# Emitters and hook points Which emitter of chock compile writes each hook point, and the file chock sync installs for it. A hook point is where a compiled control runs. The chock compile command hands each policy to one emitter per hook point. Then chock sync installs what the emitters wrote. Each arrow out of chock compile names the hook points that emitter writes, as the engine's compiler maps them. > Ask the user before running any command on this page: each one changes how their agent or repository behaves. ## Diagram [This diagram as JSON](/api/docs/architecture/enforcement-surfaces.json) ## Components - **`chock compile`** (Engine code): Runs the emitter for each hook point on a policy, in the engine's order, and writes the output to `.chock/compiled///`. The gateway hook point has no emitter. It is modeled for budgets and egress, and nothing is emitted for it. Source: [chock/src/chock/compile/compiler.py](https://github.com/open-coder-ai/chock/blob/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021/src/chock/compile/compiler.py) - **Git hook emitter** (Engine code): Emits git-hook entrypoints from the policy's implementations folder: guards at pre-commit, pre-merge-commit and pre-push. Hard at commit and push. `git commit --no-verify` skips it. Source: [chock/src/chock/compile/emitters/git_hook.py](https://github.com/open-coder-ai/chock/blob/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021/src/chock/compile/emitters/git_hook.py) - **CI emitter** (Engine code): Emits a CI gate step that re-runs the policy's check over a pull request's commit range: the backstop for a skipped git hook. Source: [chock/src/chock/compile/emitters/ci.py](https://github.com/open-coder-ai/chock/blob/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021/src/chock/compile/emitters/ci.py) - **In-agent emitter** (Engine code): Hook fragments for every wired vendor. The `pre-tool-use` hook point refuses a call before it runs. The `stop` hook point reads what the turn left in the worktree and earns no coverage word. The `agent-hooks` hook point is the same deny for Copilot CLI and VS Code agent mode. Source: [chock/src/chock/compile/emitters/in_agent.py](https://github.com/open-coder-ai/chock/blob/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021/src/chock/compile/emitters/in_agent.py) - **Managed settings** (Engine code): Emits Claude managed-settings.json fragments. There is no installer, so it enforces nothing today. Source: [chock/src/chock/compile/emitters/claude_managed.py](https://github.com/open-coder-ai/chock/blob/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021/src/chock/compile/emitters/claude_managed.py) - **Ambient rule** (Engine code): Emits the AGENTS.md block the agent is asked to follow. Advisory: it blocks nothing on its own. Source: [chock/src/chock/compile/emitters/ambient.py](https://github.com/open-coder-ai/chock/blob/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021/src/chock/compile/emitters/ambient.py) - **MCP gateway** (Engine code): Emits the gate specs the MCP proxy evaluates per tool call. It governs MCP-routed tool calls only. Source: [chock/src/chock/compile/emitters/mcp_gateway.py](https://github.com/open-coder-ai/chock/blob/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021/src/chock/compile/emitters/mcp_gateway.py) - **Git hooks** (Generated file): The chock sync command installs a dispatcher in .git/hooks. It runs every executable script for the event. Source: [chock/src/chock/hooks/data/dispatcher.sh](https://github.com/open-coder-ai/chock/blob/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021/src/chock/hooks/data/dispatcher.sh) - **CI workflow** (Generated file): With --ci, chock sync writes .github/workflows/chock.yml. Until then ci-gate is compiled and inert, and the coverage report says so. Source: [chock/src/chock/scaffold/install_ci.py](https://github.com/open-coder-ai/chock/blob/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021/src/chock/scaffold/install_ci.py) - **Agent hook files** (Generated file): The chock sync command writes each wired agent's hook file, in that agent's own format. What happens when a hook cannot run is agentseam's data, listed below. Source: [chock/src/chock/hooks/in_agent_install.py](https://github.com/open-coder-ai/chock/blob/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021/src/chock/hooks/in_agent_install.py) Agentseam's tier table at the release the engine pins, by fail mode: - No adapted pre-tool hook (10): Aider (none), Amp (unadapted), GitHub Copilot (Agent Plugins 1.0 marketplace bundle) (unadapted), DeepSeek Harness (dsh) (unadapted), Kilo Code (unadapted), Kiro (unadapted), OpenCode (unadapted), Replit Agent (unadapted), Roo Code (unadapted), Zed (none) - If the hook fails, the action goes through (14): Antigravity (block+rewrite), Claude Code (block+rewrite), Cline (block), OpenAI Codex CLI (block+rewrite), Devin (block+rewrite), Factory Droid (block), Gemini CLI (block+rewrite), Grok CLI (block), Junie CLI (block+rewrite), Kimi Code CLI (block), OpenHands (block), Tabnine CLI (block+rewrite), GitHub Copilot (VS Code agent mode / CLI) (block+rewrite), Windsurf (Cascade) (block) - What a failed hook does can be configured (3): Cursor (block+rewrite), goose (block), Mistral Vibe (block+rewrite) - **INDEX.md** (Generated file): The chock sync command compiles every active rule into .agents/policies/INDEX.md. AGENTS.md holds one pointer to it. Source: [chock/src/chock/index/builder.py](https://github.com/open-coder-ai/chock/blob/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021/src/chock/index/builder.py) - **Gateway proxy** (Engine code): A stdio proxy the client launches instead of the real MCP server. It refuses matching `tools/call` payloads. One downstream server per gateway process. Source: [chock/src/chock/gateway/proxy.py](https://github.com/open-coder-ai/chock/blob/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021/src/chock/gateway/proxy.py) ## Connections - `chock compile` → Git hook emitter: `git-hook` - `chock compile` → CI emitter: `ci-gate` - `chock compile` → In-agent emitter: `pre-tool-use, stop, agent-hooks` - `chock compile` → Managed settings: `managed-setting` - `chock compile` → Ambient rule: `ambient-rule` - `chock compile` → MCP gateway: `mcp-gateway` - Git hook emitter → Git hooks: `chock sync` - CI emitter → CI workflow: `chock sync --ci` - In-agent emitter → Agent hook files: `chock sync` - Ambient rule → INDEX.md: `chock sync` - MCP gateway → Gateway proxy: `gateway run` ## Main path The flow this diagram is about, in order: 1. `chock compile` 2. In-agent emitter 3. Agent hook files ## Pinned sources Every box cites a file at these commits. CI fails the build if a cited path is missing at its commit. - `chock` @ [5a4b6287a46e](https://github.com/open-coder-ai/chock/commit/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021) --- Built from engine [5a4b6287a46e](https://github.com/open-coder-ai/chock/commit/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021) and catalog [1e60d211c1bb](https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f).