Glossary
The vocabulary that runs through the rest of the docs. Each entry is a short
definition; follow the link for the page that covers the term in depth. Every
term has its own anchor, so you can deep-link a single definition (for example
glossary/#output-reference).
Core model
Workspace
The magus root directory that owns a set of projects and shared config; the unit magus operates over. See workspace.
Referenced on 245 pages
- Affected
- Cache model
- Charms
- Compatibility
- Concurrency
- Dependencies
- Engines
- Formatting, linting, and generated files
- Insight
- Knowledge graph
- Merge queue
- Remote caching
- Review
- Sandbox model
- Secret providers
- Secrets
- Services
- Spells
- Target output references
- Targets
- Telemetry
- Tokens and grants
- Tool identity
- Volatility
- Workspace and projects
- Workspace providers
- bash spell
- docker spell
- go spell
- typescript spell
- Agents
- Any other host
- Claude Code
- Codex
- Cursor
- Debugging magusfiles
- Editor setup
- Event stream design notes
- Getting started
- Git integration
- GitHub Actions
- Guard hook templates
- Jobs and leases
- MCP
- Nx
- Pull request advice
- Quick start
- Reviewing your changes
- Skills
- The broker and the server
- The event stream
- The guard
- Tips and tricks
- Writing a spell
- ActivityService
- Console API
- Diagnostics
- FAQ
- GraphService
- Guard rules
- InsightService
- Logging and verbosity
- MGS1001: no ci target defined
- MGS1002: spell import shadowed
- MGS1003: bespoke phase-fragment target name
- MGS1006: unknown target
- MGS1010: affected set could not be computed
- MGS1011: cross-project output names an unusable owner
- MGS1012: cross-project output forms a dependency cycle
- MGS1013: cross-project output glob escapes its owner
- MGS1015: cross-project dependency names an unresolvable project
- MGS1016: workspace-local Go replace directives drifted
- MGS1020: output owned by two targets
- MGS1021: workspace requires a newer magus
- MGS1022: member only callable from a magusfile
- MGS1023: workspace provider reported an unusable project path
- MGS1024: workspace provider project shadowed by a magusfile
- MGS1028: a changed file seeds a project it does not key
- MGS1029: source glob reaches into a pruned directory
- MGS1031: a project's output is another project's source
- MGS1038: a magus.project option was removed
- MGS1040: magus.yaml has a key this magus does not know
- MGS1041: a remote spell import is not declared
- MGS1042: a remote spell does not match its digest
- MGS1043: a remote spell's lock entry is missing or stale
- MGS1044: a spell override replaces nothing usable
- MGS1045: a magus\guard.spawn, command or write registration is unusable
- MGS1101: this VCS backend cannot answer that
- MGS2001: path read denied
- MGS2002: path write denied
- MGS2004: sandbox config unresolved
- MGS2006: PATH-shim manager stripped
- MGS2007: exec denied
- MGS2008: magus socket withheld
- MGS2010: sandbox weakened
- MGS2012: sandbox required
- MGS3001: descendant project boundary crossed
- MGS3002: VCS unavailable
- MGS3005: tool too old
- MGS3007: project lock held by an ancestor run
- MGS3008: no workspace root found
- MGS3009: machine budget exhausted
- MGS3010: redundant gate deferred
- MGS3011: target exceeded its declared timeout
- MGS3012: invocation stalled
- MGS3014: gate superseded
- MGS3016: workspace failed to load
- MGS3017: workspace still loading
- MGS3018: a directory as a job write path
- MGS3022: no broker answered
- MGS3030: pipe upstream failed
- MGS4001: filesystem race condition
- MGS4002: declared output overlap
- MGS4004: potential undeclared dependency
- MGS4007: undeclared source modified
- MGS4008: unordered same-step write
- MGS7001: unresolvable buzz import
- MGS8001: output ref not found
- MGS8004: output ref was produced on a different machine
- MGS9010: console file withheld
- NotesService
- Remote spells
- StatusService
- The CLI in practice
- The Go SDK
- ToolService
- agent-sign-off: an agent stamping a read receipt or closing an attention request, which only a person may do
- backtick-substitution: a backtick command substitution, which inside double quotes runs a command
- brief-command: a spawn or continuation brief that teaches a command the guard denies
- busy-wait: a loop polling for work you started, which announces its own completion
- buzz-unbriefed: the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skill
- cache-dir-write: a write into this checkout's magus cache dir, which magus alone owns
- capture-filter: a filter over a run capture or log, which cuts the failure block apart
- cd: a `cd` before a magus command, when the project is an argument
- chained-run: several magus runs chained on one line, where the dependency graph would have run them
- checkpoint-state: a command reaching for a tree's identity, which a revision alone cannot give
- claimed-declaration: a leased edit landing in a declaration another live job claims (`run.go#executeStages`)
- credential-verb: an agent minting, printing, rotating or revoking a credential through the CLI
- exit-status-echo: a line ending by printing an exit status, which the harness already reports
- filter-without-input: a filter with no file, pipe or redirect, which reads a stdin nothing feeds
- focus: a read or write outside the paths the running job declared
- gate-repeat: the gate run again soon after it passed, repeating work already done
- generated-write: a hand edit to a declared output, which the next run overwrites
- graph-stale: a graph read while the index is older than the sources it describes
- hook-wiring: a write to the host wiring that decides whether these rules run at all
- installed-skill: a write to an installed skill copy, which re-installing discards
- interpreter-rewrite: an inline interpreter rewriting a file this tree already carries
- knowledge-graph diagnostics
- lease-invalid: a call naming a lease this workspace's job store does not declare
- lease-terminal: a call naming a lease whose row has already finished
- leased-path: a write into paths a running lease owns, by a caller that names no lease
- magus affected
- magus broker
- magus buzz
- magus clean
- magus command
- magus completion
- magus config
- magus describe
- magus diff
- magus doctor
- magus events
- magus graph
- magus init
- magus ls
- magus mcp
- magus module
- magus notes
- magus query
- magus queue
- magus refs
- magus run
- magus self
- magus server
- magus session
- magus shell
- magus spell
- magus status
- magus stdlib
- magus vcs
- magus version
- magus watch
- magus x
- magus-architecture-review
- magus-buzz-write
- magus-change-summary
- magus-commit-composition
- magus-docs-lookup
- magus-multi-agent
- magus-sdk
- magus-vcs-hygiene
- magus-workspace-rules
- magus.yaml configuration
- magus\guard.command
- magus\guard.spawn
- magusfile diagnostics
- memory-write: a write to a memory file, where the memory surface is the way in
- merge-side-checkout: a checkout of one merge side over a conflicted file, which discards the merge
- new-file: a new file in a directory whose naming has settled
- new-source-dir: a new file that opens a directory, which is a boundary rather than a file
- notes-author: an agent authoring a human's note, whose only provenance is who wrote it
- output-pipe: magus output piped into a filter, when magus projects the record itself
- output-redirect: magus output redirected to a file, which the run log already holds
- pipe module
- precedent-search: a hunt for one distinctive name, which refs answers with verified sites
- process-poll: a process table inspected to wait on magus work the lock already reports
- push-gate: a push the run log does not prove ungated, which names the gate and lets it through
- push-ungated: a push at a commit with no green gate: the person is asked, a leased worker refused
- raw-tool: a toolchain command a spell already wraps, run outside the cache
- regen-source: a hand edit to a file a target regenerates
- revert-classify: a revert that has not classified what it is reverting
- sandbox diagnostics
- scope-drift: a write into a project this session has no dependency edge to
- scripted-rewrite: a scripted substitute-and-write, which cannot tell your symbol from a dependency's
- search-translation: a text search whose pattern a graph query provably answers with the same entities
- sed-in-place: `sed -i`, whose two spellings destroy each other's work across platforms
- shared-stash: a bare stash push or pop, on a stack every worktree shares
- sibling-checkout: a magus command relocated into another checkout, judging a tree nobody ships
- skill-source: a write to an installed skill copy rather than to its source
- source-read: an unbounded source read the symbol index has already answered
- spawn-unbriefed: a subagent spawned before the multi-agent skill loaded
- split-run: the same target run again on a different project set, on one line or as a separate call
- stage-all: a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated output
- stage-classify: staging without classifying, when generated and source differ
- stale-binary: a verdict from a binary older than the rules in the tree around it
- symbol-search: a recursive text search for names the graph answers exactly: symbols or diagnostic codes
- throwaway-copy: a run inside a temp or scratchpad copy, which leaves the real tree unverified
- token-state: an agent reading or writing the token secrets: the operator token file or the token store
- unknown-env: a retired or misspelled MAGUS_* variable handed to a command
- unleased-write: a write magus cannot attribute while a fleet is running
- whole-tree: a whole-tree VCS reset, checkout, restore or clean, which cannot be undone
- worktree-remove: removing a worktree, which may hold another session's uncommitted work
Project
A directory magus recognizes as a unit of work (it has a magusfile); the unit of caching, scheduling, and dependency tracking. See workspace.
Referenced on 161 pages
- Affected
- CI
- CI providers
- Cache model
- Charms
- Concurrency
- Dependencies
- Insight
- Knowledge graph
- Merge queue
- Operations
- Review
- Sandbox model
- Secrets
- Spells
- Target output references
- Targets
- Telemetry
- Terminal
- Tool identity
- Volatility
- Workspace and projects
- Workspace providers
- bash spell
- buzz spell
- go spell
- python spell
- typescript spell
- Console API
- FAQ
- GraphService
- Guard rules
- InsightService
- Logging and verbosity
- MGS1001: no ci target defined
- MGS1002: spell import shadowed
- MGS1003: bespoke phase-fragment target name
- MGS1005: redundant footprint glob
- MGS1006: unknown target
- MGS1007: target dependency cycle
- MGS1009: target never replays from cache
- MGS1010: affected set could not be computed
- MGS1011: cross-project output names an unusable owner
- MGS1012: cross-project output forms a dependency cycle
- MGS1013: cross-project output glob escapes its owner
- MGS1014: cross-project output was never produced
- MGS1015: cross-project dependency names an unresolvable project
- MGS1016: workspace-local Go replace directives drifted
- MGS1017: magusfile is not a spell
- MGS1018: dead output glob
- MGS1019: committed output records its own commit
- MGS1020: output owned by two targets
- MGS1022: member only callable from a magusfile
- MGS1023: workspace provider reported an unusable project path
- MGS1024: workspace provider project shadowed by a magusfile
- MGS1028: a changed file seeds a project it does not key
- MGS1029: source glob reaches into a pruned directory
- MGS1031: a project's output is another project's source
- MGS1032: timeout declaration no longer describes the target
- MGS1036: a narrowed footprint dropped the files its own ops read
- MGS1037: a tool's observation is keyed as its version
- MGS1038: a magus.project option was removed
- MGS1045: a magus\guard.spawn, command or write registration is unusable
- MGS3001: descendant project boundary crossed
- MGS3004: tool not ready
- MGS3005: tool too old
- MGS3006: tool too new
- MGS3007: project lock held by an ancestor run
- MGS3008: no workspace root found
- MGS3009: machine budget exhausted
- MGS3010: redundant gate deferred
- MGS3011: target exceeded its declared timeout
- MGS3012: invocation stalled
- MGS3013: build slots deadlocked
- MGS3014: gate superseded
- MGS3018: a directory as a job write path
- MGS3020: preflight failed
- MGS3021: preflight outside the closure
- MGS3023: pipe cycle
- MGS4001: filesystem race condition
- MGS4002: declared output overlap
- MGS4003: non-deterministic output
- MGS4004: potential undeclared dependency
- MGS4008: unordered same-step write
- MGS5001: near-duplicate services
- MGS7003: symbol index not current
- MetricsService
- StatusService
- The CLI in practice
- The Go SDK
- ToolService
- ViewerService
- cd: a `cd` before a magus command, when the project is an argument
- knowledge-graph diagnostics
- magus affected
- magus clean
- magus command
- magus completion
- magus config
- magus describe
- magus diff
- magus doctor
- magus events
- magus graph
- magus job
- magus ls
- magus memory
- magus module
- magus notes
- magus query
- magus run
- magus where
- magus x
- magus-commit-composition
- magus\guard.command
- magus\guard.spawn
- magusfile diagnostics
- pipe module
- platform module
- process-poll: a process table inspected to wait on magus work the lock already reports
- sandbox diagnostics
- scope-drift: a write into a project this session has no dependency edge to
- scripted-rewrite: a scripted substitute-and-write, which cannot tell your symbol from a dependency's
- sibling-checkout: a magus command relocated into another checkout, judging a tree nobody ships
- split-run: the same target run again on a different project set, on one line or as a separate call
- symbol-search: a recursive text search for names the graph answers exactly: symbols or diagnostic codes
- throwaway-copy: a run inside a temp or scratchpad copy, which leaves the real tree unverified
- vcs module
Magusfile
The magusfile.buzz that declares a project's targets (as export funs) and
binds its spells. See targets.
Referenced on 130 pages
- ActivityService
- Console API
- Diagnostics
- FAQ
- Logging and verbosity
- MGS1001: no ci target defined
- MGS1002: spell import shadowed
- MGS1003: bespoke phase-fragment target name
- MGS1004: unreached footprint declaration
- MGS1006: unknown target
- MGS1008: target missing its context parameter
- MGS1015: cross-project dependency names an unresolvable project
- MGS1017: magusfile is not a spell
- MGS1021: workspace requires a newer magus
- MGS1022: member only callable from a magusfile
- MGS1023: workspace provider reported an unusable project path
- MGS1024: workspace provider project shadowed by a magusfile
- MGS1025: magusfile calls an API that was removed
- MGS1026: a cacheable target reaches for a credential
- MGS1030: memory declaration disagrees with what was measured
- MGS1038: a magus.project option was removed
- MGS1039: magus is called without being imported
- MGS1040: magus.yaml has a key this magus does not know
- MGS1041: a remote spell import is not declared
- MGS1043: a remote spell's lock entry is missing or stale
- MGS1045: a magus\guard.spawn, command or write registration is unusable
- MGS1102: this review provider does not implement that op
- MGS2004: sandbox config unresolved
- MGS2005: kernel landlock unavailable
- MGS2011: secret too short to mask
- MGS3002: VCS unavailable
- MGS3003: tool not on PATH
- MGS3005: tool too old
- MGS3008: no workspace root found
- MGS3009: machine budget exhausted
- MGS3010: redundant gate deferred
- MGS3011: target exceeded its declared timeout
- MGS3018: a directory as a job write path
- MGS4008: unordered same-step write
- MGS6002: a charm is spelled by its retired name
- Remote spells
- StatusService
- The CLI in practice
- The Go SDK
- ToolService
- env module
- magus affected
- magus agent
- magus buzz
- magus command
- magus describe
- magus doctor
- magus events
- magus init
- magus module
- magus run
- magus spell
- magus stdlib
- magus-buzz-review
- magus-buzz-write
- magus-query
- magus-run
- magus-vcs-hygiene
- magus\guard.command
- magus\guard.spawn
- magusfile diagnostics
- search-translation: a text search whose pattern a graph query provably answers with the same entities
- term module
- vcs module
Target
A named operation (build, test, ...) you invoke with magus run <target>; it
may compose a spell's tool-native operations and depend on other targets. See
targets.
Referenced on 211 pages
- Affected
- CI
- Cache model
- Charms
- Concurrency
- Dependencies
- Engines
- Formatting, linting, and generated files
- Insight
- Knowledge graph
- Merge queue
- Operations
- Remote caching
- Review
- Running under CI
- Sandbox model
- Secret providers
- Secrets
- Services
- Spells
- Target output references
- Targets
- Telemetry
- Terminal
- Tokens and grants
- Tool identity
- Volatility
- Wards
- Workspace and projects
- Workspace providers
- bash spell
- buf spell
- buzz spell
- cosign spell
- docker spell
- go spell
- markdown spell
- podman spell
- python spell
- rust spell
- typescript spell
- Agents
- Claude Code
- Codex
- Cursor
- Debugging magusfiles
- Editor setup
- Event stream design notes
- Getting started
- Git integration
- GitHub Actions
- Jobs and leases
- MCP
- Nx
- OpenCode
- Profiling a magusfile
- Pull request advice
- Quick start
- Releasing
- Reviewing your changes
- Skills
- The event stream
- The guard
- Tips and tricks
- Writing a spell
- Console API
- FAQ
- GraphService
- Guard rules
- InsightService
- JobService
- Logging and verbosity
- MGS1001: no ci target defined
- MGS1003: bespoke phase-fragment target name
- MGS1004: unreached footprint declaration
- MGS1005: redundant footprint glob
- MGS1006: unknown target
- MGS1007: target dependency cycle
- MGS1008: target missing its context parameter
- MGS1009: target never replays from cache
- MGS1010: affected set could not be computed
- MGS1011: cross-project output names an unusable owner
- MGS1012: cross-project output forms a dependency cycle
- MGS1013: cross-project output glob escapes its owner
- MGS1014: cross-project output was never produced
- MGS1015: cross-project dependency names an unresolvable project
- MGS1016: workspace-local Go replace directives drifted
- MGS1018: dead output glob
- MGS1019: committed output records its own commit
- MGS1020: output owned by two targets
- MGS1023: workspace provider reported an unusable project path
- MGS1024: workspace provider project shadowed by a magusfile
- MGS1025: magusfile calls an API that was removed
- MGS1026: a cacheable target reaches for a credential
- MGS1027: a secret grant is malformed
- MGS1028: a changed file seeds a project it does not key
- MGS1029: source glob reaches into a pruned directory
- MGS1030: memory declaration disagrees with what was measured
- MGS1031: a project's output is another project's source
- MGS1032: timeout declaration no longer describes the target
- MGS1033: a cacheable target composes an op that reaches outside the tree
- MGS1034: a target reads a file it declares as its own output
- MGS1035: a target writes the tree when it was given no rw charm
- MGS1036: a narrowed footprint dropped the files its own ops read
- MGS1037: a tool's observation is keyed as its version
- MGS1038: a magus.project option was removed
- MGS1041: a remote spell import is not declared
- MGS1043: a remote spell's lock entry is missing or stale
- MGS2001: path read denied
- MGS2002: path write denied
- MGS2004: sandbox config unresolved
- MGS2006: PATH-shim manager stripped
- MGS2012: sandbox required
- MGS3001: descendant project boundary crossed
- MGS3003: tool not on PATH
- MGS3005: tool too old
- MGS3006: tool too new
- MGS3007: project lock held by an ancestor run
- MGS3009: machine budget exhausted
- MGS3011: target exceeded its declared timeout
- MGS3012: invocation stalled
- MGS3013: build slots deadlocked
- MGS3014: gate superseded
- MGS3020: preflight failed
- MGS3021: preflight outside the closure
- MGS3029: saved plan refused
- MGS4001: filesystem race condition
- MGS4002: declared output overlap
- MGS4007: undeclared source modified
- MGS4008: unordered same-step write
- MGS4009: commit left formatting stale
- MGS5001: near-duplicate services
- MGS6001: charm patch does not apply to the command
- MGS6002: a charm is spelled by its retired name
- MGS7002: dangling doc reference
- MGS7003: symbol index not current
- MGS8001: output ref not found
- MGS8002: ambiguous output ref prefix
- MGS8003: malformed output ref
- MGS8004: output ref was produced on a different machine
- MGS9006: token not found
- MetricsService
- Remote spells
- StatusService
- The CLI in practice
- The Go SDK
- ViewerService
- capture-filter: a filter over a run capture or log, which cuts the failure block apart
- charm diagnostics
- charm module
- fs module
- log module
- magus affected
- magus broker
- magus buzz
- magus command
- magus config
- magus describe
- magus diff
- magus doctor
- magus events
- magus explain
- magus graph
- magus job
- magus ls
- magus mcp
- magus memory
- magus module
- magus notes
- magus path
- magus query
- magus queue
- magus run
- magus spell
- magus stdlib
- magus x
- magus-buzz-review
- magus-buzz-write
- magus-run
- magusfile diagnostics
- os module
- output-redirect: magus output redirected to a file, which the run log already holds
- output-reference diagnostics
- path module
- pipe module
- proc module
- race diagnostics
- raw-tool: a toolchain command a spell already wraps, run outside the cache
- regen-source: a hand edit to a file a target regenerates
- revert-classify: a revert that has not classified what it is reverting
- sandbox diagnostics
- search-translation: a text search whose pattern a graph query provably answers with the same entities
- split-run: the same target run again on a different project set, on one line or as a separate call
- stage-all: a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated output
- term module
- vcs module
Op
A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). See operations.
Referenced on 82 pages
- CI providers
- Cache model
- Charms
- Compatibility
- Dependencies
- Engines
- Formatting, linting, and generated files
- Knowledge graph
- Merge queue
- Operations
- Remote caching
- Review
- Sandbox model
- Secret providers
- Secrets
- Services
- Spells
- Targets
- Tool identity
- Wards
- Workspace providers
- bash spell
- buf spell
- buzz spell
- cosign spell
- docker spell
- go spell
- markdown spell
- podman spell
- python spell
- rust spell
- typescript spell
- FAQ
- MGS1001: no ci target defined
- MGS1003: bespoke phase-fragment target name
- MGS1005: redundant footprint glob
- MGS1006: unknown target
- MGS1008: target missing its context parameter
- MGS1024: workspace provider project shadowed by a magusfile
- MGS1026: a cacheable target reaches for a credential
- MGS1033: a cacheable target composes an op that reaches outside the tree
- MGS1036: a narrowed footprint dropped the files its own ops read
- MGS1037: a tool's observation is keyed as its version
- MGS1101: this VCS backend cannot answer that
- MGS1102: this review provider does not implement that op
- MGS1103: this provider did not say who opened the review
- MGS2008: magus socket withheld
- MGS3004: tool not ready
- MGS3005: tool too old
- MGS3012: invocation stalled
- MGS5002: service op detaches
- MGS5003: command op never exits
- MGS6001: charm patch does not apply to the command
- MemoryService
- MetricsService
- The CLI in practice
- The Go SDK
- ViewerService
- env module
- magus agent
- magus command
- magus graph
- magus job
- magus module
- magus query
- magus vcs
- magus-docs-lookup
- services diagnostics
- term module
Spell
A language/runtime adapter (e.g. go, md) that maps generic targets onto a
toolchain's real commands. See spells.
Referenced on 135 pages
- CI providers
- Cache model
- Charms
- Compatibility
- Dependencies
- Engines
- Formatting, linting, and generated files
- Knowledge graph
- Merge queue
- Operations
- Remote caching
- Review
- Sandbox model
- Secret providers
- Secrets
- Spells
- Target output references
- Targets
- Telemetry
- Tool identity
- Workspace and projects
- Workspace providers
- bash spell
- buf spell
- buzz spell
- cosign spell
- docker spell
- go spell
- markdown spell
- podman spell
- python spell
- rust spell
- typescript spell
- FAQ
- GraphService
- Guard rules
- InsightService
- Logging and verbosity
- MGS1001: no ci target defined
- MGS1002: spell import shadowed
- MGS1003: bespoke phase-fragment target name
- MGS1006: unknown target
- MGS1008: target missing its context parameter
- MGS1009: target never replays from cache
- MGS1017: magusfile is not a spell
- MGS1018: dead output glob
- MGS1022: member only callable from a magusfile
- MGS1023: workspace provider reported an unusable project path
- MGS1024: workspace provider project shadowed by a magusfile
- MGS1026: a cacheable target reaches for a credential
- MGS1028: a changed file seeds a project it does not key
- MGS1031: a project's output is another project's source
- MGS1033: a cacheable target composes an op that reaches outside the tree
- MGS1036: a narrowed footprint dropped the files its own ops read
- MGS1037: a tool's observation is keyed as its version
- MGS1039: magus is called without being imported
- MGS1041: a remote spell import is not declared
- MGS1042: a remote spell does not match its digest
- MGS1043: a remote spell's lock entry is missing or stale
- MGS1044: a spell override replaces nothing usable
- MGS1102: this review provider does not implement that op
- MGS1103: this provider did not say who opened the review
- MGS2001: path read denied
- MGS2002: path write denied
- MGS2003: env vars stripped
- MGS2004: sandbox config unresolved
- MGS2005: kernel landlock unavailable
- MGS2007: exec denied
- MGS2008: magus socket withheld
- MGS3001: descendant project boundary crossed
- MGS3004: tool not ready
- MGS3005: tool too old
- MGS3006: tool too new
- MGS3013: build slots deadlocked
- MGS3024: a hook names no agent host
- MGS3031: a declaration claim nothing can grade
- MGS4001: filesystem race condition
- MGS4004: potential undeclared dependency
- MGS6001: charm patch does not apply to the command
- MetricsService
- Remote spells
- StatusService
- The CLI in practice
- The Go SDK
- ToolService
- ViewerService
- magus buzz
- magus command
- magus describe
- magus explain
- magus graph
- magus init
- magus ls
- magus module
- magus path
- magus query
- magus spell
- magus stdlib
- magus-buzz-review
- magus-buzz-write
- magus-docs-lookup
- magusfile diagnostics
- raw-tool: a toolchain command a spell already wraps, run outside the cache
- sandbox diagnostics
- semver module
- sibling-checkout: a magus command relocated into another checkout, judging a tree nobody ships
Charm
An execution modifier attached with : (lint:rw) that changes how a target
runs, not which one; the built-in rw flips a check-only target to mutate in
place, and ci always strips it. See charms.
Referenced on 56 pages
- FAQ
- GraphService
- Logging and verbosity
- MGS1002: spell import shadowed
- MGS1016: workspace-local Go replace directives drifted
- MGS1033: a cacheable target composes an op that reaches outside the tree
- MGS1035: a target writes the tree when it was given no rw charm
- MGS1041: a remote spell import is not declared
- MGS1042: a remote spell does not match its digest
- MGS1043: a remote spell's lock entry is missing or stale
- MGS3021: preflight outside the closure
- MGS4007: undeclared source modified
- MGS6001: charm patch does not apply to the command
- MGS6002: a charm is spelled by its retired name
- Remote spells
- The Go SDK
- charm diagnostics
- charm module
- magus describe
- magus doctor
- magus module
- magus run
- magus spell
- magus stdlib
Ward
A coded diagnostic that inspects a resolved op and nudges or blocks an anti-pattern before it runs. See wards.
Referenced on 4 pages
Module
A magus stdlib namespace a magusfile imports for host capabilities: filesystem, exec, vcs, and more. See the module reference.
Referenced on 86 pages
- MGS1016: workspace-local Go replace directives drifted
- MGS1021: workspace requires a newer magus
- MGS1022: member only callable from a magusfile
- MGS1025: magusfile calls an API that was removed
- MGS1033: a cacheable target composes an op that reaches outside the tree
- MGS1039: magus is called without being imported
- MGS3005: tool too old
- MGS3012: invocation stalled
- MGS4001: filesystem race condition
- The Go SDK
- archive module
- base64 module
- charm module
- crypto module
- csv module
- diff module
- env module
- flags module
- fmt module
- fs module
- hex module
- http module
- ini module
- json module
- knowledge-graph diagnostics
- lcov module
- log module
- magus buzz
- magus describe
- magus diff
- magus module
- magus stdlib
- magus-architecture-review
- magus-docs-lookup
- markdown module
- math module
- net module
- os module
- path module
- pipe module
- platform module
- proc module
- semver module
- sort module
- strings module
- template module
- term module
- time module
- toml module
- url module
- uuid module
- vcs module
- xml module
- yaml module
Buzz
The language magusfiles are written in (the .buzz engine). See
engines.
Referenced on 86 pages
- FAQ
- Guard rules
- MGS1008: target missing its context parameter
- MGS1022: member only callable from a magusfile
- MGS1025: magusfile calls an API that was removed
- MGS1027: a secret grant is malformed
- MGS2005: kernel landlock unavailable
- MGS3010: redundant gate deferred
- MGS3024: a hook names no agent host
- MGS3031: a declaration claim nothing can grade
- MGS7001: unresolvable buzz import
- MetricsService
- Remote spells
- The Go SDK
- buzz-unbriefed: the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skill
- crypto module
- env module
- fs module
- http module
- json module
- knowledge-graph diagnostics
- magus agent
- magus buzz
- magus command
- magus describe
- magus diff
- magus graph
- magus init
- magus module
- magus queue
- magus shell
- magus spell
- magus stdlib
- magus-buzz-review
- magus-buzz-write
- magus-query
- magus-run
- magus-vcs-hygiene
- magus\guard.command
- magus\guard.spawn
- math module
- os module
- proc module
- sandbox diagnostics
- strings module
- time module
Engine
The interpreter a magusfile runs on; magus embeds the Buzz engine. See engines.
Referenced on 29 pages
Execution and caching
Cache
The content-addressed store magus consults before running a target, so unchanged work is skipped. See cache.
Referenced on 143 pages
- Affected
- CI
- CI providers
- Cache model
- Compatibility
- Concurrency
- Dependencies
- Formatting, linting, and generated files
- Knowledge graph
- Merge queue
- Operations
- Remote caching
- Review
- Running under CI
- Sandbox model
- Secret providers
- Secrets
- Services
- Spells
- Target output references
- Targets
- Telemetry
- Terminal
- Tool identity
- Volatility
- Workspace and projects
- Workspace providers
- bash spell
- buf spell
- buzz spell
- cosign spell
- docker spell
- go spell
- markdown spell
- podman spell
- python spell
- rust spell
- typescript spell
- Console API
- FAQ
- Guard rules
- JobService
- Logging and verbosity
- MGS1004: unreached footprint declaration
- MGS1005: redundant footprint glob
- MGS1008: target missing its context parameter
- MGS1009: target never replays from cache
- MGS1011: cross-project output names an unusable owner
- MGS1013: cross-project output glob escapes its owner
- MGS1014: cross-project output was never produced
- MGS1015: cross-project dependency names an unresolvable project
- MGS1018: dead output glob
- MGS1020: output owned by two targets
- MGS1023: workspace provider reported an unusable project path
- MGS1026: a cacheable target reaches for a credential
- MGS1028: a changed file seeds a project it does not key
- MGS1029: source glob reaches into a pruned directory
- MGS1032: timeout declaration no longer describes the target
- MGS1034: a target reads a file it declares as its own output
- MGS1037: a tool's observation is keyed as its version
- MGS1042: a remote spell does not match its digest
- MGS2001: path read denied
- MGS2002: path write denied
- MGS3004: tool not ready
- MGS3005: tool too old
- MGS3007: project lock held by an ancestor run
- MGS3010: redundant gate deferred
- MGS3011: target exceeded its declared timeout
- MGS3013: build slots deadlocked
- MGS3026: queue hook is not a command
- MGS4002: declared output overlap
- MGS4003: non-deterministic output
- MGS4007: undeclared source modified
- MGS4008: unordered same-step write
- MGS7003: symbol index not current
- MGS8001: output ref not found
- MGS8004: output ref was produced on a different machine
- MetricsService
- NotesService
- Remote spells
- StatusService
- The CLI in practice
- The Go SDK
- ViewerService
- cache-dir-write: a write into this checkout's magus cache dir, which magus alone owns
- fs module
- http module
- magus affected
- magus clean
- magus command
- magus config
- magus describe
- magus explain
- magus graph
- magus job
- magus module
- magus path
- magus query
- magus queue
- magus run
- magus self
- magus shell
- magus spell
- magus status
- magus stdlib
- magus x
- magus-run
- magus\guard.spawn
- output-reference diagnostics
- pipe module
- race diagnostics
- raw-tool: a toolchain command a spell already wraps, run outside the cache
- sandbox diagnostics
- semver module
- throwaway-copy: a run inside a temp or scratchpad copy, which leaves the real tree unverified
Affected
The set of projects touched by a change; magus affected <target> runs a target
only over them. See affected.
Referenced on 61 pages
- Console API
- GraphService
- Logging and verbosity
- MGS1001: no ci target defined
- MGS1002: spell import shadowed
- MGS1006: unknown target
- MGS1009: target never replays from cache
- MGS1010: affected set could not be computed
- MGS1012: cross-project output forms a dependency cycle
- MGS1015: cross-project dependency names an unresolvable project
- MGS1028: a changed file seeds a project it does not key
- MGS1101: this VCS backend cannot answer that
- MGS3007: project lock held by an ancestor run
- MGS3009: machine budget exhausted
- MGS3029: saved plan refused
- MGS4001: filesystem race condition
- MGS4003: non-deterministic output
- StatusService
- The CLI in practice
- ViewerService
- knowledge-graph diagnostics
- magus affected
- magus command
- magus completion
- magus diff
- magus graph
- magus module
- magus queue
- magus run
- magus shell
- magus watch
- magus-change-summary
- magus-multi-agent
- magus-run
- race diagnostics
- raw-tool: a toolchain command a spell already wraps, run outside the cache
- split-run: the same target run again on a different project set, on one line or as a separate call
Sandbox
The restricted filesystem and environment a target runs in, so builds stay reproducible and side-effect-free. See sandbox.
Referenced on 43 pages
- Diagnostics
- MGS2001: path read denied
- MGS2002: path write denied
- MGS2003: env vars stripped
- MGS2004: sandbox config unresolved
- MGS2005: kernel landlock unavailable
- MGS2006: PATH-shim manager stripped
- MGS2007: exec denied
- MGS2008: magus socket withheld
- MGS2010: sandbox weakened
- MGS2012: sandbox required
- MGS3026: queue hook is not a command
- MetricsService
- env module
- fs module
- http module
- json module
- magus buzz
- magus command
- magus shell
- magus stdlib
- magus-run
- pipe module
- proc module
- raw-tool: a toolchain command a spell already wraps, run outside the cache
- sandbox diagnostics
- term module
Service
A long-running or shared process magus manages across runs, distinct from a one-shot target. See services.
Referenced on 49 pages
- ActivityService
- Console API
- FAQ
- GraphService
- MGS1009: target never replays from cache
- MGS1026: a cacheable target reaches for a credential
- MGS3004: tool not ready
- MGS3007: project lock held by an ancestor run
- MGS5001: near-duplicate services
- MGS5002: service op detaches
- MGS5003: command op never exits
- Server API
- StatusService
- ToolService
- ViewerService
- magus broker
- magus command
- magus queue
- magus stdlib
- magus.query.v1alpha1
- net module
- services diagnostics
Broker
The per-user background process that holds this host's capacity: the machine
budget every run claims slots from, and the shared services runs keep warm. A
run starts it on demand; broker: off in magus.yaml runs without one. See
server.
Referenced on 17 pages
Server
The background process a person starts with magus server start. It serves MCP,
the console, background jobs and the warm knowledge graph, and adopts nested
magus calls into one pool. See server.
Referenced on 95 pages
- ActivityService
- Console API
- GraphService
- InsightService
- JobService
- MGS2003: env vars stripped
- MGS2008: magus socket withheld
- MGS2010: sandbox weakened
- MGS3004: tool not ready
- MGS3010: redundant gate deferred
- MGS3012: invocation stalled
- MGS3014: gate superseded
- MGS3016: workspace failed to load
- MGS3017: workspace still loading
- MGS3025: server speaks the old socket protocol
- MGS5004: this needs the persistent server
- MGS9001: bearer token rejected
- MGS9004: no auth token configured
- MGS9007: host not allowed
- MGS9008: local access only
- MGS9010: console file withheld
- MGS9011: no bearer token presented
- MGS9012: method not allowed
- MGS9013: console not built
- MGS9014: share listener unavailable
- MGS9015: grant below the route's need
- MGS9016: operator token predates the class prefix
- MGS9019: invalid token record skipped
- MGS9022: socket peer is not the server's user
- MetricsService
- Server API
- StatusService
- The CLI in practice
- TokenService
- ViewerService
- http module
- magus affected
- magus buzz
- magus command
- magus describe
- magus events
- magus graph
- magus job
- magus mcp
- magus query
- magus run
- magus server
- magus session
- magus status
- magus vcs
- magus version
- net module
- os module
- sandbox diagnostics
- term module
- token-state: an agent reading or writing the token secrets: the operator token file or the token store
CI
An ordinary magusfile-defined target you compose yourself with magus\needs -
magus does not hardcode its stages. Magus.RunCI treats it specially only in
that it strips the rw charm, it is the anchor magus affected ci keys off,
and a selected scope with no project declaring it is a load error rather than
a silent no-op. See targets.
Referenced on 103 pages
- Console API
- Diagnostics
- FAQ
- Logging and verbosity
- MGS1001: no ci target defined
- MGS1003: bespoke phase-fragment target name
- MGS1010: affected set could not be computed
- MGS1015: cross-project dependency names an unresolvable project
- MGS1018: dead output glob
- MGS1019: committed output records its own commit
- MGS1021: workspace requires a newer magus
- MGS1038: a magus.project option was removed
- MGS3003: tool not on PATH
- MGS3004: tool not ready
- MGS3005: tool too old
- MGS3010: redundant gate deferred
- MGS3011: target exceeded its declared timeout
- MGS3014: gate superseded
- MGS3020: preflight failed
- MGS3021: preflight outside the closure
- MGS4005: environmental drift
- MGS4007: undeclared source modified
- MGS4009: commit left formatting stale
- Remote spells
- StatusService
- The CLI in practice
- ViewerService
- env module
- magus affected
- magus command
- magus config
- magus describe
- magus doctor
- magus graph
- magus init
- magus module
- magus queue
- magus run
- magus stdlib
- magus version
- magus x
- magus-run
- magus\guard.command
- magusfile diagnostics
- race diagnostics
- term module
- vcs module
Output reference
A short, shareable id (out1a2b3c, "ref" for short) for one target execution's
captured output; it appears on each target's line, and
magus query output out1a2b3c prints those exact bytes. In OpenTelemetry terms
it corresponds to a span (one target execution) within its trace (the
whole magus invocation). See output-refs.
Referenced on 7 pages
Trace
OpenTelemetry's name for one whole magus invocation; every target it runs is a
span beneath it. See telemetry.
Referenced on 19 pages
Span
OpenTelemetry's name for one unit of work under a trace - a target execution, whose sub-operations are child spans. An output reference points at a span's captured output. See telemetry.
Referenced on 9 pages
Pool
The concurrency pool: the shared set of slots that caps how many targets run in
parallel on one machine. Its capacity defaults to MAGUS_CONCURRENCY, then 4 on
GitHub-hosted runners, then min(NumCPU, 8); magus status and the
dashboard report it live. See server.
Referenced on 22 pages
Slot
One unit of the pool's capacity. A target acquires the slots it needs to run (most take one) and releases them when it finishes; the pool tracks capacity (total slots), running (acquired), and queued (blocked). See server.
Referenced on 22 pages
Concurrency
How many targets run at once. It is bounded by the pool's capacity and set with
--concurrency, MAGUS_CONCURRENCY, or the concurrency config key. See
server.
Referenced on 35 pages
- Logging and verbosity
- MGS1007: target dependency cycle
- MGS1030: memory declaration disagrees with what was measured
- MGS1038: a magus.project option was removed
- MGS3009: machine budget exhausted
- MGS3011: target exceeded its declared timeout
- MGS3013: build slots deadlocked
- MGS3022: no broker answered
- MGS4008: unordered same-step write
- StatusService
- The CLI in practice
- magus affected
- magus broker
- magus command
- magus module
- magus run
- magus status
- proc module
Queued
A target that wants a slot while the pool is full; it blocks first-in-first-out until a slot frees. The dashboard colors a sample with queued > 0 accordingly. See server.
Referenced on 14 pages
Pool mode
Which pool a run uses: server (one shared pool the server owns across every workspace and client) or proc (a per-process pool for a single one-off invocation). See server.
One-off
A single magus invocation that runs a target and exits, using a per-process
pool; the opposite of the long-lived server or a service. See
server.
Referenced on 6 pages
Remote cache
A CI-only backend that shares content-addressed artifacts across runners: a cold machine replays a build another runner already did instead of rebuilding. Every remote artifact must be signed by a trusted key. See remote.
Referenced on 18 pages
Snapshot
A point-in-time view of live state - the pool's occupancy or a tick of exported metrics - as opposed to accumulated history. See server.
Referenced on 24 pages
- Console API
- JobService
- MGS1009: target never replays from cache
- MGS1018: dead output glob
- MGS1020: output owned by two targets
- MGS1034: a target reads a file it declares as its own output
- MGS3001: descendant project boundary crossed
- MGS4002: declared output overlap
- MemoryService
- MetricsService
- StatusService
- magus graph
- magus status
Backfill
The recent history the server replays to a dashboard on connect, so its charts start populated instead of empty. It is served from a bounded ring buffer of the last few hundred samples. See server.
Telemetry and health
Latency
How long an operation takes. magus records latency as OpenTelemetry histograms per family - target execution, cache op, pool wait, and graph query - and reports each as a count, sum, and percentiles. See telemetry.
Referenced on 4 pages
Percentile
A latency value at a given rank, interpolated from a histogram's buckets: p50 is the median, p95 and p99 are the tail that most latency budgets care about. See telemetry.
Health
The at-a-glance server state derived from the pool: healthy when the pool is reporting, degraded when it reports an error, down when there is no pool. The dashboard color-codes each state. See server.
Referenced on 16 pages
Volatility
A target that fails once and passes on rerun is volatile, as opposed to a regression that started failing and stays failing. magus keeps per-target pass/fail history and a Wilson-score volatility rate to tell them apart and auto-retry the noise. See volatility.
Referenced on 14 pages
Insight and knowledge
Knowledge graph
The queryable graph of a workspace's spells, targets, docs, and code
relationships; query it with magus query/explain/path. See
knowledge.
Referenced on 30 pages
MAGUS.md
The committed routing index at a workspace root, regenerated from the knowledge graph: it lists every node and points at the exact query for a given question, so it is the entry point an agent reads first. See knowledge.
Insight
The reports magus derives over the graph and history (hotspots, affinity, ownership, trend, volatility, unreferenced). See insight.
Referenced on 8 pages
Hotspot
An insight lens: edit frequency times complexity, the prime refactoring targets.
The project view heat-colors the dependency graph by churn; --files ranks
individual files. See insight.
Affinity
An insight lens: projects that change together (temporal coupling). A pair that co-changes without either declaring a dependency on the other is a candidate architectural smell. See insight.
Referenced on 8 pages
Ownership
An insight lens: author concentration - the primary author and their share, the distinct-author count (the bus factor), and abandonment. See insight.
Referenced on 23 pages
- Console API
- InsightService
- MGS1013: cross-project output glob escapes its owner
- MGS1020: output owned by two targets
- MGS1036: a narrowed footprint dropped the files its own ops read
- MGS4007: undeclared source modified
- MGS4008: unordered same-step write
- MGS7003: symbol index not current
- The CLI in practice
- magus diff
- magus graph
- magus module
- magus-commit-composition
Trend
An insight lens: the recent half of the window against the earlier half. A positive delta is a rising hotspot; a negative one is cooling. See insight.
Referenced on 8 pages
Diagnostic code
A stable MGSxxxx identifier attached to a magus warning or error, so it can be
referenced and looked up; some are guardrails (see wards), others hard
errors.
Referenced on 9 pages
Design and scope
Two rules named often enough elsewhere to need a definition of their own.
Scope test
The question every proposed capability has to answer: does it read the model magus already had to build, or does it make magus learn something new about the world? Reads stay small; acquisitions are where a tool loses its shape. See scope.
Referenced on 1 page
One-vocabulary rule
Each concept gets one name, used everywhere: target, spell, charm, op. A second word for the same thing is a house dialect, and it costs every reader (and every agent) a lookup that never ends. See doctrine.
Referenced on 1 page
Sessions and leases
The vocabulary of magus watching work happen: who ran what, what an agent is blocked on, and which agent owns which paths. The policy behind these terms lives in doctrine.
Session
An agent host's conversation, by the id the host delivers to its hooks. magus never mints one: a record with no session is unattributed, and the OS user it carries says whose account ran it.
Referenced on 66 pages
- ActivityService
- Console API
- Diagnostics
- Guard rules
- JobService
- MGS1028: a changed file seeds a project it does not key
- MGS3010: redundant gate deferred
- MGS4003: non-deterministic output
- MGS9008: local access only
- MetricsService
- NotesService
- StatusService
- ViewerService
- buzz-unbriefed: the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skill
- cd: a `cd` before a magus command, when the project is an argument
- credential-verb: an agent minting, printing, rotating or revoking a credential through the CLI
- leased-path: a write into paths a running lease owns, by a caller that names no lease
- magus command
- magus diff
- magus graph
- magus job
- magus memory
- magus module
- magus session
- magus shell
- magus-memory
- magus\guard.command
- magus\guard.spawn
- push-ungated: a push at a commit with no green gate: the person is asked, a leased worker refused
- raw-tool: a toolchain command a spell already wraps, run outside the cache
- scope-drift: a write into a project this session has no dependency edge to
- shared-stash: a bare stash push or pop, on a stack every worktree shares
- spawn-unbriefed: a subagent spawned before the multi-agent skill loaded
- split-run: the same target run again on a different project set, on one line or as a separate call
- stale-binary: a verdict from a binary older than the rules in the tree around it
- token-state: an agent reading or writing the token secrets: the operator token file or the token store
- whole-tree: a whole-tree VCS reset, checkout, restore or clean, which cannot be undone
- worktree-remove: removing a worktree, which may hold another session's uncommitted work
Invocation
One magus process's recorded facts - the targets it finished, their outcomes,
the lease it acted as, and the session it ran in when a host delivered one -
kept in a repo-scoped store every worktree shares. magus session lists them;
the store prunes itself by last-fact age.
Referenced on 60 pages
- ActivityService
- Console API
- FAQ
- JobService
- MGS1003: bespoke phase-fragment target name
- MGS1009: target never replays from cache
- MGS2001: path read denied
- MGS2005: kernel landlock unavailable
- MGS2008: magus socket withheld
- MGS3001: descendant project boundary crossed
- MGS3007: project lock held by an ancestor run
- MGS3009: machine budget exhausted
- MGS3010: redundant gate deferred
- MGS3011: target exceeded its declared timeout
- MGS3012: invocation stalled
- MGS3014: gate superseded
- MGS3021: preflight outside the closure
- MGS3029: saved plan refused
- MGS8004: output ref was produced on a different machine
- Remote spells
- StatusService
- ViewerService
- chained-run: several magus runs chained on one line, where the dependency graph would have run them
- magus affected
- magus command
- magus describe
- magus module
- magus query
- magus run
- magus session
- magus shell
- magus x
- sandbox diagnostics
- split-run: the same target run again on a different project set, on one line or as a separate call
Window
The terminal a command runs in. It keys fire-once notices for a caller no host gave a session, and is never recorded as a session.
Referenced on 35 pages
- ActivityService
- InsightService
- MGS1037: a tool's observation is keyed as its version
- MGS3001: descendant project boundary crossed
- MGS3004: tool not ready
- MGS3005: tool too old
- MGS3006: tool too new
- MGS3012: invocation stalled
- MGS4001: filesystem race condition
- StatusService
- ToolService
- ViewerService
- magus module
- magus watch
- split-run: the same target run again on a different project set, on one line or as a separate call
- term module
Attention request
A durable "an agent is blocked" record, opened when a magus session notify
event carries the waiting or permission outcome and held until a person disposes
it. magus session attention lists what is open. Nothing closes one on its own - see
doctrine.
Referenced on 4 pages
Dispose
The human act of closing an attention request: a judgment rendered, recorded with who and why. Distinct from resolving a review thread or a merge conflict - a disposition answers a request; it does not merge anything.
Referenced on 3 pages
Job
The unit of delegated work, and one row of the job store: what an orchestrating agent handed out, with its goal, the checkpoint it was cut against, the paths it may write or must not touch, and the one check it runs. A job's holder is either a session, for work an orchestrator handed out, or the server, for its own maintenance. The store records; the agent guard is what reads those facts back when grading a write. See doctrine.
A job is not a run. magus run build web is a run, and no job exists for it. A
job causes runs: its check executes as one, and a server job records the
invocation of its last one. Jobs are listed with magus ls jobs and in the
console's Jobs view; runs are listed in the Runs view.
Referenced on 81 pages
- ActivityService
- Console API
- Diagnostics
- GraphService
- Guard rules
- JobService
- MGS1017: magusfile is not a spell
- MGS1019: committed output records its own commit
- MGS1031: a project's output is another project's source
- MGS1032: timeout declaration no longer describes the target
- MGS1038: a magus.project option was removed
- MGS2004: sandbox config unresolved
- MGS2012: sandbox required
- MGS3009: machine budget exhausted
- MGS3011: target exceeded its declared timeout
- MGS3018: a directory as a job write path
- MGS3029: saved plan refused
- MGS3031: a declaration claim nothing can grade
- MGS5004: this needs the persistent server
- Remote spells
- The CLI in practice
- claimed-declaration: a leased edit landing in a declaration another live job claims (`run.go#executeStages`)
- focus: a read or write outside the paths the running job declared
- lease-invalid: a call naming a lease this workspace's job store does not declare
- magus affected
- magus buzz
- magus command
- magus describe
- magus job
- magus ls
- magus module
- magus query
- magus shell
- magus stdlib
- magus vcs
- magus\guard.command
- magus\guard.spawn
- push-ungated: a push at a commit with no green gate: the person is asked, a leased worker refused
- sandbox diagnostics
Run
One target executing under one magus invocation, such as magus run test web
or magus affected ci. A run keeps its captured output behind an output
reference. Every magus run is a run whether or not any job asked for it; see
Job for how the two relate.
Referenced on 279 pages
- Affected
- CI
- CI providers
- Cache model
- Charms
- Compatibility
- Concurrency
- Dependencies
- Formatting, linting, and generated files
- Knowledge graph
- Merge queue
- Operations
- Remote caching
- Review
- Running under CI
- Sandbox model
- Secret providers
- Secrets
- Services
- Spells
- Target output references
- Targets
- Telemetry
- Terminal
- Tokens and grants
- Tool identity
- Volatility
- Wards
- Workspace and projects
- Workspace providers
- bash spell
- docker spell
- go spell
- python spell
- Agents
- Any other host
- Attention hooks
- CI checkout
- Claude Code
- Codex
- Cursor
- Debugging magusfiles
- Editor setup
- Event stream design notes
- Getting started
- Git integration
- GitHub Actions
- Guard hook templates
- Jobs and leases
- MCP
- Nx
- OpenCode
- Profiling a magusfile
- Pull request advice
- Quick start
- Releasing
- Reviewing your changes
- Session load adapters
- Skills
- Testing
- The broker and the server
- The event stream
- The guard
- Tips and tricks
- Writing a spell
- ActivityService
- Console API
- FAQ
- Guard rules
- InsightService
- JobService
- Logging and verbosity
- MGS1001: no ci target defined
- MGS1002: spell import shadowed
- MGS1006: unknown target
- MGS1007: target dependency cycle
- MGS1008: target missing its context parameter
- MGS1009: target never replays from cache
- MGS1010: affected set could not be computed
- MGS1012: cross-project output forms a dependency cycle
- MGS1014: cross-project output was never produced
- MGS1015: cross-project dependency names an unresolvable project
- MGS1016: workspace-local Go replace directives drifted
- MGS1019: committed output records its own commit
- MGS1020: output owned by two targets
- MGS1021: workspace requires a newer magus
- MGS1022: member only callable from a magusfile
- MGS1023: workspace provider reported an unusable project path
- MGS1025: magusfile calls an API that was removed
- MGS1028: a changed file seeds a project it does not key
- MGS1029: source glob reaches into a pruned directory
- MGS1030: memory declaration disagrees with what was measured
- MGS1032: timeout declaration no longer describes the target
- MGS1033: a cacheable target composes an op that reaches outside the tree
- MGS1034: a target reads a file it declares as its own output
- MGS1035: a target writes the tree when it was given no rw charm
- MGS1036: a narrowed footprint dropped the files its own ops read
- MGS1037: a tool's observation is keyed as its version
- MGS1038: a magus.project option was removed
- MGS1041: a remote spell import is not declared
- MGS1042: a remote spell does not match its digest
- MGS1043: a remote spell's lock entry is missing or stale
- MGS2004: sandbox config unresolved
- MGS2005: kernel landlock unavailable
- MGS2007: exec denied
- MGS2008: magus socket withheld
- MGS2010: sandbox weakened
- MGS2012: sandbox required
- MGS3001: descendant project boundary crossed
- MGS3002: VCS unavailable
- MGS3003: tool not on PATH
- MGS3004: tool not ready
- MGS3005: tool too old
- MGS3006: tool too new
- MGS3007: project lock held by an ancestor run
- MGS3008: no workspace root found
- MGS3009: machine budget exhausted
- MGS3010: redundant gate deferred
- MGS3011: target exceeded its declared timeout
- MGS3012: invocation stalled
- MGS3013: build slots deadlocked
- MGS3014: gate superseded
- MGS3020: preflight failed
- MGS3021: preflight outside the closure
- MGS3022: no broker answered
- MGS3023: pipe cycle
- MGS3024: a hook names no agent host
- MGS3025: server speaks the old socket protocol
- MGS3026: queue hook is not a command
- MGS3027: queue run untrusted
- MGS3028: queue plan unverified
- MGS3029: saved plan refused
- MGS3030: pipe upstream failed
- MGS4001: filesystem race condition
- MGS4002: declared output overlap
- MGS4003: non-deterministic output
- MGS4004: potential undeclared dependency
- MGS4007: undeclared source modified
- MGS4008: unordered same-step write
- MGS5001: near-duplicate services
- MGS5003: command op never exits
- MGS5004: this needs the persistent server
- MGS6001: charm patch does not apply to the command
- MGS6002: a charm is spelled by its retired name
- MGS7001: unresolvable buzz import
- MGS7003: symbol index not current
- MGS8001: output ref not found
- MGS8003: malformed output ref
- MGS8004: output ref was produced on a different machine
- MGS9002: insecure token file permissions
- MGS9004: no auth token configured
- MGS9022: socket peer is not the server's user
- MetricsService
- Remote spells
- StatusService
- The CLI in practice
- The Go SDK
- ViewerService
- agent-sign-off: an agent stamping a read receipt or closing an attention request, which only a person may do
- backtick-substitution: a backtick command substitution, which inside double quotes runs a command
- brief-command: a spawn or continuation brief that teaches a command the guard denies
- busy-wait: a loop polling for work you started, which announces its own completion
- buzz-unbriefed: the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skill
- cache-dir-write: a write into this checkout's magus cache dir, which magus alone owns
- capture-filter: a filter over a run capture or log, which cuts the failure block apart
- cd: a `cd` before a magus command, when the project is an argument
- chained-run: several magus runs chained on one line, where the dependency graph would have run them
- charm diagnostics
- charm module
- claimed-declaration: a leased edit landing in a declaration another live job claims (`run.go#executeStages`)
- credential-verb: an agent minting, printing, rotating or revoking a credential through the CLI
- env module
- exit-status-echo: a line ending by printing an exit status, which the harness already reports
- filter-without-input: a filter with no file, pipe or redirect, which reads a stdin nothing feeds
- fs module
- gate-repeat: the gate run again soon after it passed, repeating work already done
- generated-write: a hand edit to a declared output, which the next run overwrites
- hook-wiring: a write to the host wiring that decides whether these rules run at all
- http module
- interpreter-rewrite: an inline interpreter rewriting a file this tree already carries
- json module
- knowledge-graph diagnostics
- log module
- magus affected
- magus agent
- magus broker
- magus buzz
- magus clean
- magus command
- magus completion
- magus config
- magus describe
- magus diff
- magus doctor
- magus events
- magus explain
- magus graph
- magus init
- magus job
- magus ls
- magus man
- magus mcp
- magus memory
- magus module
- magus query
- magus queue
- magus run
- magus self
- magus server
- magus session
- magus status
- magus stdlib
- magus vcs
- magus x
- magus-buzz-review
- magus-buzz-write
- magus-docs-lookup
- magus-run
- magus-sdk
- magus-test-design
- magus\guard.command
- magus\guard.spawn
- magusfile diagnostics
- math module
- merge-side-checkout: a checkout of one merge side over a conflicted file, which discards the merge
- net module
- notes-author: an agent authoring a human's note, whose only provenance is who wrote it
- os module
- output-pipe: magus output piped into a filter, when magus projects the record itself
- output-redirect: magus output redirected to a file, which the run log already holds
- pipe module
- proc module
- process-poll: a process table inspected to wait on magus work the lock already reports
- push-gate: a push the run log does not prove ungated, which names the gate and lets it through
- push-ungated: a push at a commit with no green gate: the person is asked, a leased worker refused
- race diagnostics
- raw-tool: a toolchain command a spell already wraps, run outside the cache
- sandbox diagnostics
- scripted-rewrite: a scripted substitute-and-write, which cannot tell your symbol from a dependency's
- search-translation: a text search whose pattern a graph query provably answers with the same entities
- sed-in-place: `sed -i`, whose two spellings destroy each other's work across platforms
- services diagnostics
- shared-stash: a bare stash push or pop, on a stack every worktree shares
- sibling-checkout: a magus command relocated into another checkout, judging a tree nobody ships
- spawn-unbriefed: a subagent spawned before the multi-agent skill loaded
- split-run: the same target run again on a different project set, on one line or as a separate call
- stage-all: a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated output
- stale-binary: a verdict from a binary older than the rules in the tree around it
- strings module
- symbol-search: a recursive text search for names the graph answers exactly: symbols or diagnostic codes
- term module
- throwaway-copy: a run inside a temp or scratchpad copy, which leaves the real tree unverified
- token-state: an agent reading or writing the token secrets: the operator token file or the token store
- unknown-env: a retired or misspelled MAGUS_* variable handed to a command
- uuid module
- vcs module
- whole-tree: a whole-tree VCS reset, checkout, restore or clean, which cannot be undone
- worktree-remove: removing a worktree, which may hold another session's uncommitted work
Lease
The grant a holder takes on a job: the write and read paths that job declared,
enforced in the checkout that took it with magus job exec. A job is the piece
of work; a lease is permission over it.
Referenced on 33 pages
- ActivityService
- Guard rules
- MGS2004: sandbox config unresolved
- lease-invalid: a call naming a lease this workspace's job store does not declare
- lease-terminal: a call naming a lease whose row has already finished
- leased-path: a write into paths a running lease owns, by a caller that names no lease
- magus job
- magus module
- magus shell
- magus vcs
- magus-multi-agent
- magus\guard.command
- magus\guard.spawn
- push-ungated: a push at a commit with no green gate: the person is asked, a leased worker refused
- spawn-unbriefed: a subagent spawned before the multi-agent skill loaded
Lease id
The short identifier a worker carries (the --lease flag, or the
magus.lease member of the W3C BAGGAGE environment channel) so its runs,
journal facts, and guard verdicts attribute to the job it holds. Letters, digits
and -_./: only.
Spawn claim
What a spawning tool said about itself in the environment: TRACEPARENT (the
W3C trace and the parent span this process runs under) and the
magus.spawner baggage member (a label for whoever spawned it). magus records
each verbatim beside the invocation's own minted span id, and no verdict reads
any of them - the ancestry is a relation between recorded invocations, the way
a process tree is a relation between pids.
Advisor
One read-only check from the advice suite: it reads the changeset through magus
and writes one titled section of findings. The same advisors run as a pull
request comment in CI and inside magus diff --impact locally.
Referenced on 7 pages
Console
The vocabulary of the browser app. These terms name things you only meet in the console's UI, so they are defined here rather than left to be inferred from it.
Console
The browser app that reads a magus workspace: a tabbed, tiling page hosting the log viewer, graph explorer, dashboard, and activity trail. It is a separate static app, not something the server serves - the server exposes a loopback API it calls: read-only views plus one bearer-gated job-control service for maintenance jobs. See reference/console.
Console app
One of the console's applications (Runs, Log Viewer, Graph Explorer, Dashboard, Activity Trail, Settings). "App" rather than "page" because one is never a document you navigate to: it is mounted into a tab, or into a pane beside another one. Each is single-instance - opening one you already have focuses it instead of duplicating it.
The glossary term is two words on purpose. As a bare "App" the auto-linker matched every unrelated "app" in the docs - a ChatGPT desktop app, a Postgres app - and pointed each at this definition. See reference/console.
Referenced on 1 page
Pane
A split within a tab. Splitting divides the focused pane along its longer side, so the same action tiles side-by-side on a desktop and stacks on a phone; a tab with no split is a single pane. Drag the divider to re-weight the split. See reference/console.
Referenced on 1 page
Chord
A key combination bound to a console command, written mod+k - where mod is
Cmd on macOS and Ctrl elsewhere, so one binding fits both. Every chord is
rebindable (Settings > Keybindings), and a command remains reachable from the
command bar whether or not it has one. See reference/console.
Command bar
The console's runner: one searchable list of every command and its chord,
opened with mod+k. It is the discoverable route to any action - the menus and
chords dispatch the same commands it does. See reference/console.
Live link
The URL that points an app at a running server. The server serves the console
from its own loopback origin, so the link is that origin plus the app path and
a bearer token in the fragment (http://127.0.0.1:7391/console/graph/#token=...).
The server prints it; the console consumes the token, stores it, and strips it from
the URL, so the secret never lingers in history or a copied link. The origin must be
literal loopback - localhost and hostnames are rejected before any request.
Without one, an app
reads only what rides in the link itself. See reference/console.
See also
- Conventions - how to read the placeholders, shell commands, and admonitions used across these pages.
- Targets - the fuller Target-struct glossary (Path, Name, Files) for magusfile authors.