protect-agent-config

{
  "name": "protect-agent-config",
  "version": "0.2.0",
  "description": "Guard against an agent hand-editing its own guardrails. Agent instruction files (AGENTS.md and the per-agent wrappers), permission files (.claude/settings.json, .mcp.json), the dependency allowlist (.chock/dependency-allowlist.txt) and vendored enforcement (.chock/bin/, .chock/compiled/) define what the agent may do -- so a shell command that rewrites them is the agent modifying its own authority (MITRE ATLAS AML.T0081). The guard refuses shell writes to those paths -- a redirect, rm/mv/tee/sed -i, cp into the path, git checkout/restore, PowerShell Set-Content/Add-Content/Out-File; reads and copies out pass, and `chock sync` passes. Best-effort and deliberately coarse. The 'chock: approved-config-change' marker is friction plus an audit trail, not authentication. A second, tool_use-only gate refuses Edit/Write to the same paths; it never runs at commit, so a person stays free to edit them. [Session-enforced in Codex by a PreToolUse hook: a matched command is denied before it runs (witnessed blocking on Codex Desktop, Windows, 2026-08-24; the deny is returned as hook JSON, not an exit code, which Codex's Windows shell wrapper mangles). Codex requires a one-time trust review per hook -- the plugin is ADVISORY until you approve its hook, and a plugin update voids that trust until re-approved. The hook needs git and a Python 3.11+ (python3, python or py) on PATH; with no working Python it exits 2 rather than allowing, and any other failure of the HOOK (missing git, a timeout, an unexpected exit) fails OPEN. A failure of the GUARD it runs is a DENY here, because Codex rejects the confirmation prompt the other clients get. Repo-wide enforcement at commit time and in CI still needs `chock sync`.]",
  "author": {
    "name": "chock-core"
  },
  "repository": "https://github.com/open-coder-ai/chock-catalog",
  "license": "Apache-2.0",
  "keywords": [
    "chock",
    "policy-as-code",
    "rule",
    "advise",
    "{'control': 'asi03', 'coverage': 'partial', 'note': 'blocks shell self-modification of agent permission and instruction files; identity design and grant scoping remain advisory'}"
  ],
  "interface": {
    "displayName": "Protect Agent Config",
    "shortDescription": "Guard against an agent hand-editing its own guardrails.",
    "composerIcon": "./assets/icon.svg"
  },
  "skills": "./skills",
  "hooks": "./hooks/hooks.json"
}