Product
Chock
A security-first harness for AI agents.
Agents work in a locked-down copy of your project, under a policy that governs what they may read, run, and change. Their work comes back as a commit you choose to keep.
git clone https://git.lilithsemi.com/LilithSemi/chock.gitWhy it exists
Built for the work we do ourselves
We use LLMs to help with our own work every day, and we wanted their speed without handing them the keys to the repository.
Chock is the harness we built for that. Security comes first, so the sandbox is designed into the harness itself rather than wrapped around it. Sandboxing is something you design a harness around, not something you bolt on afterwards.
How it works
From a task to a commit
- 01
Set the policy first
Decide what the agent may read, run, and change before it starts work. The sandbox holds it to that policy for the whole session.
- 02
Give it a copy to work in
The agent works in its own locked-down copy of the project. Your checkout stays exactly as you left it.
- 03
Keep the commit
Finished work comes back as a commit on top of your project. Read the diff, then keep it or throw it away.
Advantages
What the design buys you
Chock
The harness talks to your provider. The sandbox talks to no one.
A tool call runs in a network namespace with no interface at all, so nothing the agent runs can reach a host. The model is reached by the harness, outside the sandbox. A task that needs a page gets it from a broker the agent cannot reach.
- Fail closed
- A layer that fails to apply fails the tool call. Nothing is quietly skipped, and chock doctor measures each layer and says which are on.
- Policy, read only
- The rules are a table in your project, bound into the workspace read only. The agent can narrow its own policy and cannot widen it again.
- A log, not a promise
- Every turn, tool call, approval and cost is an event, written before the act happens. An approval nobody answers is a refusal.
- Nix aware
- A project with a Flake dev shell gets that shell's closure and nothing else from the store. The agent can ask for one more program, and only that one arrives.
- Tested, not assumed
- A red team run set up an io_uring ring inside a tool call, the classic way past a system call filter. The paths were still refused and the network was still unreachable.
What's inside
What the harness gives you
Built in, not bolted on
The sandbox is part of the harness itself, not a bwrap wrapper around a harness that was never designed for one. Every tool call the agent can make passes through it, because Chock was built that way from the start.
Policy decides
What the agent may read, run, and change is written down as policy before the session starts. The sandbox enforces it. It is not a request the agent can argue its way out of.
Room to work
Locked down does not mean helpless. The agent runs builds and tests inside the sandbox, reads its own output, and fixes what it broke before handing work back.
A commit you choose to keep
Nothing touches your project until you have read the diff. Keep the commit, or drop it and start fresh.
Hard boundaries
What Chock will not do
The lines the harness holds for the whole session. They do not move, whatever the agent is working on.
Will not
Touch your checkout
The agent works in a locked-down copy of the project. Your checkout stays exactly as you left it, whatever the agent does.
Will not
Step outside the policy
What the agent may read, run, and change is written down before the session starts. The sandbox enforces it for the whole session.
Will not
Land work you have not read
Finished work comes back as a commit on top of your project. You read the diff first, then keep it or throw it away.
Will not
Bolt the sandbox on afterwards
The sandbox is designed into the harness itself, not wrapped around it. Every tool call the agent can make passes through it.
Providers
Bring your own model
One credential per provider, stored by the harness and never inside the sandbox. Chock reads your configuration and never writes it.
- ai&
- Anthropic
- Any OpenAI compatible endpoint
Also from Lilith Semi
One workflow, start to finish
Chock, Aegis, and Harbor. One for the agent that writes your code, one for the FPGA it runs on, one for the libraries it builds with.
Contact
Putting agents to work on your code?
Tell us what your agents work on today and what you want fenced off from them. We will come back with questions and next steps.