Guard rulesEvery rule the guard enforces: what each one catches, whether it denies or advises by default, and where the reasoning lives. agent-sign-off: an agent stamping a read receipt or closing an attention request, which only a person may doA deny rule by default: it refuses an agent stamping a read receipt or closing an attention request, which only a person may do, and names what to run instead. backtick-substitution: a backtick command substitution, which inside double quotes runs a commandA deny rule by default: it refuses a backtick command substitution, which inside double quotes runs a command, and names what to run instead. brief-command: a spawn or continuation brief that teaches a command the guard deniesAn advisory by default: it explains, and blocks nothing, on a spawn or continuation brief that teaches a command the guard denies. busy-wait: a loop that only sleeps between polls, holding a tool slot for its whole waitAn advisory by default: it explains, and blocks nothing, on a loop that only sleeps between polls, holding a tool slot for its whole wait. buzz-unbriefed: the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skillAn advisory by default: it explains, and blocks nothing, on the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skill. cache-dir-write: a write into this checkout's magus cache dir, which magus alone ownsA deny rule by default: it refuses a write into this checkout's magus cache dir, which magus alone owns, and names what to run instead. capture-filter: a filter over a run capture or log, which cuts the failure block apartAn advisory by default: it explains, and blocks nothing, on a filter over a run capture or log, which cuts the failure block apart. chained-run: magus runs sequenced with `&&` or `;`, which a pipe of the same stages runs ordered and fail-fastAn advisory by default: it explains, and blocks nothing, on magus runs sequenced with `&&` or `;`, which a pipe of the same stages runs ordered and fail-fast. checkpoint-state: a command reaching for a tree's identity, which a revision alone cannot giveAn advisory by default: it explains, and blocks nothing, on a command reaching for a tree's identity, which a revision alone cannot give. claimed-declaration: a leased edit landing in a declaration another live job claims (`run.go#executeStages`)A deny rule by default: it refuses a leased edit landing in a declaration another live job claims (`run.go#executeStages`), and names what to run instead. credential-verb: an agent minting, printing, rotating or revoking a credential through the CLIA deny rule by default: it refuses an agent minting, printing, rotating or revoking a credential through the CLI, and names what to run instead. dependency-install: a raw package install that the cached install target already runsAn advisory by default: it explains, and blocks nothing, on a raw package install that the cached install target already runs. dependency-update: a raw dependency update outside a target's update charmAn advisory by default: it explains, and blocks nothing, on a raw dependency update outside a target's update charm. echo-on-success: an `&& echo` that restates what the exit status already saysAn advisory by default: it explains, and blocks nothing, on an `&& echo` that restates what the exit status already says. exit-status-echo: a line ending by printing an exit status, which the harness already reportsAn advisory by default: it explains, and blocks nothing, on a line ending by printing an exit status, which the harness already reports. filter-without-input: a filter with no file, pipe or redirect, which reads a stdin nothing feedsAn advisory by default: it explains, and blocks nothing, on a filter with no file, pipe or redirect, which reads a stdin nothing feeds. focus-read: a read outside the paths a focus lease was givenA deny rule by default: it refuses a read outside the paths a focus lease was given, and names what to run instead. focus: a read or write outside the paths the running job declaredAn advisory by default: it explains, and blocks nothing, on a read or write outside the paths the running job declared. gate-repeat: the gate run again soon after it passed, repeating work already doneAn advisory by default: it explains, and blocks nothing, on the gate run again soon after it passed, repeating work already done. generated-write: a hand edit to a declared output, which the next run overwritesAn advisory by default: it explains, and blocks nothing, on a hand edit to a declared output, which the next run overwrites. graph-pipe: a read-only graph verb piped into a text filter, when magus projects the record itselfAn advisory by default: it explains, and blocks nothing, on a read-only graph verb piped into a text filter, when magus projects the record itself. graph-stale: a graph read, or a graph-backed deny, while the graph describes another treeAn advisory by default: it explains, and blocks nothing, on a graph read, or a graph-backed deny, while the graph describes another tree. grep-reader: a definition lookup with a context flag (`grep -A40 'func X'`), which uses grep to read the bodyAn advisory by default: it explains, and blocks nothing, on a definition lookup with a context flag (`grep -A40 'func X'`), which uses grep to read the body. hook-wiring-write: a leased or agent-attributed write to the hook wiring the guard is installed byA deny rule by default: it refuses a leased or agent-attributed write to the hook wiring the guard is installed by, and names what to run instead. hook-wiring: a write to the host wiring that decides whether these rules run at allAn advisory by default: it explains, and blocks nothing, on a write to the host wiring that decides whether these rules run at all. inline-alias: a VCS alias defined inline (`git -c alias.x=...`), which hides the command it runsA deny rule by default: it refuses a VCS alias defined inline (`git -c alias.x=...`), which hides the command it runs, and names what to run instead. installed-skill: a write to an installed skill copy, which re-installing discardsAn advisory by default: it explains, and blocks nothing, on a write to an installed skill copy, which re-installing discards. instruction-write: a write to a cross-host instruction file, which every session loads wholeAn advisory by default: it explains, and blocks nothing, on a write to a cross-host instruction file, which every session loads whole. interpreter-rewrite: an inline interpreter rewriting a file this tree already carriesAn advisory by default: it explains, and blocks nothing, on an inline interpreter rewriting a file this tree already carries. lease-gate: a leased worker running the gate instead of the check it was assignedA deny rule by default: it refuses a leased worker running the gate instead of the check it was assigned, and names what to run instead. lease-harness: a leased worker rewriting the harness skill trees that steer itA deny rule by default: it refuses a leased worker rewriting the harness skill trees that steer it, and names what to run instead. lease-invalid: a call naming a lease this workspace's job store does not declareAn advisory by default: it explains, and blocks nothing, on a call naming a lease this workspace's job store does not declare. lease-rebind: a leased worker rewriting who it is or what its own job row saysA deny rule by default: it refuses a leased worker rewriting who it is or what its own job row says, and names what to run instead. lease-state: a leased write while its row reports a diverged base, a re-entered path, or a bad patternAn advisory by default: it explains, and blocks nothing, on a leased write while its row reports a diverged base, a re-entered path, or a bad pattern. lease-terminal: a call naming a lease whose row has already finishedAn advisory by default: it explains, and blocks nothing, on a call naming a lease whose row has already finished. lease-undeclared: a call graded under a lease id the job store has no row for, or a binding it tombstonedA deny rule by default: it refuses a call graded under a lease id the job store has no row for, or a binding it tombstoned, and names what to run instead. lease-vcs: a worker lease pushing, stashing or reverting, or committing outside its own branch and checkoutA deny rule by default: it refuses a worker lease pushing, stashing or reverting, or committing outside its own branch and checkout, and names what to run instead. lease-write: a leased write outside its write paths, or into a path it was denied or another lease ownsA deny rule by default: it refuses a leased write outside its write paths, or into a path it was denied or another lease owns, and names what to run instead. leased-path: a write into paths a running lease owns, by a caller that names no leaseAn advisory by default: it explains, and blocks nothing, on a write into paths a running lease owns, by a caller that names no lease. magus-timeout: a magus call wrapped in coreutils `timeout` or `gtimeout`, which kills it from outsideAn advisory by default: it explains, and blocks nothing, on a magus call wrapped in coreutils `timeout` or `gtimeout`, which kills it from outside. merge-side-checkout: a checkout of one merge side over a conflicted file, which discards the mergeA deny rule by default: it refuses a checkout of one merge side over a conflicted file, which discards the merge, and names what to run instead. new-file: a new file in a directory whose naming has settledAn advisory by default: it explains, and blocks nothing, on a new file in a directory whose naming has settled. new-source-dir: a new file that opens a directory, which is a boundary rather than a fileAn advisory by default: it explains, and blocks nothing, on a new file that opens a directory, which is a boundary rather than a file. notes-author: an agent authoring a human's note, whose only provenance is who wrote itA deny rule by default: it refuses an agent authoring a human's note, whose only provenance is who wrote it, and names what to run instead. output-pipe: magus output piped into a filter, when magus projects the record itselfAn advisory by default: it explains, and blocks nothing, on magus output piped into a filter, when magus projects the record itself. output-redirect: magus output sent to a file or discarded, which the run log already holdsAn advisory by default: it explains, and blocks nothing, on magus output sent to a file or discarded, which the run log already holds. precedent-search: a hunt for one distinctive name, which refs answers with verified sitesAn advisory by default: it explains, and blocks nothing, on a hunt for one distinctive name, which refs answers with verified sites. process-poll: a process table inspected to wait on magus work the lock already reportsAn advisory by default: it explains, and blocks nothing, on a process table inspected to wait on magus work the lock already reports. push-gate: a push the run log does not prove ungated, which names the gate and lets it throughAn advisory by default: it explains, and blocks nothing, on a push the run log does not prove ungated, which names the gate and lets it through. push-ungated: a push at a commit with no green gate: the person is asked, a leased worker refusedA deny rule by default: it refuses a push at a commit with no green gate: the person is asked, a leased worker refused, and names what to run instead. raw-tool: a toolchain command a spell already wraps, run outside the cacheAn advisory by default: it explains, and blocks nothing, on a toolchain command a spell already wraps, run outside the cache. read-navigation: a whole read of a Go, Buzz or Markdown file past the workspace's line limitAn advisory by default: it explains, and blocks nothing, on a whole read of a Go, Buzz or Markdown file past the workspace's line limit. read-symbol: a bounded read inside one indexed declaration, which refs --definition --source prints checkedAn advisory by default: it explains, and blocks nothing, on a bounded read inside one indexed declaration, which refs --definition --source prints checked. regen-source: a hand edit to a file a target regeneratesAn advisory by default: it explains, and blocks nothing, on a hand edit to a file a target regenerates. revert-classify: a revert that has not classified what it is revertingAn advisory by default: it explains, and blocks nothing, on a revert that has not classified what it is reverting. scope-drift: a write into a project this session has no dependency edge toAn advisory by default: it explains, and blocks nothing, on a write into a project this session has no dependency edge to. scripted-rewrite: a scripted substitute-and-write, which cannot tell your symbol from a dependency'sAn advisory by default: it explains, and blocks nothing, on a scripted substitute-and-write, which cannot tell your symbol from a dependency's. search-translation: a text search whose pattern a graph query provably answers with the same entitiesAn advisory by default: it explains, and blocks nothing, on a text search whose pattern a graph query provably answers with the same entities. sed-in-place: `sed -i`, whose two spellings destroy each other's work across platformsAn advisory by default: it explains, and blocks nothing, on `sed -i`, whose two spellings destroy each other's work across platforms. shared-checkout: a spawn into a checkout a live job already holds and writesAn advisory by default: it explains, and blocks nothing, on a spawn into a checkout a live job already holds and writes. shared-stash: a bare stash push or pop, on a stack every worktree sharesA deny rule by default: it refuses a bare stash push or pop, on a stack every worktree shares, and names what to run instead. sibling-checkout: a magus command relocated into another checkout, judging a tree nobody shipsAn advisory by default: it explains, and blocks nothing, on a magus command relocated into another checkout, judging a tree nobody ships. skill-source: a write to an installed skill copy rather than to its sourceAn advisory by default: it explains, and blocks nothing, on a write to an installed skill copy rather than to its source. source-read: an unbounded source read the symbol index has already answeredAn advisory by default: it explains, and blocks nothing, on an unbounded source read the symbol index has already answered. spawn-unbriefed: a subagent spawned before the multi-agent skill loadedAn advisory by default: it explains, and blocks nothing, on a subagent spawned before the multi-agent skill loaded. split-run: the same target run again on a different project set, as a separate callAn advisory by default: it explains, and blocks nothing, on the same target run again on a different project set, as a separate call. stage-all: a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated outputAn advisory by default: it explains, and blocks nothing, on a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated output. stage-classify: staging without classifying, when generated and source differAn advisory by default: it explains, and blocks nothing, on staging without classifying, when generated and source differ. stdin-closed: shell commands run with stdin at end-of-file, said once per sessionAn advisory by default: it explains, and blocks nothing, on shell commands run with stdin at end-of-file, said once per session. symbol-search: a text search of the tree for a symbol, a declaration or a diagnostic code the graph answersAn advisory by default: it explains, and blocks nothing, on a text search of the tree for a symbol, a declaration or a diagnostic code the graph answers. throwaway-copy: a run inside a temp or scratchpad copy, which leaves the real tree unverifiedAn advisory by default: it explains, and blocks nothing, on a run inside a temp or scratchpad copy, which leaves the real tree unverified. timed-magus: `time` around a silent magus run, which already reports its own durationsAn advisory by default: it explains, and blocks nothing, on `time` around a silent magus run, which already reports its own durations. token-state: an agent reading or writing the token secrets: the operator token file or the token storeA deny rule by default: it refuses an agent reading or writing the token secrets: the operator token file or the token store, and names what to run instead. unknown-env: a retired or misspelled MAGUS_* variable handed to a commandAn advisory by default: it explains, and blocks nothing, on a retired or misspelled MAGUS_* variable handed to a command. unleased-write: a write magus cannot attribute while a fleet is runningAn advisory by default: it explains, and blocks nothing, on a write magus cannot attribute while a fleet is running. vcs-off-switch: an agent's write setting vcs.enabled: false in a magus.yaml this workspace readsA deny rule by default: it refuses an agent's write setting vcs.enabled: false in a magus.yaml this workspace reads, and names what to run instead. whole-tree: a whole-tree VCS reset, checkout, restore or clean, which cannot be undoneA deny rule by default: it refuses a whole-tree VCS reset, checkout, restore or clean, which cannot be undone, and names what to run instead. worker-check-only: a bound worker running a target other than its row's check or one writing its write pathsA deny rule by default: it refuses a bound worker running a target other than its row's check or one writing its write paths, and names what to run instead. worktree-remove: removing a worktree magus cannot prove holds nothing that would be lostA deny rule by default: it refuses removing a worktree magus cannot prove holds nothing that would be lost, and names what to run instead.