---
id: protect-main-branch
track: coding
version: 0.0.4
label: advisory
keyword: advise
where: text
sha256: b469c3dbab9a12a009e3ef995fcab99d468e1363da4892af9f1b3bbdcf24a173
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/protect-main-branch
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# Protect Main Branch

protect-main-branch · version 0.0.4

Advisory — Advisory only. It is skill text, and nothing stops a violation. Chock adds friction. It is not a security boundary. 

In a git repo: at commit (Chock refuses the commit, locally and in CI.)

 Advisory inside the agent. In a repo set up with chock init, chock enforces it at commit.

## What it does

Keeps agents off main and master: a git hook reads the current branch at commit time and parses the refs being pushed at push time. The hook refuses a violation only where it is installed. As skill text alone this is advice, and nothing stops one.

## Its label on each agent

- Claude Code (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=claude-code&p=protect-main-branch
- Cursor (tested): Advisory — Text only in a plugin. Nothing in the plugin stops a violation. The plugin does not carry the enforcement the manifest declares. Builder: /coding/builder/#client=cursor&p=protect-main-branch
- Codex (tested): Advisory — Text only in a plugin. Nothing in the plugin stops a violation. The plugin does not carry the enforcement the manifest declares. Builder: /coding/builder/#client=codex&p=protect-main-branch
- GitHub Copilot (tested): Advisory — Text only in a plugin. Nothing in the plugin stops a violation. The plugin does not carry the enforcement the manifest declares. Builder: /coding/builder/#client=copilot&p=protect-main-branch
- Devin (tested): Advisory — Text only in a plugin. Nothing in the plugin stops a violation. The plugin does not carry the enforcement the manifest declares. Builder: /coding/builder/#client=devin&p=protect-main-branch
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=protect-main-branch
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=protect-main-branch
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=protect-main-branch
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=protect-main-branch
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=protect-main-branch
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=protect-main-branch

## What it misses

This policy does not state what it misses.

## Examples

- Refused: The agent is on main and runs git commit.
- Allowed: The agent is on a feature branch and commits.

## Latest change

0.0.4 · 2026-10-23 — Description wording only (IR-F4): it said the policy is enforced, but on every agent client the plugin carries skill text only and an agent can commit on main. It now says what the git hook checks and that skill text alone is advice. Behaviour unchanged.

## Provenance

- Tested by 4 of 4 cases run automatically
- SHA-256: `b469c3dbab9a12a009e3ef995fcab99d468e1363da4892af9f1b3bbdcf24a173`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/protect-main-branch (catalog path `base/protect-main-branch`)
- Presets: Git hygiene
- JSON: `/api/coding/policies/protect-main-branch.json`
- Report a problem: https://chock.sh/report/?policy=protect-main-branch&version=0.0.4&page=%2Fcoding%2Fpolicies%2Fprotect-main-branch%2F