feat: implement native hooks runtime

skills/native-hook-authoring/references/contracts.md

@@ -0,0 +1,16 @@
+# Policy contracts
+
+The authoritative declarations are exported by `pi-native-hooks/policy` from `src/policy.ts`. Do not copy them into personal config.
+
+A diagnostic policy declares `kind`, a unique `id`, analyzer keys, `appliesTo`, and a pure `evaluate`. `evaluate` receives readonly normalized snapshots and a process-free policy context. Filter findings by exact rule ID and return bounded guidance plus the supported suppression form.
+
+A verification policy declares a project matcher and exact requirements. Each requirement owns an exact command, `cwd: "project-root"`, and a pure `affects(path)` predicate. Do not infer scripts or accept command variants.
+
+Use:
+
+```ts
+import type { DiagnosticPolicy } from "pi-native-hooks/policy";
+export default { /* ... */ } satisfies DiagnosticPolicy;
+```
+
+No runtime import is needed. Enums, namespaces, parameter properties, JSX, and tsconfig transforms are unsupported in personal modules.

skills/native-hook-authoring/references/testing.md

@@ -0,0 +1,16 @@
+# Policy testing
+
+Work only in repository fixtures until activation is explicitly approved.
+
+1. Put policy fixtures in `tests/fixtures/personal-config/policies/`.
+2. Put ast-grep rules below `tests/fixtures/personal-config/ast-grep/rules/` and keep severity below `error`.
+3. Cover TS and TSX positives, nearby negatives, the exact named suppression with a `-- rationale`, Unicode ranges, and malformed analyzer output where relevant.
+4. Assert multiple policies sharing one analyzer key cause one adapter invocation.
+5. Run:
+
+```bash
+npm run typecheck
+npm test
+```
+
+Use `/hooks-doctor` only after authorized initialization. Never make a policy evaluator invoke `ast-grep`, a linter, LSP, shell, or Pi API directly.