Write policies

Manifest reference

Every field of a policy's manifest.yaml, with its type, whether it is required and the values it allows, read from the engine's schema at the pinned commit.

View as Markdown

manifest.yaml is the policy's identity and its payload: a gate, rule text, a skill or a workflow. chock validate checks it against the engine's JSON schemas. The site generates the tables below from those schemas, as installed at the pinned commit.

From the engine docs: docs/authoring-policies.md

Anatomy of a policy folder

.agents/policies/block-console-log/
├── manifest.yaml            # manifest — always present
├── skill/                   # optional: body.md, and any file the packaged skill should ship
└── evals/
    └── suite.yaml         # trigger / negative / behavior / adversarial cases

Every field

Generated from manifest.schema.json as installed from the pinned engine commit, with every $ref followed into the engine's other schema files. A field a.b is b inside a. A field a[].b is b in each item of the list a. A field a.<name>.b is b under any key of a. Required means required when its parent is present. The first table is the top level. Each object below it has its own table.

The schema file at the pinned commit: src/chock/validation/schemas/manifest.schema.json

Field	Type	Required	Allowed values	Description in the schema
`id`	string	yes	Pattern ^[a-z][a-z0-9-]{2,63}$
`name`	string	yes	Max length 128
`version`	string	yes	A pattern. It holds a backslash, so only the schema file shows it
`description`	string	yes	Max length 1024
`artifact`	string	yes	One of: "rule", "hook", "skill", "workflow"
`agent_specific_vocabulary`	boolean	no
`mandatory`	boolean	no
`enforcement`	string	yes	One of: "advise", "verify", "block"
`effects`	Array of string	no
`approval`	object	no
`provenance`	object	yes
`lifecycle`	object	yes
`optimization`	object	no
`evaluation`	object	no
`dependencies`	object	no
`security`	object	no
`tags`	Array of string	no	Max items 20
`changelog`	Array of object	no
`applies_to`	object	no
`compliance`	object	no
`validation`	object	no
`propagation`	string	no	One of: "inherit", "local"
`concerns`	Array of string	no
`conflicts_with`	Array of object	no
`bundle`	object	no
`rule`	object	no		V3 rule payload: ambient rule text under 'rule:'.
`hook`	object	no		V3 hook payload: the compiled gate DSL under 'hook.gate', the event declaration under 'hook.script' for a check no declarative kind can express, or both -- the same control on its git events and its tool_use surface. A script and a shell guard (implementations/<policy_id>.{sh,py}, found by name) never see an Edit/Write; their write-path door is a hook.gate whose 'on' includes tool_use: kind script for logic, or a path gate (content_regex, forbidden_path_regex, content_pattern '(?!)'). DET-6, spec/script-backed-gates.md.
`skill`	object	no		V3 skill payload under 'skill:'.
`workflow`	object	no		V3 workflow payload under 'workflow:'.
`input_schema`	object	no
`output_schema`	object	no
`runtime`	object	no
`composition`	object	no
`categories`	Array of string	no
`determinization_reviewed`	boolean	no
`ambient_override`	boolean	no		SEC-5: a rule below trust_tier community may be wired into ambient context only when this is true and ambient_override_reason says why it is trusted without review.
`ambient_override_reason`	string	no	Min length 1, max length 500	Why the rule is trusted without review, e.g. "authored by the installing user".
`scripts`	object	no

`approval`

Field	Type	Required	Allowed values
`approval.required`	boolean	no
`approval.mode`	string	no	One of: "human", "auto"
`approval.justification`	string	no	Max length 500

`provenance`

Field	Type	Required	Allowed values
`provenance.author`	string	yes
`provenance.author_email`	string	no	Format email
`provenance.created_at`	string	no	Format date-time
`provenance.updated_at`	string	no	Format date-time
`provenance.source_repo`	string	yes
`provenance.license`	string	yes	One of: "Apache-2.0", "MIT", "BSD-3-Clause", "proprietary"
`provenance.trust_tier`	string	yes	One of: "sandbox", "community", "verified", "certified"
`provenance.signature`	string	no
`provenance.public_key`	string	no

`lifecycle`

Field	Type	Required	Allowed values
`lifecycle.status`	string	yes	One of: "draft", "review", "staging", "production", "deprecated", "retired"
`lifecycle.reviewed_by`	Array of string	no
`lifecycle.deprecated_at`	string	no	Format date-time
`lifecycle.replacement_id`	string	no

`optimization`

Field	Type	Required	Allowed values
`optimization.optimizable`	boolean	no
`optimization.learning_rate_budget`	number	no	Minimum 0.0, maximum 1.0
`optimization.frozen_sections`	Array of string	no
`optimization.validation_gate`	string	no	One of: "strict", "standard", "permissive"
`optimization.min_eval_score`	number	no	Minimum 0.0, maximum 1.0
`optimization.rejected_edit_ttl_days`	integer	no

`evaluation`

Field	Type	Required	Allowed values
`evaluation.test_suite_ref`	string	no
`evaluation.benchmark_scenarios`	Array of string	no
`evaluation.primary_metric`	string	no
`evaluation.metrics`	object	no
`evaluation.metrics.<name>.weight`	number	no
`evaluation.metrics.<name>.threshold`	number	yes
`evaluation.metrics.<name>.direction`	string	yes	One of: "higher_is_better", "lower_is_better"

`dependencies`

Field	Type	Required	Allowed values
`dependencies.skills`	Array of object	no
`dependencies.skills[].id`	string	yes
`dependencies.skills[].version_constraint`	string	no
`dependencies.skills[].optional`	boolean	no
`dependencies.skills[].name`	string	no
`dependencies.skills[].type`	string	no	One of: "rest_api", "grpc", "database", "message_queue", "storage"
`dependencies.skills[].min_context_tokens`	integer	no
`dependencies.skills[].required`	boolean	no
`dependencies.subagents`	Array of object	no
`dependencies.subagents[].id`	string	yes
`dependencies.subagents[].version_constraint`	string	no
`dependencies.subagents[].optional`	boolean	no
`dependencies.subagents[].name`	string	no
`dependencies.subagents[].type`	string	no	One of: "rest_api", "grpc", "database", "message_queue", "storage"
`dependencies.subagents[].min_context_tokens`	integer	no
`dependencies.subagents[].required`	boolean	no
`dependencies.services`	Array of object	no
`dependencies.services[].id`	string	yes
`dependencies.services[].version_constraint`	string	no
`dependencies.services[].optional`	boolean	no
`dependencies.services[].name`	string	no
`dependencies.services[].type`	string	no	One of: "rest_api", "grpc", "database", "message_queue", "storage"
`dependencies.services[].min_context_tokens`	integer	no
`dependencies.services[].required`	boolean	no
`dependencies.models`	Array of object	no
`dependencies.models[].id`	string	yes
`dependencies.models[].version_constraint`	string	no
`dependencies.models[].optional`	boolean	no
`dependencies.models[].name`	string	no
`dependencies.models[].type`	string	no	One of: "rest_api", "grpc", "database", "message_queue", "storage"
`dependencies.models[].min_context_tokens`	integer	no
`dependencies.models[].required`	boolean	no
`dependencies.tools`	object	no
`dependencies.tools.allowed`	Array of string	no
`dependencies.tools.forbidden`	Array of string	no
`dependencies.mcp_servers`	Array of string	no
`dependencies.policies`	Array of object	no
`dependencies.policies[].id`	string	yes
`dependencies.policies[].version_constraint`	string	no
`dependencies.policies[].optional`	boolean	no
`dependencies.policies[].name`	string	no
`dependencies.policies[].type`	string	no	One of: "rest_api", "grpc", "database", "message_queue", "storage"
`dependencies.policies[].min_context_tokens`	integer	no
`dependencies.policies[].required`	boolean	no

`security`

Field	Type	Required	Allowed values
`security.content_instructions`	string	no	One of: "never-obey"
`security.prompt_injection_defense`	string	no	One of: "strict", "standard", "disabled"
`security.input_sanitization`	boolean	no
`security.output_validation`	boolean	no
`security.pii_handling`	string	no	One of: "block", "redact", "allow"
`security.data_residency`	string	no
`security.audit_logging`	boolean	no
`security.processes_external_content`	boolean	no

`changelog`

Field	Type	Required	Allowed values
`changelog[].version`	string	yes
`changelog[].date`	string	yes	Format date
`changelog[].changes`	Array of string	yes
`changelog[].breaking`	boolean	no

`applies_to`

Field	Type	Required
`applies_to.agents`	Array of string	no
`applies_to.paths`	Array of string	no
`applies_to.events`	Array of string	no
`applies_to.model_tier`	Array of string	no

`validation`

Field	Type	Required	Description in the schema
`validation.last_validated`	object	no	Evidence that this policy was validated. Optional -- but when present every field is required, so an empty or partial object is a schema error rather than a way to look validated without being validated.
`validation.last_validated.model`	string	no
`validation.last_validated.date`	string	yes
`validation.last_validated.eval_score`	number	yes
`validation.last_validated.chock`	string	yes
`validation.known_good`	Array of string	no

`conflicts_with`

Field	Type	Required	Allowed values	Description in the schema
`conflicts_with[].id`	string	yes
`conflicts_with[].reason`	string	yes

`bundle`

Field	Type	Required	Allowed values	Description in the schema
`bundle.id`	string	yes
`bundle.shared_assets`	Array of string	no

`rule`

Field	Type	Required	Allowed values	Description in the schema
`rule.text`	string	yes	Max length 500

`hook`

Field	Type	Required	Allowed values	Description in the schema
`hook.gate`	object	no
`hook.gate.kind`	string	yes	One of: "content_regex", "forbidden_ref", "dependency_allowlist", "test_integrity", "script", "egress_allowlist"
`hook.gate.on`	Array of string	yes	Min items 1
`hook.gate.outside_repo`	Array of string	no	Min items 1	Globs (absolute or starting with ~) of files outside the repository whose writes this gate may judge, at PreToolUse only. Needs tool_use in 'on'.
`hook.gate.action`	string	yes	One of: "block", "ask", "warn"
`hook.gate.message`	string	yes	Min length 1, max length 1000
`hook.gate.params`	object	yes		Per-kind params are validated by checks_gate.
`hook.script`	object	no		A check that cannot be expressed as a gate kind, run by the installed hook from implementations/<policy_id>-<event>.{sh,py}. No kind and no params: the behaviour is the script's. No message either -- the script prints its own refusal, with the detail only it has. 'on' is authoritative: the compiler wires exactly these events, and the validator fails when a declared event has no script or a script is undeclared. Git events only: a script never runs at tool_use, tool_call, stop or in CI; declare the write path as a hook.gate (DET-6).
`hook.script.on`	Array of string	yes	Min items 1

`skill`

Field	Type	Required	Allowed values
`skill.skill_type`	string	yes	One of: "nl", "code", "hybrid"
`skill.entry`	string	yes
`skill.effects`	Array of string	yes
`skill.approval`	object	no
`skill.approval.required`	boolean	no
`skill.approval.mode`	string	no	One of: "human", "auto"
`skill.approval.justification`	string	no	Max length 500

`workflow`

Field	Type	Required	Allowed values
`workflow.effects`	Array of string	yes
`workflow.approval`	object	yes
`workflow.approval.required`	boolean	no
`workflow.approval.mode`	string	no	One of: "human", "auto"
`workflow.approval.justification`	string	no	Max length 500
`workflow.control`	string	no	One of: "deterministic", "llm_driven"
`workflow.steps`	Array of object	yes	Min items 1
`workflow.steps[].id`	string	yes
`workflow.steps[].uses`	string	yes
`workflow.steps[].mode`	string	no	One of: "inline", "delegated"
`workflow.steps[].input`	object	no
`workflow.steps[].output`	object	no
`workflow.steps[].on_error`	string	no	One of: "abort", "continue"
`workflow.outputs`	object	no
`workflow.max_delegation_depth`	integer	no	Minimum 1
`workflow.aggregate_check`	boolean	no

`input_schema`

Field	Type	Required	Allowed values
`input_schema.type`	string	yes
`input_schema.properties`	object	yes
`input_schema.properties.<name>.type`	string	yes
`input_schema.properties.<name>.description`	string	no	Min length 1
`input_schema.properties.<name>.format`	string	no
`input_schema.properties.<name>.default`		no
`input_schema.properties.<name>.enum`	array	no
`input_schema.properties.<name>.items`		no
`input_schema.properties.<name>.properties`	object	no
`input_schema.properties.<name>.required`	Array of string	no
`input_schema.properties.<name>.additionalProperties`		no
`input_schema.properties.<name>.minLength`	integer	no
`input_schema.properties.<name>.maxLength`	integer	no
`input_schema.required`	Array of string	no
`input_schema.additionalProperties`	boolean	yes

`output_schema`

Field	Type	Required	Allowed values
`output_schema.type`	string	yes
`output_schema.properties`	object	yes
`output_schema.properties.outcome`	object	yes
`output_schema.properties.outcome.type`	string	yes
`output_schema.properties.outcome.enum`	Array of string	yes
`output_schema.properties.outcome.description`	string	no
`output_schema.properties.<name>.type`	string	yes
`output_schema.properties.<name>.description`	string	no	Min length 1
`output_schema.properties.<name>.format`	string	no
`output_schema.properties.<name>.default`		no
`output_schema.properties.<name>.enum`	array	no
`output_schema.properties.<name>.items`		no
`output_schema.properties.<name>.properties`	object	no
`output_schema.properties.<name>.required`	Array of string	no
`output_schema.properties.<name>.additionalProperties`		no
`output_schema.properties.<name>.minLength`	integer	no
`output_schema.properties.<name>.maxLength`	integer	no
`output_schema.required`	Array of string	no
`output_schema.additionalProperties`	boolean	yes

`runtime`

Field	Type	Required	Allowed values	Description in the schema
`runtime.max_retries`	integer	no
`runtime.max_identical_invocations`	integer	no

`composition`

Field	Type	Required	Allowed values
`composition.pattern`	string	no
`composition.phases`	Array of object	yes	Min items 1
`composition.phases[].id`	string	yes
`composition.phases[].mode`	string	yes
`composition.phases[].source`	string	no
`composition.phases[].invoke`	object	no
`composition.phases[].isolation`	object	no
`composition.phases[].concurrency`	object	no
`composition.phases[].failure_policy`	string	yes
`composition.phases[].result`	object	no
`composition.phases[].approval`	object	no
`composition.phases[].monitoring`	object	yes
`composition.monitoring`	object	yes
`composition.handoff`	object	yes

`scripts`

Field	Type	Required	Allowed values	Description in the schema
`scripts.entrypoint`	string	no

Built from engine 5a4b6287a46e and catalog 1e60d211c1bb.