Install the source repo's hooks, and still leave its config alone #1391

Merged

coilyco-ops merged 2 commits from aos/claude/ee98-dogfood into main

2026-08-29 08:59:06 +00:00

coilyco-ops commented

2026-08-29 08:47:36 +00:00

Owner

Closes #1192.

One return doing two jobs

The agentic-os branch of apply_to_repo skipped the whole repository:

do not write the managed block here - correct. The source repo dogfoods through repo: local, so an upstream-ref block would duplicate every hook id. This is also what #1199 is about, and it is untouched.
do not install git hooks here - not correct, and it rode along on the same return for free.

So the repository that authors pr-guard was the one repository not running it. #1385 gave every consumer a pre-push hook and left the author uncovered.

Verified against the real checkout

A fixture would not have caught the thing I actually wanted to know, so I tested the live repo:

hooks before: commit-msg pre-commit prepare-commit-msg
hooks after:  commit-msg pre-commit pre-push prepare-commit-msg
config sha256: identical before and after

Two tests, one per half. A change that installed hooks by also writing the managed block would pass a test that only checked the hooks, so the config-untouched assertion is the one carrying the protection.

Why it was worth separating rather than just installing by hand

I installed agentic-os's hooks manually earlier tonight while closing #1382, which made the gap true on my machine and false in the code. That is the worse of the two states: a fresh clone of agentic-os, or any other checkout of it, was back to no pre-push with nothing saying so. This makes it a property of the rollout instead of a property of my afternoon.

Not in scope

#1199, the general problem that this repo hand-maintains the config it generates for everyone else and nothing asserts they agree. That needs an assertion comparing the third-party hook revs and args between the generated block and this repo's own config, and it is a different change.

Closes `#1192`. ## One return doing two jobs The `agentic-os` branch of `apply_to_repo` skipped the whole repository: * **do not write the managed block here** - correct. The source repo dogfoods through `repo: local`, so an upstream-ref block would duplicate every hook id. This is also what `#1199` is about, and it is untouched. * **do not install git hooks here** - not correct, and it rode along on the same `return` for free. So the repository that authors `pr-guard` was the one repository not running it. `#1385` gave every consumer a pre-push hook and left the author uncovered. ## Verified against the real checkout A fixture would not have caught the thing I actually wanted to know, so I tested the live repo: ``` hooks before: commit-msg pre-commit prepare-commit-msg hooks after: commit-msg pre-commit pre-push prepare-commit-msg config sha256: identical before and after ``` Two tests, one per half. A change that installed hooks by also writing the managed block would pass a test that only checked the hooks, so the config-untouched assertion is the one carrying the protection. ## Why it was worth separating rather than just installing by hand I installed agentic-os's hooks manually earlier tonight while closing `#1382`, which made the gap true on my machine and false in the code. That is the worse of the two states: a fresh clone of agentic-os, or any other checkout of it, was back to no pre-push with nothing saying so. This makes it a property of the rollout instead of a property of my afternoon. ## Not in scope `#1199`, the general problem that this repo hand-maintains the config it generates for everyone else and nothing asserts they agree. That needs an assertion comparing the third-party hook revs and args between the generated block and this repo's own config, and it is a different change.

coilyco-ops added 1 commit

2026-08-29 08:47:36 +00:00

fix(hooks): install the source repo's hooks, and still leave its config alone

ci / aos-cli-tests (pull_request) Successful in 27s

Details

ci / gate (pull_request) Successful in 52s

Details

4dbed587f6

The `agentic-os` skip in apply_to_repo was doing two jobs on one `return`:

* do not write the managed block here. Correct: the source repo dogfoods
  through `repo: local`, so an upstream-ref block would duplicate every hook id.
* do not install git hooks here. Not correct, and it rode along for free.

The result was that the repository authoring pr-guard was the one repository
not running it. #1385 gave every consumer a pre-push hook and left the author
uncovered, which is the failure this milestone exists for wearing the most
embarrassing hat available.

The skip now covers the config and not the install. Verified against the real
checkout rather than a fixture: deleting .git/hooks/pre-push and re-running
restores it, and the config's sha256 is byte-identical before and after.

    hooks before: commit-msg pre-commit prepare-commit-msg
    hooks after:  commit-msg pre-commit pre-push prepare-commit-msg
    config: UNCHANGED

Two tests, one per half, because a change that installed hooks by also writing
the block would pass a test that only checked the hooks.

Refs coilyco-flight-deck/agentic-os#1192

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Agent-Role: platform

coilyco-ops added 1 commit

2026-08-29 08:55:07 +00:00