---
id: verify-dependency-exists
track: coding
version: 0.2.2
label: blocks
keyword: block
where: write turn-end
sha256: 07540ee575f9a40a61c4a52fc6291d4de70c549766916d057ca01cdd420906ae
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/verify-dependency-exists
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# Dependency Allowlist

verify-dependency-exists · version 0.2.2

Blocks — Blocks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. 

In a git repo: at commit (Chock refuses the commit, locally and in CI.)



## What it does

Allowlist gate for new dependencies; no registry lookup. Reads Python, Node, Rust, Ruby, PHP, JVM, .NET, Go, Elixir, Dart and Swift manifests (read, never run); blocks an added name missing from .chock/dependency-allowlist.txt, asks on a lockfile-only one. Not read: computed lists, sources, versions, some forms (see docs). No allowlist file (plugin-only installs): a manifest change warns, never blocks. Repo form is opt-in: seed, observe, \`chock enable\`. Runs: commit, agent write, turn's end.

## Its label on each agent

- Claude Code (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=verify-dependency-exists
- Cursor (tested): Blocks — Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. Builder: /coding/builder/#client=cursor&p=verify-dependency-exists
- Codex (tested): Blocks — Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=verify-dependency-exists
- GitHub Copilot (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=verify-dependency-exists
- Devin (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=verify-dependency-exists
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=verify-dependency-exists
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=verify-dependency-exists
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=verify-dependency-exists
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=verify-dependency-exists
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=verify-dependency-exists
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=verify-dependency-exists

## What it misses

This policy does not state what it misses.

## Examples

- Refused: A package that is not on the allowlist, which may not exist, is added to requirements.txt or package.json.
- Allowed: A package already listed in .chock/dependency-allowlist.txt is added.

## Latest change

0.2.2 · 2026-10-25 — Hardening (SR-2d2d): at an agent's event with no usable HEAD (a repository with no commit yet, or no git) the allowlist is treated as not seeded (warn-only) and the file on disk is never read, so an agent cannot approve its own dependencies with a freshly written allowlist; a write that adds an allowlist entry is still refused against the empty base. A person's commit, push and CI still read the file on disk. Replaces the 0.2.1 rule that read the disk when there was no commit. Tests: test_verify_dependency_exists_sr2d2.py.

## Provenance

- Tested by 61 of 61 cases run automatically
- SHA-256: `07540ee575f9a40a61c4a52fc6291d4de70c549766916d057ca01cdd420906ae`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/verify-dependency-exists (catalog path `base/verify-dependency-exists`)
- Presets: none
- JSON: `/api/coding/policies/verify-dependency-exists.json`
- Report a problem: https://chock.sh/report/?policy=verify-dependency-exists&version=0.2.2&page=%2Fcoding%2Fpolicies%2Fverify-dependency-exists%2F