Guard rulesEvery rule the guard enforces: what each one catches, whether it denies or advises by default, and where the reasoning lives. Proofread rulesEvery rule proofread applies to written text: what each one catches, the decision it takes by default on each kind of text, and its code. absoluteAn advisory by default: it explains, and blocks nothing, on never, nobody or nothing as a claim about the past ("has never fired", "nobody checked"). agent-sign-off: an agent stamping a read receipt or closing an attention request, which only a person may doA deny rule by default: it refuses an agent stamping a read receipt or closing an attention request, which only a person may do, and names what to run instead. agreement-openerAn advisory by default: it explains, and blocks nothing, on an agent reply that opens with praise or agreement ("Great question", "You're right"). all-capsAn advisory by default: it explains, and blocks nothing, on words in capitals for emphasis in a review reply ("DO NOT", "NEVER"). approve-blockerA rule that is off by default: it reports an approving review whose body names a blocker ("must fix", "blocking", "before merge") once a decisions table turns it on. architecture-unbriefed: an agent's next call after a structure question, or a new directory, before the architecture skillA deny rule by default: it refuses an agent's next call after a structure question, or a new directory, before the architecture skill, and names what to run instead. asciiA house-style rule, off until a decisions table turns it on: it reports a curly quote, an ellipsis character or an emoji in prose. asideA house-style rule, off until a decisions table turns it on: it reports a spaced hyphen spelling an em dash in a doc comment. attributionA house-style rule, off until a decisions table turns it on: it reports credit to a tool or an agent, or an account of how the work was produced. background-left: an agent finishing while shell commands it ran in the background are still runningA deny rule by default: it refuses an agent finishing while shell commands it ran in the background are still running, and names what to run instead. background-silent: a background task of the session that has written nothing for advise_minutes (30 unset)A deny rule by default: it refuses a background task of the session that has written nothing for advise_minutes (30 unset), and names what to run instead. background-unbounded: a shell command run in the background with nothing to end itA deny rule by default: it refuses a shell command run in the background with nothing to end it, and names what to run instead. backtick-substitution: a backtick command substitution, which inside double quotes runs a commandA deny rule by default: it refuses a backtick command substitution, which inside double quotes runs a command, and names what to run instead. banned-wordA house-style rule, off until a decisions table turns it on: it reports a word this repository bans, in a stylesheet comment. bare-imperativeAn advisory by default: it explains, and blocks nothing, on a short command in a review reply that gives no reason anywhere ("Fix this."). bare-lgtmA rule that is off by default: it reports a review summary that only approves: "LGTM", "ship it", "looks good" once a decisions table turns it on. bare-ruleA house-style rule, off until a decisions table turns it on: it reports "rule" in agent instructions with no mechanism named. blameAn advisory by default: it explains, and blocks nothing, on a person or past work as the subject of a fault, and contempt for code or a decision. block-budgetA house-style rule, off until a decisions table turns it on: it reports a rule block whose comments, summed, outrun its size. body-separatorA deny rule by default: it refuses a commit body that starts on the line after the subject. bold-labelAn advisory by default: it explains, and blocks nothing, on list items or paragraphs of an agent reply that open with a bold label. brief-command: a spawn or continuation brief that teaches a command the guard deniesA deny rule by default: it refuses a spawn or continuation brief that teaches a command the guard denies, and names what to run instead. brief-plain-commands: a brief for an isolated worker that teaches a substitution, a loop or an execA deny rule by default: it refuses a brief for an isolated worker that teaches a substitution, a loop or an exec, and names what to run instead. busy-wait: a while or until loop that sleeps, or a for loop that sleeps until it breaks outA deny rule by default: it refuses a while or until loop that sleeps, or a for loop that sleeps until it breaks out, and names what to run instead. buzz-unbriefed: the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skillA deny rule by default: it refuses the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skill, and names what to run instead. buzzwordA deny rule by default: it refuses a word chosen to sound significant rather than to say what is so ("delve", "tapestry"). buzzword-weakAn advisory by default: it explains, and blocks nothing, on a buzzword that also has an ordinary sense ("crucial", "landscape"). cache-dir-write: a write into this checkout's magus cache dir, which magus alone ownsA deny rule by default: it refuses a write into this checkout's magus cache dir, which magus alone owns, and names what to run instead. capture-filter: a filter over a run capture or log, which cuts the failure block apartA deny rule by default: it refuses a filter over a run capture or log, which cuts the failure block apart, and names what to run instead. chained-run: magus runs sequenced with `&&` or `;`, which a pipe of the same stages runs ordered and fail-fastA deny rule by default: it refuses magus runs sequenced with `&&` or `;`, which a pipe of the same stages runs ordered and fail-fast, and names what to run instead. changelog-entryAn advisory by default: it explains, and blocks nothing, on a changelog entry that names a Go identifier and says little else. changelog-groupAn advisory by default: it explains, and blocks nothing, on a changelog heading that is not Added, Changed, Deprecated, Removed, Fixed or Security. changelog-headingA rule that is off by default: it reports a changelog version heading that is not "## [version] - date" or "## [Unreleased]" once a decisions table turns it on. chatbotA rule that is off by default: it reports text a chat assistant addressed to its user: an offer, flattery, a knowledge disclaimer once a decisions table turns it on. check-timeout: a bound worker's magus run whose timeout is shorter than the target's last real run allows forA deny rule by default: it refuses a bound worker's magus run whose timeout is shorter than the target's last real run allows for, and names what to run instead. checkpoint-state: a command reaching for a tree's identity, which a revision alone cannot giveA deny rule by default: it refuses a command reaching for a tree's identity, which a revision alone cannot give, and names what to run instead. claimAn advisory by default: it explains, and blocks nothing, on a measurement, a comparison or a completion with no evidence in its sentence or bullet. claimed-declaration: a leased edit landing in a declaration another live job claims (`run.go#executeStages`)A deny rule by default: it refuses a leased edit landing in a declaration another live job claims (`run.go#executeStages`), and names what to run instead. closerA deny rule by default: it refuses a sentence that opens by announcing it restates the text above ("In conclusion,"). closing-offerAn advisory by default: it explains, and blocks nothing, on an agent reply whose last paragraph offers more work or asks leave to go on. comment-blockA house-style rule, off until a decisions table turns it on: it reports a doc comment over 250 words. comment-budgetA house-style rule, off until a decisions table turns it on: it reports a stylesheet comment over the lines its place earns. comment-sentenceA house-style rule, off until a decisions table turns it on: it reports a doc comment sentence over 60 words. compact-costly-abbrevA rule that is off by default: it reports an abbreviation that costs more tokens than the word it replaces: k8s, w/, b/c, e.g., i.e., or dropped vowels once a decisions table turns it on. compact-duplicateA rule that is off by default: it reports a compact line that restates an earlier one: half or more of its content words and every negation, condition, scope and order word the same once a decisions table turns it on. compact-fillerA rule that is off by default: it reports articles, linking verbs, "you", "please", "note that" and "instead" outside code, counted with the tokens dropping them saves once a decisions table turns it on. compact-lineA rule that is off by default: it reports a compact line over 21 words that joins clauses with a semicolon or a comma and a conjunction once a decisions table turns it on. compact-markupA rule that is off by default: it reports a bold or italic marker, or a Markdown table, in compact agent text once a decisions table turns it on. compact-symbol-negationA rule that is off by default: it reports "!" or a Unicode symbol standing in for "not" or a logic operator once a decisions table turns it on. compat-marker: a leased worker adding a marker that keeps code for older data or callersAn advisory by default: it explains, and blocks nothing, on a leased worker adding a marker that keeps code for older data or callers. condescensionA rule that is off by default: it reports a word that tells the reader how hard a step should feel or what they should already know once a decisions table turns it on. conflict-rewrite: an inline interpreter rewriting a file that holds merge conflict markersA deny rule by default: it refuses an inline interpreter rewriting a file that holds merge conflict markers, and names what to run instead. contrastA rule that is off by default: it reports a claim made by denying its opposite first ("not just X, it is Y") once a decisions table turns it on. credential-verb: an agent minting, printing, rotating or revoking a credential through the CLIA deny rule by default: it refuses an agent minting, printing, rotating or revoking a credential through the CLI, and names what to run instead. creditAn advisory by default: it explains, and blocks nothing, on a change description that removes or replaces something and says nothing of what it was for. dashA house-style rule, off until a decisions table turns it on: it reports an em dash, an en dash or a spaced double hyphen in prose. date-formatA rule that is off by default: it reports dates in more than one style in one text: 2026-10-13, Oct 2026, October 2026, 10/13/2026, or Sep beside Sept once a decisions table turns it on. decline-no-reasonA rule that is off by default: it reports a short review reply declining the change ("won't fix", "No, ...") with no reason once a decisions table turns it on. deferral-no-linkA rule that is off by default: it reports a review reply deferring to later, a follow-up or a TODO, with no issue link or number once a decisions table turns it on. dependency-install: a raw package install that the cached install target already runsA deny rule by default: it refuses a raw package install that the cached install target already runs, and names what to run instead. dependency-update: a raw dependency update outside a target's update charmA deny rule by default: it refuses a raw dependency update outside a target's update charm, and names what to run instead. docstubA house-style rule, off until a decisions table turns it on: it reports a one-line doc comment that only repeats the symbol's name. echo-on-success: an `&& echo` that restates what the exit status already saysAn advisory by default: it explains, and blocks nothing, on an `&& echo` that restates what the exit status already says. empty-request-changesA rule that is off by default: it reports a review requesting changes whose body names nothing blocking and points at no inline comment once a decisions table turns it on. exit-status-echo: a line ending by printing an exit status, which the harness already reportsA deny rule by default: it refuses a line ending by printing an exit status, which the harness already reports, and names what to run instead. fillerAn advisory by default: it explains, and blocks nothing, on throat-clearing ("Note that") and filler adverbs ("simply", "basically"). filter-without-input: a filter or interpreter with no file, script, pipe or redirect, which reads a stdin nothing feedsA deny rule by default: it refuses a filter or interpreter with no file, script, pipe or redirect, which reads a stdin nothing feeds, and names what to run instead. focus-read: a read outside the paths a focus lease was givenA deny rule by default: it refuses a read outside the paths a focus lease was given, and names what to run instead. focus: a read or write outside the paths the running job declaredAn advisory by default: it explains, and blocks nothing, on a read or write outside the paths the running job declared. gate-repeat: the gate run a third time over a tree its last green verdict already coversA deny rule by default: it refuses the gate run a third time over a tree its last green verdict already covers, and names what to run instead. generated-write: a hand edit to a declared output, which the next run overwritesA deny rule by default: it refuses a hand edit to a declared output, which the next run overwrites, and names what to run instead. gradeA deny rule by default: it refuses a text whose grade, out of 100, is under the minimum its kind is held to. graph-pipe: a read-only graph verb piped into a text filter, when magus projects the record itselfA deny rule by default: it refuses a read-only graph verb piped into a text filter, when magus projects the record itself, and names what to run instead. graph-stale: a graph read, or a graph-backed deny, while the graph describes another treeAn advisory by default: it explains, and blocks nothing, on a graph read, or a graph-backed deny, while the graph describes another tree. grep-reader: a definition lookup with a context flag (`grep -A40 'func X'`), which uses grep to read the bodyA deny rule by default: it refuses a definition lookup with a context flag (`grep -A40 'func X'`), which uses grep to read the body, and names what to run instead. guard-unfinished: guard checks that never finished, so no rule judged their callsAn advisory by default: it explains, and blocks nothing, on guard checks that never finished, so no rule judged their calls. heading-caseAn advisory by default: it explains, and blocks nothing, on a heading whose every word after the first is capitalized. hedgeAn advisory by default: it explains, and blocks nothing, on a softener qualifying a claim ("might fix", "could potentially"). help-lengthA deny rule by default: it refuses help text over 240 runes. help-sentenceA deny rule by default: it refuses a sentence of help text over 40 words. heredoc-write: a here-document written to a file, judged as the file write it isA deny rule by default: it refuses a here-document written to a file, judged as the file write it is, and names what to run instead. historyA house-style rule, off until a decisions table turns it on: it reports a doc comment phrase narrating the change rather than the code ("used to"). hook-wiring-write: a leased or agent-attributed write to the host hook wiring or the workspace's ./magusA deny rule by default: it refuses a leased or agent-attributed write to the host hook wiring or the workspace's ./magus, and names what to run instead. hook-wiring: a write to the host wiring that decides whether these rules run at allAn advisory by default: it explains, and blocks nothing, on a write to the host wiring that decides whether these rules run at all. hooks-off: a git call with the repository's hooks switched offA deny rule by default: it refuses a git call with the repository's hooks switched off, and names what to run instead. human-only: a magus run reaching a human_only target: the person is asked, a leased worker refusedA deny rule by default: it refuses a magus run reaching a human_only target: the person is asked, a leased worker refused, and names what to run instead. impatienceA rule that is off by default: it reports a review reply that reads as impatient: "as I said", "for the last time", "obviously" once a decisions table turns it on. ing-tailA rule that is off by default: it reports a participle clause added to claim significance (", highlighting the importance of") once a decisions table turns it on. inline-alias: a VCS alias defined inline (`git -c alias.x=...`), which hides the command it runsA deny rule by default: it refuses a VCS alias defined inline (`git -c alias.x=...`), which hides the command it runs, and names what to run instead. installed-skill: a write to an installed skill copy, which re-installing discardsA deny rule by default: it refuses a write to an installed skill copy, which re-installing discards, and names what to run instead. instruction-positionA rule that is off by default: it reports a full skill form of 1500 words or more whose first "must" or "never" sits past the middle of its body once a decisions table turns it on. instruction-write: a write to a cross-host instruction file, which every session loads wholeAn advisory by default: it explains, and blocks nothing, on a write to a cross-host instruction file, which every session loads whole. intentA rule that is off by default: it reports a motive given to a tool or a person ("guessed", "pretends") once a decisions table turns it on. interpreter-rewrite: an inline interpreter rewriting a file this tree already carriesA deny rule by default: it refuses an inline interpreter rewriting a file this tree already carries, and names what to run instead. interpreter-script: an ad-hoc script in python, node, perl or ruby, where Buzz is the workspace's scripting languageA deny rule by default: it refuses an ad-hoc script in python, node, perl or ruby, where Buzz is the workspace's scripting language, and names what to run instead. issue-reproAn advisory by default: it explains, and blocks nothing, on a bug report with neither what happened against what was expected, nor steps to reproduce it. judgment-as-factAn advisory by default: it explains, and blocks nothing, on a recommendation in a review reply stated as a fact, with no reason given. lead-contextA deny rule by default: it refuses a change description whose first paragraph does not state the intent: what it set out to do and why. leakAn advisory by default: it explains, and blocks nothing, on residue of a tool or a template: a citation marker or an unfilled placeholder. lease-checkout: a worker holding a checkout running magus outside itA deny rule by default: it refuses a worker holding a checkout running magus outside it, and names what to run instead. lease-claim: a leased write outside its write paths that magus proves belongs to the jobA deny rule by default: it refuses a leased write outside its write paths that magus proves belongs to the job, and names what to run instead. lease-gate: a leased worker running the gate instead of the check it was assignedA deny rule by default: it refuses a leased worker running the gate instead of the check it was assigned, and names what to run instead. lease-harness: a leased worker rewriting the harness skill trees that steer itA deny rule by default: it refuses a leased worker rewriting the harness skill trees that steer it, and names what to run instead. lease-invalid: a call naming a lease this workspace's job store does not declareA deny rule by default: it refuses a call naming a lease this workspace's job store does not declare, and names what to run instead. lease-paused: a leased worker starting a magus run while a person has its job pausedA deny rule by default: it refuses a leased worker starting a magus run while a person has its job paused, and names what to run instead. lease-rebind: a leased worker rewriting who it is or what its own job row saysA deny rule by default: it refuses a leased worker rewriting who it is or what its own job row says, and names what to run instead. lease-state: a leased write while its row reports a diverged base, a re-entered path, or a bad patternAn advisory by default: it explains, and blocks nothing, on a leased write while its row reports a diverged base, a re-entered path, or a bad pattern. lease-terminal: a call naming a lease whose row has already finishedAn advisory by default: it explains, and blocks nothing, on a call naming a lease whose row has already finished. lease-undeclared: a call graded under a lease id the job store has no row for, or a binding it tombstonedA deny rule by default: it refuses a call graded under a lease id the job store has no row for, or a binding it tombstoned, and names what to run instead. lease-vcs: a worker lease mutating version control, or committing outside its own branch and checkoutA deny rule by default: it refuses a worker lease mutating version control, or committing outside its own branch and checkout, and names what to run instead. lease-write: a leased write outside its write paths, or into a path it was denied or another lease ownsA deny rule by default: it refuses a leased write outside its write paths, or into a path it was denied or another lease owns, and names what to run instead. leased-path: a write into paths a running lease owns, by a caller that names no leaseAn advisory by default: it explains, and blocks nothing, on a write into paths a running lease owns, by a caller that names no lease. list-marksA rule that is off by default: it reports a list item whose initial capital or closing full stop differs from the list's other items once a decisions table turns it on. list-parallelA rule that is off by default: it reports a list item that opens with a verb where the others open with a noun phrase, or in another tense once a decisions table turns it on. long-threadAn advisory by default: it explains, and blocks nothing, on a review reply that is its author's fourth or later in a thread. magus-timeout: a magus call wrapped in coreutils `timeout` or `gtimeout`, which kills it from outsideA deny rule by default: it refuses a magus call wrapped in coreutils `timeout` or `gtimeout`, which kills it from outside, and names what to run instead. merge-side-checkout: a checkout of one merge side over a conflicted file, which discards the mergeA deny rule by default: it refuses a checkout of one merge side over a conflicted file, which discards the merge, and names what to run instead. message-commandsA deny rule by default: it refuses a message naming more than one backticked command. message-lengthA deny rule by default: it refuses a message longer than its rune cap, 160 unless the caller names one. message-rationaleA deny rule by default: it refuses a message that joins more than one reason (so, because, a semicolon, ", which"). message-tagA deny rule by default: it refuses a message opening with a component tag ("server: ") or carrying a marker such as "[AGENT]". model-tier-context-cap: a leased worker writing past the context its job's model tier capsA deny rule by default: it refuses a leased worker writing past the context its job's model tier caps, and names what to run instead. monitor-duplicate: a second live watcher on one subject, or one on work the agent backgrounded itselfA deny rule by default: it refuses a second live watcher on one subject, or one on work the agent backgrounded itself, and names what to run instead. monitor-pile: an agent arming a waiter while several of its own are already liveA deny rule by default: it refuses an agent arming a waiter while several of its own are already live, and names what to run instead. new-file: a new file in a directory whose naming has settledAn advisory by default: it explains, and blocks nothing, on a new file in a directory whose naming has settled. new-source-dir: a new file that opens a directory, which is a boundary rather than a fileAn advisory by default: it explains, and blocks nothing, on a new file that opens a directory, which is a boundary rather than a file. nit-labelA rule that is off by default: it reports an inline review comment labeled nit on a blocking demand, or blocking on an optional one once a decisions table turns it on. no-reasonA rule that is off by default: it reports an inline review comment that asks for a change and gives no reason once a decisions table turns it on. nominalizationsAn advisory by default: it explains, and blocks nothing, on a text whose verbs are turned into nouns (validation, agreement, stability) at a generated-writing rate. nonspecificAn advisory by default: it explains, and blocks nothing, on a top-level review comment that judges or asks for a change and names no code, path, line, example or reason. notes-author: an agent authoring a human's note, whose only provenance is who wrote itA deny rule by default: it refuses an agent authoring a human's note, whose only provenance is who wrote it, and names what to run instead. option-listA rule that is off by default: it reports an agent reply that lays out labeled options or alternatives once a decisions table turns it on. orchestrator-groundwork: a session that hands out work doing its own groundwork: reads, searches, edits, runsA deny rule by default: it refuses a session that hands out work doing its own groundwork: reads, searches, edits, runs, and names what to run instead. output-pipe: magus output piped into a filter, when magus projects the record itselfA deny rule by default: it refuses magus output piped into a filter, when magus projects the record itself, and names what to run instead. output-redirect: magus output sent to a file or discarded, which the run log already holdsA deny rule by default: it refuses magus output sent to a file or discarded, which the run log already holds, and names what to run instead. participlesAn advisory by default: it explains, and blocks nothing, on a text that hangs present participial clauses on its sentences at a generated-writing rate. policy-unloaded: a push, merge, spawn or state-writing magus verb while the guard policy that judges it does not loadA deny rule by default: it refuses a push, merge, spawn or state-writing magus verb while the guard policy that judges it does not load, and names what to run instead. precedent-search: a hunt for one distinctive name, which refs answers with verified sitesAn advisory by default: it explains, and blocks nothing, on a hunt for one distinctive name, which refs answers with verified sites. process-poll: a process table inspected to wait on magus work the lock already reportsA deny rule by default: it refuses a process table inspected to wait on magus work the lock already reports, and names what to run instead. push-gate: a push or `gh pr create` the run log cannot prove ungated; names the gateAn advisory by default: it explains, and blocks nothing, on a push or `gh pr create` the run log cannot prove ungated; names the gate. push-ungated: a push or `gh pr create` at a commit with no green gate; refused for every sessionA deny rule by default: it refuses a push or `gh pr create` at a commit with no green gate; refused for every session, and names what to run instead. raw-tool: a toolchain command a spell already wraps, run outside the cacheA deny rule by default: it refuses a toolchain command a spell already wraps, run outside the cache, and names what to run instead. read-navigation: a whole read of a Go, Buzz or Markdown file past the workspace's line limitA deny rule by default: it refuses a whole read of a Go, Buzz or Markdown file past the workspace's line limit, and names what to run instead. read-paging: a mapped file read window by window, past two windows of itA deny rule by default: it refuses a mapped file read window by window, past two windows of it, and names what to run instead. read-symbol: a bounded read inside one indexed declaration, which refs --definition --source prints checkedAn advisory by default: it explains, and blocks nothing, on a bounded read inside one indexed declaration, which refs --definition --source prints checked. regen-source: a hand edit to a file a target regeneratesAn advisory by default: it explains, and blocks nothing, on a hand edit to a file a target regenerates. release-requested: a job holding write paths another fork was refused for, with a release request openAn advisory by default: it explains, and blocks nothing, on a job holding write paths another fork was refused for, with a release request open. repeated-marksAn advisory by default: it explains, and blocks nothing, on a run of question or exclamation marks in a review reply ("??", "!!", "?!"). reply-openerAn advisory by default: it explains, and blocks nothing, on a sentence of a review reply that opens by contradicting ("No,", "As I said"). reply-voiceAn advisory by default: it explains, and blocks nothing, on text that answers a prompt the reader never saw: a reply opener, a bold-label item, a stock label. request-recapAn advisory by default: it explains, and blocks nothing, on an agent reply that opens by restating what the person asked. restatesA house-style rule, off until a decisions table turns it on: it reports a one-line stylesheet comment that only names the rule or declaration it sits on. restates-diffA rule that is off by default: it reports a bullet or paragraph that is a verb and the things touched, with no reason: "Updates foo.go" once a decisions table turns it on. revert-classify: a revert that has not classified what it is revertingAn advisory by default: it explains, and blocks nothing, on a revert that has not classified what it is reverting. review-lengthA rule that is off by default: it reports a review text over its word cap: an inline comment over 60 words, a summary over 100, a reply over 80 once a decisions table turns it on. root-context-budget: a session's main thread whose context has grown past its level's sizeOff by default: once a workspace turns it on, it reports a session's main thread whose context has grown past its level's size. root-heavy-command: a main thread running delegable commands one after another without spawningOff by default: once a workspace turns it on, it reports a main thread running delegable commands one after another without spawning. root-repeat: a main thread running the same delegable command again with no write sinceOff by default: once a workspace turns it on, it reports a main thread running the same delegable command again with no write since. root-result-cap: one tool result too large for a main thread's context, said on its next callOff by default: once a workspace turns it on, it reports one tool result too large for a main thread's context, said on its next call. scope-drift: a write into a project this session has no dependency edge toAn advisory by default: it explains, and blocks nothing, on a write into a project this session has no dependency edge to. search-translation: a text search whose pattern a graph query provably answers with the same entitiesA deny rule by default: it refuses a text search whose pattern a graph query provably answers with the same entities, and names what to run instead. second-personA rule that is off by default: it reports we, us, our or ours in a guide, which speaks to the reader as you once a decisions table turns it on. sed-in-place: `sed -i`, whose two spellings destroy each other's work across platformsA deny rule by default: it refuses `sed -i`, whose two spellings destroy each other's work across platforms, and names what to run instead. shared-checkout: a spawn into a checkout a live job already holds and writesAn advisory by default: it explains, and blocks nothing, on a spawn into a checkout a live job already holds and writes. shared-stash: a bare stash push or pop, on a stack every worktree sharesA deny rule by default: it refuses a bare stash push or pop, on a stack every worktree shares, and names what to run instead. short-reply-headingAn advisory by default: it explains, and blocks nothing, on a heading in an agent reply under 300 words. sibling-checkout: a magus command relocated into another checkout, judging a tree nobody shipsA deny rule by default: it refuses a magus command relocated into another checkout, judging a tree nobody ships, and names what to run instead. signpostAn advisory by default: it explains, and blocks nothing, on an announcement standing where the point should be ("Here's the thing", "Let's dive in"). skill-description-budgetA rule that is off by default: it reports a skill description over 100 words, or a full form's description sharing 75% or more of its content words with the short form's once a decisions table turns it on. skill-set-description-budgetA rule that is off by default: it reports an installed set of skills whose descriptions sum past 2100 words, each skill's short and full form counted once a decisions table turns it on. skill-source: a write to an installed skill copy rather than to its sourceAn advisory by default: it explains, and blocks nothing, on a write to an installed skill copy rather than to its source. sleep-poll: a sleep before a status read, a call that only sleeps, or a wait on or retry into a full budgetA deny rule by default: it refuses a sleep before a status read, a call that only sleeps, or a wait on or retry into a full budget, and names what to run instead. source-read: an unbounded source read the symbol index has already answeredAn advisory by default: it explains, and blocks nothing, on an unbounded source read the symbol index has already answered. spawn-above-model-tier: a subagent spawned on a model whose tier ranks above the tier its job was forked atOff by default: once a workspace turns it on, it reports a subagent spawned on a model whose tier ranks above the tier its job was forked at. spawn-above-parent-tier: a subagent spawned on a model whose tier ranks above its spawner'sA deny rule by default: it refuses a subagent spawned on a model whose tier ranks above its spawner's, and names what to run instead. spawn-duplicate: a spawn for a job that already has a workerA deny rule by default: it refuses a spawn for a job that already has a worker, and names what to run instead. spawn-names-model: a main thread spawning a subagent without naming the model it runs onOff by default: once a workspace turns it on, it reports a main thread spawning a subagent without naming the model it runs on. spawn-nested-waiter: a subagent spawning a helper whose title or brief opening speaks of waiting or watchingA deny rule by default: it refuses a subagent spawning a helper whose title or brief opening speaks of waiting or watching, and names what to run instead. spawn-unbriefed: a subagent spawned before the multi-agent skill loadedA deny rule by default: it refuses a subagent spawned before the multi-agent skill loaded, and names what to run instead. spawn-unplaced: a subagent's first call that no waiting spawn names, which then runs under no leaseAn advisory by default: it explains, and blocks nothing, on a subagent's first call that no waiting spawn names, which then runs under no lease. spawn-unvalidated: a spawn for a job whose record was never validatedA deny rule by default: it refuses a spawn for a job whose record was never validated, and names what to run instead. spawn-waiter: a spawn whose child exists to wait on, poll or watch other workA deny rule by default: it refuses a spawn whose child exists to wait on, poll or watch other work, and names what to run instead. spawn-warm-worker: a fresh spawn for follow-up work while the worker that wrote the code is still warmA deny rule by default: it refuses a fresh spawn for follow-up work while the worker that wrote the code is still warm, and names what to run instead. split-run: the same target run again on a different project set, as a separate callAn advisory by default: it explains, and blocks nothing, on the same target run again on a different project set, as a separate call. staccatoA rule that is off by default: it reports three or more consecutive sentences of six words or fewer in one paragraph once a decisions table turns it on. stacked-colonA rule that is off by default: it reports two or more clause-introducing colons in one paragraph once a decisions table turns it on. stacked-hedgeAn advisory by default: it explains, and blocks nothing, on two softeners in one sentence of a review reply, or an apology before its point. stage-all: a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated outputA deny rule by default: it refuses a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated output, and names what to run instead. stage-classify: staging without classifying, when generated and source differAn advisory by default: it explains, and blocks nothing, on staging without classifying, when generated and source differ. stale-binary: a call that changes state while the magus judging it cannot load this tree's guard policyA deny rule by default: it refuses a call that changes state while the magus judging it cannot load this tree's guard policy, and names what to run instead. stall: a leased worker refused by something only the root can clearOff by default: once a workspace turns it on, it reports a leased worker refused by something only the root can clear. step-verbA deny rule by default: it refuses a numbered step of a guide that does not open with its imperative verb. subject-lengthA deny rule by default: it refuses a commit subject over 100 bytes. subject-moodAn advisory by default: it explains, and blocks nothing, on a commit subject opening in the past tense, the third person or a gerund ("added", "fixes", "making"). subject-periodA deny rule by default: it refuses a commit subject ending in a period. suppression-unusedA deny rule by default: it refuses a suppression comment that gives no reason or that matched no finding. symbol-search: a text search of the tree for a symbol, a declaration or a diagnostic code the graph answersA deny rule by default: it refuses a text search of the tree for a symbol, a declaration or a diagnostic code the graph answers, and names what to run instead. templateA house-style rule, off until a decisions table turns it on: it reports a skill template that does not render, so neither of its forms can be judged. tenseA house-style rule, off until a decisions table turns it on: it reports a claim in the future tense, or a first-person account of a change. termsA house-style rule, off until a decisions table turns it on: it reports a spelling the glossary replaces ("sub-agent"). terse-paragraphA house-style rule, off until a decisions table turns it on: it reports a paragraph or list item of agent instructions over 60 words. terse-sentenceA house-style rule, off until a decisions table turns it on: it reports a sentence of agent instructions over 25 words. throwaway-copy: a run inside a temp or scratchpad copy, which leaves the real tree unverifiedA deny rule by default: it refuses a run inside a temp or scratchpad copy, which leaves the real tree unverified, and names what to run instead. timed-magus: `time` around a silent magus run, which already reports its own durationsAn advisory by default: it explains, and blocks nothing, on `time` around a silent magus run, which already reports its own durations. token-state: an agent reading or writing the token secrets: the operator token file or the token storeA deny rule by default: it refuses an agent reading or writing the token secrets: the operator token file or the token store, and names what to run instead. tool-boundaryAn advisory by default: it explains, and blocks nothing, on a description that names no case where the tool is the wrong choice and no tool to use instead. tool-leadAn advisory by default: it explains, and blocks nothing, on a description whose first sentence opens on the tool itself, holds under 4 words or runs past 40 words. tool-lengthAn advisory by default: it explains, and blocks nothing, on a tool or skill description over 1024 runes. tool-sellingA deny rule by default: it refuses a word that sells the tool (powerful, seamless, effortless, state-of-the-art) or a buzzword. triadA rule that is off by default: it reports a series of exactly three ("X, Y, and Z", three parallel short sentences, three parallel bullets) twice in a text, or once in the lead's first sentence once a decisions table turns it on. unbacked-doneAn advisory by default: it explains, and blocks nothing, on a claim of done, fixed, verified or passing with no command, output ref, file or link beside it. unjudged-tool: a tool call whose input carries nothing any rule reads, from a tool the guard does not knowA deny rule by default: it refuses a tool call whose input carries nothing any rule reads, from a tool the guard does not know, and names what to run instead. unknown-env: a retired or misspelled MAGUS_* variable handed to a commandA deny rule by default: it refuses a retired or misspelled MAGUS_* variable handed to a command, and names what to run instead. unleased-write: a write magus cannot attribute while a fleet is runningAn advisory by default: it explains, and blocks nothing, on a write magus cannot attribute while a fleet is running. unread-command: a program or VCS subcommand the shell computes before it runs, which no rule can readA deny rule by default: it refuses a program or VCS subcommand the shell computes before it runs, which no rule can read, and names what to run instead. vagueA deny rule by default: it refuses weight or consensus asserted with nothing named ("experts argue", "the stakes are high"). vcs-off-switch: an agent's write setting vcs.enabled: false in a magus.yaml this workspace readsA deny rule by default: it refuses an agent's write setting vcs.enabled: false in a magus.yaml this workspace reads, and names what to run instead. verdictAn advisory by default: it explains, and blocks nothing, on a judgment word standing in for the behavior it judges ("was broken", "a mess"). voice-driftAn advisory by default: it explains, and blocks nothing, on a draft that reads further from its author's own texts of its kind than 95 percent of them do, or a commit subject longer than 95 percent of the author's. whole-tree: a whole-tree VCS reset, checkout, restore or clean, which cannot be undoneA deny rule by default: it refuses a whole-tree VCS reset, checkout, restore or clean, which cannot be undone, and names what to run instead. why-openerAn advisory by default: it explains, and blocks nothing, on a review reply sentence that opens "Why did you" or "Why would you". wordyAn advisory by default: it explains, and blocks nothing, on a phrase with a shorter equivalent ("in order to"). worker-background-run: a bound worker running a magus target in the backgroundA deny rule by default: it refuses a bound worker running a magus target in the background, and names what to run instead. worker-check-only: a bound worker running other than its check or a writer of its write paths, or writing past themA deny rule by default: it refuses a bound worker running other than its check or a writer of its write paths, or writing past them, and names what to run instead. workspace-command-failed: a command the workspace's rule could not judge, so only the built-in rules graded itAn advisory by default: it explains, and blocks nothing, on a command the workspace's rule could not judge, so only the built-in rules graded it. workspace-spawn-failed: a spawn the workspace's rule could not judge, so only the built-in rules graded itAn advisory by default: it explains, and blocks nothing, on a spawn the workspace's rule could not judge, so only the built-in rules graded it. workspace-write-failed: a file write the workspace's rule could not judge, so only the built-in rules graded itAn advisory by default: it explains, and blocks nothing, on a file write the workspace's rule could not judge, so only the built-in rules graded it. worktree-remove: removing a worktree magus cannot prove holds nothing that would be lostA deny rule by default: it refuses removing a worktree magus cannot prove holds nothing that would be lost, and names what to run instead.