--- id: lockfile-integrity track: coding version: 0.0.3 label: blocks keyword: block where: write turn-end sha256: 6512a38de5c1161c6295ebfe83631b55ce97c6655e9bdc3aad5e5cc36930581e source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/lockfile-integrity catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f --- # Lockfile Integrity lockfile-integrity · version 0.0.3 Blocks — Blocks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. In a git repo: at commit (Chock refuses the commit, locally and in CI.) ## What it does Script gate (commit, agent write, CI) over npm, yarn, pnpm, bun, poetry, uv, Pipfile, Cargo, go.sum, Gemfile, composer and NuGet locks. Blocks: source off the registry list or not https, missing hash, hash changed for a locked version, unpinned git source, unreadable lock. Asks: SHA-1-only hash, transitive install script, lock or manifest moved alone, go.sum lines removed, lock ignored or deleted. Judges what a change adds. Friction, not a security boundary. ## Its label on each agent - Claude Code (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=lockfile-integrity - Cursor (tested): Blocks — Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. Builder: /coding/builder/#client=cursor&p=lockfile-integrity - Codex (tested): Blocks — Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=lockfile-integrity - GitHub Copilot (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=lockfile-integrity - Devin (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=lockfile-integrity - Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=lockfile-integrity - goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=lockfile-integrity - Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=lockfile-integrity - OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=lockfile-integrity - Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=lockfile-integrity - Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=lockfile-integrity ## What it misses This policy does not state what it misses. ## Examples - Refused: A commit keeps left-pad@1.3.0 but points its resolved URL at another host. - Allowed: A commit bumps left-pad to 1.3.1 in package.json and the lock, with a registry URL and sha512. ## Latest change 0.0.3 · 2026-10-25 — Hardening (SR-2d2d): at push and ci the registry host allowlist is the one at the range base, not the one the change under judgement carries: the pull request's base branch (GITHUB_BASE_REF read as origin/\), else the \`before\` commit of the push event, else the first parent; a root commit has no base, so only the default registries count. A named base that does not resolve, or a shallow checkout with no parent, is a fault (exit 2), never an allow. ci now raises lock-allowlist-edited for a change that carries the allowlist, as tool use and agent-commit do; push does not. The finding message now reads for both writers. Tests: test_lockfile_integrity_sr2d2.py. No eval case can drive this: replay has no range base to name. ## Provenance - Tested by 65 of 65 cases run automatically - SHA-256: `6512a38de5c1161c6295ebfe83631b55ce97c6655e9bdc3aad5e5cc36930581e` - Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f - Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/lockfile-integrity (catalog path `base/lockfile-integrity`) - Presets: Packages and supply chain - JSON: `/api/coding/policies/lockfile-integrity.json` - Report a problem: https://chock.sh/report/?policy=lockfile-integrity&version=0.0.3&page=%2Fcoding%2Fpolicies%2Flockfile-integrity%2F