Nick
9591e8a0eb
Every mutating tool call (subagent or main session) is scope-checked against the active construction contract through the installed hook: in-scope edits allowed, out-of-scope blocked naming the contract; the durable lock fails closed across fresh processes (ACTIVE/UNREADABLE both stop, ABSENT allows ordinary work); shell escapes (clobber/tee/ --output/touch) caught; supervisory acts refused; violations recorded and self-clear on remediation. 67/67 drills + authority tests green; hook installed hash-verified; activation front door ported (the one design decision per the map) with the introduce-verb fix for rune's Rust-core delegation. closes #2499
73 lines
2.4 KiB
Python
Executable File
73 lines
2.4 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""install_mimo_hook.py — T21.2 §21.2D (T22: multi-hook): canonical MiMo
|
|
hook installer.
|
|
|
|
Canonical sources: config/mimo-hooks/*.ts
|
|
Targets: ~/.mimocode/hooks/<same-name>.ts
|
|
|
|
Every hook is hash-verified after install; drift is detected in both
|
|
directions. T22 added builder-bridge.ts to the managed set — it was
|
|
previously installed by hand, unversioned, which is how it silently rotted
|
|
(hardcoded ephemeral interpreter). A hook that reaches the builder must be
|
|
version-controlled and drift-checked like any other authority.
|
|
|
|
Usage:
|
|
python3 scripts/install_mimo_hook.py # sync all managed hooks
|
|
python3 scripts/install_mimo_hook.py --check # verify only, install nothing
|
|
"""
|
|
import hashlib
|
|
import shutil
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
REPO = Path(__file__).resolve().parent.parent
|
|
CANONICAL_DIR = REPO / "config" / "mimo-hooks"
|
|
TARGET_DIR = Path.home() / ".mimocode" / "hooks"
|
|
|
|
# The managed set. Adding a file here is what makes a hook version-controlled.
|
|
MANAGED = ["event-wait-guard.ts", "builder-bridge.ts", "scaffolding-guard.ts"]
|
|
|
|
|
|
def sha256(p: Path) -> str:
|
|
return hashlib.sha256(p.read_bytes()).hexdigest()
|
|
|
|
|
|
def sync_one(name: str, check_only: bool) -> bool:
|
|
canonical = CANONICAL_DIR / name
|
|
target = TARGET_DIR / name
|
|
if not canonical.is_file():
|
|
print(f"canonical source missing: {canonical}")
|
|
return False
|
|
canon_hash = sha256(canonical)
|
|
if target.is_file() and sha256(target) == canon_hash:
|
|
print(f"in-sync: {name} {canon_hash[:12]}")
|
|
return True
|
|
if check_only:
|
|
state = "DRIFT" if target.is_file() else "MISSING"
|
|
inst = sha256(target)[:12] if target.is_file() else "-"
|
|
print(f"{state}: {name} canonical={canon_hash[:12]} installed={inst}")
|
|
return False
|
|
if target.is_file():
|
|
print(f"DRIFT: {name} canonical={canon_hash[:12]} installed={sha256(target)[:12]}")
|
|
else:
|
|
print(f"hook missing at {target}")
|
|
TARGET_DIR.mkdir(parents=True, exist_ok=True)
|
|
shutil.copy2(canonical, target)
|
|
if sha256(target) != canon_hash:
|
|
print(f"INSTALL FAILED: {name} hash mismatch after copy")
|
|
return False
|
|
print(f"installed: {name} {canon_hash[:12]}")
|
|
return True
|
|
|
|
|
|
def main() -> int:
|
|
check_only = "--check" in sys.argv
|
|
ok = True
|
|
for name in MANAGED:
|
|
ok = sync_one(name, check_only) and ok
|
|
return 0 if ok else 1
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|