magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
1 min read

leased-path

An advisory: it explains, and blocks nothing, on a write into paths a running lease owns, by a caller that names no lease.

What it catches

A write into paths a running lease owns, by a caller that names no lease.

Why

The writer is either that lease, not saying so, or a second agent about to collide with it; magus cannot tell which, so it advises rather than refuses. It speaks once per session per lease. Every write used to repeat it: 8,419 servings in one audit, 52% of every advisory the guard served, for a fact the writer had after the first.

Seeing it

A verdict names its rule in brackets, which is how you got here:

advise [leased-path]: ...

magus describe rule leased-path prints the same entry at a terminal, and magus describe rules lists every rule this workspace enforces.

See also

  • All rules - what this workspace enforces, deny first
  • The guard - how a verdict is reached and wired
ReferencePages in this section. push-ungated: a push at a commit with no green gate: the person is asked, a leased worker refusedA deny rule: it refuses a push at a commit with no green gate: the person is asked, a leased worker refused, and names what to run instead. magus\guard.commandRegister one Buzz function the agent guard calls on every agent shell command, to add a deny or an advisory from your repository's own rules. magus ships the seam and no rules. magus\guard.spawnRegister one Buzz function the agent guard calls on every subagent spawn and continuation, to add a deny or an advisory from your own rules. magus ships the seam and no rules.
guardrulesleased-pathadvise
Last updated (a9ff8609)
Glossary

Workspace

The magus root directory that owns a set of projects and shared config; the unit magus operates over. See workspace.

Session

An agent host's conversation, by the id the host delivers to its hooks. magus never mints one: a record with no session is unattributed, and the OS user it carries says whose account ran it.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate.

Lease

The grant a holder takes on a job: the write and read paths that job declared, enforced in the checkout that took it with magus job exec. A job is the piece of work; a lease is permission over it.

Advisor

One read-only check from the advice suite: it reads the changeset through magus and writes one titled section of findings. The same advisors run as a pull request comment in CI and inside magus diff --impact locally.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.