Skip to content
Chock
Documentation

This page is the documentation for unstable. Read the current version.

Documentation unstable

The pages as they stood in the newest build of the default branch. Every link here stays in unstable. The current documentation is elsewhere.

Running a session

chock run from the command line to the exit code: the session log, devices, getting the work back out of the workspace, cost, the task list, and chock doctor.

Roadmap

what is not built yet, and the faults Chock is known to have. ## Using a session

Using

The tools

the 23 tools, what each one asks for, how every call is gated, and provide_tool for a program the session has not got.

Nix, from inside a session

nix_eval and nix_build, what a build may fetch while it runs, mirrors, and where your flake inputs come from.

Approvals

what a session asks a person, how the question reaches them, where an approved apply lands, and what happens when nobody is there.

Driving Chock from an editor

driving Chock from an editor over the agent client protocol: both versions, what the editor is told, and the four things Chock will not take from one.

Subagents

spawn_agent, the depth and width limits, the budget slice, and a spawn that waits or carries on.

Notes an agent keeps between sessions

the notes an agent keeps between sessions, their bounds, and the hazard a writable memory directory is.

Project instructions

the three layers of AGENTS.md, why they are never flattened, and how they differ from a note.

Skills

Agent Skills read off disk, the three layers and their defaults, and the four things a skill may never do. ## Configuring a project

Configure

Configuration

config.zon, provider instances, how much context a model holds, and every block of the project's own chock.zon.

Policy

how a rule is read: the fields, the decisions, precedence, wildcards, deny_read, and the ratchet an agent cannot lift.

The actions

the reference for every action name a rule can carry, and what Chock ships for each.

Web search

the web search engine: the three kinds, the key in the credential store, and the org ceiling over both.

Secrets for a tool

giving a tool call a secret the agent never sees: the mapping, the action every use is asked under, and what the log records.

An organisation above a project

the org policy bundle, the budget, the subagent limits, and the limits and nix ceilings. ## Security

Security

The threat model

what the sandbox is built against, one attack walked end to end, and what is not covered.

The sandbox

the layers a tool call runs inside, the workspace, the mount tree, the limits, device passthrough, what macOS gives, and what chock doctor reports.

The red team harness

the red team harness, what two models proved, and the one boundary that moved. ## Running the tooling

Operate

The daemon

chock daemon, chock serve, the control protocol, and handing a session over with chock detach.

Toolchains, and where the compiler writes

the dev shell, a container image instead, where a compiler writes, and every path in a tool call's mount tree.

Credentials

chock login, where a credential goes, where a lookup goes, and why there is no argument and no environment variable for one. ## Extending Chock

Extend

Plugins

tools you supply yourself, as WebAssembly, and how each one is gated.