brief-command: a spawn or continuation brief that teaches a command the guard deniesAn advisory by default: it explains, and blocks nothing, on a spawn or continuation brief that teaches a command the guard denies. busy-wait: a loop that only sleeps between polls, holding a tool slot for its whole waitAn advisory by default: it explains, and blocks nothing, on a loop that only sleeps between polls, holding a tool slot for its whole wait. buzz-unbriefed: the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skillAn advisory by default: it explains, and blocks nothing, on the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skill. capture-filter: a filter over a run capture or log, which cuts the failure block apartAn advisory by default: it explains, and blocks nothing, on a filter over a run capture or log, which cuts the failure block apart. chained-run: magus runs sequenced with `&&` or `;`, which a pipe of the same stages runs ordered and fail-fastAn advisory by default: it explains, and blocks nothing, on magus runs sequenced with `&&` or `;`, which a pipe of the same stages runs ordered and fail-fast. checkpoint-state: a command reaching for a tree's identity, which a revision alone cannot giveAn advisory by default: it explains, and blocks nothing, on a command reaching for a tree's identity, which a revision alone cannot give. dependency-install: a raw package install that the cached install target already runsAn advisory by default: it explains, and blocks nothing, on a raw package install that the cached install target already runs. dependency-update: a raw dependency update outside a target's update charmAn advisory by default: it explains, and blocks nothing, on a raw dependency update outside a target's update charm. echo-on-success: an `&& echo` that restates what the exit status already saysAn advisory by default: it explains, and blocks nothing, on an `&& echo` that restates what the exit status already says. exit-status-echo: a line ending by printing an exit status, which the harness already reportsAn advisory by default: it explains, and blocks nothing, on a line ending by printing an exit status, which the harness already reports. filter-without-input: a filter with no file, pipe or redirect, which reads a stdin nothing feedsAn advisory by default: it explains, and blocks nothing, on a filter with no file, pipe or redirect, which reads a stdin nothing feeds. focus: a read or write outside the paths the running job declaredAn advisory by default: it explains, and blocks nothing, on a read or write outside the paths the running job declared. gate-repeat: the gate run again soon after it passed, repeating work already doneAn advisory by default: it explains, and blocks nothing, on the gate run again soon after it passed, repeating work already done. generated-write: a hand edit to a declared output, which the next run overwritesAn advisory by default: it explains, and blocks nothing, on a hand edit to a declared output, which the next run overwrites. graph-pipe: a read-only graph verb piped into a text filter, when magus projects the record itselfAn advisory by default: it explains, and blocks nothing, on a read-only graph verb piped into a text filter, when magus projects the record itself. graph-stale: a graph read, or a graph-backed deny, while the graph describes another treeAn advisory by default: it explains, and blocks nothing, on a graph read, or a graph-backed deny, while the graph describes another tree. grep-reader: a definition lookup with a context flag (`grep -A40 'func X'`), which uses grep to read the bodyAn advisory by default: it explains, and blocks nothing, on a definition lookup with a context flag (`grep -A40 'func X'`), which uses grep to read the body. hook-wiring: a write to the host wiring that decides whether these rules run at allAn advisory by default: it explains, and blocks nothing, on a write to the host wiring that decides whether these rules run at all. installed-skill: a write to an installed skill copy, which re-installing discardsAn advisory by default: it explains, and blocks nothing, on a write to an installed skill copy, which re-installing discards. instruction-write: a write to a cross-host instruction file, which every session loads wholeAn advisory by default: it explains, and blocks nothing, on a write to a cross-host instruction file, which every session loads whole. interpreter-rewrite: an inline interpreter rewriting a file this tree already carriesAn advisory by default: it explains, and blocks nothing, on an inline interpreter rewriting a file this tree already carries. lease-invalid: a call naming a lease this workspace's job store does not declareAn advisory by default: it explains, and blocks nothing, on a call naming a lease this workspace's job store does not declare. lease-state: a leased write while its row reports a diverged base, a re-entered path, or a bad patternAn advisory by default: it explains, and blocks nothing, on a leased write while its row reports a diverged base, a re-entered path, or a bad pattern. lease-terminal: a call naming a lease whose row has already finishedAn advisory by default: it explains, and blocks nothing, on a call naming a lease whose row has already finished. leased-path: a write into paths a running lease owns, by a caller that names no leaseAn advisory by default: it explains, and blocks nothing, on a write into paths a running lease owns, by a caller that names no lease. magus-timeout: a magus call wrapped in coreutils `timeout` or `gtimeout`, which kills it from outsideAn advisory by default: it explains, and blocks nothing, on a magus call wrapped in coreutils `timeout` or `gtimeout`, which kills it from outside. new-file: a new file in a directory whose naming has settledAn advisory by default: it explains, and blocks nothing, on a new file in a directory whose naming has settled. new-source-dir: a new file that opens a directory, which is a boundary rather than a fileAn advisory by default: it explains, and blocks nothing, on a new file that opens a directory, which is a boundary rather than a file. output-pipe: magus output piped into a filter, when magus projects the record itselfAn advisory by default: it explains, and blocks nothing, on magus output piped into a filter, when magus projects the record itself. output-redirect: magus output sent to a file or discarded, which the run log already holdsAn advisory by default: it explains, and blocks nothing, on magus output sent to a file or discarded, which the run log already holds. precedent-search: a hunt for one distinctive name, which refs answers with verified sitesAn advisory by default: it explains, and blocks nothing, on a hunt for one distinctive name, which refs answers with verified sites. process-poll: a process table inspected to wait on magus work the lock already reportsAn advisory by default: it explains, and blocks nothing, on a process table inspected to wait on magus work the lock already reports. push-gate: a push the run log does not prove ungated, which names the gate and lets it throughAn advisory by default: it explains, and blocks nothing, on a push the run log does not prove ungated, which names the gate and lets it through. raw-tool: a toolchain command a spell already wraps, run outside the cacheAn advisory by default: it explains, and blocks nothing, on a toolchain command a spell already wraps, run outside the cache. read-navigation: a whole read of a Go, Buzz or Markdown file past the workspace's line limitAn advisory by default: it explains, and blocks nothing, on a whole read of a Go, Buzz or Markdown file past the workspace's line limit. read-symbol: a bounded read inside one indexed declaration, which refs --definition --source prints checkedAn advisory by default: it explains, and blocks nothing, on a bounded read inside one indexed declaration, which refs --definition --source prints checked. regen-source: a hand edit to a file a target regeneratesAn advisory by default: it explains, and blocks nothing, on a hand edit to a file a target regenerates. revert-classify: a revert that has not classified what it is revertingAn advisory by default: it explains, and blocks nothing, on a revert that has not classified what it is reverting. scope-drift: a write into a project this session has no dependency edge toAn advisory by default: it explains, and blocks nothing, on a write into a project this session has no dependency edge to. scripted-rewrite: a scripted substitute-and-write, which cannot tell your symbol from a dependency'sAn advisory by default: it explains, and blocks nothing, on a scripted substitute-and-write, which cannot tell your symbol from a dependency's. search-translation: a text search whose pattern a graph query provably answers with the same entitiesAn advisory by default: it explains, and blocks nothing, on a text search whose pattern a graph query provably answers with the same entities. sed-in-place: `sed -i`, whose two spellings destroy each other's work across platformsAn advisory by default: it explains, and blocks nothing, on `sed -i`, whose two spellings destroy each other's work across platforms. shared-checkout: a spawn into a checkout a live job already holds and writesAn advisory by default: it explains, and blocks nothing, on a spawn into a checkout a live job already holds and writes. sibling-checkout: a magus command relocated into another checkout, judging a tree nobody shipsAn advisory by default: it explains, and blocks nothing, on a magus command relocated into another checkout, judging a tree nobody ships. skill-source: a write to an installed skill copy rather than to its sourceAn advisory by default: it explains, and blocks nothing, on a write to an installed skill copy rather than to its source. source-read: an unbounded source read the symbol index has already answeredAn advisory by default: it explains, and blocks nothing, on an unbounded source read the symbol index has already answered. spawn-unbriefed: a subagent spawned before the multi-agent skill loadedAn advisory by default: it explains, and blocks nothing, on a subagent spawned before the multi-agent skill loaded. split-run: the same target run again on a different project set, as a separate callAn advisory by default: it explains, and blocks nothing, on the same target run again on a different project set, as a separate call. stage-all: a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated outputAn advisory by default: it explains, and blocks nothing, on a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated output. stage-classify: staging without classifying, when generated and source differAn advisory by default: it explains, and blocks nothing, on staging without classifying, when generated and source differ. stdin-closed: shell commands run with stdin at end-of-file, said once per sessionAn advisory by default: it explains, and blocks nothing, on shell commands run with stdin at end-of-file, said once per session. symbol-search: a text search of the tree for a symbol, a declaration or a diagnostic code the graph answersAn advisory by default: it explains, and blocks nothing, on a text search of the tree for a symbol, a declaration or a diagnostic code the graph answers. throwaway-copy: a run inside a temp or scratchpad copy, which leaves the real tree unverifiedAn advisory by default: it explains, and blocks nothing, on a run inside a temp or scratchpad copy, which leaves the real tree unverified. timed-magus: `time` around a silent magus run, which already reports its own durationsAn advisory by default: it explains, and blocks nothing, on `time` around a silent magus run, which already reports its own durations. unknown-env: a retired or misspelled MAGUS_* variable handed to a commandAn advisory by default: it explains, and blocks nothing, on a retired or misspelled MAGUS_* variable handed to a command. unleased-write: a write magus cannot attribute while a fleet is runningAn advisory by default: it explains, and blocks nothing, on a write magus cannot attribute while a fleet is running.