Lead the README with the security guardrails each plugin ships

[jothimani-rajendran]

What

Reworks README.md (hand-written, not generated) so it leads with security:

• Security-first header: the existing badges plus plugins (26), deny hooks (14), and the catalog's 48 policies, 1,179 eval cases and OWASP Agentic 10/10.
• The refreshed hero GIF, with a caption saying it shows commit-time refusal and which of its guards are packaged here.
• What these plugins refuse: a table grouped by security area. It lists only the 14 enforcing packages published here, each marked guard or gate, with its catalog eval-case count. The 12 advisory packages and the catalog policies not packaged here are in collapsible lists.
• How a refusal works in Copilot: the existing guard/gate text is kept verbatim, including the JSON verdict carried on exit 0. The statement that no package here has a witnessed block yet (claims come from vendor docs) is kept and repeated next to the table.
• A family table linking all five plugin repos, and a Contributing table with concrete upstream first contributions.

Install steps are unchanged. This PR matches the structure of the sibling PRs in the claude, cursor, codex and devin plugin repos.

Why README.md is safe to edit here

The generator (chock plugin build / chock marketplace build) writes the packages and PLUGINS.md, not README.md. A test regeneration with chock 0.15.0 left the README unchanged. close-prs.yml only closes PRs from forks.

Checks

• No workflow, tool or test in this repo reads README.md.
• All relative links resolve, and every table row has the right column count.

Note for a reviewer

docs/assets/hero.svg in this repo is titled "witnessed on a real install", which contradicts the README's "no witnessed block yet". This PR does not reference that figure. One of the two statements should be corrected.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LAxde3s5KW8N36kS8LF3er

---

Generated by Claude Code

[jothimani-rajendran]

Generated-only / verify is red, and not because of this PR. This PR changes only README.md, which chock plugin build / chock marketplace build never write. So the diff the check finds is in generated files this PR doesn't touch. main fails the same check: see run 34175133625. The published tree was built from framework v0.11.2, and the catalog now declares v0.15.0.

No fix fits inside this PR. The generated tree should only change through the Publish workflow (workflow_dispatch), which rebuilds from chock-catalog and commits the result. I didn't re-run the check because it's a deterministic diff and would fail the same way. Once Publish has run on main, merging main into this branch should turn it green.

---

Generated by Claude Code

[jothimani-rajendran]

Closing at the owner's request (2026-10-05). The README refresh will be redone once before launch, so that it matches the chock.sh site and the current labels.

---

Generated by Claude Code