agent-sign-off
A deny rule by default: it refuses an agent stamping a read receipt or closing an attention request, which only a person may do, and names what to run instead.
What it catches
An agent stamping a read receipt or closing an attention request, which only a person may do.
Why
This is not a permission an agent is missing: there is no spelling of either an agent may use, because an agent stamping the changeset or closing its own block would make the measure mean nothing for everybody, including the human relying on it. Report what is unread instead: magus diff --impact names every changed file carrying no receipt, and magus diff -o json puts read_state on each file for a caller to branch on. Waiting on a request instead: say you are waiting on its id and hand it back; magus session dispose <id> is a person's to run.
Default and override
By default this rule takes the decision deny. A workspace sets it by name, in its root
magusfile, to deny, advise or off:
magus\guard.builtins({"agent-sign-off": "advise"})
A loosening takes effect once it is committed; a tightening applies at once.
Seeing it
A verdict names its rule in brackets, which is how you got here:
deny [agent-sign-off]: ...
A workspace that sets this rule to advise sees advise [agent-sign-off]: ... instead.
magus describe rule agent-sign-off prints the same entry at a terminal, and
magus describe rules lists every rule this workspace enforces.
See also
- All rules - what this workspace enforces, deny first
- The guard - how a verdict is reached and wired
- Setting a built-in rule - how a workspace changes this default