lease-write
A deny rule by default: it refuses a leased write outside its write paths, or into a path it was denied or another lease owns, and names what to run instead.
What it catches
A leased write outside its write paths, or into a path it was denied or another lease owns.
Why
The boundary is the orchestrator's declaration in the job store; the guard reads it back for a file write and for a shell line, in the same words. A shell line's relative paths resolve from the directory it runs in. A remove or move (rm, rmdir, mv, git rm and mv, hg and sl remove and rename) is graded by every path it reaches: each operand, and everything a directory operand holds, must be inside the write paths and outside the deny paths. A leased write before the job has reported the base it landed on is refused under the same name, since nothing yet records which revision the work applies to.
Default and override
By default this rule takes the decision deny. A workspace sets it by name, in its root
magusfile, to deny, advise or off:
magus\guard.builtins({"lease-write": "advise"})
A loosening takes effect once it is committed; a tightening applies at once.
Seeing it
A verdict names its rule in brackets, which is how you got here:
deny [lease-write]: ...
A workspace that sets this rule to advise sees advise [lease-write]: ... instead.
magus describe rule lease-write prints the same entry at a terminal, and
magus describe rules lists every rule this workspace enforces.
See also
- All rules - what this workspace enforces, deny first
- The guard - how a verdict is reached and wired
- Setting a built-in rule - how a workspace changes this default