ADR 0005: deterministic answersThe v0.5.0 finishing pass, recorded in full. A stalled multi-agent change showed where agents improvise and where magus stays silent. The person drives; magus answers from the graph, the job store and typed APIs, and prints what to run. Every idea and use case raised during the pass is listed here with its state, so this page is also the plan. AgentsHow magus equips AI agents (the installable skills, the MAGUS.md routing index, the MCP server, and the guard hook any agent host can wire), with a setup page per host. Any other hostThe host-neutral contract (install the guidance where your host reads it, pipe the event to magus shell, render the verdict with -o template) for an agent host magus does not document by name. Claude CodeWiring magus into Claude Code (skills in .claude/skills, the two PreToolUse guard hooks, attention notifications, and the checks that prove the guard is running). CodexWiring magus into Codex (skills in .agents/skills, the AGENTS.md block you paste, MCP in the user-level config, and the hooks that carry the guard, the checkpoint and the post-compaction brief). CursorWiring magus into Cursor (AGENTS.md for guidance, one self-contained hook script for its wired events, and the one job Cursor's contract cannot express). Guard hook templatesThe Buzz hook templates Claude Code and Codex run for the magus guard, the checkpoint and the post-compaction brief, with the knobs that adapt them to a host, the version marker that tells you when your copy is stale, and the full source of each. Guard rulesEvery rule the guard enforces: what each one catches, whether it denies or advises by default, and where the reasoning lives. MGS1045: a magus\guard.spawn, command or write registration is unusableFires when magus\guard.spawn, magus\guard.command or magus\guard.write is handed something other than a function, is called twice in one load, or is called from a magusfile other than the root one. The workspace does not load. MGS1046: a MAGUS_* environment variable that is provably wrongFires when the environment carries a MAGUS_* variable magus retired, or one a typo away from a variable magus reads. Every command stops before doing any work, and the magus shell guard denies, naming each variable with what to do instead. MGS3024: a hook names no agent hostInstalled hook glue called magus without --agent-name, so magus cannot tell which agent host it is answering. The call is refused, and `magus describe harness` prints a configuration that names the host. OpenCodeWiring magus into OpenCode (skills in .opencode/skills, the TypeScript plugin that carries both guard surfaces, the post-compaction brief, and the idle checkpoint). Session load adaptersPer-host adapters that turn an agent host's own session log into the magus session event contract, so an audit can ask which skills loaded, whether the guard fired, and what ran unjudged. The guardWhat magus session hook denies, what it advises by default, and why: the five deny grounds, how a workspace sets a built-in rule, the file-path surface, the verdict contract a host wires into, and the observations magus records. agent-sign-off: an agent stamping a read receipt or closing an attention request, which only a person may doA deny rule by default: it refuses an agent stamping a read receipt or closing an attention request, which only a person may do, and names what to run instead. backtick-substitution: a backtick command substitution, which inside double quotes runs a commandA deny rule by default: it refuses a backtick command substitution, which inside double quotes runs a command, and names what to run instead. brief-command: a spawn or continuation brief that teaches a command the guard deniesAn advisory by default: it explains, and blocks nothing, on a spawn or continuation brief that teaches a command the guard denies. busy-wait: a loop that only sleeps between polls, holding a tool slot for its whole waitAn advisory by default: it explains, and blocks nothing, on a loop that only sleeps between polls, holding a tool slot for its whole wait. buzz-unbriefed: the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skillAn advisory by default: it explains, and blocks nothing, on the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skill. cache-dir-write: a write into this checkout's magus cache dir, which magus alone ownsA deny rule by default: it refuses a write into this checkout's magus cache dir, which magus alone owns, and names what to run instead. capture-filter: a filter over a run capture or log, which cuts the failure block apartAn advisory by default: it explains, and blocks nothing, on a filter over a run capture or log, which cuts the failure block apart. chained-run: magus runs sequenced with `&&` or `;`, which a pipe of the same stages runs ordered and fail-fastAn advisory by default: it explains, and blocks nothing, on magus runs sequenced with `&&` or `;`, which a pipe of the same stages runs ordered and fail-fast. checkpoint-state: a command reaching for a tree's identity, which a revision alone cannot giveAn advisory by default: it explains, and blocks nothing, on a command reaching for a tree's identity, which a revision alone cannot give. claimed-declaration: a leased edit landing in a declaration another live job claims (`run.go#executeStages`)A deny rule by default: it refuses a leased edit landing in a declaration another live job claims (`run.go#executeStages`), and names what to run instead. credential-verb: an agent minting, printing, rotating or revoking a credential through the CLIA deny rule by default: it refuses an agent minting, printing, rotating or revoking a credential through the CLI, and names what to run instead. dependency-install: a raw package install that the cached install target already runsAn advisory by default: it explains, and blocks nothing, on a raw package install that the cached install target already runs. dependency-update: a raw dependency update outside a target's update charmAn advisory by default: it explains, and blocks nothing, on a raw dependency update outside a target's update charm. echo-on-success: an `&& echo` that restates what the exit status already saysAn advisory by default: it explains, and blocks nothing, on an `&& echo` that restates what the exit status already says. exit-status-echo: a line ending by printing an exit status, which the harness already reportsAn advisory by default: it explains, and blocks nothing, on a line ending by printing an exit status, which the harness already reports. filter-without-input: a filter with no file, pipe or redirect, which reads a stdin nothing feedsAn advisory by default: it explains, and blocks nothing, on a filter with no file, pipe or redirect, which reads a stdin nothing feeds. focus-read: a read outside the paths a focus lease was givenA deny rule by default: it refuses a read outside the paths a focus lease was given, and names what to run instead. focus: a read or write outside the paths the running job declaredAn advisory by default: it explains, and blocks nothing, on a read or write outside the paths the running job declared. gate-repeat: the gate run again soon after it passed, repeating work already doneAn advisory by default: it explains, and blocks nothing, on the gate run again soon after it passed, repeating work already done. generated-write: a hand edit to a declared output, which the next run overwritesAn advisory by default: it explains, and blocks nothing, on a hand edit to a declared output, which the next run overwrites. graph-pipe: a read-only graph verb piped into a text filter, when magus projects the record itselfAn advisory by default: it explains, and blocks nothing, on a read-only graph verb piped into a text filter, when magus projects the record itself. graph-stale: a graph read, or a graph-backed deny, while the graph describes another treeAn advisory by default: it explains, and blocks nothing, on a graph read, or a graph-backed deny, while the graph describes another tree. grep-reader: a definition lookup with a context flag (`grep -A40 'func X'`), which uses grep to read the bodyAn advisory by default: it explains, and blocks nothing, on a definition lookup with a context flag (`grep -A40 'func X'`), which uses grep to read the body. hook-wiring-write: a leased or agent-attributed write to the hook wiring the guard is installed byA deny rule by default: it refuses a leased or agent-attributed write to the hook wiring the guard is installed by, and names what to run instead. hook-wiring: a write to the host wiring that decides whether these rules run at allAn advisory by default: it explains, and blocks nothing, on a write to the host wiring that decides whether these rules run at all. inline-alias: a VCS alias defined inline (`git -c alias.x=...`), which hides the command it runsA deny rule by default: it refuses a VCS alias defined inline (`git -c alias.x=...`), which hides the command it runs, and names what to run instead. installed-skill: a write to an installed skill copy, which re-installing discardsAn advisory by default: it explains, and blocks nothing, on a write to an installed skill copy, which re-installing discards. instruction-write: a write to a cross-host instruction file, which every session loads wholeAn advisory by default: it explains, and blocks nothing, on a write to a cross-host instruction file, which every session loads whole. interpreter-rewrite: an inline interpreter rewriting a file this tree already carriesAn advisory by default: it explains, and blocks nothing, on an inline interpreter rewriting a file this tree already carries. lease-gate: a leased worker running the gate instead of the check it was assignedA deny rule by default: it refuses a leased worker running the gate instead of the check it was assigned, and names what to run instead. lease-harness: a leased worker rewriting the harness skill trees that steer itA deny rule by default: it refuses a leased worker rewriting the harness skill trees that steer it, and names what to run instead. lease-invalid: a call naming a lease this workspace's job store does not declareAn advisory by default: it explains, and blocks nothing, on a call naming a lease this workspace's job store does not declare. lease-rebind: a leased worker rewriting who it is or what its own job row saysA deny rule by default: it refuses a leased worker rewriting who it is or what its own job row says, and names what to run instead. lease-state: a leased write while its row reports a diverged base, a re-entered path, or a bad patternAn advisory by default: it explains, and blocks nothing, on a leased write while its row reports a diverged base, a re-entered path, or a bad pattern. lease-terminal: a call naming a lease whose row has already finishedAn advisory by default: it explains, and blocks nothing, on a call naming a lease whose row has already finished. lease-undeclared: a call graded under a lease id the job store has no row for, or a binding it tombstonedA deny rule by default: it refuses a call graded under a lease id the job store has no row for, or a binding it tombstoned, and names what to run instead. lease-vcs: a worker lease pushing, stashing or reverting, or committing outside its own branch and checkoutA deny rule by default: it refuses a worker lease pushing, stashing or reverting, or committing outside its own branch and checkout, and names what to run instead. lease-write: a leased write outside its write paths, or into a path it was denied or another lease ownsA deny rule by default: it refuses a leased write outside its write paths, or into a path it was denied or another lease owns, and names what to run instead. leased-path: a write into paths a running lease owns, by a caller that names no leaseAn advisory by default: it explains, and blocks nothing, on a write into paths a running lease owns, by a caller that names no lease. magus sessionOne family over the repository's session store: list what magus invocations ran and the host session each ran in, list the blocks agents raised, close one by hand, and take the host-hook ingest that writes it all. magus shellRead one shell command, or one path an edit is about to write, and report what this workspace would rather you ran. magus-timeout: a magus call wrapped in coreutils `timeout` or `gtimeout`, which kills it from outsideAn advisory by default: it explains, and blocks nothing, on a magus call wrapped in coreutils `timeout` or `gtimeout`, which kills it from outside. magus\guard.commandRegister one Buzz function the agent guard calls on every agent shell command, to add a deny or an advisory from your repository's own rules. magus ships the seam and no rules. magus\guard.spawnRegister one Buzz function the agent guard calls on every subagent spawn and continuation, to add a deny or an advisory from your own rules. magus ships the seam and no rules. merge-side-checkout: a checkout of one merge side over a conflicted file, which discards the mergeA deny rule by default: it refuses a checkout of one merge side over a conflicted file, which discards the merge, and names what to run instead. new-file: a new file in a directory whose naming has settledAn advisory by default: it explains, and blocks nothing, on a new file in a directory whose naming has settled. new-source-dir: a new file that opens a directory, which is a boundary rather than a fileAn advisory by default: it explains, and blocks nothing, on a new file that opens a directory, which is a boundary rather than a file. notes-author: an agent authoring a human's note, whose only provenance is who wrote itA deny rule by default: it refuses an agent authoring a human's note, whose only provenance is who wrote it, and names what to run instead. output-pipe: magus output piped into a filter, when magus projects the record itselfAn advisory by default: it explains, and blocks nothing, on magus output piped into a filter, when magus projects the record itself. output-redirect: magus output sent to a file or discarded, which the run log already holdsAn advisory by default: it explains, and blocks nothing, on magus output sent to a file or discarded, which the run log already holds. precedent-search: a hunt for one distinctive name, which refs answers with verified sitesAn advisory by default: it explains, and blocks nothing, on a hunt for one distinctive name, which refs answers with verified sites. process-poll: a process table inspected to wait on magus work the lock already reportsAn advisory by default: it explains, and blocks nothing, on a process table inspected to wait on magus work the lock already reports. push-gate: a push the run log does not prove ungated, which names the gate and lets it throughAn advisory by default: it explains, and blocks nothing, on a push the run log does not prove ungated, which names the gate and lets it through. push-ungated: a push at a commit with no green gate: the person is asked, a leased worker refusedA deny rule by default: it refuses a push at a commit with no green gate: the person is asked, a leased worker refused, and names what to run instead. raw-tool: a toolchain command a spell already wraps, run outside the cacheAn advisory by default: it explains, and blocks nothing, on a toolchain command a spell already wraps, run outside the cache. read-navigation: a whole read of a Go, Buzz or Markdown file past the workspace's line limitAn advisory by default: it explains, and blocks nothing, on a whole read of a Go, Buzz or Markdown file past the workspace's line limit. read-symbol: a bounded read inside one indexed declaration, which refs --definition --source prints checkedAn advisory by default: it explains, and blocks nothing, on a bounded read inside one indexed declaration, which refs --definition --source prints checked. regen-source: a hand edit to a file a target regeneratesAn advisory by default: it explains, and blocks nothing, on a hand edit to a file a target regenerates. revert-classify: a revert that has not classified what it is revertingAn advisory by default: it explains, and blocks nothing, on a revert that has not classified what it is reverting. scope-drift: a write into a project this session has no dependency edge toAn advisory by default: it explains, and blocks nothing, on a write into a project this session has no dependency edge to. scripted-rewrite: a scripted substitute-and-write, which cannot tell your symbol from a dependency'sAn advisory by default: it explains, and blocks nothing, on a scripted substitute-and-write, which cannot tell your symbol from a dependency's. search-translation: a text search whose pattern a graph query provably answers with the same entitiesAn advisory by default: it explains, and blocks nothing, on a text search whose pattern a graph query provably answers with the same entities. sed-in-place: `sed -i`, whose two spellings destroy each other's work across platformsAn advisory by default: it explains, and blocks nothing, on `sed -i`, whose two spellings destroy each other's work across platforms. shared-checkout: a spawn into a checkout a live job already holds and writesAn advisory by default: it explains, and blocks nothing, on a spawn into a checkout a live job already holds and writes. shared-stash: a bare stash push or pop, on a stack every worktree sharesA deny rule by default: it refuses a bare stash push or pop, on a stack every worktree shares, and names what to run instead. sibling-checkout: a magus command relocated into another checkout, judging a tree nobody shipsAn advisory by default: it explains, and blocks nothing, on a magus command relocated into another checkout, judging a tree nobody ships. skill-source: a write to an installed skill copy rather than to its sourceAn advisory by default: it explains, and blocks nothing, on a write to an installed skill copy rather than to its source. source-read: an unbounded source read the symbol index has already answeredAn advisory by default: it explains, and blocks nothing, on an unbounded source read the symbol index has already answered. spawn-unbriefed: a subagent spawned before the multi-agent skill loadedAn advisory by default: it explains, and blocks nothing, on a subagent spawned before the multi-agent skill loaded. split-run: the same target run again on a different project set, as a separate callAn advisory by default: it explains, and blocks nothing, on the same target run again on a different project set, as a separate call. stage-all: a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated outputAn advisory by default: it explains, and blocks nothing, on a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated output. stage-classify: staging without classifying, when generated and source differAn advisory by default: it explains, and blocks nothing, on staging without classifying, when generated and source differ. stdin-closed: shell commands run with stdin at end-of-file, said once per sessionAn advisory by default: it explains, and blocks nothing, on shell commands run with stdin at end-of-file, said once per session. symbol-search: a text search of the tree for a symbol, a declaration or a diagnostic code the graph answersAn advisory by default: it explains, and blocks nothing, on a text search of the tree for a symbol, a declaration or a diagnostic code the graph answers. throwaway-copy: a run inside a temp or scratchpad copy, which leaves the real tree unverifiedAn advisory by default: it explains, and blocks nothing, on a run inside a temp or scratchpad copy, which leaves the real tree unverified. timed-magus: `time` around a silent magus run, which already reports its own durationsAn advisory by default: it explains, and blocks nothing, on `time` around a silent magus run, which already reports its own durations. token-state: an agent reading or writing the token secrets: the operator token file or the token storeA deny rule by default: it refuses an agent reading or writing the token secrets: the operator token file or the token store, and names what to run instead. unknown-env: a retired or misspelled MAGUS_* variable handed to a commandAn advisory by default: it explains, and blocks nothing, on a retired or misspelled MAGUS_* variable handed to a command. unleased-write: a write magus cannot attribute while a fleet is runningAn advisory by default: it explains, and blocks nothing, on a write magus cannot attribute while a fleet is running. vcs-off-switch: an agent's write setting vcs.enabled: false in a magus.yaml this workspace readsA deny rule by default: it refuses an agent's write setting vcs.enabled: false in a magus.yaml this workspace reads, and names what to run instead. whole-tree: a whole-tree VCS reset, checkout, restore or clean, which cannot be undoneA deny rule by default: it refuses a whole-tree VCS reset, checkout, restore or clean, which cannot be undone, and names what to run instead. worker-check-only: a bound worker running a target other than its row's check or one writing its write pathsA deny rule by default: it refuses a bound worker running a target other than its row's check or one writing its write paths, and names what to run instead. worktree-remove: removing a worktree magus cannot prove holds nothing that would be lostA deny rule by default: it refuses removing a worktree magus cannot prove holds nothing that would be lost, and names what to run instead.