README's claude allowlist and the design doc's open question learn
about hooks/; AGENTS.md drops a stale project-local mention from the
selection precedence.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ayyqfpg98CeZPmtMPXQEFo

diff --git a/AGENTS.md b/AGENTS.md
index d4ad677..8c9f635 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -46,7 +46,7 @@ just           # All four
 - The config redesign is documented in `docs/config-redesign.md`; all four steps of its sequencing are implemented.
 - Config files are parsed directly with the `kdl` crate (`parse_config` in `config.rs`), not serde: the grammar is `mounts` blocks (one child node per mount: name = host source, `target`/`writable` properties), one `env` block syntax (bare child = host passthrough), and `profile` nodes (with children = definition, bare = selection). Unknown nodes fail loudly.
 - Config merges layers, lowest precedence first: binary (staples `~/.config/git`/`~/.config/jj` plus the active agent's config allowlist, mounted read-only, canonicalized, skip-if-missing), profile (the active profile's env/mounts), user (every `*.kdl` in `~/.config/ramekin/`, merged as one layer, duplicate keys within the layer are errors), and project (`.ramekin/config.kdl`). A `/dev/null` source masks (removes) a mount inherited from a lower layer. `env` merges per variable; profiles merge by name, last writer takes the whole definition.
-- Profiles subsume agent selection: the binary ships trivial `pi`/`claude` profiles, selection precedence is binary < user < project < project-local < `-p`. `Agent` (in `config.rs`) carries each agent's host config dir, allowlist, and container config dir; `AgentState` (in `main.rs`) carries its persistent host paths and session mounts.
+- Profiles subsume agent selection: the binary ships trivial `pi`/`claude` profiles, selection precedence is binary < user < project < `-p`. `Agent` (in `config.rs`) carries each agent's host config dir, allowlist, and container config dir; `AgentState` (in `main.rs`) carries its persistent host paths and session mounts.
 - Persistence is per-agent, opposite policies: pi is ephemeral-by-default (fresh session dir at `/root/.pi/agent`; allowlisted `auth.json` from `$XDG_DATA_HOME/ramekin/agents/pi/` and per-repo `sessions/` bound on top; teardown logs discarded writes). Claude is persist-by-default (`~/.claude` + `~/.claude.json` from `$XDG_DATA_HOME/ramekin/agents/`, shared across repos; session-scoped dirs bound over the `CLAUDE_EPHEMERAL` denylist).
 - Each workspace mounts at `/workspace/<slug>` (slug is `<dirname>-<hash>`, never a shared `/workspace`) so cwd-keyed agent state stays distinct per repo; compose's `working_dir` puts the agent there on start.
 - Docker compose config is generated at runtime via `serde_yaml` over a typed `ComposeConfig` struct, not a static file. Volume mounts use the long-form bind syntax (`{type: bind, source, target, read_only}`), ordered lexicographically by target so parents precede children. Passthrough env vars render as bare names in the environment list.
diff --git a/README.md b/README.md
index f6a23b7..5f49c56 100644
--- a/README.md
+++ b/README.md
@@ -76,7 +76,7 @@ Provider credentials never appear in config: passthrough env forwards host value
 Agent config comes from the host's own dirs — the agents are also used locally, so their config already exists where they look for it. The config-shaped entries mount read-only at their normal paths inside the container:
 
 - pi: `~/.pi/agent/` — `AGENTS.md`, `skills/`
-- claude: `~/.claude/` — `CLAUDE.md`, `settings.json`, `skills/`, `agents/`, `commands/`
+- claude: `~/.claude/` — `CLAUDE.md`, `settings.json`, `skills/`, `agents/`, `commands/`, `hooks/`
 
 Ramekin keeps no parallel copy — edit the host files (or the dotfiles they symlink to) and the next session sees the changes. The rest of each host dir is runtime state (credentials, transcripts) and never enters the container. Project-level agent config (`.claude/`, `CLAUDE.md`, `AGENTS.md` in the repo) rides the workspace mount; the agents layer it themselves.
 
diff --git a/docs/config-redesign.md b/docs/config-redesign.md
index 2798cf6..3465744 100644
--- a/docs/config-redesign.md
+++ b/docs/config-redesign.md
@@ -316,8 +316,9 @@ secret, side-effect-free `config`) rather than rebasing the branch:
 ## Open questions
 
 - Finalize the agent-config allowlists: which entries of `~/.claude/` and
-  `~/.pi/agent/` are config-shaped (claude `hooks/`? `output-styles/`? pi
-  extensions, models config?). Skip-if-missing makes over-inclusion cheap.
+  `~/.pi/agent/` are config-shaped (claude `hooks/` is now included —
+  `settings.json` references its scripts; `output-styles/`? pi extensions,
+  models config?). Skip-if-missing makes over-inclusion cheap.
 - Does pi tolerate a read-only `AGENTS.md`/`skills/` in its agent dir, and
   where does it write scratch files at runtime? The fresh writable session
   dir underneath the read-only binds should absorb anything — verify before