Describe a safeguard in plain words. The page fills a chock policy template and writes a setup script you read and run yourself. The browser compiles nothing and runs nothing.
The interview
Draft cleared.
Short lowercase words or hyphens. It becomes the policy id, shown here.
Answer in plain words. The page fills the template for the kind you picked.
Add catalog policies
Picked policies install beside yours. This list is shared with the builder. A link from it carries your picks.
Your answers stay in this browser only (localStorage draft).
Review the files
Edits here win over the interview above. Restore regenerates a file from your answers.
Before the script can be written:
The selection file
Written as <folder>/chock.selection.yaml. The script asks for the agent again when it runs and writes that agent into the file.
The setup script
Download the script, read it, then run it. It writes the files, checks them with chock and builds the plugin. In install mode it also installs the plugin, but only on agents where a person has seen chock work live. It never pipes anything from the network into a shell.
SHA-256
Carries the agent and catalog policy ids only. It never carries your draft.