The outer harness stays outside
magus is the outer harness: deterministic guides and sensors around an agent host's loop, never the loop itself (Prior art and terminology). The host is the inner harness. It decides what reaches the model and what a tool call does, and magus never enters that path.
So magus judges and informs; it does not transform. A guard verdict allows, advises or denies an action and gives its reason. It never rewrites the command, the prompt or the reply on the way through. The text an agent loads from magus (skills, MAGUS.md, the AGENTS.md section) is written ahead of time. It lives in version control, and people review it like code. Compression, proofreading and regeneration happen to those files, never at session start and never per request. magus runs no proxy between an agent and its provider and no step that edits context in flight.
The reason is ownership. A provider changes how its harness loads context, caches it and calls tools on its own schedule, and a layer that rewrote text in flight would break quietly when it did: the same trade as The host wiring is yours. It would also make the text a model saw differ from the text a person reviewed, and then version control no longer records what the model read.
Enforced by
- A guard verdict has three outcomes, allow, advise and deny, and none of them carries a rewritten command.
- Skills, MAGUS.md and the AGENTS.md section are files in version control. Targets regenerate them, and the drift gate checks them.
- A record of refusals lists the proxy and the model adapter as not built.
Good
The guard refuses and names the command to run instead; the agent runs it itself:
`buzz | head` needs no pipe: `-s` stays quiet until something fails, then prints the diagnostics and the log path.
Bad
hook: rewrite `go test ./...` to `magus run test .` and continue
The model believes it ran one command while another ran. The transcript a person reviews no longer says what happened.