fix(setup): teach the verify skill's whole-user check about the dispatcher hook flavour - #1358
Merged
Merged
Conversation
…tcher hook flavour Check 8 compared ~/.claude/git-hooks/post-checkout against git-global-post-checkout.sh only. A dispatcher-flavour install symlinks post-checkout to git-hook-dispatcher.sh, so it failed the comparison even when every file matched the framework, and the run then reported per-repo .git/hooks/* as inert although the dispatcher chains to them. apache#1322 fixed the same blind spot in the update skill. Generated-by: Claude Opus 5
potiuk
added
family:setup
potiuk
added a commit
that referenced
this pull request
Sep 24, 2026
Reconciles the spec-loop specs with the functionality that shipped between 5c75abd and bcd8b7f: - agent-isolation-sandbox: the hardware-key touch policy (sig cached + aut off with OpenPGP signing, aut cached with gpg.format=ssh) (#1367); touch-watcher owner is the harness (#1365); macOS overlay closes on deactivation (#1325); whole-user git hooks allowRead and dispatcher flavour (#1364, #1322, #1358); agent-guard finds the git subcommand past global flags (#1330); agent-guard plugin counts as a complete install (#1323); per-tool cooldown_days, bubblewrap 0.13.0 (#1360). - sandbox-diagnostics: ten catalogue entries (prek/uv not found, git hooks silently skipped) (#1359, #1364); doctor probes as scripts, with probes 7 and 8 (#1336, #1362, #1364); verify's 12 checks and conditional-checks.md (#1334). - vetted-command-surface: HTTP read backend with the OSV and CVE.org operations (#1326); the vetted-op-read recipe spelling (#1339); the plugin copy resolves standalone (#1357). - cve-tooling: tools/osv (contract:security-cross-ref) and the cve-org check through vetted-ops (#1297, #1326). - security-issue-lifecycle: step 2b proposes going ahead on a quiet reporter (#1340); the post-advisory security-pages update (#1355). - meta-and-quality-tooling: name: must match the skill directory (#1361); skill-evals fixture containment and grader retry (#1315, #1341); optimize-skill budgets, eval gate, rewrite and extract-code passes (#1331, #1332, #1335, #1338); diff-scoped prek CI (#1317). - marketplace-distribution: substrate plugins (#1368, #1357). - adversarial-review (new): the tool and substrate plugin as shipped (#1368), with its known gaps. Generated-by: Claude Opus 5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
setup-isolated-setup-verifycheck 8 (whole-user scope,conditional-checks.md) only knew the simple flavour. It compared~/.claude/git-hooks/post-checkoutagainsttools/agent-isolation/git-global-post-checkout.sh.In the dispatcher flavour (install Step P.3b-whole-user),
post-checkoutand every other hook name is a symlink togit-hook-dispatcher.sh. That install fails the comparison even when every file matches the framework byte for byte.The check's "loud reminder" also told dispatcher users that per-repo
.git/hooks/*are inert. The dispatcher exists to chain to those hooks, so the note was wrong.Hit on a real dispatcher-flavour install.
git-hook-dispatcher.shmatched the framework copy, but the literalpost-checkoutcomparison reported drift.#1322 fixed the same blind spot in
setup-isolated-setup-update. This PR bringsverifyin line and uses #1322's wording:~/.claude/git-hooks/, resolvepost-checkout, and compare the script it lands on against its own framework source. Treat hook-name symlinks as the installed shape, not as drift.SKILL.mdto match, and regeneratedocs/mode-economics.md(skill-token-count --write).Type of change
Test plan
prek run --fileson the three changed files passes, includingskill-token-count --checkpost-checkout→git-hook-dispatcher.sh, which matchestools/agent-isolation/git-hook-dispatcher.sh. Under the new text this is ✓ and the reminder says per-repo hooks still fire.🤖 Generated with Claude Code