Pin generated hook executable provenance

DEVELOPER_GUIDE.md

@@ -101,7 +101,7 @@ dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll search --recipe filesystem-mut
 | Upgrade installer script and temp directory | Upgrade downloads use owner-only `cdidx-install-*` directories under `Path.GetTempPath()`. Recursive directory cleanup validates the temp root, required prefix, and symlink/reparse/device status before deletion. Install-directory write probes run only after install-directory validation rejects roots, symlinks/reparse points, and unsafe POSIX modes. | Installer script and temp-directory cleanup failures are warnings. The install operation reports its own result separately from secondary cleanup failures. |
 | `.cdidx` write probes and case-sensitivity probes | Write probes are freshly generated files under the already resolved install directory, `.cdidx` directory, or `.cdidx/probes` directory. Probe directories are created owner-only and are under the workspace data directory. | Probe files are deleted after the check. Case-sensitivity probe-directory cleanup revalidates the workspace data/probe root, expected directory name, and symlink/reparse/device status before deleting created empty probe directories; rejected cleanup records bounded diagnostics and suggests removing stale `.cdidx/probes` entries when no `cdidx` process is running. |
 | Legacy scan checkpoints | Full scans neither create nor consume `.cdidx/scan-checkpoint.json`. After the first immutable scan-input barrier, successful and partial runs delete any legacy file without parsing it. | Delete failures are warnings in human output and `CliJsonMessage` entries in JSON output; indexing continues without relying on stale HEAD-only state. |
-| Git hook staging | Hook installation first classifies the operation as create, managed replacement, custom-hook chain, or exact no-op. `hooks install --dry-run` returns that plan and the managed script before directory creation or staging, while a real mutation writes a private staged hook script inside the repository hook directory and then replaces the hook file through `File.Replace` with a backup path when needed. | Exact executable UTF-8/no-BOM managed-hook reruns return `already_installed` without rewriting. Other encodings and non-executable managed hooks are replaced so Git can execute them. If a staged script was not moved into place, cleanup is best-effort and recorded as hook warnings. Failure to delete a managed hook is a command error because that is the requested mutation. |
+| Git hook staging | Hook installation first resolves the current invocation to an absolute, runnable executable path; a `dotnet` launcher remains classified as a host before its symlink leaf resolves, the host also pins the absolute `cdidx.dll`, other symlinked executable leaves resolve to their final target, and every argv/path is POSIX-shell quoted. The managed block stores a bounded versioned provenance manifest and visible source/version comments, and the complete generated script must fit the same 64 KiB management-read bound before any preview or write. Installation then classifies create, managed replacement, custom-hook chain, or exact no-op. `hooks install --dry-run` returns that plan, managed script, and executable diagnostics before directory creation or staging, while a real mutation writes a private staged hook script inside the repository hook directory and then replaces the hook file through `File.Replace` with a backup path when needed. | Exact executable UTF-8/no-BOM managed-hook reruns return `already_installed` without rewriting. Other encodings and non-executable managed hooks are replaced so Git can execute them. `hooks status` parses but never executes the stored invocation; it first verifies source/argv cardinality and that the managed block matches the manifest, then checks path availability and effective POSIX execute access, obtains the current version only from the matching running invocation or a bounded adjacent `version.json`, and reports malformed, tampered, missing, unverifiable, or skewed provenance with support-safe diagnostic argv. If a staged script was not moved into place, cleanup is best-effort and recorded as hook warnings. Failure to delete a managed hook is a command error because that is the requested mutation. |
 | Index and MCP lock metadata sidecars | Lock files and `.info` sidecars live next to the resolved DB or MCP index lock path and are created with owner-only permissions. | Disposing a lock deletes only the metadata sidecar. Cleanup failures are logged through `GlobalToolLog` and optional test sinks; stale lock files rely on OS lock release rather than recursive cleanup. |
 | Search audit recipes | `SearchAuditRecipes` contains literal recipe strings such as `Directory.Delete` and `File.Move`; these are search metadata, not filesystem mutations. | No cleanup policy applies. |
 
@@ -3473,7 +3473,7 @@ dotnet ./src/CodeIndex/bin/Debug/net8.0/cdidx.dll search File.Move --path src/ -
 | upgrade installer script と temp directory | upgrade download は `Path.GetTempPath()` 配下の owner-only `cdidx-install-*` directory を使います。recursive directory cleanup は削除前に temp root、required prefix、symlink / reparse / device 状態を検証します。install-directory write probe は、root、symlink / reparse point、unsafe POSIX mode を拒否する install-directory validation の後だけ実行します。 | installer script と temp-directory cleanup の失敗は warning です。install operation の結果は、二次的な cleanup failure とは分けて報告します。 |
 | `.cdidx` write probe と case-sensitivity probe | write probe は、解決済み install directory、`.cdidx` directory、または `.cdidx/probes` directory 配下に fresh file として生成します。probe directory は owner-only で作成され、workspace data directory 配下にあります。 | probe file は確認後に削除します。case-sensitivity probe directory の cleanup は、作成済みの空 probe directory を削除する前に workspace data / probe root、期待する directory name、symlink / reparse / device 状態を再検証します。拒否した cleanup は bounded diagnostic を記録し、`cdidx` process が動いていないときに stale `.cdidx/probes` entry を削除するよう案内します。 |
 | legacy scan checkpoint | full scan は `.cdidx/scan-checkpoint.json` を作成も参照もせず、最初の immutable scan-input barrier 後に success / partial のどちらでも旧fileをparseせず削除します。 | delete failure は human output では warning、JSON output では `CliJsonMessage` entry です。indexing は古いHEAD-only stateに依存せず継続します。 |
-| Git hook staging | hook installation は操作を create、managed replacement、custom-hook chain、exact no-op のいずれかに分類します。`hooks install --dry-run` は directory 作成や staging より前にその plan と managed script を返し、実際に変更する場合は repository hook directory 内に private staged hook script を書き込み、必要に応じて backup path 付きの `File.Replace` で hook file を置き換えます。 | 同一かつ実行可能な UTF-8/no-BOM の managed hook に対する再実行は書き換えず `already_installed` を返します。それ以外の encoding や実行不可の managed hook は Git が実行できるよう置き換えます。staged script が配置されなかった場合の cleanup は best-effort で、hook warning として記録します。managed hook の削除失敗は requested mutation の失敗なので command error です。 |
+| Git hook staging | hook installation はまず current invocation を絶対かつ実行可能な executable path に解決します。`dotnet` launcher は symlink の leaf を解決する前の host 分類を維持し、host の場合は絶対 `cdidx.dll` も固定します。その他の symlink executable leaf は最終 target に解決し、すべての argv / path を POSIX shell 向けに quote します。managed block は上限付きの versioned provenance manifest と目視可能な source / version comment を保持し、生成 script 全体が preview または書き込み前に同じ 64 KiB の management-read 上限内であることを要求します。その後、操作を create、managed replacement、custom-hook chain、exact no-op のいずれかに分類します。`hooks install --dry-run` は directory 作成や staging より前に plan、managed script、executable diagnostics を返し、実際に変更する場合は repository hook directory 内に private staged hook scriptを書き込み、必要に応じて backup path 付きの `File.Replace` で hook file を置き換えます。 | 同一かつ実行可能な UTF-8/no-BOM の managed hook に対する再実行は書き換えず `already_installed` を返します。それ以外の encoding や実行不可の managed hook は Git が実行できるよう置き換えます。`hooks status` は保存済み invocation を parse しますが実行せず、まず source / argv の個数整合性と managed block / manifest の一致を確認してから path availability と POSIX の実効 execute access を検証します。current version は同じ実行中 invocation または上限付きの隣接 `version.json` からだけ取得し、不正形式、tamper、missing、検証不能、version skew を support-safe な diagnostic argv とともに報告します。staged script が配置されなかった場合の cleanup は best-effort で、hook warning として記録します。managed hook の削除失敗は requested mutation の失敗なので command error です。 |
 | index / MCP lock metadata sidecar | lock file と `.info` sidecar は、解決済み DB または MCP index lock path の隣に置き、owner-only permission で作成します。 | lock dispose は metadata sidecar だけを削除します。cleanup failure は `GlobalToolLog` と任意の test sink に記録します。stale lock file は recursive cleanup ではなく OS の lock release に依存して復旧します。 |
 | search audit recipe | `SearchAuditRecipes` には `Directory.Delete` や `File.Move` のような literal recipe string が含まれます。これは search metadata であり filesystem mutation ではありません。 | cleanup policy は適用されません。 |