magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
1 min read

vcs-off-switch

A deny rule by default: it refuses an agent's write setting vcs.enabled: false in a magus.yaml this workspace reads, and names what to run instead.

What it catches

An agent's write setting vcs.enabled: false in a magus.yaml this workspace reads.

Why

With vcs off, vcs.Resolve returns no VCS, so the guard has no approved copy to compare a policy edit against and every workspace rule is read from the working tree alone. Decided by parsing the proposed magus.yaml content, never by matching text. A person editing their own checkout, with no lease and no spawn ancestry, is untouched.

Default and override

By default this rule takes the decision deny. A workspace sets it by name, in its root magusfile, to deny, advise or off:

magus\guard.builtins({"vcs-off-switch": "advise"})

A loosening takes effect once it is committed; a tightening applies at once.

Seeing it

A verdict names its rule in brackets, which is how you got here:

deny [vcs-off-switch]: ...

A workspace that sets this rule to advise sees advise [vcs-off-switch]: ... instead.

magus describe rule vcs-off-switch prints the same entry at a terminal, and magus describe rules lists every rule this workspace enforces.

See also

ReferencePages in this section. hook-wiring-write: a leased or agent-attributed write to the host hook wiring or the workspace's ./magusA deny rule by default: it refuses a leased or agent-attributed write to the host hook wiring or the workspace's ./magus, and names what to run instead. human-only: a magus run reaching a human_only target: the person is asked, a leased worker refusedA deny rule by default: it refuses a magus run reaching a human_only target: the person is asked, a leased worker refused, and names what to run instead. lease-vcs: a worker lease mutating version control, or committing outside its own branch and checkoutA deny rule by default: it refuses a worker lease mutating version control, or committing outside its own branch and checkout, and names what to run instead.
guardrulesvcs-off-switchdeny
Last updated (29d8b3de)
Earlier changes on this page (2)

Full history ↗ · Blame source ↗

Glossary

Workspace

The magus root directory that owns a set of projects and shared config; the unit magus operates over. Workspace in full.

Magusfile

The magusfile.buzz that declares a project's targets (as export funs) and binds its spells. Magusfile in full.

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). Op in full.

Buzz

The language magusfiles are written in (the .buzz engine). Buzz in full.

CI

An ordinary target you compose yourself with ctx.needs; magus does not hardcode its stages. It is the anchor magus affected ci keys off, and ci strips the rw charm. CI in full.

Agent

A model working through an agent host such as Claude Code, Codex, Cursor or OpenCode. magus treats an agent as one more caller of its CLI, MCP tools and console, held to the same checks as a person. Agent in full.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate. Run in full.

Lease

The grant a holder takes on a job: the write and read paths that job declared, enforced in the checkout that took it with magus job exec. A job is the piece of work; a lease is permission over it. Lease in full.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.