Three different meanings
Panel's compiled hosting lifecycle hooks coordinate trusted native modules. Operation events are append-only task evidence read through authorized API endpoints. A repository hook is code supplied by the Git repository. These have different trust and execution boundaries and must not be treated as interchangeable plugins.
Git configuration field
The versioned Git application configuration contains repository_url, ref, immutable commit_sha, destination, transient credential handle, optional retained release ID, run_build and repository_hooks. The existence of the boolean records an execution policy; it does not grant root or make arbitrary repository hooks a supported administrative automation mechanism. Use only the exact installed runtime's accepted policy and supported form.
Build and deployment review
Review the immutable commit, tenant-scoped build, environment handles and supported start command before deployment. A repository credential is write-only material for that source; it must not become a root shell credential, general local API token or another tenant's secret. Inspect actual deployment logs, exit status and release digest. A code rollback does not reverse database writes or external side effects caused by application/repository code.
Events and external consumers
Read authorized operation detail/events using bounded cursors. The signed extension broker permits only six fixed read tools. There is no public arbitrary callback URL registry or unauthenticated event-ingestion endpoint in this reviewed reference. Do not invent a webhook secret or endpoint by copying an internal Go hook name into a URL.
Test and troubleshoot
Use a harmless controlled repository in a disposable environment. Verify unsupported policies are refused, account isolation survives build/hook execution and logs do not expose staged credentials. For interrupted deployment, inspect the retained operation/release instead of firing another external callback. Keep internal manifests/receipts unchanged; changing a repository's hooks cannot complete an account compensation or confer licensing rights.