Hook Decision Contract Enforcer

Workflow

1. Read the hook script and identify its output path: find every echo, printf, or jq call that writes to stdout and determine if it produces valid JSON.
2. Validate the existing envelope: run hook_output | jq 'has("action") and has("reason")' — any false result is a contract gap.
3. Add envelope normalization: wrap the hook's decision logic in a function that always writes the canonical envelope to stdout, even on unexpected errors (emit action: degraded, exit 3).
4. Map exit codes: ensure the hook's exit calls match the semantic table above; replace raw exit 1 with a named constant or comment.
5. Add observability tags: include at least one policy:* tag and one severity:* tag drawn from ./observability-tags.md.
6. Test all four exit paths: write a test case for allow, warn, block, and degraded; assert that jq .action returns the expected value for each.

References

• Decision Envelope
• Exit-Code Mapping
• Observability Tags