From 9405a4c9764e823aa227f7eaf9407cd6f8c9e1ef Mon Sep 17 00:00:00 2001 From: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com> Date: Wed, 7 Oct 2026 01:54:20 +0000 Subject: [PATCH 1/2] docs(readme): README v2, nothing collapsed, one carrier per fact Removes every
block, so each heading, table and code block is visible. Drops the shared panels whose facts the visible text already carries; the hero cover stays, and becomes visual-only once the matching chock change merges (same file name). Co-Authored-By: Claude Opus 5.5 Signed-off-by: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com> --- README.md | 41 +---------------------------------------- 1 file changed, 1 insertion(+), 40 deletions(-) diff --git a/README.md b/README.md index de4fd96..06bad76 100644 --- a/README.md +++ b/README.md @@ -1,11 +1,9 @@
-

agentseam: Write a guard once. Run it in the agent you use. One handler API over each agent's hooks, instruction files and config, with an honest matrix of where a guard can block.

+

Chock mark on a dusk-blue background.

-
Text version - # Teach your AI agent what not to do. Open-source guardrails for AI coding agents: rules the agent reads, checks that run as it writes, and gates at commit and in CI. agentseam is the layer underneath: one handler API over every coding agent's hooks, instruction files, plugins and config, with a verified matrix of what each agent can actually enforce. @@ -16,11 +14,6 @@ Open-source guardrails for AI coding agents: rules the agent reads, checks that agentseam is a stdlib-only Python library and CLI that turns every coding agent's own hook system into one normalized event and one `Decision`, and records, per agent and per lifecycle event, what that agent can really do with it. Write a guard once and `agentseam install` wires it into the agent's own config. When an agent cannot enforce something, agentseam says so instead of installing a hook that silently does nothing. Free and open source (Apache-2.0). -
- -

Nine areas Chock checks, application security first, each with the policies that cover it and whether they enforce at commit, in the agent, or only advise.

-
Text version - ## Application security for the code your agents write Coding agents already ask before they run a shell command. What they do not check is the code they write: @@ -52,8 +45,6 @@ A handler is your own local code: whatever it costs, it costs no tokens, and a r reason to the agent's context. **Shift left:** the known classes are refused in the agent's own turn, before they reach commit, review or CI. -
- ## Install chock is on PyPI, but the release there (0.15.2, 30 Sep 2026) is older than the engine this page describes. Install the frozen engine from its commit (Python 3.11 or newer): @@ -62,9 +53,6 @@ chock is on PyPI, but the release there (0.15.2, 30 Sep 2026) is older than the pip install "chock @ git+https://github.com/open-coder-ai/chock@992711af4cf8d4fd9c4c861f10ef6e53374d75d7" ``` -

Two adoption routes: in your repository with chock init, chock add and chock sync, or in your coding agent as plugins.

-
Text version - agentseam itself is `pip install agentseam` (Python 3.9 or newer, no dependencies); the Quick start below runs end to end. ### Two ways to adopt it @@ -94,14 +82,6 @@ Commit the result. Plugin route: the five plugin repos are Chock adds no new place your code goes: checks run where the agent writes. The agent still sends its context to its own model provider; chock adds no additional destination. -
- -

-The stack: agentseam is the primitives layer under chock, the catalog, the plugins, your agents and the evidence repos.
-Capability matrix: 16 agents by 12 lifecycle events is 192 cells, of which 0 are graded enforced, 2 enforceable, 34 best-effort, 55 detect and 101 none, counted with matrix.enforcement_level() at agentseam 104da73. -

-
Text version - ## How it works An adapter per agent owns three things: payload parsing, the response dialect and the config shape. @@ -171,12 +151,6 @@ to a silent pass-through. | Gemini CLI | block + rewrite (fail-open) | `.gemini/settings.json` | vendor-source · 2026-08-28 | | OpenAI Codex CLI | block + rewrite (fail-open) | `.codex/hooks.json` | live-run-partial · 2026-08-28 | | Windsurf | block via exit code only; no file-write event | `.windsurf/hooks.json` | third-party-install · 2026-08-26 | - -
-10 more agents - -| Agent | What it enforces | Config file | Verified | -|---|---|---|---| | Devin | block + rewrite (fail-open) | `.devin/hooks.v1.json` | vendor-docs · 2026-08-26 | | Grok CLI | block on PreToolUse only (fail-open) | `.grok/hooks/agentseam.json` | vendor-docs · 2026-08-26 | | Antigravity | block, and can refuse to let the agent stop (fail-open) | `.agents/hooks.json` | vendor-docs · 2026-08-26 | @@ -188,8 +162,6 @@ to a silent pass-through. | Replit | no hook surface found in its docs; instruction files only | none | vendor-docs · 2026-08-26 | | Copilot CLI marketplace bundle | packaging identity only; dispatches through the VS Code Copilot adapter | none | vendor-docs · 2026-08-29 | -
- Of the 12 agents that claim `pre_tool` at all, 4 (Claude Code, Codex CLI, Cursor, VS Code Copilot) rest on a live run against the real agent; seven of the other 8 rest on documentation or a third-party install, and Gemini CLI on a read of the vendor's own source. None of those @@ -296,17 +268,10 @@ The in-agent tier is exactly the agentseam matrix: a catalog policy is never lab `enforcement_level()` grades the agent it runs in. No agent reaches `enforced`. Chock does not replace code review, your SAST suite or a penetration test; it refuses known classes while the agent writes, so they are fixed before review. -
- -

Guardrails, not guarantees: the three tiers, no matrix cell graded enforced, and no OWASP Agentic risk fully covered.

-
Text version - ## Guardrails, not guarantees Tiers: `commit` is a git hook or CI gate that exits non-zero. `in-agent` is the agent's pre-tool hook: best-effort, and it fails open. `advisory` is rule text the agent reads. No agent reaches `enforced` today: 0 of 192 matrix cells are graded enforced. OWASP mappings are partial: 10 of 10 Agentic risks have a policy, 7 have a slice refused at commit, none is fully covered. The engine is frozen at the commit above. Chock does not stop every attack: it closes common, known entry points before they ship. -
- ## FAQ for people and agents **Does agentseam use an LLM?** No. It makes no model call and imports no networking module in `src/agentseam`. @@ -335,9 +300,6 @@ partial and labelled so; see chock-catalog `docs/coverage.md`. - [`docs/coverage.md`](https://github.com/open-coder-ai/chock-catalog/blob/main/docs/coverage.md): catalog coverage, with partial mappings labelled. - [`.claude-plugin/marketplace.json`](https://github.com/open-coder-ai/chock-claude-plugins/blob/main/.claude-plugin/marketplace.json): the Claude plugin marketplace. -

The 13 public repositories of open-coder-ai: core, policies, evidence, plugins, templates and community files.

-
Text version - ## Part of open-coder-ai The 13 public repositories: @@ -393,4 +355,3 @@ is signed off (`git commit -s`). Adding an adapter must never require touching ` Apache-2.0. See [LICENSE](LICENSE). -
From 53877a3dcf05c454c22b246afe60401147552b80 Mon Sep 17 00:00:00 2001 From: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com> Date: Wed, 7 Oct 2026 01:57:43 +0000 Subject: [PATCH 2/2] docs(readme): hero alt text names the wordmark The hero now shows the repo's wordmark beside the mark (chock#244), so the alt text says so. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Jothi Mani Rajendran <250249270+jothimani-rajendran@users.noreply.github.com> --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 06bad76..f570e88 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@
-

Chock mark on a dusk-blue background.

+

agentseam wordmark and mark on a dusk-blue background.