What the kernel holds
Every tool call runs in namespaces under Landlock and a system call filter, in a throwaway copy of your project. A layer that fails to apply fails the call, and there is no switch to turn it off.
Roadmap
Building an enterprise ready AI harness.
Chock is pre-alpha. This page is the order of the work and not a schedule: what the harness does today, what we are building now, and the hosted service that comes after those. The documentation says what each release does.
An organisation needs the harness, the policy above it, the record and a way to put all three on a fleet, so those ship as one product. The harness stays open source, and the log is written, sealed and checked on your machine with chock sessions verify, against a key you hold.
Built today
in the open source harness
A policy the agent cannot edit
A declarative table read before the sandbox exists and bound in read only. An organisation's bundle sits above it as a ceiling a project can narrow and never widen.
The ratchet
A session can narrow its own rules mid run and cannot widen them again without authorisation. Subagents inherit the narrower answer.
A log you do not have to trust
Append only and hash chained, every tool call carrying the policy decision that let it run. chock sessions verify finds an edit in the middle and names it.
Sealing
chock sessions seal signs the head of the chain with a software key, a smart card, or a card that can state the key never left it. An unsealed log never passes.
Export to your own systems
A verifiable copy on disk, or RFC 5424 syslog for a SIEM. A bundle can require a sink, and a session that missed it exits 9.
Next
making the record provable
The record says what happened. These say what was possible, and turn the agent set from something procedural into something a cryptographer would accept. They are the work in front of us, not a someday list.
A signature on the commit
Today the agent set is established by confinement and an approval record. A signature makes it cryptographic, so which commits came from an agent stops resting on procedure.
Session attestation
A sealed record at session start naming the layers, the policy by hash, the toolchain closure and the model. Because the table is immutable for the life of the process and the ratchet only narrows, that record is an upper bound on what was possible for the whole session.
A forge witness
The push path attested by the forge as a third party, so the chain does not end at the machine that made it.
Chock Platform
the hosted service, planned
The harness runs on one machine. Running agents across a fleet needs the rest of it: somewhere credentials are issued from, a policy that reaches every machine, somewhere the logs land, and a budget that holds across teams. Today that is a file you copy to five hundred machines. Chock Platform is the control plane that makes it something you operate.
Identity-bound credentials
Issue a short lived credential to a person, see which sessions across the fleet ran under it, and end a leaver's access everywhere on schedule.
Policy distribution and rotation
Change a rule once and every machine picks it up, with versions, signatures and expiry. The harness never widens, so a rotation reaches the fleet instead of taking it down.
An audit pipeline
Every machine's log lands in one place, chains verified as they arrive, seals checked against roots you trust, kept to your retention, replayed a session at a time and forwarded to your SIEM.
Remote approvals
A session anywhere in the fleet raises its approval to whoever is on call. Today an unanswered approval is a refusal, which is right at a desk and stops a CI run dead.
Fleet budgets and usage
See what each team, project and model is spending across every session, and hold a ceiling set in the policy rather than after the invoice.
Policy packs
Put a team on a ready made posture, such as no network or approved models only, mapped to the control frameworks an auditor already asks about.
What this page does not say
No dates, and no order beyond the grouping above. Nothing here implies a certification or an audit standard we hold. Remote attestation needs a hardware root of trust and is out of scope: a smart card means a key that cannot be copied, and a machine somebody already owns can still ask it to sign a lie.