Chock.sh Build your plugin

Architecture

Emitters and hook points

Which emitter of chock compile writes each hook point, and the file chock sync installs for it.

View as Markdown

A hook point is where a compiled control runs. The chock compile command hands each policy to one emitter per hook point. Then chock sync installs what the emitters wrote. Each arrow out of chock compile names the hook points that emitter writes, as the engine's compiler maps them.

Diagram

Emitters: chock compile What runs it: chock sync and chock gateway run git-hook ci-gate pre-tool-use, stop, agent-hooks managed-setting ambient-rule mcp-gateway chock sync chock sync --ci chock sync chock sync gateway run chock compilechock Git hook emitterchock CI emitterchock In-agent emitterchock Managed settingschock Ambient rulechock MCP gatewaychock Git hookschock CI workflowchock Agent hook fileschock INDEX.mdchock Gateway proxychock
  • Engine code
  • Generated file

Select a box to read its card below.

This diagram as JSON

Components

  1. chock compile Engine code

    Runs the emitter for each hook point on a policy, in the engine's order, and writes the output to .chock/compiled/<id>/<surface>/. The gateway hook point has no emitter. It is modeled for budgets and egress, and nothing is emitted for it.

    Source: chock/src/chock/compile/compiler.py @ 5a4b6287a46e

  2. Git hook emitter Engine code

    Emits git-hook entrypoints from the policy's implementations folder: guards at pre-commit, pre-merge-commit and pre-push. Hard at commit and push. git commit --no-verify skips it.

    Source: chock/src/chock/compile/emitters/git_hook.py @ 5a4b6287a46e

  3. CI emitter Engine code

    Emits a CI gate step that re-runs the policy's check over a pull request's commit range: the backstop for a skipped git hook.

    Source: chock/src/chock/compile/emitters/ci.py @ 5a4b6287a46e

  4. In-agent emitter Engine code

    Hook fragments for every wired vendor. The pre-tool-use hook point refuses a call before it runs. The stop hook point reads what the turn left in the worktree and earns no coverage word. The agent-hooks hook point is the same deny for Copilot CLI and VS Code agent mode.

    Source: chock/src/chock/compile/emitters/in_agent.py @ 5a4b6287a46e

  5. Managed settings Engine code

    Emits Claude managed-settings.json fragments. There is no installer, so it enforces nothing today.

    Source: chock/src/chock/compile/emitters/claude_managed.py @ 5a4b6287a46e

  6. Ambient rule Engine code

    Emits the AGENTS.md block the agent is asked to follow. Advisory: it blocks nothing on its own.

    Source: chock/src/chock/compile/emitters/ambient.py @ 5a4b6287a46e

  7. MCP gateway Engine code

    Emits the gate specs the MCP proxy evaluates per tool call. It governs MCP-routed tool calls only.

    Source: chock/src/chock/compile/emitters/mcp_gateway.py @ 5a4b6287a46e

  8. Git hooks Generated file

    The chock sync command installs a dispatcher in .git/hooks. It runs every executable script for the event.

    Source: chock/src/chock/hooks/data/dispatcher.sh @ 5a4b6287a46e

  9. CI workflow Generated file

    With --ci, chock sync writes .github/workflows/chock.yml. Until then ci-gate is compiled and inert, and the coverage report says so.

    Source: chock/src/chock/scaffold/install_ci.py @ 5a4b6287a46e

  10. Agent hook files Generated file

    The chock sync command writes each wired agent's hook file, in that agent's own format. What happens when a hook cannot run is agentseam's data, listed below.

    Agentseam's tier table at the release the engine pins, by fail mode:

    • No adapted pre-tool hook (10): Aider (none), Amp (unadapted), GitHub Copilot (Agent Plugins 1.0 marketplace bundle) (unadapted), DeepSeek Harness (dsh) (unadapted), Kilo Code (unadapted), Kiro (unadapted), OpenCode (unadapted), Replit Agent (unadapted), Roo Code (unadapted), Zed (none)
    • If the hook fails, the action goes through (14): Antigravity (block+rewrite), Claude Code (block+rewrite), Cline (block), OpenAI Codex CLI (block+rewrite), Devin (block+rewrite), Factory Droid (block), Gemini CLI (block+rewrite), Grok CLI (block), Junie CLI (block+rewrite), Kimi Code CLI (block), OpenHands (block), Tabnine CLI (block+rewrite), GitHub Copilot (VS Code agent mode / CLI) (block+rewrite), Windsurf (Cascade) (block)
    • What a failed hook does can be configured (3): Cursor (block+rewrite), goose (block), Mistral Vibe (block+rewrite)

    Source: chock/src/chock/hooks/in_agent_install.py @ 5a4b6287a46e

  11. INDEX.md Generated file

    The chock sync command compiles every active rule into .agents/policies/INDEX.md. AGENTS.md holds one pointer to it.

    Source: chock/src/chock/index/builder.py @ 5a4b6287a46e

  12. Gateway proxy Engine code

    A stdio proxy the client launches instead of the real MCP server. It refuses matching tools/call payloads. One downstream server per gateway process.

    Source: chock/src/chock/gateway/proxy.py @ 5a4b6287a46e

Connections

  • chock compile → Git hook emitter: git-hook
  • chock compile → CI emitter: ci-gate
  • chock compile → In-agent emitter: pre-tool-use, stop, agent-hooks
  • chock compile → Managed settings: managed-setting
  • chock compile → Ambient rule: ambient-rule
  • chock compile → MCP gateway: mcp-gateway
  • Git hook emitter → Git hooks: chock sync
  • CI emitter → CI workflow: chock sync --ci
  • In-agent emitter → Agent hook files: chock sync
  • Ambient rule → INDEX.md: chock sync
  • MCP gateway → Gateway proxy: gateway run

Main path

The flow this diagram is about, in order:

  1. chock compile
  2. In-agent emitter
  3. Agent hook files

Pinned sources

Every box cites a file at these commits. CI fails the build if a cited path is missing at its commit.

Built from engine 5a4b6287a46e and catalog 1e60d211c1bb.