From 1821cc0a2b3f73aa61e0d9d31cb4adf68b0bfea4 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 30 Aug 2026 13:14:07 +0000 Subject: [PATCH] docs: badge what this repository actually guarantees Every sibling repository carries a row of trust signals and this one carried none, so a visitor had no at-a-glance answer to "is this maintained, what may I do with it, and where do changes go". Three badges, each backed by something real here: - **Generated-only** -- the workflow of the same name, which regenerates from the pinned catalog sources and fails on any difference. That is not a lint, it is this repository's security argument: what you install is exactly what the catalog published. It is the badge most worth having here, so it leads. - **License Apache 2.0** -- the LICENSE already in the repository. - **Contribute upstream -> chock-catalog** -- deliberately NOT the "PRs welcome" badge every sibling carries. This repository closes hand-written pull requests by design (see close-prs.yml); review belongs where the source is. A "PRs welcome" here would invite people into a pull request that gets closed unread, which is worse than no badge at all. No OpenSSF Scorecard badge: there is no scorecard workflow in this repository, and a badge for a check that does not run is exactly the kind of claim this project exists not to make. Signed-off-by: Claude --- README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/README.md b/README.md index d189b86..a64c02c 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,9 @@ # chock-cursor-plugins +[![Generated-only](https://github.com/open-coder-ai/chock-cursor-plugins/actions/workflows/generated-only.yml/badge.svg)](https://github.com/open-coder-ai/chock-cursor-plugins/actions/workflows/generated-only.yml) +[![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE) +[![Contribute upstream](https://img.shields.io/badge/contribute-chock--catalog-8957e5)](https://github.com/open-coder-ai/chock-catalog) + Chock policies packaged as installable plugins for **Cursor**. Guard policies ship a real `beforeShellExecution` hook, so a matched destructive command is **denied in the editor before it runs** — witnessed blocking on a real Cursor install (2026-08-24), with benign