Guard rules
What this workspace enforces. A deny refuses the call and names the
replacement; an advise attaches context and blocks nothing. The tables
show each rule's compiled default, and a workspace sets any of them with
magus\guard.builtins.
Every verdict names its rule in brackets (deny [stage-all]: ...), and that
name is the entry below. magus describe rules prints the same list.
Denies by default
| Rule | Catches |
|---|---|
| agent-sign-off | an agent stamping a read receipt or closing an attention request, which only a person may do |
| backtick-substitution | a backtick command substitution, which inside double quotes runs a command |
| cache-dir-write | a write into this checkout's magus cache dir, which magus alone owns |
| claimed-declaration | a leased edit landing in a declaration another live job claims (run.go#executeStages) |
| credential-verb | an agent minting, printing, rotating or revoking a credential through the CLI |
| focus-read | a read outside the paths a focus lease was given |
| hook-wiring-write | a leased or agent-attributed write to the hook wiring the guard is installed by |
| inline-alias | a VCS alias defined inline (git -c alias.x=...), which hides the command it runs |
| lease-gate | a leased worker running the gate instead of the check it was assigned |
| lease-harness | a leased worker rewriting the harness skill trees that steer it |
| lease-rebind | a leased worker rewriting who it is or what its own job row says |
| lease-undeclared | a call graded under a lease id the job store has no row for, or a binding it tombstoned |
| lease-vcs | a worker lease pushing, stashing or reverting, or committing outside its own branch and checkout |
| lease-write | a leased write outside its write paths, or into a path it was denied or another lease owns |
| merge-side-checkout | a checkout of one merge side over a conflicted file, which discards the merge |
| notes-author | an agent authoring a human's note, whose only provenance is who wrote it |
| push-ungated | a push at a commit with no green gate: the person is asked, a leased worker refused |
| shared-stash | a bare stash push or pop, on a stack every worktree shares |
| token-state | an agent reading or writing the token secrets: the operator token file or the token store |
| vcs-off-switch | an agent's write setting vcs.enabled: false in a magus.yaml this workspace reads |
| whole-tree | a whole-tree VCS reset, checkout, restore or clean, which cannot be undone |
| worker-check-only | a bound worker running a target other than its row's check or one writing its write paths |
| worktree-remove | removing a worktree magus cannot prove holds nothing that would be lost |
Advises by default
| Rule | Catches |
|---|---|
| brief-command | a spawn or continuation brief that teaches a command the guard denies |
| busy-wait | a loop that only sleeps between polls, holding a tool slot for its whole wait |
| buzz-unbriefed | the first Buzz a session authors, by file write or magus buzz -e, before reading the Buzz skill |
| capture-filter | a filter over a run capture or log, which cuts the failure block apart |
| chained-run | magus runs sequenced with && or ;, which a pipe of the same stages runs ordered and fail-fast |
| checkpoint-state | a command reaching for a tree's identity, which a revision alone cannot give |
| dependency-install | a raw package install that the cached install target already runs |
| dependency-update | a raw dependency update outside a target's update charm |
| echo-on-success | an && echo that restates what the exit status already says |
| exit-status-echo | a line ending by printing an exit status, which the harness already reports |
| filter-without-input | a filter with no file, pipe or redirect, which reads a stdin nothing feeds |
| focus | a read or write outside the paths the running job declared |
| gate-repeat | the gate run again soon after it passed, repeating work already done |
| generated-write | a hand edit to a declared output, which the next run overwrites |
| graph-pipe | a read-only graph verb piped into a text filter, when magus projects the record itself |
| graph-stale | a graph read, or a graph-backed deny, while the graph describes another tree |
| grep-reader | a definition lookup with a context flag (grep -A40 'func X'), which uses grep to read the body |
| hook-wiring | a write to the host wiring that decides whether these rules run at all |
| installed-skill | a write to an installed skill copy, which re-installing discards |
| instruction-write | a write to a cross-host instruction file, which every session loads whole |
| interpreter-rewrite | an inline interpreter rewriting a file this tree already carries |
| lease-invalid | a call naming a lease this workspace's job store does not declare |
| lease-state | a leased write while its row reports a diverged base, a re-entered path, or a bad pattern |
| lease-terminal | a call naming a lease whose row has already finished |
| leased-path | a write into paths a running lease owns, by a caller that names no lease |
| magus-timeout | a magus call wrapped in coreutils timeout or gtimeout, which kills it from outside |
| new-file | a new file in a directory whose naming has settled |
| new-source-dir | a new file that opens a directory, which is a boundary rather than a file |
| output-pipe | magus output piped into a filter, when magus projects the record itself |
| output-redirect | magus output sent to a file or discarded, which the run log already holds |
| precedent-search | a hunt for one distinctive name, which refs answers with verified sites |
| process-poll | a process table inspected to wait on magus work the lock already reports |
| push-gate | a push the run log does not prove ungated, which names the gate and lets it through |
| raw-tool | a toolchain command a spell already wraps, run outside the cache |
| read-navigation | a whole read of a Go, Buzz or Markdown file past the workspace's line limit |
| read-symbol | a bounded read inside one indexed declaration, which refs --definition --source prints checked |
| regen-source | a hand edit to a file a target regenerates |
| revert-classify | a revert that has not classified what it is reverting |
| scope-drift | a write into a project this session has no dependency edge to |
| scripted-rewrite | a scripted substitute-and-write, which cannot tell your symbol from a dependency's |
| search-translation | a text search whose pattern a graph query provably answers with the same entities |
| sed-in-place | sed -i, whose two spellings destroy each other's work across platforms |
| shared-checkout | a spawn into a checkout a live job already holds and writes |
| sibling-checkout | a magus command relocated into another checkout, judging a tree nobody ships |
| skill-source | a write to an installed skill copy rather than to its source |
| source-read | an unbounded source read the symbol index has already answered |
| spawn-unbriefed | a subagent spawned before the multi-agent skill loaded |
| split-run | the same target run again on a different project set, as a separate call |
| stage-all | a whole-tree git add (-A, -u, ., --all, --update), which sweeps in regenerated output |
| stage-classify | staging without classifying, when generated and source differ |
| stdin-closed | shell commands run with stdin at end-of-file, said once per session |
| symbol-search | a text search of the tree for a symbol, a declaration or a diagnostic code the graph answers |
| throwaway-copy | a run inside a temp or scratchpad copy, which leaves the real tree unverified |
| timed-magus | time around a silent magus run, which already reports its own durations |
| unknown-env | a retired or misspelled MAGUS_* variable handed to a command |
| unleased-write | a write magus cannot attribute while a fleet is running |