agent-sign-off: an agent stamping a read receipt or closing an attention request, which only a person may doA deny rule: it refuses an agent stamping a read receipt or closing an attention request, which only a person may do, and names what to run instead. backtick-substitution: a backtick command substitution, which inside double quotes runs a commandA deny rule: it refuses a backtick command substitution, which inside double quotes runs a command, and names what to run instead. brief-command: a spawn or continuation brief that teaches a command the guard deniesA deny rule: it refuses a spawn or continuation brief that teaches a command the guard denies, and names what to run instead. busy-wait: a loop polling for work you started, which announces its own completionA deny rule: it refuses a loop polling for work you started, which announces its own completion, and names what to run instead. buzz-unbriefed: the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skillA deny rule: it refuses the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skill, and names what to run instead. cache-dir-write: a write into this checkout's magus cache dir, which magus alone ownsA deny rule: it refuses a write into this checkout's magus cache dir, which magus alone owns, and names what to run instead. capture-filter: a filter over a run capture or log, which cuts the failure block apartA deny rule: it refuses a filter over a run capture or log, which cuts the failure block apart, and names what to run instead. cd: a `cd` before a magus command, when the project is an argumentA deny rule: it refuses a `cd` before a magus command, when the project is an argument, and names what to run instead. claimed-declaration: a leased edit landing in a declaration another live job claims (`run.go#executeStages`)A deny rule: it refuses a leased edit landing in a declaration another live job claims (`run.go#executeStages`), and names what to run instead. credential-verb: an agent minting, printing, rotating or revoking a credential through the CLIA deny rule: it refuses an agent minting, printing, rotating or revoking a credential through the CLI, and names what to run instead. exit-status-echo: a line ending by printing an exit status, which the harness already reportsA deny rule: it refuses a line ending by printing an exit status, which the harness already reports, and names what to run instead. filter-without-input: a filter with no file, pipe or redirect, which reads a stdin nothing feedsA deny rule: it refuses a filter with no file, pipe or redirect, which reads a stdin nothing feeds, and names what to run instead. interpreter-rewrite: an inline interpreter rewriting a file this tree already carriesA deny rule: it refuses an inline interpreter rewriting a file this tree already carries, and names what to run instead. merge-side-checkout: a checkout of one merge side over a conflicted file, which discards the mergeA deny rule: it refuses a checkout of one merge side over a conflicted file, which discards the merge, and names what to run instead. notes-author: an agent authoring a human's note, whose only provenance is who wrote itA deny rule: it refuses an agent authoring a human's note, whose only provenance is who wrote it, and names what to run instead. output-pipe: magus output piped into a filter, when magus projects the record itselfA deny rule: it refuses magus output piped into a filter, when magus projects the record itself, and names what to run instead. output-redirect: magus output redirected to a file, which the run log already holdsA deny rule: it refuses magus output redirected to a file, which the run log already holds, and names what to run instead. process-poll: a process table inspected to wait on magus work the lock already reportsA deny rule: it refuses a process table inspected to wait on magus work the lock already reports, and names what to run instead. push-ungated: a push at a commit with no green gate: the person is asked, a leased worker refusedA deny rule: it refuses a push at a commit with no green gate: the person is asked, a leased worker refused, and names what to run instead. raw-tool: a toolchain command a spell already wraps, run outside the cacheA deny rule: it refuses a toolchain command a spell already wraps, run outside the cache, and names what to run instead. scripted-rewrite: a scripted substitute-and-write, which cannot tell your symbol from a dependency'sA deny rule: it refuses a scripted substitute-and-write, which cannot tell your symbol from a dependency's, and names what to run instead. search-translation: a text search whose pattern a graph query provably answers with the same entitiesA deny rule: it refuses a text search whose pattern a graph query provably answers with the same entities, and names what to run instead. sed-in-place: `sed -i`, whose two spellings destroy each other's work across platformsA deny rule: it refuses `sed -i`, whose two spellings destroy each other's work across platforms, and names what to run instead. shared-stash: a bare stash push or pop, on a stack every worktree sharesA deny rule: it refuses a bare stash push or pop, on a stack every worktree shares, and names what to run instead. sibling-checkout: a magus command relocated into another checkout, judging a tree nobody shipsA deny rule: it refuses a magus command relocated into another checkout, judging a tree nobody ships, and names what to run instead. spawn-unbriefed: a subagent spawned before the multi-agent skill loadedA deny rule: it refuses a subagent spawned before the multi-agent skill loaded, and names what to run instead. stage-all: a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated outputA deny rule: it refuses a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated output, and names what to run instead. symbol-search: a recursive text search for names the graph answers exactly: symbols or diagnostic codesA deny rule: it refuses a recursive text search for names the graph answers exactly: symbols or diagnostic codes, and names what to run instead. throwaway-copy: a run inside a temp or scratchpad copy, which leaves the real tree unverifiedA deny rule: it refuses a run inside a temp or scratchpad copy, which leaves the real tree unverified, and names what to run instead. token-state: an agent reading or writing the token secrets: the operator token file or the token storeA deny rule: it refuses an agent reading or writing the token secrets: the operator token file or the token store, and names what to run instead. unknown-env: a retired or misspelled MAGUS_* variable handed to a commandA deny rule: it refuses a retired or misspelled MAGUS_* variable handed to a command, and names what to run instead. whole-tree: a whole-tree VCS reset, checkout, restore or clean, which cannot be undoneA deny rule: it refuses a whole-tree VCS reset, checkout, restore or clean, which cannot be undone, and names what to run instead. worktree-remove: removing a worktree, which may hold another session's uncommitted workA deny rule: it refuses removing a worktree, which may hold another session's uncommitted work, and names what to run instead.