--- id: protect-test-integrity track: coding version: 0.0.3 label: blocks keyword: block where: write turn-end sha256: 37f62b136e6b0a8c7167c3f81594d30409b08edc7c3e7b4c8f6f1c8a067b96c3 source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/protect-test-integrity catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f --- # Protect Test Integrity protect-test-integrity · version 0.0.3 Blocks — Blocks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. In a git repo: at commit (Chock refuses the commit, locally and in CI.) ## What it does Blocks weakening tests to turn them green: a deleted test file (commit only), a net loss of assertions, or an added vacuous assertion (assert True, expect(true).toBe(true)). Added skips are block-test-skips. Runs: commit (incl. an agent's commit: CHOCK_AGENT_COMMIT, CLAUDECODE=1, AI_AGENT or agent_commit_env), agent write (vs disk), turn's end (vs HEAD). Waiver: 'chock: allow test-integrity' on an added line. Person's commit: honoured. Agent: only if already in HEAD; it asks a person. ## Its label on each agent - Claude Code (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=protect-test-integrity - Cursor (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=cursor&p=protect-test-integrity - Codex (tested): Blocks — Blocks on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=protect-test-integrity - GitHub Copilot (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=protect-test-integrity - Devin (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=protect-test-integrity - Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=protect-test-integrity - goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=protect-test-integrity - Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=protect-test-integrity - OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=protect-test-integrity - Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=protect-test-integrity - Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=protect-test-integrity ## What it misses This policy does not state what it misses. ## Examples - Refused: A failing test is made green by cutting two of its three assertions. - Allowed: A test is refactored: assertions are reworded and moved into a helper, and none is lost. ## Latest change 0.0.3 · 2026-09-30 — Wording fix, no behaviour change: the description and the gate message said a waiver is 'never honoured in the agent'. Since chock 0.14.0 a waiver already committed in HEAD counts in the agent (tool use, the turn's end, an agent's commit), the same as block-test-skips; a waiver on a new line does not. The description, the gate message, the tc-017 expect text and the same sentence in the 0.0.2 entry below are corrected. The description names where each check runs, and fits the 500-char budget. ## Provenance - Tested by 17 of 19 cases run automatically - SHA-256: `37f62b136e6b0a8c7167c3f81594d30409b08edc7c3e7b4c8f6f1c8a067b96c3` - Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f - Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/protect-test-integrity (catalog path `base/protect-test-integrity`) - Presets: Test integrity - JSON: `/api/coding/policies/protect-test-integrity.json` - Report a problem: https://chock.sh/report/?policy=protect-test-integrity&version=0.0.3&page=%2Fcoding%2Fpolicies%2Fprotect-test-integrity%2F