{"slug": "sandbox-first-ai-coding-harness", "title": "Sandbox-first AI coding harness", "summary": "Chock is a sandbox-first AI coding harness that runs coding agents inside the operating system's own sandbox on a throwaway copy of the project, under a policy file the agent can read but cannot edit. The tool, available on Linux and macOS, logs every turn, tool call, approval and cost in an append-only, hash-chained session log, and the sandbox cannot be turned off — if a sandbox layer cannot be applied, the tool call does not run. Chock's red team harness, run via 'zig build redteam', found one fault across two models tested, which the project says is now closed on both platforms.", "body_md": "Chock runs your coding agent inside the operating system's own sandbox, in a throwaway copy of your project, under a policy the agent cannot edit.\n\nEvery turn, tool call and approval goes into a session log you can read afterwards. The log is append-only and hash-chained, so an auditor can check it without trusting the agent or us.\n\nLinux & macOSNo way to turn the sandbox offEvery turn logged\n\nchock\n\n``` bash\n# can this machine contain a session$ chock doctor# store a credential$ chock login --provider aiand$ chock run \"add a test for the parser\"\n```\n\nWhy Chock\n\nChock takes the decisions out of the agent's hands.\n\nA coding agent runs commands, writes files and wants to reach the network. Most harnesses ask the agent to be careful. Chock puts what it may do outside the agent's control.\n\nThe agent can't leave the sandbox\n\nEvery tool call runs inside your operating system's sandbox, on a copy of your project, so your real files are never changed by the agent. If a sandbox layer can't be applied, the tool call doesn't run, and there is no option to turn the sandbox off.\n\nEvery step is logged\n\nChock records each turn, tool call, approval and cost in a session log. You can read it afterwards and see what the agent did and what it cost. The decision that allowed an action is written before the action runs.\n\nThe agent can't change its rules\n\nWhat the agent is allowed to do is a file in your project, chock.zon. The agent can read it and cannot edit it. If an action needs your approval and nobody answers, the action is refused.\n\nThe sandbox\n\nWhat Chock isolates on each OS\n\nChock uses the sandboxing built into Linux and macOS. Run chock doctor to see which protections are on for your machine, and what is lost when one is not.\n\nLinux\n\nA user namespace, a mount namespace, a PID namespace and an IPC namespace\n\nAn empty network namespace\n\nA Landlock rule set\n\nA system call filter\n\nThe credential store is never mounted into the sandbox\n\nmacOS\n\nSeatbelt holds the paths, the network including unix sockets, the signals and shared memory\n\nDarwin's own resource limits\n\nmacOS gives no bind mount and no usable system call filter, so Chock does not list those two layers on macOS. The driver reports only what it has proved.\n\nEvery tool call, held\n\n01user namespace\n\nno privilege on the host\n\n02mount namespace\n\na throwaway copy of your project\n\n03pid + ipc namespace\n\n04empty network namespace\n\n05landlock\n\nthe filesystem, held by the kernel\n\n06seccomp\n\n31 calls killed, 2 read by argument\n\nthe tool call\n\nyour tool call, in a copy of your project\n\nMeasured by the red team harness\n\nzig build redteam checks a canary set before and after a real session, and answers \"did it break out\" as a value. Grading a transcript by hand is how a real escape gets argued away. Two models have been run against it, and the one fault found is closed on both platforms. Read the threat model.\n\nFor security and platform teams\n\nEvery other workload you run has isolation, policy and an audit trail.\n\nYour developers are already running coding agents, on their own machines, next to production credentials. Nothing admits a session, nothing enforces what it may do, and nothing records what it did that you did not have to take on trust.\n\nChock puts the three controls you already require of a service around an agent: a sandbox it cannot switch off, a policy it cannot edit, and a log it cannot rewrite. At review time that gives you attribution. Establish which commits came from an agent, and the rest are human by elimination.\n\nThe log covers every path the agent has\n\nA log is worth what the agent cannot go around. Every tool call in Chock goes through the sandbox, so there is no unrecorded path to take.\n\nTen harnesses were read at the source. The three that sandbox at all mount the whole filesystem into it, and not one keeps a tamper evident log, so who approved what cannot be answered afterwards.\n\nWhat you can hand an auditor\n\nEvery event carries the hash of the one before it. chock sessions verify finds an edit in the middle and names it.\n\nchock sessions seal signs the head of the chain. A software key, a smart card key, or a card key with the card's own statement that it never left the card. An unsealed log never passes.\n\nEvery tool call carries the policy decision that let it run, and an approved apply records who answered.\n\nThe chain\n\n01 · built\n\nThe agent reaches your repository through one act and no other.\n\n02 · built\n\nA named person approves that act, and the answer is logged.\n\n03 · soon\n\nA signature on the commit, so the agent set is cryptographic rather than procedural.\n\n04 · soon after\n\nThe forge attests the push as a third party.\n\nEach link closes what the one before leaves open. The first two are in the harness now, and the other two are the next things we build, not a someday list. The roadmap says where each one stands.\n\nAn organisation policy a project cannot raise\n\nYou set the ceiling once and every project inherits it. A project's chock.zon can narrow what you allow and cannot widen it, a session can narrow its own rules while it runs, and subagents inherit the narrower answer. No repository can opt itself out.\n\nThere is no flag, environment variable or failure path that runs a tool call outside the sandbox, so a developer who is blocked cannot relax the ceiling to get moving. Zed, for comparison, offers a Run Unsandboxed button when its sandbox will not start.\n\nWhere this stops\n\nAttribution covers the sessions that ran under Chock, so it is worth what your rollout covers. Sealing is only as good as your key custody, because whoever holds the key can sign a record. The log says what an agent did, not what it could have done. There is no remote attestation and no hardware root of trust, and getting one policy onto a fleet is a file you place on each machine today, not a product.\n\nComparison\n\nHow other harnesses sandbox their agents\n\nWe compared Chock with three other harnesses by reading their source code, not their documentation. Each column names the commit we read and the date we read it. Four rows of nine are here.\n\nThe terminal and the fetch tool. Reading, writing and deleting a file run in process.\n\nNone. Their SECURITY.md calls the permission prompt a user interface feature with no isolation behind it.\n\nNone anywhere in the tree.\n\nWhat a tool call can read\n\nA minimal mount tree. The credential store is never mounted, and the environment is scrubbed.\n\nThe mount is the whole root, read only. Nothing scrubs the environment, so every token in the parent shell arrives with it.\n\nThe whole machine.\n\nThe whole machine.\n\nTurning the sandbox off\n\nThere is no switch. A layer that fails to apply fails the tool call.\n\nThe Linux failure path offers a Run Unsandboxed button, so fail open is a choice a person can make.\n\nThere is nothing to turn off.\n\nThere is nothing to turn off.\n\nWhat a rule is matched against\n\nThe act a call performs, and the directory the binary came from. A git shim does read the argument vector, and the documentation says the shim stops a mistake and does not stop an attack.\n\nRegular expressions over the command text, with chained commands parsed across 14 shells. A wrong parse is a way through.\n\nThe tool's input: the command text, the path, the URL.\n\nA regular expression denylist of dangerous commands. Writing the argument into a variable first walks past it.\n\nHoldsIn partNot there\n\nA fair note\n\nThe other harnesses have years of work behind them and do far more than Chock, which is pre-alpha. This table compares one thing: what a tool call can reach.\n\nTake a build for Linux or macOS from the downloads page, or build it yourself with Zig 0.16 and zig build.\n\nStep 2\n\nCheck your machine\n\nRun chock doctor. It applies each sandbox layer for real and tells you which ones hold here, before an agent runs anything.\n\nStep 3\n\nAdd a provider\n\nRun chock login --provider aiand to store a key. Name your providers in ~/.config/chock/config.zon: ai&, Anthropic, or any OpenAI-compatible endpoint. Chock reads that file and never writes it.\n\nStep 4\n\nRun a task\n\nIn your project, run chock run \"add a test for the parser\". Bare chock opens the full screen interface and asks you for the task there.\n\n~/some-project\n\n``` bash\n# what holds on this machine$ chock doctor# store a key$ chock login --provider aiand# run a task$ chock run \"add a test for the parser\"# the same task, with no subcommand$ chock -- add a test for the parser# the interface, which asks for the task$ chock\n```\n\nA task typed on the line goes after --, so chock fix the parser is refused. A mistyped chock rnu that quietly became a task would spend your money on a typo. echo \"fix the parser\" | chock works too.\n\nGet in touch\n\nWhether you want to use Chock, help build it, or back where it is going, we want to hear from you.", "url": "https://wpnews.pro/news/sandbox-first-ai-coding-harness", "canonical_source": "https://chock.ws/", "published_at": "2026-09-27 09:52:06+00:00", "updated_at": "2026-09-27 10:31:21.826699+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "developer-tools", "ai-tools"], "entities": ["Chock", "Linux", "macOS", "Landlock", "Seatbelt", "seccomp"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/sandbox-first-ai-coding-harness", "markdown": "https://wpnews.pro/news/sandbox-first-ai-coding-harness.md", "text": "https://wpnews.pro/news/sandbox-first-ai-coding-harness.txt", "jsonld": "https://wpnews.pro/news/sandbox-first-ai-coding-harness.jsonld"}}