Feature request: blocking before-context-load hook for instruction files (CLAUDE.md, SKILL.md, rules)

Problem

Instruction files steer the model with something close to system-prompt privilege, but there is no point in the pipeline where a policy can verify their CONTENT before it enters context. We tested the current surface empirically against 2.1.210 (method + fixtures: https://github.com/mindmodelai/contextlock/blob/master/docs/claude-code-surface.md):

• SessionStart happens to run before the root CLAUDE.md is ingested (cold start and resume) - favorable, but undocumented and non-blocking.
• Nested CLAUDE.md files load lazily with no hook at all.
• SKILL.md bodies load harness-internally: no Read event fires, so PreToolUse(Read) never sees them; only the whole Skill invocation can be denied.

So today's best available enforcement is a layered workaround: install/write-time verification + a SessionStart sweep with quarantine + PreToolUse(Skill|Read|Edit|Write) denials + managed-settings anchoring. It works, but the lazy-nested-CLAUDE.md gap stays open at load time, and the SessionStart ordering we depend on is an implementation detail that could silently change.

Proposal

A PreContextLoad hook event, fired before any instruction-class file (CLAUDE.md, SKILL.md, rules, agent/plugin configs) is added to context:

{ "hookEventName": "PreContextLoad", "filePath": "...", "sha256": "..." }

with permissionDecision: "deny" semantics identical to PreToolUse. Including the hash in the payload lets integrity tools verify without re-reading (no TOCTOU between hook and ingestion).

A meaningful subset on its own: documenting the SessionStart-before-context-ingestion ordering as a guarantee.

Why now

OWASP Agentic Skills Top 10 (AST01) recommends cryptographic signature verification for skills; the ClawHavoc/ToxicSkills incidents and the config-file CVE class (CVE-2025-59536, CVE-2026-21852) made instruction-file integrity a practical concern rather than a theoretical one. A load-time gate lets external tools - any of them - do that verification without Claude Code adopting any crypto itself.

---
Context: we build ContextLock (Apache-2.0, https://github.com/mindmodelai/contextlock), whose Claude Code plugin implements the layered workaround above; this hook would close its documented residual gap. Drafted with AI assistance, human-reviewed.