CI: add a repo-wide gate rejecting exec-form hooks whose `command` is a bare non-portable executable name

[kyle-sexton]

This defect class has now shipped three times in disk-hygiene alone, and each fix was verified by a test that encoded the defect as its contract.

The class

An exec-form hook (args present) resolves command as a bare PATH lookup. Per the hooks reference: "On Windows, exec form requires command to resolve to a real executable such as a .exe." Two Windows spellings fail:

• "command": "bash" — resolves to the WSL relay System32\bash.exe before Git Bash; dies with execvpe(/bin/bash) failed.
• "command": "python3" — commonly the zero-length WindowsApps\python3.exe App Execution Alias stub.

A failed hook launch is non-blocking, so a PreToolUse gate built this way silently enforces nothing.

History

• fix(repo-hygiene): destructive-guard fail-open on Windows — shell-form hook launch + jq fail-closed degraded mode #1006 fixed it for the skill-frontmatter guard (shell form).
• fix(disk-hygiene): guard-launch detector shares the guard's interpreter, so it is blind to the interpreter fail-open #1504 fixed Python resolution for the wired hooks but reintroduced the launch failure by registering the launcher as "command": "bash" + args; disk-hygiene: the destructive-operation guard has never launched — 73 recorded runs, all hook_non_blocking_error #1416 closed COMPLETED while the guard stayed dead.
• disk-hygiene: skill-scoped guard hook still launches via bare python3 in exec form (latent Windows fail-open) #2568 tracks the remaining python3 instance.

plugins/claude-config/skills/audit/reference/audit-checklist.md Category D already carries this as an error row — and disk-hygiene violated it anyway, because a checklist a human reads is not a gate.

Proposal

Add scripts/check-hook-exec-form.sh plus a self-test, modelled directly on the existing scripts/check-hook-userconfig-argv.sh gate (same scope rules: default hooks/hooks.json, manifest-pointed hook configs, inline manifest hooks objects — and it should additionally cover SKILL.md / agent frontmatter hooks, which the userconfig gate does not). Fail on any exec-form hook whose command contains no path separator and is not on a small allowlist of names that are real executables on every targeted platform (node, python via an absolute path, etc.), with a documented escape-hatch allowlist file that can only shrink.

Wire it as its own CI job with the self-test-first, fail-closed pattern the userconfig-argv gate uses.

Related

• disk-hygiene: the destructive-operation guard has never launched — 73 recorded runs, all hook_non_blocking_error #1416 — the wired-hook instance
• disk-hygiene: skill-scoped guard hook still launches via bare python3 in exec form (latent Windows fail-open) #2568 — the skill-hook instance
• fix(repo-hygiene): destructive-guard fail-open on Windows — shell-form hook launch + jq fail-closed degraded mode #1006 — the original fix for this class