Two seams every adopting repository needs and only one has: hook declaration identity, and a probe that drives each hook to a refusal

[HackingGate]

One superproject carries 5,247 lines of Python that answers questions every adopting repository has, and no other repository has any of it. The scripts are generic — nothing in them is specific to the organisation that wrote them — so each one is a seam uphold is missing rather than a local tool.

What exists today, and where

script	lines	question it answers
hook_declaration_identity.py	462	do the hook declarations across a fleet agree with each other
hook_failure_probes.py	742	does each declared hook actually refuse
hook_ci_parity.py	1273	does CI run what local runs
prek_denominator.py	760	what is the untracked denominator the hooks never saw
org_audit.py	2010	cross-repository structure and policy-constant drift

Driven by a policy/hooks.toml that holds waivers.

Proposal

uphold hooks --identity — compare hook declarations across a set of repositories and report where byte-identical entries have forked, where an id is pinned at differing revs, and where a declaration is absent from a repository the set says should have it. Waivers read from policy/hooks.toml.

uphold probe — drive every declared hook to both verdicts: plant a fixture the rule must refuse, confirm the refusal names the rule, then confirm a clean tree is accepted. A hook that cannot fail is the failure mode this catches, and it is not hypothetical: two repositories in that fleet declare a gofmt entry that can never exit nonzero, because gofmt -l prints its findings and exits 0.

Why it belongs here rather than there

The question "does this hook actually refuse" is the same question in every repository, and the answer has to be produced by something that reads uphold's own declaration model. A copy per organisation is the shape this tool exists to argue against — and the fleet audit that produced this issue found the meta-tooling itself shipping the defect it detects in three of six deliverables.

--identity is the more urgent half. It is what makes a forked declaration visible at all, and a fork is invisible to every check uphold has today.