The hook the repo shipped waits for a signature

You clone a contractor's repo into the agent's container. It carries a hooks file: a command that runs after every write. Somewhere else, that command would already be running.

Here GET /api/v1/agent/hooks lists it and reports trust: {"pending": true}. The on-disk definition is visible; the pending change waits. You read the command. If you want to see what it does, POST /api/v1/agent/hooks/test fires it once, in your session, on purpose. If it is fine, POST /api/v1/agent/hooks/trust/ack records the acknowledgement with a timestamp, and the hooks are cleared to run.

Every write to the hook set: upsert, delete, toggle, disable-all: needs a single-use nonce from begin-write, bound to that session, that operation, and that scope. A nonce minted for toggle is not accepted by delete. A new hook without a name and a description is rejected outright.