security: verify staged-secret enforcement across 22 workstation checkouts

scripts/install_shared_generated_guard.py

@@ -6,12 +6,17 @@ The repo argument discovers the already-configured hook path; it is not a new
 fleet routing or authority configuration.
 """
 import argparse
+import hashlib
 import os
 from pathlib import Path
 import shlex
 import subprocess
 
 
+# Reviewed composition retains this guard and adds exact-scope secret scanning.
+# CUST-WP-0080 / RMGR-WP-0021; unknown hooks still require owner integration.
+SCANNED_HOOK_SHA256 = "d50cf763dc9814383c6886e30b6650bbbdcb49ddd78889082e3fda3626a2cbfd"
+
 CHECKER = Path(__file__).with_name("check_generated_only_commit.py").resolve()
 
 
@@ -30,7 +35,8 @@ def install(repo, execute=False):
     if target.is_symlink():
         raise ValueError("refuse redirected existing pre-commit hook")
     if target.exists():
-        if target.read_text() != content:
+        if (target.read_text() != content
+                and hashlib.sha256(target.read_bytes()).hexdigest() != SCANNED_HOOK_SHA256):
             raise ValueError("existing pre-commit hook differs; owner integration required")
         return {"repo": str(repo), "hook": str(target), "status": "installed", "changed": False}
     if execute: