ahoy install --outbound-hook leaves git config --local abcd.binary for each person to set by hand in each clone, so the commit-message check warns and lets every commit through until someone does, although the recorded remedy of iss-2609250834251447 said ahoy install would write it to the owned PATH copy, the abcd.guardPath precedent. The product thinker ruled on 2026-10-15 that the installer writes abcd.binary itself, to the absolute path of the provenance-verified abcd copy ahoy installs.

ahoy install --outbound-hook leaves git config --local abcd.binary for each person to set by hand in each clone, so the commit-message check warns and lets every commit through until someone does, although the recorded remedy of iss-2609250834251447 said ahoy install would write it to the owned PATH copy, the abcd.guardPath precedent. The product thinker ruled on 2026-10-15 that the installer writes abcd.binary itself, to the absolute path of the provenance-verified abcd copy ahoy installs.

The hooks decision, made in the fix round of 2026-10-15: the product thinker ruled that the commit-message check runs with no manual step, within the rule that abcd changes nothing about how a repository works beyond what the person opted into. On the explicit --outbound alone, where no core.hooksPath is set at any scope and the common git directory's hooks/commit-msg does not exist (resolved with git rev-parse --git-common-dir, so every worktree shares it), install writes abcd's embedded commit-msg template there, marked as abcd's. It finds abcd through abcd.binary as the committed copy does, and never runs or calls the committed .githooks copy, so no repository-authored code runs through it. It never replaces an existing hook, never sets core.hooksPath and never touches global config: where a hooks path is set (the empty value included), or a commit-msg hook abcd did not write is there, it leaves that hook alone, saves the same template as hooks/abcd-commit-msg in the common git directory, a name git never runs, and one note says the check is not wired, why, and the line that calls that copy from the person's own hook, so the chained check fails open as the template does and blocks only on abcd's own refusal. A rerun leaves a current copy as it is, refreshes one only when it is byte for byte a template an earlier abcd wrote, and leaves an edited one, saying so. The binary abcd.binary names is not re-verified at commit time; a swap of the PATH copy by the same account is out of scope.