hub-fetch-run.py Runs the Gate From a Temporary File, So the Fleet's Own Documented Local Route Reports gate unknown on Every Run #1421

catalog/snippets/hub-fetch-run.py writes the script it fetches to a tempfile.NamedTemporaryFile, so the copy runs from a path under no checkout. #1417 made the prose gate resolve its own provenance from the checkout holding the script, and a copy under none resolves to unknown.

The result is that the fleet's own documented downstream local route reports gate unknown on every run, for a copy that is precisely nameable: hub main, fetched seconds earlier by the very script that is about to run it.

Why it is more than cosmetic

GOVERNANCE.md "Running the Linters Locally (Known-Working Invocations)" defines gate unknown as "a copy no commit describes". A downstream developer reading their own hook output therefore concludes the copy is unidentifiable, when the fetching script knew exactly what it fetched and simply did not say.

This is the route GOVERNANCE.md mandates fleet-wide and the one catalog/snippets/pre-commit/.pre-commit-config.yaml runs, so it is the most common way the gate is invoked outside CI, and it is the one invocation whose verdict carries no attribution at all.

The fix

hub-fetch-run.py is the one caller in a position to answer, since it resolves what it fetches. Set PROSE_GATE_PROVENANCE in the environment it hands the fetched script, naming the ref or commit it fetched. #1417 added that variable for exactly this shape, "a caller that invokes the script directly", and no caller sets it yet.

Worth deciding at the same time whether the value should name the resolved commit or the branch it fetched from, since hub-fetch-latest means the answer moves between runs and a branch name alone would not identify the copy. Naming the resolved commit is the point of the mechanism.

Neither GOVERNANCE.md nor scripts/README.md mentions this route in its provenance prose, so whichever way it goes, both need a sentence.

Provenance

Raised by the fourth local review pass on #1417 and carried in that pull request's body as a reviewer item rather than fixed there, since it is a change to a different file than that branch touched. Recorded here rather than left in a merged pull request body. Merged as 0b4657d.

🤖 Generated with Claude Code