md@plugin/hooks git:20261020.42410f0A

Immutable. This exact content never changes and is served at /api/v1/blob/3d796ff81a3ba4d8.

<!-- area: plugin/hooks · checked: 6f19656 -->
- Claude Code runs these hooks in every session of the user's (hooks.json), so all but install_notice.py (a banner once per version) act only in a project the user registered with `agent.py register`: trust comes from the user's registry, never the repository (session_start.py, §7.7).
- They fail open: an error of any kind prints nothing and exits 0, so a guardrail never costs the owner a session, a prompt or an edit.
- Only ask_guard.py makes a permission decision: it denies AskUserQuestion to a session that is not the steward (0.8.3). ruling_lookup.py prints `additionalContext` only, because "allow" would skip the owner's own prompt (1.52 R2).
- They load on native Windows Python, which lacks fcntl and O_NONBLOCK/O_NOFOLLOW/O_CLOEXEC: session_start.py takes each as optional and refuses a symlink by lstat, naming a session there is refused by name, and ruling_lookup.py stands down when the kit will not import there (on POSIX that still raises). POSIX flags are unchanged (1.53.1, test_kit WindowsHookTests).
- Standard library only. ask_guard.py and name_session.py import only session_start.py beside them; ruling_lookup.py imports `overture.lookup` from this plugin's own `../kit`, never the registry's kit or the project's.
- session_start.py re-implements the registry and doorbell reads from the kit; test_kit holds both copies to one fixture.
- What a hook prints enters the session's context, so every field shown is held to a shape (a seq an int, a path plain characters), else `?`.
- Each hook has a short timeout in hooks.json (5 to 10 s); the ruling lookup keeps its own 1.5 s deadline for the server.