Guard rulesEvery rule the guard enforces: what each one catches, whether it refuses or explains, and where the reasoning lives. agent-sign-off: an agent stamping a read receipt or closing an attention request, which only a person may doA deny rule: it refuses an agent stamping a read receipt or closing an attention request, which only a person may do, and names what to run instead. backtick-substitution: a backtick command substitution, which inside double quotes runs a commandA deny rule: it refuses a backtick command substitution, which inside double quotes runs a command, and names what to run instead. brief-command: a spawn or continuation brief that teaches a command the guard deniesA deny rule: it refuses a spawn or continuation brief that teaches a command the guard denies, and names what to run instead. busy-wait: a loop polling for work you started, which announces its own completionA deny rule: it refuses a loop polling for work you started, which announces its own completion, and names what to run instead. buzz-unbriefed: the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skillA deny rule: it refuses the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skill, and names what to run instead. cache-dir-write: a write into this checkout's magus cache dir, which magus alone ownsA deny rule: it refuses a write into this checkout's magus cache dir, which magus alone owns, and names what to run instead. capture-filter: a filter over a run capture or log, which cuts the failure block apartA deny rule: it refuses a filter over a run capture or log, which cuts the failure block apart, and names what to run instead. cd: a `cd` before a magus command, when the project is an argumentA deny rule: it refuses a `cd` before a magus command, when the project is an argument, and names what to run instead. chained-run: several magus runs chained on one line, where the dependency graph would have run themAn advisory: it explains, and blocks nothing, on several magus runs chained on one line, where the dependency graph would have run them. checkpoint-state: a command reaching for a tree's identity, which a revision alone cannot giveAn advisory: it explains, and blocks nothing, on a command reaching for a tree's identity, which a revision alone cannot give. claimed-declaration: a leased edit landing in a declaration another live job claims (`run.go#executeStages`)A deny rule: it refuses a leased edit landing in a declaration another live job claims (`run.go#executeStages`), and names what to run instead. credential-verb: an agent minting, printing, rotating or revoking a credential through the CLIA deny rule: it refuses an agent minting, printing, rotating or revoking a credential through the CLI, and names what to run instead. exit-status-echo: a line ending by printing an exit status, which the harness already reportsA deny rule: it refuses a line ending by printing an exit status, which the harness already reports, and names what to run instead. filter-without-input: a filter with no file, pipe or redirect, which reads a stdin nothing feedsA deny rule: it refuses a filter with no file, pipe or redirect, which reads a stdin nothing feeds, and names what to run instead. focus: a read or write outside the paths the running job declaredAn advisory: it explains, and blocks nothing, on a read or write outside the paths the running job declared. gate-repeat: the gate run again soon after it passed, repeating work already doneAn advisory: it explains, and blocks nothing, on the gate run again soon after it passed, repeating work already done. generated-write: a hand edit to a declared output, which the next run overwritesAn advisory: it explains, and blocks nothing, on a hand edit to a declared output, which the next run overwrites. graph-stale: a graph read while the index is older than the sources it describesAn advisory: it explains, and blocks nothing, on a graph read while the index is older than the sources it describes. hook-wiring: a write to the host wiring that decides whether these rules run at allAn advisory: it explains, and blocks nothing, on a write to the host wiring that decides whether these rules run at all. installed-skill: a write to an installed skill copy, which re-installing discardsAn advisory: it explains, and blocks nothing, on a write to an installed skill copy, which re-installing discards. interpreter-rewrite: an inline interpreter rewriting a file this tree already carriesA deny rule: it refuses an inline interpreter rewriting a file this tree already carries, and names what to run instead. lease-invalid: a call naming a lease this workspace's job store does not declareAn advisory: it explains, and blocks nothing, on a call naming a lease this workspace's job store does not declare. lease-terminal: a call naming a lease whose row has already finishedAn advisory: it explains, and blocks nothing, on a call naming a lease whose row has already finished. leased-path: a write into paths a running lease owns, by a caller that names no leaseAn advisory: it explains, and blocks nothing, on a write into paths a running lease owns, by a caller that names no lease. memory-write: a write to a memory file, where the memory surface is the way inAn advisory: it explains, and blocks nothing, on a write to a memory file, where the memory surface is the way in. merge-side-checkout: a checkout of one merge side over a conflicted file, which discards the mergeA deny rule: it refuses a checkout of one merge side over a conflicted file, which discards the merge, and names what to run instead. new-file: a new file in a directory whose naming has settledAn advisory: it explains, and blocks nothing, on a new file in a directory whose naming has settled. new-source-dir: a new file that opens a directory, which is a boundary rather than a fileAn advisory: it explains, and blocks nothing, on a new file that opens a directory, which is a boundary rather than a file. notes-author: an agent authoring a human's note, whose only provenance is who wrote itA deny rule: it refuses an agent authoring a human's note, whose only provenance is who wrote it, and names what to run instead. output-pipe: magus output piped into a filter, when magus projects the record itselfA deny rule: it refuses magus output piped into a filter, when magus projects the record itself, and names what to run instead. output-redirect: magus output redirected to a file, which the run log already holdsA deny rule: it refuses magus output redirected to a file, which the run log already holds, and names what to run instead. precedent-search: a hunt for one distinctive name, which refs answers with verified sitesAn advisory: it explains, and blocks nothing, on a hunt for one distinctive name, which refs answers with verified sites. process-poll: a process table inspected to wait on magus work the lock already reportsA deny rule: it refuses a process table inspected to wait on magus work the lock already reports, and names what to run instead. push-gate: a push the run log does not prove ungated, which names the gate and lets it throughAn advisory: it explains, and blocks nothing, on a push the run log does not prove ungated, which names the gate and lets it through. push-ungated: a push at a commit with no green gate: the person is asked, a leased worker refusedA deny rule: it refuses a push at a commit with no green gate: the person is asked, a leased worker refused, and names what to run instead. raw-tool: a toolchain command a spell already wraps, run outside the cacheA deny rule: it refuses a toolchain command a spell already wraps, run outside the cache, and names what to run instead. regen-source: a hand edit to a file a target regeneratesAn advisory: it explains, and blocks nothing, on a hand edit to a file a target regenerates. revert-classify: a revert that has not classified what it is revertingAn advisory: it explains, and blocks nothing, on a revert that has not classified what it is reverting. scope-drift: a write into a project this session has no dependency edge toAn advisory: it explains, and blocks nothing, on a write into a project this session has no dependency edge to. scripted-rewrite: a scripted substitute-and-write, which cannot tell your symbol from a dependency'sA deny rule: it refuses a scripted substitute-and-write, which cannot tell your symbol from a dependency's, and names what to run instead. search-translation: a text search whose pattern a graph query provably answers with the same entitiesA deny rule: it refuses a text search whose pattern a graph query provably answers with the same entities, and names what to run instead. sed-in-place: `sed -i`, whose two spellings destroy each other's work across platformsA deny rule: it refuses `sed -i`, whose two spellings destroy each other's work across platforms, and names what to run instead. shared-stash: a bare stash push or pop, on a stack every worktree sharesA deny rule: it refuses a bare stash push or pop, on a stack every worktree shares, and names what to run instead. sibling-checkout: a magus command relocated into another checkout, judging a tree nobody shipsA deny rule: it refuses a magus command relocated into another checkout, judging a tree nobody ships, and names what to run instead. skill-source: a write to an installed skill copy rather than to its sourceAn advisory: it explains, and blocks nothing, on a write to an installed skill copy rather than to its source. source-read: an unbounded source read the symbol index has already answeredAn advisory: it explains, and blocks nothing, on an unbounded source read the symbol index has already answered. spawn-unbriefed: a subagent spawned before the multi-agent skill loadedA deny rule: it refuses a subagent spawned before the multi-agent skill loaded, and names what to run instead. split-run: the same target run again on a different project set, on one line or as a separate callAn advisory: it explains, and blocks nothing, on the same target run again on a different project set, on one line or as a separate call. stage-all: a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated outputA deny rule: it refuses a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated output, and names what to run instead. stage-classify: staging without classifying, when generated and source differAn advisory: it explains, and blocks nothing, on staging without classifying, when generated and source differ. symbol-search: a recursive text search for names the graph answers exactly: symbols or diagnostic codesA deny rule: it refuses a recursive text search for names the graph answers exactly: symbols or diagnostic codes, and names what to run instead. throwaway-copy: a run inside a temp or scratchpad copy, which leaves the real tree unverifiedA deny rule: it refuses a run inside a temp or scratchpad copy, which leaves the real tree unverified, and names what to run instead. token-state: an agent reading or writing the token secrets: the operator token file or the token storeA deny rule: it refuses an agent reading or writing the token secrets: the operator token file or the token store, and names what to run instead. unknown-env: a retired or misspelled MAGUS_* variable handed to a commandA deny rule: it refuses a retired or misspelled MAGUS_* variable handed to a command, and names what to run instead. unleased-write: a write magus cannot attribute while a fleet is runningAn advisory: it explains, and blocks nothing, on a write magus cannot attribute while a fleet is running. whole-tree: a whole-tree VCS reset, checkout, restore or clean, which cannot be undoneA deny rule: it refuses a whole-tree VCS reset, checkout, restore or clean, which cannot be undone, and names what to run instead. worktree-remove: removing a worktree, which may hold another session's uncommitted workA deny rule: it refuses removing a worktree, which may hold another session's uncommitted work, and names what to run instead.