Fix Promotion-PR Review Findings on Pre-Commit Hooks Rollout

AUDIT.md

@@ -87,7 +87,7 @@ A check with `intentRef`/`workflowRef` points at the prose section that owns the
 - **carried-scope** - the repo carries no file the hub hosts rather than carries. The set is derived, not listed: the hub's git-tracked paths minus the [`spec/files.json`][files] baseline, so a file dropped from the manifest starts being reported on the next run with no retirement list to remember to edit. The remedy is the opposite of every other file finding, a **deletion**, since the repo reaches the hub's copy per [GOVERNANCE.md "Hub-Hosted Tooling"][governance-hub-hosted-tooling]. The match is on path alone, so a hit is a candidate and not a verdict: a repo's own content at a path the hub also uses matches while carrying nothing of the hub's, which the first fleet run showed twice, a KiCad tooling doc at `scripts/README.md` and per-repo formatting hooks at `.husky/pre-commit`. A [`spec/divergences.json`][divergences] `gaps` disposition decides which case a hit is, so only `retire` asserts a deletion, `accepted` closes a collision or a repo-owned file, and an untriaged hit is read before it is acted on.
 - **verbatim-tree** - every applicable `trees[]` declaration in [`spec/files.json`][files] owns its target tree. The audit reports missing files as letter findings, stale or modified bytes as drift, and extra files under a pruned target as drift. An unreadable or truncated repository tree is undecided and produces drift rather than a clean result.
 - **repo-setup** - every required secret for the repo's publish mechanisms is configured, and no forbidden secret is present (per [`spec/secrets.json`][secrets]).
-- **linter-parity** - one config per linter (`.markdownlint-cli2.jsonc`, `cspell.json`, ruff/pyright, editorconfig/csharpier, actionlint) drives the editor extension, the CLI, and CI, and CI runs each. A local hook exists and runs at minimum the diff-scoped prose gate and the eol check (`parity.hooks`, intent). A repo with none wired is a defect, and one mid-convergence on the language-formatting half stays operational.
+- **linter-parity** - one config per linter (`.markdownlint-cli2.jsonc`, `cspell.json`, ruff/pyright, editorconfig/csharpier, actionlint) drives the editor extension, the CLI, and CI, and CI runs each. A local hook exists and runs at minimum the diff-scoped prose gate and the eol check via `hub-fetch-run.py`, or the hub's own local script copies for the hub repo itself (`parity.hooks`, intent). A repo with none wired is a defect, and one mid-convergence on the language-formatting half stays operational.
 - **recurring-violations** - comments concise and non-narrative, ASCII only (no em-dash, no smart quotes), US spelling, line endings per `.editorconfig`. These are frequent regressions, so this dimension is high priority and always runs, and each check is grep-able (see below).
 - **readme-structure** - the README follows [`spec/readme-structure.md`][readme-structure] (applicable sections, in order). Mechanically checked against the declared model in [`spec/readme-sections.json`][readme-sections]: required sections present, declared sections in their relative order, `License` last, the shields each deliverable implies, the license shield in the closing License section, and the tagline and its mirrors. A heading the model does not name is dropped before the order comparison, so a repo-specific section is never a finding.
 

catalog/snippets/configs/vscode-tasks-python.json

@@ -127,6 +127,8 @@
         // Lint: Prose and Lint: EOL below add the same two checks in whole-repo mode, for on-demand full-tree validation.
         // Lint: EditorConfig/Workflows/Markdown/Spelling are language-agnostic, identical to the
         // .NET snippet's Lint group.
+        // Lint: Prose and Lint: EOL assume the pre-commit-framework layout (hub-fetch-run.py at the workspace root).
+        // A repo using the Husky.Net snippet instead points these two tasks at .husky/hub-fetch-run.py.
         {
             "label": "Lint: EditorConfig",
             "type": "process",

catalog/snippets/pre-commit/.pre-commit-config.yaml

@@ -1,8 +1,10 @@
 # Reference pre-commit (pre-commit.com) config for a fleet Python repo with no .NET/Husky.Net tree.
 # Copy into the repo root alongside ../hub-fetch-run.py.
 # Adapt the type-check hook to match this repo's own CI checker (pyright or mypy, per python-codestyle).
-# Enable with `uv run pre-commit install`.
-# The type checker and ruff hooks are native/uv-run, no Docker.
+# Install and enable with `uv tool install pre-commit` once, then `pre-commit install`.
+# The type checker and ruff hooks run via uvx, native tooling, no Docker.
+# That needs no project dependency, matching CI's own invocation for the lint-only profile.
+# A repo on the build profile with a uv.lock may swap an entry for `uv run <tool>` to pin its own project version instead.
 # The prose/EOL hooks fetch their scripts fresh from ptr727/ProjectTemplate's `main` branch via hub-fetch-run.py, rather than vendoring or pinning a copy.
 # See that file's docstring for why.
 # A fetch failure fails the commit, and it never silently skips the gate.
@@ -11,17 +13,17 @@ repos:
     hooks:
       - id: ruff-format
         name: ruff format --check
-        entry: uv run ruff format --check
+        entry: uvx ruff@latest format --check
         language: system
         pass_filenames: false
       - id: ruff-check
         name: ruff check
-        entry: uv run ruff check
+        entry: uvx ruff@latest check
         language: system
         pass_filenames: false
       - id: type-check
-        name: pyright (swap for "uv run mypy" if this repo's CI runs mypy instead)
-        entry: uv run pyright
+        name: pyright (swap for "uvx mypy@latest" if this repo's CI runs mypy instead)
+        entry: uvx pyright@latest
         language: system
         pass_filenames: false
       - id: prose-gate

catalog/snippets/pre-commit/README.md

@@ -3,19 +3,26 @@
 `.pre-commit-config.yaml` is the reference config for the Python `pre-commit` framework
 (pre-commit.com), for a Python repo with no `.husky/` tree of its own. It runs `ruff format
 --check`, `ruff check`, and this repo's declared type checker (`pyright` or `mypy`, match
-whichever `python-codestyle` says this repo's CI runs) via `uv run`, native tooling, no
-Docker, plus the same two shared doc gates the Husky.Net snippet carries: the diff-scoped
-prose/comment-style gate and the whole-tree line-ending check.
+whichever `python-codestyle` says this repo's CI runs) via `uvx`, native tooling, no Docker,
+plus the same two shared doc gates the Husky.Net snippet carries: the diff-scoped
+prose/comment-style gate and the whole-tree line-ending check. `uvx` runs each tool from its
+own latest release with no project dependency required, matching CI's own invocation for the
+lint-only profile (`CODESTYLE.md` "Two profiles"). A repo on the build profile with a
+`uv.lock` may swap in `uv run <tool>` per entry to pin the project's own version instead.
 
 Copy `../hub-fetch-run.py` alongside `.pre-commit-config.yaml` (repo root) for the doc gates
 to run: it fetches those two checks fresh from `ptr727/ProjectTemplate`'s `main` branch and
 runs them, rather than vendoring or pinning a copy. A pin nothing keeps current goes stale by
 construction, and CI (this repo's own, and the hub's) is the backstop for a change that lands
-broken on `main` before it does real damage locally. This is one more network fetch alongside
-the Docker pulls the VS Code Lint tasks already do. A fetch failure fails the commit rather
-than silently skipping the gate.
+broken on `main` before it does real damage locally. These are two more network fetches
+alongside the Docker pulls the VS Code Lint tasks already do. A fetch failure fails the
+commit rather than silently skipping the gate.
 
-Enable the hook with `uv run pre-commit install`. Full linting (workflow YAML, Markdown,
+Install and enable with `uv tool install pre-commit` once, then `pre-commit install`.
+`pre-commit` itself is never added as a project dependency: the lint-only profile has no
+project environment to add it to, and `uv tool install` gives a persistent, PATH-available
+command independent of any project, the same footing `uvx` gives the tools the hooks run.
+Full linting (workflow YAML, Markdown,
 spelling, EditorConfig) stays out of the hook: it runs in CI as pinned action wrappers, and on
 demand via the VS Code **Lint** tasks in `catalog/snippets/configs/vscode-tasks-python.json`
 (Docker at `:latest`), which also carries the same prose/EOL gates in whole-repo mode for

spec/project-types.json

@@ -168,7 +168,7 @@
                 { "id": "parity.markdownlint", "verdict": "letter", "assert": "One .markdownlint-cli2.jsonc drives the VS Code extension, the CLI, and CI, and CI runs it.", "intentRef": "GOVERNANCE.md#running-the-linters-locally-known-working-invocations" },
                 { "id": "parity.cspell", "verdict": "letter", "assert": "A cspell.json (not only a workspace word list) drives the extension, the CLI, and CI.", "intentRef": "CODESTYLE.md" },
                 { "id": "parity.lang", "verdict": "intent", "assert": "ruff/pyright (Python) and editorconfig/csharpier (C#) configs are shared by editor, CLI, and CI where those languages are present.", "intentRef": "CODESTYLE.md" },
-                { "id": "parity.hooks", "verdict": "intent", "assert": "A local hook config file exists in the repo's tracked tree (.husky/pre-commit or .pre-commit-config.yaml), and its content, read directly rather than inferred from per-clone core.hooksPath or pre-commit install state neither of which the audit can observe, invokes at minimum the diff-scoped prose gate and the eol check via hub-fetch-run.py. The language-formatting half (ruff/pyright or mypy, CSharpier/dotnet format) is added once the repo's own corpus passes it clean, a repo mid-convergence rather than a repo out of conformance.", "intentRef": "GOVERNANCE.md#running-the-linters-locally-known-working-invocations" }
+                { "id": "parity.hooks", "verdict": "intent", "assert": "A local hook config file exists in the repo's tracked tree (.husky/pre-commit or .pre-commit-config.yaml), and its content, read directly rather than inferred from per-clone core.hooksPath or pre-commit install state neither of which the audit can observe, invokes at minimum the diff-scoped prose gate and the eol check via hub-fetch-run.py. The hub repo itself is the one exception, calling its own scripts/prose_lint.py and scripts/repo_gate.py directly, since it has no separate hub to fetch from. The language-formatting half (ruff/pyright or mypy, CSharpier/dotnet format) is added once the repo's own corpus passes it clean, a repo mid-convergence rather than a repo out of conformance.", "intentRef": "GOVERNANCE.md#running-the-linters-locally-known-working-invocations" }
             ]
         },
         "recurring-violations": {