Development record

The identity package comment says the installed pre-commit hook calls Check to fail closed before a mis-attributed commit can land (internal/core/identity/identity.go:5-9), but no hook calls identity.Check: its only callers are ahoy's detection and the CLI's ahoy --identity, this repository's .githooks/pre-commit carries a self-contained shell twin, and the pre-commit ahoy scaffolds into a managed repository (internal/core/ahoy/defaults/pre-commit) has no identity gate at all, so a managed repository has no commit-time identity check.