Guard Memory Writes
Blocks on an agent's file writes and at turn end.
Acts on
File write · Turn end
When
Before the file write · at turn end
Tested
46 of 47 pass
In a git repo
At commit
What it does
Refuses agent-memory writes holding pasted git history, a code block over 20 lines, a duplicate line or a secret. Warns (observe, ASI06) on an added line that tells the agent to run a command or fetch a URL, an encoded blob, and, only where the repo keeps .chock/egress-allowlist.txt, a URL host off it. Judges memory files only (MEMORY.md, CLAUDE.local.md, .claude/memory/**, memory/**/*.md, the agent's own stores) and what a change adds. No waiver. A write after an untrusted fetch is not seen.
Chock adds friction. It is not a security boundary.
Its label on each agent
The catalog grades each policy on each agent. Pick an agent to build with this policy:
- Claude Code TestedBlocks Blocks on an agent's file writes and at turn endBuild →
- Cursor TestedBlocks Blocks on an agent's file writes and at turn endBuild →
- Codex TestedBlocks Blocks on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- GitHub Copilot TestedBlocks Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- Devin TestedBlocks Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed)Build →
- Grok Tested Not graded yet for GrokBuild →
- goose Tested Not graded yet for gooseBuild →
- Antigravity Tested Not graded yet for AntigravityBuild →
- OpenHands Untested Not graded yet for OpenHandsBuild →
- Kimi Code Untested Not graded yet for Kimi CodeBuild →
- Factory Droid Untested Not graded yet for Factory DroidBuild →
See it in action
Refused
A memory file gains a pasted git diff header.
Allowed
A memory file holds short non-derivable facts and repeated headings.
Both examples are this policy's own test cases.
What it misses
This policy does not state what it misses.
Latest change
0.0.10 · · Hardening (SR-2d2d; finding F35; eval case tc-047; tests in test_guard_memory_writes_sr2d2.py). The ask-tier instruction and url-host rows take the set of lines a secret already refuses: for a statement with such a line (any physical line of it) the instruction row says the text is withheld and the url-host row names no host, and its key is the statement's digest alone, so the credential never reaches a finding message that the engine logs. A URL whose host cannot be read is shown without its userinfo (everything up to the last @ is dropped), never as the raw authority. Messages and keys for lines no secret refuses are unchanged. Known limit: the engine still writes finding messages to its log unredacted; that is the framework's to change.