chock-quickstart

What chock init leaves behind: the wiring exhibit.

the framework → · the full catalog → · with policies installed →

Demo repository. A frozen exhibit of chock init, nothing more. Questions and issues belong on the framework repo.

Use this template

Click Use this template above, then sync it into your new repo:

git clone <your-new-repo-url> && cd <your-new-repo>
chock sync --repo .   # git never clones hooks — this wires them in

What chock init . wrote

.
├── AGENTS.md
├── chock.lock
├── .gitattributes
├── LICENSE
├── README.md
├── docs/
│   └── README.md
├── .agents/
│   ├── policies/
│   └── skills/
├── .chock/
│   ├── bin/
│   ├── config.yaml
│   ├── coverage.json
│   ├── dependency-allowlist.txt
│   └── registry.json
├── .claude/
├── .gemini/
└── .github/

The wiring behind that tree: .agents/policies/ and .agents/skills/ are what an agent reads to work here — policies once you chock add some, plus the bundled authoring skills (eval, optimize, policy-init, validate) it uses to write and test them. .chock/ is the engine's own state: config.yaml you're free to edit, plus registry.json, coverage.json, dependency-allowlist.txt, and the vendored hook adapter in bin/sessionstart.py that re-installs hooks on a fresh Claude Code session, since git never clones them. .claude/, .gemini/ and .github/ are thin per-agent wrappers — nothing agent-facing lives twice, everything delegates back to the single AGENTS.md. .gitattributes pins generated and hash-attested files to LF, so a pack checks out byte-identical whether the clone happens on Linux or Windows.

What each of these is, file by file: docs/README.md.

Next steps from here:

chock add protect-main-branch   # install a guardrail from the catalog
chock status                    # see what's installed and what it enforces
chock check                     # is this repo sound?

For the version of this repo with policies installed — one per artifact layer — see chock-example.

Where to go from here

• Adopt it in your own repository. pip install chock && chock init ., then chock add the policies that match how your team gets hurt; the catalog labels each one with what it actually enforces.
• Contribute a policy. The catalog's contributing guide is short and its rules are mechanical: a policy claims only what it can do, and evals are the argument. The policy wanted entries in the threat ledger are the open work list.
• Found something wrong in this exhibit? This tree is a frozen exhibit of chock init, so the fix belongs in the framework. Issues go to the framework repo.

Part of the open-coder-ai family

Everything under open-coder-ai is built on one rule: a claim must match a mechanism. Where this repository sits among the others:

Repository	What it is
chock	The framework: write a policy once, enforce it on git hooks, CI, and every agent
chock-catalog	The policies, each graded by what it actually enforces
agentseam	The primitives layer for every coding agent: one handler API over their hooks, instruction files, plugin packaging and config, with a capability matrix that carries its provenance. chock is one thing built on it
context-report	A signed report format for whether a plugin, hook, skill or AGENTS.md actually works
chock-threat-intel	A weekly, human-reviewed threat digest scored against the catalog
chock-claude-plugins · copilot · cursor · codex	The catalog compiled into each client's native plugin format; generated only, rebuilt and diffed in CI
chock-example	The same scaffold with policies installed, one per artifact layer