- Claude Code runs these hooks in every session of the user's (hooks.json), so all but install_notice.py (a banner once per version) act only in a project the user registered with `agent.py register`: trust comes from the user's registry, never the repository (session_start.py, §7.7). - They fail open: an error of any kind prints nothing and exits 0, so a guardrail never costs the owner a session, a prompt or an edit. - Only ask_guard.py makes a permission decision: it denies AskUserQuestion to a session that is not the steward (0.8.3). ruling_lookup.py prints `additionalContext` only, because "allow" would skip the owner's own prompt (1.52 R2). - Standard library only. ask_guard.py and name_session.py import only session_start.py beside them; ruling_lookup.py imports `overture.lookup` from this plugin's own `../kit`, never the registry's kit or the project's. - session_start.py re-implements the registry and doorbell reads from the kit; test_kit holds both copies to one fixture. - What a hook prints enters the session's context, so every field shown is held to a shape (a seq an int, a path plain characters), else `?`. - Each hook has a short timeout in hooks.json (5 to 10 s); the ruling lookup keeps its own 1.5 s deadline for the server.