agent-sign-off: an agent stamping a read receipt or closing an attention request, which only a person may doA deny rule by default: it refuses an agent stamping a read receipt or closing an attention request, which only a person may do, and names what to run instead. architecture-unbriefed: an agent's next call after a structure question, or a new directory, before the architecture skillA deny rule by default: it refuses an agent's next call after a structure question, or a new directory, before the architecture skill, and names what to run instead. background-left: an agent finishing while shell commands it ran in the background are still runningA deny rule by default: it refuses an agent finishing while shell commands it ran in the background are still running, and names what to run instead. background-silent: a background task of the session that has written nothing for advise_minutes (30 unset)A deny rule by default: it refuses a background task of the session that has written nothing for advise_minutes (30 unset), and names what to run instead. background-unbounded: a shell command run in the background with nothing to end itA deny rule by default: it refuses a shell command run in the background with nothing to end it, and names what to run instead. backtick-substitution: a backtick command substitution, which inside double quotes runs a commandA deny rule by default: it refuses a backtick command substitution, which inside double quotes runs a command, and names what to run instead. body-separatorA deny rule by default: it refuses a commit body that starts on the line after the subject. brief-command: a spawn or continuation brief that teaches a command the guard deniesA deny rule by default: it refuses a spawn or continuation brief that teaches a command the guard denies, and names what to run instead. brief-plain-commands: a brief for an isolated worker that teaches a substitution, a loop or an execA deny rule by default: it refuses a brief for an isolated worker that teaches a substitution, a loop or an exec, and names what to run instead. busy-wait: a while or until loop that sleeps, or a for loop that sleeps until it breaks outA deny rule by default: it refuses a while or until loop that sleeps, or a for loop that sleeps until it breaks out, and names what to run instead. buzz-unbriefed: the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skillA deny rule by default: it refuses the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skill, and names what to run instead. buzzwordA deny rule by default: it refuses a word chosen to sound significant rather than to say what is so ("delve", "tapestry"). cache-dir-write: a write into this checkout's magus cache dir, which magus alone ownsA deny rule by default: it refuses a write into this checkout's magus cache dir, which magus alone owns, and names what to run instead. capture-filter: a filter over a run capture or log, which cuts the failure block apartA deny rule by default: it refuses a filter over a run capture or log, which cuts the failure block apart, and names what to run instead. chained-run: magus runs sequenced with `&&` or `;`, which a pipe of the same stages runs ordered and fail-fastA deny rule by default: it refuses magus runs sequenced with `&&` or `;`, which a pipe of the same stages runs ordered and fail-fast, and names what to run instead. check-timeout: a bound worker's magus run whose timeout is shorter than the target's last real run allows forA deny rule by default: it refuses a bound worker's magus run whose timeout is shorter than the target's last real run allows for, and names what to run instead. checkpoint-state: a command reaching for a tree's identity, which a revision alone cannot giveA deny rule by default: it refuses a command reaching for a tree's identity, which a revision alone cannot give, and names what to run instead. claimed-declaration: a leased edit landing in a declaration another live job claims (`run.go#executeStages`)A deny rule by default: it refuses a leased edit landing in a declaration another live job claims (`run.go#executeStages`), and names what to run instead. closerA deny rule by default: it refuses a sentence that opens by announcing it restates the text above ("In conclusion,"). conflict-rewrite: an inline interpreter rewriting a file that holds merge conflict markersA deny rule by default: it refuses an inline interpreter rewriting a file that holds merge conflict markers, and names what to run instead. credential-verb: an agent minting, printing, rotating or revoking a credential through the CLIA deny rule by default: it refuses an agent minting, printing, rotating or revoking a credential through the CLI, and names what to run instead. dependency-install: a raw package install that the cached install target already runsA deny rule by default: it refuses a raw package install that the cached install target already runs, and names what to run instead. dependency-update: a raw dependency update outside a target's update charmA deny rule by default: it refuses a raw dependency update outside a target's update charm, and names what to run instead. exit-status-echo: a line ending by printing an exit status, which the harness already reportsA deny rule by default: it refuses a line ending by printing an exit status, which the harness already reports, and names what to run instead. filter-without-input: a filter or interpreter with no file, script, pipe or redirect, which reads a stdin nothing feedsA deny rule by default: it refuses a filter or interpreter with no file, script, pipe or redirect, which reads a stdin nothing feeds, and names what to run instead. focus-read: a read outside the paths a focus lease was givenA deny rule by default: it refuses a read outside the paths a focus lease was given, and names what to run instead. gate-repeat: the gate run a third time over a tree its last green verdict already coversA deny rule by default: it refuses the gate run a third time over a tree its last green verdict already covers, and names what to run instead. generated-write: a hand edit to a declared output, which the next run overwritesA deny rule by default: it refuses a hand edit to a declared output, which the next run overwrites, and names what to run instead. gradeA deny rule by default: it refuses a text whose grade, out of 100, is under the minimum its kind is held to. graph-pipe: a read-only graph verb piped into a text filter, when magus projects the record itselfA deny rule by default: it refuses a read-only graph verb piped into a text filter, when magus projects the record itself, and names what to run instead. grep-reader: a definition lookup with a context flag (`grep -A40 'func X'`), which uses grep to read the bodyA deny rule by default: it refuses a definition lookup with a context flag (`grep -A40 'func X'`), which uses grep to read the body, and names what to run instead. help-lengthA deny rule by default: it refuses help text over 240 runes. help-sentenceA deny rule by default: it refuses a sentence of help text over 40 words. heredoc-write: a here-document written to a file, judged as the file write it isA deny rule by default: it refuses a here-document written to a file, judged as the file write it is, and names what to run instead. hook-wiring-write: a leased or agent-attributed write to the host hook wiring or the workspace's ./magusA deny rule by default: it refuses a leased or agent-attributed write to the host hook wiring or the workspace's ./magus, and names what to run instead. hooks-off: a git call with the repository's hooks switched offA deny rule by default: it refuses a git call with the repository's hooks switched off, and names what to run instead. human-only: a magus run reaching a human_only target: the person is asked, a leased worker refusedA deny rule by default: it refuses a magus run reaching a human_only target: the person is asked, a leased worker refused, and names what to run instead. inline-alias: a VCS alias defined inline (`git -c alias.x=...`), which hides the command it runsA deny rule by default: it refuses a VCS alias defined inline (`git -c alias.x=...`), which hides the command it runs, and names what to run instead. installed-skill: a write to an installed skill copy, which re-installing discardsA deny rule by default: it refuses a write to an installed skill copy, which re-installing discards, and names what to run instead. interpreter-rewrite: an inline interpreter rewriting a file this tree already carriesA deny rule by default: it refuses an inline interpreter rewriting a file this tree already carries, and names what to run instead. interpreter-script: an ad-hoc script in python, node, perl or ruby, where Buzz is the workspace's scripting languageA deny rule by default: it refuses an ad-hoc script in python, node, perl or ruby, where Buzz is the workspace's scripting language, and names what to run instead. lead-contextA deny rule by default: it refuses a change description whose first paragraph does not state the intent: what it set out to do and why. lease-checkout: a worker holding a checkout running magus outside itA deny rule by default: it refuses a worker holding a checkout running magus outside it, and names what to run instead. lease-claim: a leased write outside its write paths that magus proves belongs to the jobA deny rule by default: it refuses a leased write outside its write paths that magus proves belongs to the job, and names what to run instead. lease-gate: a leased worker running the gate instead of the check it was assignedA deny rule by default: it refuses a leased worker running the gate instead of the check it was assigned, and names what to run instead. lease-harness: a leased worker rewriting the harness skill trees that steer itA deny rule by default: it refuses a leased worker rewriting the harness skill trees that steer it, and names what to run instead. lease-invalid: a call naming a lease this workspace's job store does not declareA deny rule by default: it refuses a call naming a lease this workspace's job store does not declare, and names what to run instead. lease-paused: a leased worker starting a magus run while a person has its job pausedA deny rule by default: it refuses a leased worker starting a magus run while a person has its job paused, and names what to run instead. lease-rebind: a leased worker rewriting who it is or what its own job row saysA deny rule by default: it refuses a leased worker rewriting who it is or what its own job row says, and names what to run instead. lease-undeclared: a call graded under a lease id the job store has no row for, or a binding it tombstonedA deny rule by default: it refuses a call graded under a lease id the job store has no row for, or a binding it tombstoned, and names what to run instead. lease-vcs: a worker lease mutating version control, or committing outside its own branch and checkoutA deny rule by default: it refuses a worker lease mutating version control, or committing outside its own branch and checkout, and names what to run instead. lease-write: a leased write outside its write paths, or into a path it was denied or another lease ownsA deny rule by default: it refuses a leased write outside its write paths, or into a path it was denied or another lease owns, and names what to run instead. magus-timeout: a magus call wrapped in coreutils `timeout` or `gtimeout`, which kills it from outsideA deny rule by default: it refuses a magus call wrapped in coreutils `timeout` or `gtimeout`, which kills it from outside, and names what to run instead. merge-side-checkout: a checkout of one merge side over a conflicted file, which discards the mergeA deny rule by default: it refuses a checkout of one merge side over a conflicted file, which discards the merge, and names what to run instead. message-commandsA deny rule by default: it refuses a message naming more than one backticked command. message-lengthA deny rule by default: it refuses a message longer than its rune cap, 160 unless the caller names one. message-rationaleA deny rule by default: it refuses a message that joins more than one reason (so, because, a semicolon, ", which"). message-tagA deny rule by default: it refuses a message opening with a component tag ("server: ") or carrying a marker such as "[AGENT]". model-tier-context-cap: a leased worker writing past the context its job's model tier capsA deny rule by default: it refuses a leased worker writing past the context its job's model tier caps, and names what to run instead. monitor-duplicate: a second live watcher on one subject, or one on work the agent backgrounded itselfA deny rule by default: it refuses a second live watcher on one subject, or one on work the agent backgrounded itself, and names what to run instead. monitor-pile: an agent arming a waiter while several of its own are already liveA deny rule by default: it refuses an agent arming a waiter while several of its own are already live, and names what to run instead. notes-author: an agent authoring a human's note, whose only provenance is who wrote itA deny rule by default: it refuses an agent authoring a human's note, whose only provenance is who wrote it, and names what to run instead. orchestrator-groundwork: a session that hands out work doing its own groundwork: reads, searches, edits, runsA deny rule by default: it refuses a session that hands out work doing its own groundwork: reads, searches, edits, runs, and names what to run instead. output-pipe: magus output piped into a filter, when magus projects the record itselfA deny rule by default: it refuses magus output piped into a filter, when magus projects the record itself, and names what to run instead. output-redirect: magus output sent to a file or discarded, which the run log already holdsA deny rule by default: it refuses magus output sent to a file or discarded, which the run log already holds, and names what to run instead. policy-unloaded: a push, merge, spawn or state-writing magus verb while the guard policy that judges it does not loadA deny rule by default: it refuses a push, merge, spawn or state-writing magus verb while the guard policy that judges it does not load, and names what to run instead. process-poll: a process table inspected to wait on magus work the lock already reportsA deny rule by default: it refuses a process table inspected to wait on magus work the lock already reports, and names what to run instead. push-ungated: a push or `gh pr create` at a commit with no green gate; refused for every sessionA deny rule by default: it refuses a push or `gh pr create` at a commit with no green gate; refused for every session, and names what to run instead. raw-tool: a toolchain command a spell already wraps, run outside the cacheA deny rule by default: it refuses a toolchain command a spell already wraps, run outside the cache, and names what to run instead. read-navigation: a whole read of a Go, Buzz or Markdown file past the workspace's line limitA deny rule by default: it refuses a whole read of a Go, Buzz or Markdown file past the workspace's line limit, and names what to run instead. read-paging: a mapped file read window by window, past two windows of itA deny rule by default: it refuses a mapped file read window by window, past two windows of it, and names what to run instead. search-translation: a text search whose pattern a graph query provably answers with the same entitiesA deny rule by default: it refuses a text search whose pattern a graph query provably answers with the same entities, and names what to run instead. sed-in-place: `sed -i`, whose two spellings destroy each other's work across platformsA deny rule by default: it refuses `sed -i`, whose two spellings destroy each other's work across platforms, and names what to run instead. shared-stash: a bare stash push or pop, on a stack every worktree sharesA deny rule by default: it refuses a bare stash push or pop, on a stack every worktree shares, and names what to run instead. sibling-checkout: a magus command relocated into another checkout, judging a tree nobody shipsA deny rule by default: it refuses a magus command relocated into another checkout, judging a tree nobody ships, and names what to run instead. sleep-poll: a sleep before a status read, a call that only sleeps, or a wait on or retry into a full budgetA deny rule by default: it refuses a sleep before a status read, a call that only sleeps, or a wait on or retry into a full budget, and names what to run instead. spawn-above-parent-tier: a subagent spawned on a model whose tier ranks above its spawner'sA deny rule by default: it refuses a subagent spawned on a model whose tier ranks above its spawner's, and names what to run instead. spawn-duplicate: a spawn for a job that already has a workerA deny rule by default: it refuses a spawn for a job that already has a worker, and names what to run instead. spawn-nested-waiter: a subagent spawning a helper whose title or brief opening speaks of waiting or watchingA deny rule by default: it refuses a subagent spawning a helper whose title or brief opening speaks of waiting or watching, and names what to run instead. spawn-unbriefed: a subagent spawned before the multi-agent skill loadedA deny rule by default: it refuses a subagent spawned before the multi-agent skill loaded, and names what to run instead. spawn-unvalidated: a spawn for a job whose record was never validatedA deny rule by default: it refuses a spawn for a job whose record was never validated, and names what to run instead. spawn-waiter: a spawn whose child exists to wait on, poll or watch other workA deny rule by default: it refuses a spawn whose child exists to wait on, poll or watch other work, and names what to run instead. spawn-warm-worker: a fresh spawn for follow-up work while the worker that wrote the code is still warmA deny rule by default: it refuses a fresh spawn for follow-up work while the worker that wrote the code is still warm, and names what to run instead. stage-all: a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated outputA deny rule by default: it refuses a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated output, and names what to run instead. stale-binary: a call that changes state while the magus judging it cannot load this tree's guard policyA deny rule by default: it refuses a call that changes state while the magus judging it cannot load this tree's guard policy, and names what to run instead. step-verbA deny rule by default: it refuses a numbered step of a guide that does not open with its imperative verb. subject-lengthA deny rule by default: it refuses a commit subject over 100 bytes. subject-periodA deny rule by default: it refuses a commit subject ending in a period. suppression-unusedA deny rule by default: it refuses a suppression comment that gives no reason or that matched no finding. symbol-search: a text search of the tree for a symbol, a declaration or a diagnostic code the graph answersA deny rule by default: it refuses a text search of the tree for a symbol, a declaration or a diagnostic code the graph answers, and names what to run instead. throwaway-copy: a run inside a temp or scratchpad copy, which leaves the real tree unverifiedA deny rule by default: it refuses a run inside a temp or scratchpad copy, which leaves the real tree unverified, and names what to run instead. token-state: an agent reading or writing the token secrets: the operator token file or the token storeA deny rule by default: it refuses an agent reading or writing the token secrets: the operator token file or the token store, and names what to run instead. tool-sellingA deny rule by default: it refuses a word that sells the tool (powerful, seamless, effortless, state-of-the-art) or a buzzword. unjudged-tool: a tool call whose input carries nothing any rule reads, from a tool the guard does not knowA deny rule by default: it refuses a tool call whose input carries nothing any rule reads, from a tool the guard does not know, and names what to run instead. unknown-env: a retired or misspelled MAGUS_* variable handed to a commandA deny rule by default: it refuses a retired or misspelled MAGUS_* variable handed to a command, and names what to run instead. unread-command: a program or VCS subcommand the shell computes before it runs, which no rule can readA deny rule by default: it refuses a program or VCS subcommand the shell computes before it runs, which no rule can read, and names what to run instead. vagueA deny rule by default: it refuses weight or consensus asserted with nothing named ("experts argue", "the stakes are high"). vcs-off-switch: an agent's write setting vcs.enabled: false in a magus.yaml this workspace readsA deny rule by default: it refuses an agent's write setting vcs.enabled: false in a magus.yaml this workspace reads, and names what to run instead. whole-tree: a whole-tree VCS reset, checkout, restore or clean, which cannot be undoneA deny rule by default: it refuses a whole-tree VCS reset, checkout, restore or clean, which cannot be undone, and names what to run instead. worker-background-run: a bound worker running a magus target in the backgroundA deny rule by default: it refuses a bound worker running a magus target in the background, and names what to run instead. worker-check-only: a bound worker running other than its check or a writer of its write paths, or writing past themA deny rule by default: it refuses a bound worker running other than its check or a writer of its write paths, or writing past them, and names what to run instead. worktree-remove: removing a worktree magus cannot prove holds nothing that would be lostA deny rule by default: it refuses removing a worktree magus cannot prove holds nothing that would be lost, and names what to run instead.