# Manifest reference

Every field of a policy's manifest.yaml, with its type, whether it is required and the values it allows, read from the engine's schema at the pinned commit.

\`manifest.yaml\` is the policy's identity and its payload: a gate, rule text, a skill or a workflow. \`chock validate\` checks it against the engine's JSON schemas. The site generates the tables below from those schemas, as installed at the pinned commit.

> Ask the user before running any command on this page: each one changes how their agent or repository behaves.

From the engine docs: [docs/authoring-policies.md](https://github.com/open-coder-ai/chock/blob/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021/docs/authoring-policies.md)

## Anatomy of a policy folder

Ask the user before running the commands below:

```text
.agents/policies/block-console-log/
├── manifest.yaml            # manifest — always present
├── skill/                   # optional: body.md, and any file the packaged skill should ship
└── evals/
    └── suite.yaml         # trigger / negative / behavior / adversarial cases
```

## Every field

Generated from `manifest.schema.json` as installed from the pinned engine commit, with every `$ref` followed into the engine's other schema files. A field `a.b` is `b` inside `a`. A field `a[].b` is `b` in each item of the list `a`. A field `a.<name>.b` is `b` under any key of `a`. Required means required when its parent is present. The first table is the top level. Each object below it has its own table.

The schema file at the pinned commit: [src/chock/validation/schemas/manifest.schema.json](https://github.com/open-coder-ai/chock/blob/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021/src/chock/validation/schemas/manifest.schema.json)

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `id` | string | yes | Pattern ^\[a-z\]\[a-z0-9-\]{2,63}$ |  |
| `name` | string | yes | Max length 128 |  |
| `version` | string | yes | A pattern. It holds a backslash, so only the schema file shows it |  |
| `description` | string | yes | Max length 1024 |  |
| `artifact` | string | yes | One of: "rule", "hook", "skill", "workflow" |  |
| `agent_specific_vocabulary` | boolean | no |  |  |
| `mandatory` | boolean | no |  |  |
| `enforcement` | string | yes | One of: "advise", "verify", "block" |  |
| `effects` | Array of string | no |  |  |
| `approval` | object | no |  |  |
| `provenance` | object | yes |  |  |
| `lifecycle` | object | yes |  |  |
| `optimization` | object | no |  |  |
| `evaluation` | object | no |  |  |
| `dependencies` | object | no |  |  |
| `security` | object | no |  |  |
| `tags` | Array of string | no | Max items 20 |  |
| `changelog` | Array of object | no |  |  |
| `applies_to` | object | no |  |  |
| `compliance` | object | no |  |  |
| `validation` | object | no |  |  |
| `propagation` | string | no | One of: "inherit", "local" |  |
| `concerns` | Array of string | no |  |  |
| `conflicts_with` | Array of object | no |  |  |
| `bundle` | object | no |  |  |
| `rule` | object | no |  | V3 rule payload: ambient rule text under 'rule:'. |
| `hook` | object | no |  | V3 hook payload: the compiled gate DSL under 'hook.gate', the event declaration under 'hook.script' for a check no declarative kind can express, or both -- the same control on its git events and its tool_use surface. A script and a shell guard (implementations/\<policy_id\>.{sh,py}, found by name) never see an Edit/Write; their write-path door is a hook.gate whose 'on' includes tool_use: kind script for logic, or a path gate (content_regex, forbidden_path_regex, content_pattern '(?!)'). DET-6, spec/script-backed-gates.md. |
| `skill` | object | no |  | V3 skill payload under 'skill:'. |
| `workflow` | object | no |  | V3 workflow payload under 'workflow:'. |
| `input_schema` | object | no |  |  |
| `output_schema` | object | no |  |  |
| `runtime` | object | no |  |  |
| `composition` | object | no |  |  |
| `categories` | Array of string | no |  |  |
| `determinization_reviewed` | boolean | no |  |  |
| `ambient_override` | boolean | no |  | SEC-5: a rule below trust_tier community may be wired into ambient context only when this is true and ambient_override_reason says why it is trusted without review. |
| `ambient_override_reason` | string | no | Min length 1, max length 500 | Why the rule is trusted without review, e.g. "authored by the installing user". |
| `scripts` | object | no |  |  |

### `approval`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `approval.required` | boolean | no |  |  |
| `approval.mode` | string | no | One of: "human", "auto" |  |
| `approval.justification` | string | no | Max length 500 |  |

### `provenance`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `provenance.author` | string | yes |  |  |
| `provenance.author_email` | string | no | Format email |  |
| `provenance.created_at` | string | no | Format date-time |  |
| `provenance.updated_at` | string | no | Format date-time |  |
| `provenance.source_repo` | string | yes |  |  |
| `provenance.license` | string | yes | One of: "Apache-2.0", "MIT", "BSD-3-Clause", "proprietary" |  |
| `provenance.trust_tier` | string | yes | One of: "sandbox", "community", "verified", "certified" |  |
| `provenance.signature` | string | no |  |  |
| `provenance.public_key` | string | no |  |  |

### `lifecycle`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `lifecycle.status` | string | yes | One of: "draft", "review", "staging", "production", "deprecated", "retired" |  |
| `lifecycle.reviewed_by` | Array of string | no |  |  |
| `lifecycle.deprecated_at` | string | no | Format date-time |  |
| `lifecycle.replacement_id` | string | no |  |  |

### `optimization`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `optimization.optimizable` | boolean | no |  |  |
| `optimization.learning_rate_budget` | number | no | Minimum 0.0, maximum 1.0 |  |
| `optimization.frozen_sections` | Array of string | no |  |  |
| `optimization.validation_gate` | string | no | One of: "strict", "standard", "permissive" |  |
| `optimization.min_eval_score` | number | no | Minimum 0.0, maximum 1.0 |  |
| `optimization.rejected_edit_ttl_days` | integer | no |  |  |

### `evaluation`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `evaluation.test_suite_ref` | string | no |  |  |
| `evaluation.benchmark_scenarios` | Array of string | no |  |  |
| `evaluation.primary_metric` | string | no |  |  |
| `evaluation.metrics` | object | no |  |  |
| `evaluation.metrics.<name>.weight` | number | no |  |  |
| `evaluation.metrics.<name>.threshold` | number | yes |  |  |
| `evaluation.metrics.<name>.direction` | string | yes | One of: "higher_is_better", "lower_is_better" |  |

### `dependencies`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `dependencies.skills` | Array of object | no |  |  |
| `dependencies.skills[].id` | string | yes |  |  |
| `dependencies.skills[].version_constraint` | string | no |  |  |
| `dependencies.skills[].optional` | boolean | no |  |  |
| `dependencies.skills[].name` | string | no |  |  |
| `dependencies.skills[].type` | string | no | One of: "rest_api", "grpc", "database", "message_queue", "storage" |  |
| `dependencies.skills[].min_context_tokens` | integer | no |  |  |
| `dependencies.skills[].required` | boolean | no |  |  |
| `dependencies.subagents` | Array of object | no |  |  |
| `dependencies.subagents[].id` | string | yes |  |  |
| `dependencies.subagents[].version_constraint` | string | no |  |  |
| `dependencies.subagents[].optional` | boolean | no |  |  |
| `dependencies.subagents[].name` | string | no |  |  |
| `dependencies.subagents[].type` | string | no | One of: "rest_api", "grpc", "database", "message_queue", "storage" |  |
| `dependencies.subagents[].min_context_tokens` | integer | no |  |  |
| `dependencies.subagents[].required` | boolean | no |  |  |
| `dependencies.services` | Array of object | no |  |  |
| `dependencies.services[].id` | string | yes |  |  |
| `dependencies.services[].version_constraint` | string | no |  |  |
| `dependencies.services[].optional` | boolean | no |  |  |
| `dependencies.services[].name` | string | no |  |  |
| `dependencies.services[].type` | string | no | One of: "rest_api", "grpc", "database", "message_queue", "storage" |  |
| `dependencies.services[].min_context_tokens` | integer | no |  |  |
| `dependencies.services[].required` | boolean | no |  |  |
| `dependencies.models` | Array of object | no |  |  |
| `dependencies.models[].id` | string | yes |  |  |
| `dependencies.models[].version_constraint` | string | no |  |  |
| `dependencies.models[].optional` | boolean | no |  |  |
| `dependencies.models[].name` | string | no |  |  |
| `dependencies.models[].type` | string | no | One of: "rest_api", "grpc", "database", "message_queue", "storage" |  |
| `dependencies.models[].min_context_tokens` | integer | no |  |  |
| `dependencies.models[].required` | boolean | no |  |  |
| `dependencies.tools` | object | no |  |  |
| `dependencies.tools.allowed` | Array of string | no |  |  |
| `dependencies.tools.forbidden` | Array of string | no |  |  |
| `dependencies.mcp_servers` | Array of string | no |  |  |
| `dependencies.policies` | Array of object | no |  |  |
| `dependencies.policies[].id` | string | yes |  |  |
| `dependencies.policies[].version_constraint` | string | no |  |  |
| `dependencies.policies[].optional` | boolean | no |  |  |
| `dependencies.policies[].name` | string | no |  |  |
| `dependencies.policies[].type` | string | no | One of: "rest_api", "grpc", "database", "message_queue", "storage" |  |
| `dependencies.policies[].min_context_tokens` | integer | no |  |  |
| `dependencies.policies[].required` | boolean | no |  |  |

### `security`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `security.content_instructions` | string | no | One of: "never-obey" |  |
| `security.prompt_injection_defense` | string | no | One of: "strict", "standard", "disabled" |  |
| `security.input_sanitization` | boolean | no |  |  |
| `security.output_validation` | boolean | no |  |  |
| `security.pii_handling` | string | no | One of: "block", "redact", "allow" |  |
| `security.data_residency` | string | no |  |  |
| `security.audit_logging` | boolean | no |  |  |
| `security.processes_external_content` | boolean | no |  |  |

### `changelog`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `changelog[].version` | string | yes |  |  |
| `changelog[].date` | string | yes | Format date |  |
| `changelog[].changes` | Array of string | yes |  |  |
| `changelog[].breaking` | boolean | no |  |  |

### `applies_to`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `applies_to.agents` | Array of string | no |  |  |
| `applies_to.paths` | Array of string | no |  |  |
| `applies_to.events` | Array of string | no |  |  |
| `applies_to.model_tier` | Array of string | no |  |  |

### `validation`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `validation.last_validated` | object | no |  | Evidence that this policy was validated. Optional -- but when present every field is required, so an empty or partial object is a schema error rather than a way to look validated without being validated. |
| `validation.last_validated.model` | string | no |  |  |
| `validation.last_validated.date` | string | yes |  |  |
| `validation.last_validated.eval_score` | number | yes |  |  |
| `validation.last_validated.chock` | string | yes |  |  |
| `validation.known_good` | Array of string | no |  |  |

### `conflicts_with`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `conflicts_with[].id` | string | yes |  |  |
| `conflicts_with[].reason` | string | yes |  |  |

### `bundle`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `bundle.id` | string | yes |  |  |
| `bundle.shared_assets` | Array of string | no |  |  |

### `rule`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `rule.text` | string | yes | Max length 500 |  |

### `hook`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `hook.gate` | object | no |  |  |
| `hook.gate.kind` | string | yes | One of: "content_regex", "forbidden_ref", "dependency_allowlist", "test_integrity", "script", "egress_allowlist" |  |
| `hook.gate.on` | Array of string | yes | Min items 1 |  |
| `hook.gate.outside_repo` | Array of string | no | Min items 1 | Globs (absolute or starting with ~) of files outside the repository whose writes this gate may judge, at PreToolUse only. Needs tool_use in 'on'. |
| `hook.gate.action` | string | yes | One of: "block", "ask", "warn" |  |
| `hook.gate.message` | string | yes | Min length 1, max length 1000 |  |
| `hook.gate.params` | object | yes |  | Per-kind params are validated by checks_gate. |
| `hook.script` | object | no |  | A check that cannot be expressed as a gate kind, run by the installed hook from implementations/\<policy_id\>-\<event\>.{sh,py}. No kind and no params: the behaviour is the script's. No message either -- the script prints its own refusal, with the detail only it has. 'on' is authoritative: the compiler wires exactly these events, and the validator fails when a declared event has no script or a script is undeclared. Git events only: a script never runs at tool_use, tool_call, stop or in CI; declare the write path as a hook.gate (DET-6). |
| `hook.script.on` | Array of string | yes | Min items 1 |  |

### `skill`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `skill.skill_type` | string | yes | One of: "nl", "code", "hybrid" |  |
| `skill.entry` | string | yes |  |  |
| `skill.effects` | Array of string | yes |  |  |
| `skill.approval` | object | no |  |  |
| `skill.approval.required` | boolean | no |  |  |
| `skill.approval.mode` | string | no | One of: "human", "auto" |  |
| `skill.approval.justification` | string | no | Max length 500 |  |

### `workflow`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `workflow.effects` | Array of string | yes |  |  |
| `workflow.approval` | object | yes |  |  |
| `workflow.approval.required` | boolean | no |  |  |
| `workflow.approval.mode` | string | no | One of: "human", "auto" |  |
| `workflow.approval.justification` | string | no | Max length 500 |  |
| `workflow.control` | string | no | One of: "deterministic", "llm_driven" |  |
| `workflow.steps` | Array of object | yes | Min items 1 |  |
| `workflow.steps[].id` | string | yes |  |  |
| `workflow.steps[].uses` | string | yes |  |  |
| `workflow.steps[].mode` | string | no | One of: "inline", "delegated" |  |
| `workflow.steps[].input` | object | no |  |  |
| `workflow.steps[].output` | object | no |  |  |
| `workflow.steps[].on_error` | string | no | One of: "abort", "continue" |  |
| `workflow.outputs` | object | no |  |  |
| `workflow.max_delegation_depth` | integer | no | Minimum 1 |  |
| `workflow.aggregate_check` | boolean | no |  |  |

### `input_schema`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `input_schema.type` | string | yes |  |  |
| `input_schema.properties` | object | yes |  |  |
| `input_schema.properties.<name>.type` | string | yes |  |  |
| `input_schema.properties.<name>.description` | string | no | Min length 1 |  |
| `input_schema.properties.<name>.format` | string | no |  |  |
| `input_schema.properties.<name>.default` |  | no |  |  |
| `input_schema.properties.<name>.enum` | array | no |  |  |
| `input_schema.properties.<name>.items` |  | no |  |  |
| `input_schema.properties.<name>.properties` | object | no |  |  |
| `input_schema.properties.<name>.required` | Array of string | no |  |  |
| `input_schema.properties.<name>.additionalProperties` |  | no |  |  |
| `input_schema.properties.<name>.minLength` | integer | no |  |  |
| `input_schema.properties.<name>.maxLength` | integer | no |  |  |
| `input_schema.required` | Array of string | no |  |  |
| `input_schema.additionalProperties` | boolean | yes |  |  |

### `output_schema`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `output_schema.type` | string | yes |  |  |
| `output_schema.properties` | object | yes |  |  |
| `output_schema.properties.outcome` | object | yes |  |  |
| `output_schema.properties.outcome.type` | string | yes |  |  |
| `output_schema.properties.outcome.enum` | Array of string | yes |  |  |
| `output_schema.properties.outcome.description` | string | no |  |  |
| `output_schema.properties.<name>.type` | string | yes |  |  |
| `output_schema.properties.<name>.description` | string | no | Min length 1 |  |
| `output_schema.properties.<name>.format` | string | no |  |  |
| `output_schema.properties.<name>.default` |  | no |  |  |
| `output_schema.properties.<name>.enum` | array | no |  |  |
| `output_schema.properties.<name>.items` |  | no |  |  |
| `output_schema.properties.<name>.properties` | object | no |  |  |
| `output_schema.properties.<name>.required` | Array of string | no |  |  |
| `output_schema.properties.<name>.additionalProperties` |  | no |  |  |
| `output_schema.properties.<name>.minLength` | integer | no |  |  |
| `output_schema.properties.<name>.maxLength` | integer | no |  |  |
| `output_schema.required` | Array of string | no |  |  |
| `output_schema.additionalProperties` | boolean | yes |  |  |

### `runtime`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `runtime.max_retries` | integer | no |  |  |
| `runtime.max_identical_invocations` | integer | no |  |  |

### `composition`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `composition.pattern` | string | no |  |  |
| `composition.phases` | Array of object | yes | Min items 1 |  |
| `composition.phases[].id` | string | yes |  |  |
| `composition.phases[].mode` | string | yes |  |  |
| `composition.phases[].source` | string | no |  |  |
| `composition.phases[].invoke` | object | no |  |  |
| `composition.phases[].isolation` | object | no |  |  |
| `composition.phases[].concurrency` | object | no |  |  |
| `composition.phases[].failure_policy` | string | yes |  |  |
| `composition.phases[].result` | object | no |  |  |
| `composition.phases[].approval` | object | no |  |  |
| `composition.phases[].monitoring` | object | yes |  |  |
| `composition.monitoring` | object | yes |  |  |
| `composition.handoff` | object | yes |  |  |

### `scripts`

| Field | Type | Required | Allowed values | Description in the schema |
| --- | --- | --- | --- | --- |
| `scripts.entrypoint` | string | no |  |  |


---

Built from engine [5a4b6287a46e](https://github.com/open-coder-ai/chock/commit/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021) and catalog [1e60d211c1bb](https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f).