magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
1 min read

lease-harness

A deny rule by default: it refuses a leased worker rewriting the harness skill trees that steer it, and names what to run instead.

What it catches

A leased worker rewriting the harness skill trees that steer it.

Default and override

By default this rule takes the decision deny. A workspace sets it by name, in its root magusfile, to deny, advise or off:

magus\guard.builtins({"lease-harness": "advise"})

A loosening takes effect once it is committed; a tightening applies at once.

Seeing it

A verdict names its rule in brackets, which is how you got here:

deny [lease-harness]: ...

magus describe rule lease-harness prints the same entry at a terminal, and magus describe rules lists every rule this workspace enforces.

See also

ReferencePages in this section. claimed-declaration: a leased edit landing in a declaration another live job claims (`run.go#executeStages`)A deny rule by default: it refuses a leased edit landing in a declaration another live job claims (`run.go#executeStages`), and names what to run instead. focus-read: a read outside the paths a focus lease was givenA deny rule by default: it refuses a read outside the paths a focus lease was given, and names what to run instead. hook-wiring-write: a leased or agent-attributed write to the hook wiring the guard is installed byA deny rule by default: it refuses a leased or agent-attributed write to the hook wiring the guard is installed by, and names what to run instead.
guardruleslease-harnessdeny
Last updated (1a76274f)
Earlier changes on this page (1)

Full history ↗ · Blame source ↗

Glossary

Workspace

The magus root directory that owns a set of projects and shared config; the unit magus operates over. See workspace.

Magusfile

The magusfile.buzz that declares a project's targets (as export funs) and binds its spells. See targets.

Buzz

The language magusfiles are written in (the .buzz engine). See engines.

CI

An ordinary magusfile-defined target you compose yourself with magus\needs: magus does not hardcode its stages. Magus.RunCI treats it specially only in that it strips the rw charm, it is the anchor magus affected ci keys off, and a selected scope with no project declaring it is a load error rather than a silent no-op. See targets.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate.

Lease

The grant a holder takes on a job: the write and read paths that job declared, enforced in the checkout that took it with magus job exec. A job is the piece of work; a lease is permission over it.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.