Where this is strained

Friction placed wrong is bureaucracy. A refusal that teaches and one that nags differ in nothing but their message text, and message text rots like any other prose; these principles hold while error messages get the same care as code.

The explain lenses cover verdicts magus computes. magus captures and replays the output of the tools a target drives, but it cannot make a third-party tool's reasoning inspectable; the lens stops at the tool boundary.

The host boundary still has costs, but the binary no longer owns host location lists. A harness descriptor declares a configuration path, native event matchers, response template, and skill locations; magus doctor verifies that contract as data, and agent install follows its declared skill paths. A host neither one names can still work through a portable adapter, while a new native host can add a collaborator without a Magus release. The envelope field names remain host-shaped, so a host that spells them differently reshapes its payload before piping it. And the OpenCode plugin carries a type-check and tests because it is real TypeScript, which is more upkeep than a shell template and more than an example should need.

Four rules in the standard live only in prose today, and by its own measure that makes each a debt. Every one is a read of what magus already records, so each passes the scope test; none is built:

• The size ledger (criterion 2): a generated, committed inventory of verbs, flags, config keys, and diagnostic codes, regenerated by generate so the drift gate lands any growth in the diff of the change that caused it, where the person who can say no is already looking. Not a cap: a number nobody can fail to notice.
• The savings lens (criterion 4): what the cache and the affected set bought (runs replayed against runs executed, wall time avoided) as arithmetic over run records that already exist, interrogable like any other verdict. Until it exists, "the cache is worth its complexity" is taken on trust, which is the one way this tool asks not to be taken.
• The departure test (criterion 1): Scope claims that deleting everything magus wrote leaves magus run build working, and admits the claim is thinner than it sounds. An audit job that strips those artifacts in a throwaway worktree and builds would make the exit guarantee self-verifying instead of asserted.
• When it breaks (criterion 6): the diagnostics reference covers coded refusals; the failures that never raise a code (a daemon that did not bind, a watcher gone stale, a cache entry that will not replay) are documented where someone thought to write them down and absent where nobody did. The systematic version is a failure-modes section per concept page, enforced the way this repository already enforces document shape.

The principle pages name debts of their own:

• A scale target (Built for the largest monorepos): nothing commits the size of repository magus is measured against, or the latency a lookup must hold at that size, so "fast at scale" is asserted, not measured.

• Interface size and the unsafe packages (The Go proverbs, beyond Go): the bigger-interface and reflection proverbs hold in review alone. An interfacebloat linter, and an import rule keeping reflect and unsafe to an allowlist, are the candidates, rolled out under the stricter-rule rule.

• Thin packages (Abstract at the right layer, or not at all): nothing fails a package that is one file and its test and exports one symbol. A conformance metric for it, ratcheted like file-split, is the candidate.

The line between automated and manual moves as a mechanism earns confidence. To move a row out of Manual on purpose, or a debt off this list, edit that page in the same commit that changes the behavior.