Module commit_hooks 

Commit-time trailer injection (prepare-commit-msg hook + data files). Commit-time trailer injection — the machinery that makes a plain git commit produce a verifiable commit with zero new verbs.

The gpg.ssh.program shim (auths-sign) can only return signature bytes; it cannot edit the commit message. The Auths-Id / Auths-Device trailers that KEL-native verification replays therefore go in at commit time via a prepare-commit-msg hook installed under <auths_home>/githooks and wired through the global core.hooksPath. The hook is deliberately dumb — it reads two static files written at init (no auths process spawn per commit):

• <auths_home>/commit-trailers — the literal trailer lines to inject
• <auths_home>/root-pin — the .auths/roots content to seed into a repo on first signed commit (the committed trust declaration teammates and CI inherit)

The hook chains to the repo’s own $GIT_DIR/hooks/prepare-commit-msg when one exists. Repos that set a local core.hooksPath (husky-style managers) bypass the global path entirely; auths doctor detects that and the missing-trailer verify error explains the remedy.

Auths-Anchor-Seq is intentionally NOT in the static trailer file: it is the root-KEL tip position at signing time, which changes as the KEL grows. The explicit auths sign <ref> repair path still embeds it.

Enums

CommitHookError

Failure installing the commit hook or writing its data files.

Constants

HOOKS_DIR

Directory under auths_home that core.hooksPath points at.

PREPARE_COMMIT_MSG_HOOK

The managed prepare-commit-msg hook. Version-stamped so auths doctor can detect a stale install; bump the version when editing.

ROOT_PIN_FILE

File under auths_home holding the .auths/roots seed content.

TRAILERS_FILE

File under auths_home holding the trailer lines the hook injects.

Functions

enable_commit_trailers

Full commit-trailer wiring: install the hook + data files and point core.hooksPath at the managed hooks directory.

hook_is_current

Whether the managed hook file exists with the current script content.

hook_path

Path of the managed hook file under auths_home.

install_commit_hooks

Install the prepare-commit-msg hook under <auths_home>/githooks and write the trailer + root-pin data files it reads.

refresh_commit_trailers

Rewrite the trailer data file from the locally-resolved signer, including the current root-KEL position as Auths-Anchor-Seq.