Guard rules
What this workspace enforces. A deny refuses the call and names the
replacement; an advise attaches context and blocks nothing. The tables
show each rule's compiled default, and a workspace sets any of them with
magus\guard.builtins.
Every verdict names its rule in brackets (deny [stage-all]: ...), and that
name is the entry below. magus describe rules prints the same list.
Rules for written text, such as pull request descriptions and docs, are the proofread rules.
Denies by default
| Rule | Catches |
|---|---|
| agent-sign-off | an agent stamping a read receipt or closing an attention request, which only a person may do |
| architecture-unbriefed | an agent's next call after a structure question, or a new directory, before the architecture skill |
| background-left | an agent finishing while shell commands it ran in the background are still running |
| background-silent | a background task of the session that has written nothing for advise_minutes (30 unset) |
| background-unbounded | a shell command run in the background with nothing to end it |
| backtick-substitution | a backtick command substitution, which inside double quotes runs a command |
| brief-command | a spawn or continuation brief that teaches a command the guard denies |
| brief-plain-commands | a brief for an isolated worker that teaches a substitution, a loop or an exec |
| busy-wait | a while or until loop that sleeps, or a for loop that sleeps until it breaks out |
| buzz-unbriefed | the first Buzz a session authors, by file write or magus buzz -e, before reading the Buzz skill |
| cache-dir-write | a write into this checkout's magus cache dir, which magus alone owns |
| capture-filter | a filter over a run capture or log, which cuts the failure block apart |
| chained-run | magus runs sequenced with && or ;, which a pipe of the same stages runs ordered and fail-fast |
| check-timeout | a bound worker's magus run whose timeout is shorter than the target's last real run allows for |
| checkpoint-state | a command reaching for a tree's identity, which a revision alone cannot give |
| claimed-declaration | a leased edit landing in a declaration another live job claims (run.go#executeStages) |
| conflict-rewrite | an inline interpreter rewriting a file that holds merge conflict markers |
| credential-verb | an agent minting, printing, rotating or revoking a credential through the CLI |
| dependency-install | a raw package install that the cached install target already runs |
| dependency-update | a raw dependency update outside a target's update charm |
| exit-status-echo | a line ending by printing an exit status, which the harness already reports |
| filter-without-input | a filter or interpreter with no file, script, pipe or redirect, which reads a stdin nothing feeds |
| focus-read | a read outside the paths a focus lease was given |
| gate-repeat | the gate run a third time over a tree its last green verdict already covers |
| generated-write | a hand edit to a declared output, which the next run overwrites |
| graph-pipe | a read-only graph verb piped into a text filter, when magus projects the record itself |
| grep-reader | a definition lookup with a context flag (grep -A40 'func X'), which uses grep to read the body |
| heredoc-write | a here-document written to a file, judged as the file write it is |
| hook-wiring-write | a leased or agent-attributed write to the host hook wiring or the workspace's ./magus |
| hooks-off | a git call with the repository's hooks switched off |
| human-only | a magus run reaching a human_only target: the person is asked, a leased worker refused |
| inline-alias | a VCS alias defined inline (git -c alias.x=...), which hides the command it runs |
| installed-skill | a write to an installed skill copy, which re-installing discards |
| interpreter-rewrite | an inline interpreter rewriting a file this tree already carries |
| interpreter-script | an ad-hoc script in python, node, perl or ruby, where Buzz is the workspace's scripting language |
| lease-checkout | a worker holding a checkout running magus outside it |
| lease-claim | a leased write outside its write paths that magus proves belongs to the job |
| lease-gate | a leased worker running the gate instead of the check it was assigned |
| lease-harness | a leased worker rewriting the harness skill trees that steer it |
| lease-invalid | a call naming a lease this workspace's job store does not declare |
| lease-paused | a leased worker starting a magus run while a person has its job paused |
| lease-rebind | a leased worker rewriting who it is or what its own job row says |
| lease-undeclared | a call graded under a lease id the job store has no row for, or a binding it tombstoned |
| lease-vcs | a worker lease mutating version control, or committing outside its own branch and checkout |
| lease-write | a leased write outside its write paths, or into a path it was denied or another lease owns |
| magus-timeout | a magus call wrapped in coreutils timeout or gtimeout, which kills it from outside |
| merge-side-checkout | a checkout of one merge side over a conflicted file, which discards the merge |
| model-tier-context-cap | a leased worker writing past the context its job's model tier caps |
| monitor-duplicate | a second live watcher on one subject, or one on work the agent backgrounded itself |
| monitor-pile | an agent arming a waiter while several of its own are already live |
| notes-author | an agent authoring a human's note, whose only provenance is who wrote it |
| orchestrator-groundwork | a session that hands out work doing its own groundwork: reads, searches, edits, runs |
| output-pipe | magus output piped into a filter, when magus projects the record itself |
| output-redirect | magus output sent to a file or discarded, which the run log already holds |
| policy-unloaded | a push, merge, spawn or state-writing magus verb while the guard policy that judges it does not load |
| process-poll | a process table inspected to wait on magus work the lock already reports |
| push-ungated | a push or gh pr create at a commit with no green gate; refused for every session |
| raw-tool | a toolchain command a spell already wraps, run outside the cache |
| read-navigation | a whole read of a Go, Buzz or Markdown file past the workspace's line limit |
| read-paging | a mapped file read window by window, past two windows of it |
| search-translation | a text search whose pattern a graph query provably answers with the same entities |
| sed-in-place | sed -i, whose two spellings destroy each other's work across platforms |
| shared-stash | a bare stash push or pop, on a stack every worktree shares |
| sibling-checkout | a magus command relocated into another checkout, judging a tree nobody ships |
| sleep-poll | a sleep before a status read, a call that only sleeps, or a wait on or retry into a full budget |
| spawn-above-parent-tier | a subagent spawned on a model whose tier ranks above its spawner's |
| spawn-duplicate | a spawn for a job that already has a worker |
| spawn-nested-waiter | a subagent spawning a helper whose title or brief opening speaks of waiting or watching |
| spawn-unbriefed | a subagent spawned before the multi-agent skill loaded |
| spawn-unvalidated | a spawn for a job whose record was never validated |
| spawn-waiter | a spawn whose child exists to wait on, poll or watch other work |
| spawn-warm-worker | a fresh spawn for follow-up work while the worker that wrote the code is still warm |
| stage-all | a whole-tree git add (-A, -u, ., --all, --update), which sweeps in regenerated output |
| stale-binary | a call that changes state while the magus judging it cannot load this tree's guard policy |
| symbol-search | a text search of the tree for a symbol, a declaration or a diagnostic code the graph answers |
| throwaway-copy | a run inside a temp or scratchpad copy, which leaves the real tree unverified |
| token-state | an agent reading or writing the token secrets: the operator token file or the token store |
| unjudged-tool | a tool call whose input carries nothing any rule reads, from a tool the guard does not know |
| unknown-env | a retired or misspelled MAGUS_* variable handed to a command |
| unread-command | a program or VCS subcommand the shell computes before it runs, which no rule can read |
| vcs-off-switch | an agent's write setting vcs.enabled: false in a magus.yaml this workspace reads |
| whole-tree | a whole-tree VCS reset, checkout, restore or clean, which cannot be undone |
| worker-background-run | a bound worker running a magus target in the background |
| worker-check-only | a bound worker running other than its check or a writer of its write paths, or writing past them |
| worktree-remove | removing a worktree magus cannot prove holds nothing that would be lost |
Advises by default
| Rule | Catches |
|---|---|
| compat-marker | a leased worker adding a marker that keeps code for older data or callers |
| echo-on-success | an && echo that restates what the exit status already says |
| focus | a read or write outside the paths the running job declared |
| graph-stale | a graph read, or a graph-backed deny, while the graph describes another tree |
| guard-unfinished | guard checks that never finished, so no rule judged their calls |
| hook-wiring | a write to the host wiring that decides whether these rules run at all |
| instruction-write | a write to a cross-host instruction file, which every session loads whole |
| lease-state | a leased write while its row reports a diverged base, a re-entered path, or a bad pattern |
| lease-terminal | a call naming a lease whose row has already finished |
| leased-path | a write into paths a running lease owns, by a caller that names no lease |
| new-file | a new file in a directory whose naming has settled |
| new-source-dir | a new file that opens a directory, which is a boundary rather than a file |
| precedent-search | a hunt for one distinctive name, which refs answers with verified sites |
| push-gate | a push or gh pr create the run log cannot prove ungated; names the gate |
| read-symbol | a bounded read inside one indexed declaration, which refs --definition --source prints checked |
| regen-source | a hand edit to a file a target regenerates |
| release-requested | a job holding write paths another fork was refused for, with a release request open |
| revert-classify | a revert that has not classified what it is reverting |
| scope-drift | a write into a project this session has no dependency edge to |
| shared-checkout | a spawn into a checkout a live job already holds and writes |
| skill-source | a write to an installed skill copy rather than to its source |
| source-read | an unbounded source read the symbol index has already answered |
| spawn-unplaced | a subagent's first call that no waiting spawn names, which then runs under no lease |
| split-run | the same target run again on a different project set, as a separate call |
| stage-classify | staging without classifying, when generated and source differ |
| timed-magus | time around a silent magus run, which already reports its own durations |
| unleased-write | a write magus cannot attribute while a fleet is running |
| workspace-command-failed | a command the workspace's rule could not judge, so only the built-in rules graded it |
| workspace-spawn-failed | a spawn the workspace's rule could not judge, so only the built-in rules graded it |
| workspace-write-failed | a file write the workspace's rule could not judge, so only the built-in rules graded it |
| root-context-budget | a session's main thread whose context has grown past its level's size |
| root-heavy-command | a main thread running delegable commands one after another without spawning |
| root-repeat | a main thread running the same delegable command again with no write since |
| root-result-cap | one tool result too large for a main thread's context, said on its next call |
| spawn-above-model-tier | a subagent spawned on a model whose tier ranks above the tier its job was forked at |
| spawn-names-model | a main thread spawning a subagent without naming the model it runs on |
| stall | a leased worker refused by something only the root can clear |