---
id: guard-memory-writes
track: coding
version: 0.0.10
label: blocks
keyword: block
where: write turn-end
sha256: c354da6bba22299f860bb2789b8818454f4a95d513912ce4d440253368848e1b
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/guard-memory-writes
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# Guard Memory Writes

guard-memory-writes · version 0.0.10

Blocks — Blocks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. 

In a git repo: at commit (Chock refuses the commit, locally and in CI.)



## What it does

Refuses agent-memory writes holding pasted git history, a code block over 20 lines, a duplicate line or a secret. Warns (observe, ASI06) on an added line that tells the agent to run a command or fetch a URL, an encoded blob, and, only where the repo keeps .chock/egress-allowlist.txt, a URL host off it. Judges memory files only (MEMORY.md, CLAUDE.local.md, .claude/memory/**, memory/**/*.md, the agent's own stores) and what a change adds. No waiver. A write after an untrusted fetch is not seen.

## Its label on each agent

- Claude Code (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=guard-memory-writes
- Cursor (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=cursor&p=guard-memory-writes
- Codex (tested): Blocks — Blocks on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=guard-memory-writes
- GitHub Copilot (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=guard-memory-writes
- Devin (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=guard-memory-writes
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=guard-memory-writes
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=guard-memory-writes
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=guard-memory-writes
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=guard-memory-writes
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=guard-memory-writes
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=guard-memory-writes

## What it misses

This policy does not state what it misses.

## Examples

- Refused: A memory file gains a pasted git diff header.
- Allowed: A memory file holds short non-derivable facts and repeated headings.

## Latest change

0.0.10 · 2026-10-25 — Hardening (SR-2d2d; finding F35; eval case tc-047; tests in test_guard_memory_writes_sr2d2.py). The ask-tier instruction and url-host rows take the set of lines a secret already refuses: for a statement with such a line (any physical line of it) the instruction row says the text is withheld and the url-host row names no host, and its key is the statement's digest alone, so the credential never reaches a finding message that the engine logs. A URL whose host cannot be read is shown without its userinfo (everything up to the last \`@\` is dropped), never as the raw authority. Messages and keys for lines no secret refuses are unchanged. Known limit: the engine still writes finding messages to its log unredacted; that is the framework's to change.

## Provenance

- Tested by 46 of 47 cases run automatically
- SHA-256: `c354da6bba22299f860bb2789b8818454f4a95d513912ce4d440253368848e1b`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/guard-memory-writes (catalog path `base/guard-memory-writes`)
- Presets: Prompt injection and memory
- JSON: `/api/coding/policies/guard-memory-writes.json`
- Report a problem: https://chock.sh/report/?policy=guard-memory-writes&version=0.0.10&page=%2Fcoding%2Fpolicies%2Fguard-memory-writes%2F