chock sync wires every agentseam adapter it can reach (E-ALL)

[jothimani-rajendran]

What

E-ALL from org-plan plan/one-oh-gaps.md (c5a8305). chock sync now takes its agent list from agentseam's adapter registry, with agentseam pinned to main bebbfa6 as a direct reference.

Agent names and the pin

• Every adapter is a valid supported_agents name. CHOCK_AGENT is the alias table plus each remaining adapter id, written with -.

Newly wired: every adapter whose hook config is in the repository as JSON or TOML

Agent	Hook file
factory_droid	.factory/hooks.json
goose	.agents/plugins/chock/hooks/hooks.json (chock's own plugin slot)
openhands	.openhands/hooks.json
mistral_vibe	one owned block in .vibe/hooks.toml

• Mistral Vibe's block goes through agentseam's write_block and render_config.
• goose needs no plugin.json, per goose's source at aaif-goose/goose@3295f5e:
  • crates/goose/src/plugins/discovery.rs:56-101 and :181-201 treat every subdirectory of <project>/.agents/plugins/ as a plugin.
  • crates/goose/src/hooks/mod.rs:424-440 loads each plugin's hooks/hooks.json.
  • Goose's own test finds_project_scope_plugin (discovery.rs:265-310) writes only hooks/hooks.json.
  • The manifest is read only when installing a plugin from source (plugins/formats/open_plugins.rs:41-60).

How each new runtime answers

• Each answers in its vendor's grammar. These were measured against agentseam's goldens.
• None of these agents can prompt. So an ask becomes deny or block, and CHOCK_CAN_ASK is 0 at their pre-tool gates.
• Each vendor's documented timeout field is recorded with its source URL.

What sync prints

• For each agent it wires: agentseam's tier-table row for pre-tool (tier, grade, fail mode, basis, date).
• "Untested" when the witness ledger has no live run of chock's hooks in that client.

Not wired yet, each listed in a test with its reason:

• cline: a hooks directory runs one command per event.
• junie and kimi_code: their config is in the home directory.

Other changes

• Witness updates (orchestrator additions):
  • Cursor no longer gets the install "Untested" warning (W-CUR, witness-cursor-2026-10-11).
  • Copilot's gate label now says the write is judged before it lands (witness-copilot-2026-10-11, Copilot CLI 1.0.94). A client note says VS Code agent mode is unmeasured.
• figures.yml gains a step that runs only on failure. It prints each drifted docs/figures/*.png as base64, so the runner's exact raster can be committed. actionlint and zizmor are clean, and it adds no new action, permission or secret.
• README and docs/enforcement-surfaces.md gain rows. Both tables are test-checked against surfaces.py.

Definition of done

• chock check validate and verify, and chock sync --repo . --check: all wait on the owner regen below.
• chock check --only matrix
• pytest -q (local, Python 3.12): 3583 passed, 88 skipped, 1 failed. The failure is test_compiled_freshness, which waits on the same owner regen.
• ruff check ., ruff format --check .
• Changelog fragments added

Owner step (it must be the last commit): run chock sync --repo . and commit .chock and chock.lock. Measured in a scratch copy, it modifies 9 .chock/bin files and chock.lock and adds 60 .chock/compiled files.

Claims

• No surface is described as enforcing more than it installs. Grades and bases come from agentseam's tier table, and the new agents print "Untested".

🤖 Generated with Claude Code

[jothimani-rajendran]

The validate jobs (3.11, 3.12 and 3.13) fail at the chock check --only validate step with compiled_drift in this repo's own .chock/bin and .chock/compiled. The cause is the agentseam pin bump: its bundler changed the 9 runtimes, and the 4 new agents add 60 compiled fragments. Those files, plus chock.lock, are owner-only, so this branch cannot regenerate them.

Fix (owner), on this branch:

pip install -e . && chock sync --repo . && git add .chock chock.lock && git commit -s -m "regen .chock for agentseam bebbfa6"

Measured in a scratch copy, that commit modifies 9 .chock/bin/*.py files and chock.lock and adds 60 .chock/compiled files. After it, chock check --only verify and chock sync --repo . --check were clean, and the local full pytest had only test_compiled_freshness failing before the regen.

figures and brand-assets failed on the placeholder archive hash. dddb4f8 sets the hash pip measured.

---

Generated by Claude Code

[jothimani-rajendran]

figures on 1b1e6e2: every SVG and the social preview now match the generators. Only docs/figures/social-card.png differs byte for byte. Its text has to change: the card now reads "20 chock agent names map to 19 agentseam vendors".

I could not reproduce CI's rasterization from this container, which runs Ubuntu 24.04 with cairo 1.18.0 and the pinned cairosvg 2.9.0, cairocffi 1.7.1 and pillow 12.3.0. As an oracle I regenerated main's own card from main's source. Across 13 fontconfig sets (DejaVu, Liberation, Noto and others, with and without the system conf.d), none reproduced main's committed PNG (26d0a619…, last rendered 2026-09-09).

The fix needs a CI-identical render of that one file. Either:

• a run of cd docs/figures && python make_social_card.py on an ubuntu-latest runner, with the PNG committed; or
• a figures.yml step that uploads docs/figures/social-card.png as an artifact on failure, so the render can be committed. That is a workflow edit, so it needs SHA pins and the orchestrator's review.

The validate jobs remain blocked on the owner-only .chock regen in the earlier comment.

---

Generated by Claude Code