ADR 0005: deterministic answersThe v0.5.0 finishing pass, recorded in full. A stalled multi-agent change showed where agents improvise and where magus stays silent. The person drives; magus answers from the graph, the job store and typed APIs, and prints what to run. Every idea and use case raised during the pass is listed here with its state, so this page is also the plan. ADR 0006: the person drives reviewDraft. Agents write code faster than we can review it, and review has become the bottleneck that does not scale. This records what a review of agent-written pull requests found, what magus enforces on its own tree versus what it ships to anyone else, and how a local review reads in an order built from the code's own relationships, with a person driving every step. ADR 0007: verbosity decides which parts of a message printA message is written once as typed parts, and the verbosity flags decide which parts print. The default keeps every reason and progress note; -q and -s keep the verdict, the next command and the ref. ADR 0009: cost profiles for agent sessionsThe guard keeps a long-running root session from spending its context on work a cheaper worker could do. One level, set by magus\guard.profile and defaulting to light, picks how much of that advice a workspace sees; the account's billing and model facts live in magus.yaml, detected from the host and never from an environment variable; a person may raise the level and never lower it. ADR 0010: jobs share a file by declaration claimsTwo jobs that change different declarations of one file should run at once. A fork refused for a shared file prints the claim pair that would let both run and writes nothing; a claim must name one declaration; the append-only tables that no claim could split are split; and two jobs that passed with disjoint claims can be settled at integration when a project opts in with merge_low_risk. ADR 0013: the guard deniesADR 0006 section 2 shipped every built-in rule that guards a recoverable action as advice, said once a session. Six months of agent sessions show advice that only prints is routed around, so this record reverses it. Every built-in rule whose verdict names a remedy the caller can take now denies by default, shipped defaults included. A rule with no reachable remedy becomes a notice, which states a fact and never refuses. A workspace still lowers any deny to advise or off by name. ADR 0015: a call runs where its line saysHost shells differ in where a subagent's call starts, and the lease rules read only the directory the host reported. This record has the guard place each magus call by its own line, denies a holder's call that resolves outside its checkout, and leaves the CLI's root rules alone. ADR 0016: vcs lists; the person stagesThe guard denied git add -A and served magus vcs add, a command that classified the tree and staged it in one call. This record replaces it with magus vcs ls-files, which lists the paths a commit wants and stages nothing, so each inclusion is a flag the caller names and the staging stays a git command the person runs. AgentsHow magus equips AI agents (the installable skills, the MAGUS.md routing index, the MCP server, and the guard hook any agent host can wire), with a setup page per host. Any other hostThe host-neutral contract (install the guidance where your host reads it, pipe the event to magus shell, render the verdict with -o template) for an agent host magus does not document by name. Claude CodeWiring magus into Claude Code (skills in .claude/skills, the two PreToolUse guard hooks, attention notifications, and the checks that prove the guard is running). CodexWiring magus into Codex (skills in .agents/skills, the AGENTS.md block you paste, MCP in the user-level config, and the hooks that carry the guard, the spawn check, the message record, the checkpoint, the opt-in reply check and the post-compaction brief). CursorWiring magus into Cursor (AGENTS.md for guidance, one hook script for its wired events, the opt-in reply check on stop, and what Cursor's contract cannot express). Guard hook templatesThe Buzz hook templates Claude Code and Codex run for the magus guard, the checkpoint and the post-compaction brief, with the knobs that adapt them to a host, the version marker that tells you when your copy is stale, and the full source of each. Guard rulesEvery rule the guard enforces: what each one catches, whether it denies or advises by default, and where the reasoning lives. How orchestration worksThe three roles a fanned-out agent session splits into (orchestrator, worker, integrator), the boundary each one holds, and the pieces of magus that hold it (the guard, the job store, the broker's machine budget and the worktree bootstrap). Long-running sessionsWhich host scheduler keeps an agent session going for hours (Claude Code loops and goals, desktop and cloud scheduled tasks, Codex, Cursor, GitHub Actions), the magus commands each wake runs, the cloud risk of an unguarded clone, and what magus leaves out. MGS1045: a magus\guard.spawn, command or write registration is unusableFires when magus\guard.spawn, magus\guard.command or magus\guard.write is handed something other than a function, is called twice in one load, or is called from a magusfile other than the root one. The workspace does not load. MGS1046: a MAGUS_* environment variable that is provably wrongFires when the environment carries a MAGUS_* variable magus retired, or one a typo away from a variable magus reads. Every command stops before doing any work, and the magus shell guard denies, naming each variable with what to do instead. MGS3024: a hook names no agent hostInstalled hook glue called magus without --agent-name, so magus cannot tell which agent host it is answering. The call is refused, and `magus describe harness` prints a configuration that names the host. OpenCodeWiring magus into OpenCode (skills in .opencode/skills, the TypeScript plugin that carries the shell-command, file-write, MCP and subagent rules, the idle checkpoint, and the opt-in reply check). Session load adaptersPer-host adapters that turn an agent host's own session log into the magus session event contract, so an audit can ask which skills loaded, whether the guard fired, and what ran unjudged. The guardWhat magus session hook denies, what it only notes, and why: the five deny grounds, how a workspace sets a built-in rule, the file-write rules, the verdict contract a host wires into, and the observations magus records. agent-sign-off: an agent stamping a read receipt or closing an attention request, which only a person may doA deny rule by default: it refuses an agent stamping a read receipt or closing an attention request, which only a person may do, and names what to run instead. architecture-unbriefed: an agent's next call after a structure question, or a new directory, before the architecture skillA deny rule by default: it refuses an agent's next call after a structure question, or a new directory, before the architecture skill, and names what to run instead. background-left: an agent finishing while shell commands it ran in the background are still runningA deny rule by default: it refuses an agent finishing while shell commands it ran in the background are still running, and names what to run instead. background-silent: a background task of the session that has written nothing for advise_minutes (30 unset)A deny rule by default: it refuses a background task of the session that has written nothing for advise_minutes (30 unset), and names what to run instead. background-unbounded: a shell command run in the background with nothing to end itA deny rule by default: it refuses a shell command run in the background with nothing to end it, and names what to run instead. backtick-substitution: a backtick command substitution, which inside double quotes runs a commandA deny rule by default: it refuses a backtick command substitution, which inside double quotes runs a command, and names what to run instead. brief-command: a spawn or continuation brief that teaches a command the guard deniesA deny rule by default: it refuses a spawn or continuation brief that teaches a command the guard denies, and names what to run instead. brief-plain-commands: a brief for an isolated worker that teaches a substitution, a loop or an execA deny rule by default: it refuses a brief for an isolated worker that teaches a substitution, a loop or an exec, and names what to run instead. busy-wait: a while or until loop that sleeps, or a for loop that sleeps until it breaks outA deny rule by default: it refuses a while or until loop that sleeps, or a for loop that sleeps until it breaks out, and names what to run instead. buzz-unbriefed: the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skillA deny rule by default: it refuses the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skill, and names what to run instead. cache-dir-write: a write into this checkout's magus cache dir, which magus alone ownsA deny rule by default: it refuses a write into this checkout's magus cache dir, which magus alone owns, and names what to run instead. capture-filter: a filter over a run capture or log, which cuts the failure block apartA deny rule by default: it refuses a filter over a run capture or log, which cuts the failure block apart, and names what to run instead. chained-run: magus runs sequenced with `&&` or `;`, which a pipe of the same stages runs ordered and fail-fastA deny rule by default: it refuses magus runs sequenced with `&&` or `;`, which a pipe of the same stages runs ordered and fail-fast, and names what to run instead. check-timeout: a bound worker's magus run whose timeout is shorter than the target's last real run allows forA deny rule by default: it refuses a bound worker's magus run whose timeout is shorter than the target's last real run allows for, and names what to run instead. checkpoint-state: a command reaching for a tree's identity, which a revision alone cannot giveA deny rule by default: it refuses a command reaching for a tree's identity, which a revision alone cannot give, and names what to run instead. claimed-declaration: a leased edit landing in a declaration another live job claims (`run.go#executeStages`)A deny rule by default: it refuses a leased edit landing in a declaration another live job claims (`run.go#executeStages`), and names what to run instead. compat-marker: a leased worker adding a marker that keeps code for older data or callersAn advisory by default: it explains, and blocks nothing, on a leased worker adding a marker that keeps code for older data or callers. conflict-rewrite: an inline interpreter rewriting a file that holds merge conflict markersA deny rule by default: it refuses an inline interpreter rewriting a file that holds merge conflict markers, and names what to run instead. credential-verb: an agent minting, printing, rotating or revoking a credential through the CLIA deny rule by default: it refuses an agent minting, printing, rotating or revoking a credential through the CLI, and names what to run instead. dependency-install: a raw package install that the cached install target already runsA deny rule by default: it refuses a raw package install that the cached install target already runs, and names what to run instead. dependency-update: a raw dependency update outside a target's update charmA deny rule by default: it refuses a raw dependency update outside a target's update charm, and names what to run instead. echo-on-success: an `&& echo` that restates what the exit status already saysAn advisory by default: it explains, and blocks nothing, on an `&& echo` that restates what the exit status already says. exit-status-echo: a line ending by printing an exit status, which the harness already reportsA deny rule by default: it refuses a line ending by printing an exit status, which the harness already reports, and names what to run instead. filter-without-input: a filter or interpreter with no file, script, pipe or redirect, which reads a stdin nothing feedsA deny rule by default: it refuses a filter or interpreter with no file, script, pipe or redirect, which reads a stdin nothing feeds, and names what to run instead. focus-read: a read outside the paths a focus lease was givenA deny rule by default: it refuses a read outside the paths a focus lease was given, and names what to run instead. focus: a read or write outside the paths the running job declaredAn advisory by default: it explains, and blocks nothing, on a read or write outside the paths the running job declared. gate-repeat: the gate run a third time over a tree its last green verdict already coversA deny rule by default: it refuses the gate run a third time over a tree its last green verdict already covers, and names what to run instead. generated-write: a hand edit to a declared output, which the next run overwritesA deny rule by default: it refuses a hand edit to a declared output, which the next run overwrites, and names what to run instead. graph-pipe: a read-only graph verb piped into a text filter, when magus projects the record itselfA deny rule by default: it refuses a read-only graph verb piped into a text filter, when magus projects the record itself, and names what to run instead. graph-stale: a graph read, or a graph-backed deny, while the graph describes another treeAn advisory by default: it explains, and blocks nothing, on a graph read, or a graph-backed deny, while the graph describes another tree. grep-reader: a definition lookup with a context flag (`grep -A40 'func X'`), which uses grep to read the bodyA deny rule by default: it refuses a definition lookup with a context flag (`grep -A40 'func X'`), which uses grep to read the body, and names what to run instead. guard-unfinished: guard checks that never finished, so no rule judged their callsAn advisory by default: it explains, and blocks nothing, on guard checks that never finished, so no rule judged their calls. heredoc-write: a here-document written to a file, judged as the file write it isA deny rule by default: it refuses a here-document written to a file, judged as the file write it is, and names what to run instead. hook-wiring-write: a leased or agent-attributed write to the host hook wiring or the workspace's ./magusA deny rule by default: it refuses a leased or agent-attributed write to the host hook wiring or the workspace's ./magus, and names what to run instead. hook-wiring: a write to the host wiring that decides whether these rules run at allAn advisory by default: it explains, and blocks nothing, on a write to the host wiring that decides whether these rules run at all. hooks-off: a git call with the repository's hooks switched offA deny rule by default: it refuses a git call with the repository's hooks switched off, and names what to run instead. human-only: a magus run reaching a human_only target: the person is asked, a leased worker refusedA deny rule by default: it refuses a magus run reaching a human_only target: the person is asked, a leased worker refused, and names what to run instead. inline-alias: a VCS alias defined inline (`git -c alias.x=...`), which hides the command it runsA deny rule by default: it refuses a VCS alias defined inline (`git -c alias.x=...`), which hides the command it runs, and names what to run instead. installed-skill: a write to an installed skill copy, which re-installing discardsA deny rule by default: it refuses a write to an installed skill copy, which re-installing discards, and names what to run instead. instruction-write: a write to a cross-host instruction file, which every session loads wholeAn advisory by default: it explains, and blocks nothing, on a write to a cross-host instruction file, which every session loads whole. interpreter-rewrite: an inline interpreter rewriting a file this tree already carriesA deny rule by default: it refuses an inline interpreter rewriting a file this tree already carries, and names what to run instead. interpreter-script: an ad-hoc script in python, node, perl or ruby, where Buzz is the workspace's scripting languageA deny rule by default: it refuses an ad-hoc script in python, node, perl or ruby, where Buzz is the workspace's scripting language, and names what to run instead. lease-checkout: a worker holding a checkout running magus outside itA deny rule by default: it refuses a worker holding a checkout running magus outside it, and names what to run instead. lease-claim: a leased write outside its write paths that magus proves belongs to the jobA deny rule by default: it refuses a leased write outside its write paths that magus proves belongs to the job, and names what to run instead. lease-gate: a leased worker running the gate instead of the check it was assignedA deny rule by default: it refuses a leased worker running the gate instead of the check it was assigned, and names what to run instead. lease-harness: a leased worker rewriting the harness skill trees that steer itA deny rule by default: it refuses a leased worker rewriting the harness skill trees that steer it, and names what to run instead. lease-invalid: a call naming a lease this workspace's job store does not declareA deny rule by default: it refuses a call naming a lease this workspace's job store does not declare, and names what to run instead. lease-paused: a leased worker starting a magus run while a person has its job pausedA deny rule by default: it refuses a leased worker starting a magus run while a person has its job paused, and names what to run instead. lease-rebind: a leased worker rewriting who it is or what its own job row saysA deny rule by default: it refuses a leased worker rewriting who it is or what its own job row says, and names what to run instead. lease-state: a leased write while its row reports a diverged base, a re-entered path, or a bad patternAn advisory by default: it explains, and blocks nothing, on a leased write while its row reports a diverged base, a re-entered path, or a bad pattern. lease-terminal: a call naming a lease whose row has already finishedAn advisory by default: it explains, and blocks nothing, on a call naming a lease whose row has already finished. lease-undeclared: a call graded under a lease id the job store has no row for, or a binding it tombstonedA deny rule by default: it refuses a call graded under a lease id the job store has no row for, or a binding it tombstoned, and names what to run instead. lease-vcs: a worker lease mutating version control, or committing outside its own branch and checkoutA deny rule by default: it refuses a worker lease mutating version control, or committing outside its own branch and checkout, and names what to run instead. lease-write: a leased write outside its write paths, or into a path it was denied or another lease ownsA deny rule by default: it refuses a leased write outside its write paths, or into a path it was denied or another lease owns, and names what to run instead. leased-path: a write into paths a running lease owns, by a caller that names no leaseAn advisory by default: it explains, and blocks nothing, on a write into paths a running lease owns, by a caller that names no lease. magus sessionOne family over the repository's session store: list what magus invocations ran and the host session each ran in, list the blocks agents raised, close one by hand, and take the host-hook ingest that writes it all. magus shellRead one shell command, or one path an edit is about to write, and report what this workspace would rather you ran. magus-timeout: a magus call wrapped in coreutils `timeout` or `gtimeout`, which kills it from outsideA deny rule by default: it refuses a magus call wrapped in coreutils `timeout` or `gtimeout`, which kills it from outside, and names what to run instead. magus\guard.commandRegister one Buzz function the agent guard calls on every agent shell command, to add a deny or an advisory from your repository's own rules. magus ships the seam and no rules. magus\guard.spawnRegister one Buzz function the agent guard calls on every subagent spawn and continuation, to add a deny or an advisory from your own rules. magus ships the seam and no rules. merge-side-checkout: a checkout of one merge side over a conflicted file, which discards the mergeA deny rule by default: it refuses a checkout of one merge side over a conflicted file, which discards the merge, and names what to run instead. model-tier-context-cap: a leased worker writing past the context its job's model tier capsA deny rule by default: it refuses a leased worker writing past the context its job's model tier caps, and names what to run instead. monitor-duplicate: a second live watcher on one subject, or one on work the agent backgrounded itselfA deny rule by default: it refuses a second live watcher on one subject, or one on work the agent backgrounded itself, and names what to run instead. monitor-pile: an agent arming a waiter while several of its own are already liveA deny rule by default: it refuses an agent arming a waiter while several of its own are already live, and names what to run instead. new-file: a new file in a directory whose naming has settledAn advisory by default: it explains, and blocks nothing, on a new file in a directory whose naming has settled. new-source-dir: a new file that opens a directory, which is a boundary rather than a fileAn advisory by default: it explains, and blocks nothing, on a new file that opens a directory, which is a boundary rather than a file. notes-author: an agent authoring a human's note, whose only provenance is who wrote itA deny rule by default: it refuses an agent authoring a human's note, whose only provenance is who wrote it, and names what to run instead. orchestrator-groundwork: a session that hands out work doing its own groundwork: reads, searches, edits, runsA deny rule by default: it refuses a session that hands out work doing its own groundwork: reads, searches, edits, runs, and names what to run instead. output-pipe: magus output piped into a filter, when magus projects the record itselfA deny rule by default: it refuses magus output piped into a filter, when magus projects the record itself, and names what to run instead. output-redirect: magus output sent to a file or discarded, which the run log already holdsA deny rule by default: it refuses magus output sent to a file or discarded, which the run log already holds, and names what to run instead. policy-unloaded: a push, merge, spawn or state-writing magus verb while the guard policy that judges it does not loadA deny rule by default: it refuses a push, merge, spawn or state-writing magus verb while the guard policy that judges it does not load, and names what to run instead. precedent-search: a hunt for one distinctive name, which refs answers with verified sitesAn advisory by default: it explains, and blocks nothing, on a hunt for one distinctive name, which refs answers with verified sites. process-poll: a process table inspected to wait on magus work the lock already reportsA deny rule by default: it refuses a process table inspected to wait on magus work the lock already reports, and names what to run instead. push-gate: a push or `gh pr create` the run log cannot prove ungated; names the gateAn advisory by default: it explains, and blocks nothing, on a push or `gh pr create` the run log cannot prove ungated; names the gate. push-ungated: a push or `gh pr create` at a commit with no green gate; refused for every sessionA deny rule by default: it refuses a push or `gh pr create` at a commit with no green gate; refused for every session, and names what to run instead. raw-tool: a toolchain command a spell already wraps, run outside the cacheA deny rule by default: it refuses a toolchain command a spell already wraps, run outside the cache, and names what to run instead. read-navigation: a whole read of a Go, Buzz or Markdown file past the workspace's line limitA deny rule by default: it refuses a whole read of a Go, Buzz or Markdown file past the workspace's line limit, and names what to run instead. read-paging: a mapped file read window by window, past two windows of itA deny rule by default: it refuses a mapped file read window by window, past two windows of it, and names what to run instead. read-symbol: a bounded read inside one indexed declaration, which refs --definition --source prints checkedAn advisory by default: it explains, and blocks nothing, on a bounded read inside one indexed declaration, which refs --definition --source prints checked. regen-source: a hand edit to a file a target regeneratesAn advisory by default: it explains, and blocks nothing, on a hand edit to a file a target regenerates. release-requested: a job holding write paths another fork was refused for, with a release request openAn advisory by default: it explains, and blocks nothing, on a job holding write paths another fork was refused for, with a release request open. revert-classify: a revert that has not classified what it is revertingAn advisory by default: it explains, and blocks nothing, on a revert that has not classified what it is reverting. root-context-budget: a session's main thread whose context has grown past its level's sizeOff by default: once a workspace turns it on, it reports a session's main thread whose context has grown past its level's size. root-heavy-command: a main thread running delegable commands one after another without spawningOff by default: once a workspace turns it on, it reports a main thread running delegable commands one after another without spawning. root-repeat: a main thread running the same delegable command again with no write sinceOff by default: once a workspace turns it on, it reports a main thread running the same delegable command again with no write since. root-result-cap: one tool result too large for a main thread's context, said on its next callOff by default: once a workspace turns it on, it reports one tool result too large for a main thread's context, said on its next call. scope-drift: a write into a project this session has no dependency edge toAn advisory by default: it explains, and blocks nothing, on a write into a project this session has no dependency edge to. search-translation: a text search whose pattern a graph query provably answers with the same entitiesA deny rule by default: it refuses a text search whose pattern a graph query provably answers with the same entities, and names what to run instead. sed-in-place: `sed -i`, whose two spellings destroy each other's work across platformsA deny rule by default: it refuses `sed -i`, whose two spellings destroy each other's work across platforms, and names what to run instead. shared-checkout: a spawn into a checkout a live job already holds and writesAn advisory by default: it explains, and blocks nothing, on a spawn into a checkout a live job already holds and writes. shared-stash: a bare stash push or pop, on a stack every worktree sharesA deny rule by default: it refuses a bare stash push or pop, on a stack every worktree shares, and names what to run instead. sibling-checkout: a magus command relocated into another checkout, judging a tree nobody shipsA deny rule by default: it refuses a magus command relocated into another checkout, judging a tree nobody ships, and names what to run instead. skill-source: a write to an installed skill copy rather than to its sourceAn advisory by default: it explains, and blocks nothing, on a write to an installed skill copy rather than to its source. sleep-poll: a sleep before a status read, a call that only sleeps, or a wait on or retry into a full budgetA deny rule by default: it refuses a sleep before a status read, a call that only sleeps, or a wait on or retry into a full budget, and names what to run instead. source-read: an unbounded source read the symbol index has already answeredAn advisory by default: it explains, and blocks nothing, on an unbounded source read the symbol index has already answered. spawn-above-model-tier: a subagent spawned on a model whose tier ranks above the tier its job was forked atOff by default: once a workspace turns it on, it reports a subagent spawned on a model whose tier ranks above the tier its job was forked at. spawn-above-parent-tier: a subagent spawned on a model whose tier ranks above its spawner'sA deny rule by default: it refuses a subagent spawned on a model whose tier ranks above its spawner's, and names what to run instead. spawn-duplicate: a spawn for a job that already has a workerA deny rule by default: it refuses a spawn for a job that already has a worker, and names what to run instead. spawn-names-model: a main thread spawning a subagent without naming the model it runs onOff by default: once a workspace turns it on, it reports a main thread spawning a subagent without naming the model it runs on. spawn-nested-waiter: a subagent spawning a helper whose title or brief opening speaks of waiting or watchingA deny rule by default: it refuses a subagent spawning a helper whose title or brief opening speaks of waiting or watching, and names what to run instead. spawn-unbriefed: a subagent spawned before the multi-agent skill loadedA deny rule by default: it refuses a subagent spawned before the multi-agent skill loaded, and names what to run instead. spawn-unplaced: a subagent's first call that no waiting spawn names, which then runs under no leaseAn advisory by default: it explains, and blocks nothing, on a subagent's first call that no waiting spawn names, which then runs under no lease. spawn-unvalidated: a spawn for a job whose record was never validatedA deny rule by default: it refuses a spawn for a job whose record was never validated, and names what to run instead. spawn-waiter: a spawn whose child exists to wait on, poll or watch other workA deny rule by default: it refuses a spawn whose child exists to wait on, poll or watch other work, and names what to run instead. spawn-warm-worker: a fresh spawn for follow-up work while the worker that wrote the code is still warmA deny rule by default: it refuses a fresh spawn for follow-up work while the worker that wrote the code is still warm, and names what to run instead. split-run: the same target run again on a different project set, as a separate callAn advisory by default: it explains, and blocks nothing, on the same target run again on a different project set, as a separate call. stage-all: a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated outputA deny rule by default: it refuses a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated output, and names what to run instead. stage-classify: staging without classifying, when generated and source differAn advisory by default: it explains, and blocks nothing, on staging without classifying, when generated and source differ. stale-binary: a call that changes state while the magus judging it cannot load this tree's guard policyA deny rule by default: it refuses a call that changes state while the magus judging it cannot load this tree's guard policy, and names what to run instead. stall: a leased worker refused by something only the root can clearOff by default: once a workspace turns it on, it reports a leased worker refused by something only the root can clear. symbol-search: a text search of the tree for a symbol, a declaration or a diagnostic code the graph answersA deny rule by default: it refuses a text search of the tree for a symbol, a declaration or a diagnostic code the graph answers, and names what to run instead. throwaway-copy: a run inside a temp or scratchpad copy, which leaves the real tree unverifiedA deny rule by default: it refuses a run inside a temp or scratchpad copy, which leaves the real tree unverified, and names what to run instead. timed-magus: `time` around a silent magus run, which already reports its own durationsAn advisory by default: it explains, and blocks nothing, on `time` around a silent magus run, which already reports its own durations. token-state: an agent reading or writing the token secrets: the operator token file or the token storeA deny rule by default: it refuses an agent reading or writing the token secrets: the operator token file or the token store, and names what to run instead. unjudged-tool: a tool call whose input carries nothing any rule reads, from a tool the guard does not knowA deny rule by default: it refuses a tool call whose input carries nothing any rule reads, from a tool the guard does not know, and names what to run instead. unknown-env: a retired or misspelled MAGUS_* variable handed to a commandA deny rule by default: it refuses a retired or misspelled MAGUS_* variable handed to a command, and names what to run instead. unleased-write: a write magus cannot attribute while a fleet is runningAn advisory by default: it explains, and blocks nothing, on a write magus cannot attribute while a fleet is running. unread-command: a program or VCS subcommand the shell computes before it runs, which no rule can readA deny rule by default: it refuses a program or VCS subcommand the shell computes before it runs, which no rule can read, and names what to run instead. vcs-off-switch: an agent's write setting vcs.enabled: false in a magus.yaml this workspace readsA deny rule by default: it refuses an agent's write setting vcs.enabled: false in a magus.yaml this workspace reads, and names what to run instead. whole-tree: a whole-tree VCS reset, checkout, restore or clean, which cannot be undoneA deny rule by default: it refuses a whole-tree VCS reset, checkout, restore or clean, which cannot be undone, and names what to run instead. worker-background-run: a bound worker running a magus target in the backgroundA deny rule by default: it refuses a bound worker running a magus target in the background, and names what to run instead. worker-check-only: a bound worker running other than its check or a writer of its write paths, or writing past themA deny rule by default: it refuses a bound worker running other than its check or a writer of its write paths, or writing past them, and names what to run instead. workspace-command-failed: a command the workspace's rule could not judge, so only the built-in rules graded itAn advisory by default: it explains, and blocks nothing, on a command the workspace's rule could not judge, so only the built-in rules graded it. workspace-spawn-failed: a spawn the workspace's rule could not judge, so only the built-in rules graded itAn advisory by default: it explains, and blocks nothing, on a spawn the workspace's rule could not judge, so only the built-in rules graded it. workspace-write-failed: a file write the workspace's rule could not judge, so only the built-in rules graded itAn advisory by default: it explains, and blocks nothing, on a file write the workspace's rule could not judge, so only the built-in rules graded it. worktree-remove: removing a worktree magus cannot prove holds nothing that would be lostA deny rule by default: it refuses removing a worktree magus cannot prove holds nothing that would be lost, and names what to run instead.