Your AI governance dashboard is probably lying to you. Mine was too.

This is the author's first open source project and it began with an uncomfortable realization about their own setup. They were using a coding agent that wrote more code than they could honestly review. The author had guardrails in place, but upon checking what was actually enforced, they found that almost nothing was blocked. The rules were just prose in a file that the agent read and weighed against everything else in its context.

The author's new project, Chock, aims to address this gap. It is governance-as-code for AI coding agents, with policies written as plain reviewable files committed to the repository. Chock compiles these policies into whatever enforcement each agent supports, such as pre-tool-use hooks, Git hooks, and CI gates. The policies are committed content, traveling with every clone and fork, ensuring they are always in the agent's context.

The coverage report in Chock distinguishes between policies that are actually enforced and those that are merely advisory, based on whether the specific enforcement mechanism is installed for that agent. The report provides a clear picture of the enforcement status for each agent.