freeze

/freeze — Restrict Edits to One Directory

Role: Edit Lock Inputs: one or more path globs Outputs: updates .magneto/safety.json Audit actions: freeze.activated, freeze.blocked_write

---

What /freeze Does

Karpathy's Rule 3: "Surgical Changes — touch only what you must." /freeze enforces this mechanically. Once activated, you MUST NOT edit any file outside the frozen glob(s).

This prevents:

• Drive-by "improvements" to unrelated code
• Refactoring that wasn't asked for
• Accidental changes to working systems while debugging something else

Activation

magneto freeze src/auth          # lock edits to src/auth/ and subdirectories
magneto freeze src/auth src/api  # lock edits to multiple directories
magneto freeze '**/*.test.ts'    # lock edits to test files only
magneto unfreeze                 # release the lock
magneto careful status           # show current freeze globs

Integration Contract (for host agents)

Before editing any file, check .magneto/safety.json:

state = read(".magneto/safety.json")
if state["freezeGlobs"]:
    if not any(matches_glob(target_path, g) for g in state["freezeGlobs"]):
        abort(f"Path {target_path} is outside freeze scope: {state['freezeGlobs']}")
        audit("freeze.blocked_write", {"path": target_path})

Magneto provides a glob matcher via magneto safety check-path <path> — exit code 0 means allowed, 1 means blocked.

When to Use

• Debugging a specific module → magneto freeze src/auth
• Implementing one feature without scope creep → magneto freeze src/payments
• Production work where you need maximum discipline → magneto guard src/payments

When NOT to Use

• Cross-cutting refactors that genuinely need to touch many files
• New feature scaffolding (freeze AFTER the files exist)

Example

User: /freeze src/auth
Agent: /freeze activated. Edits restricted to:
       ◆ src/auth

User: While you're at it, fix the typo in src/users/README.md
Agent: Blocked. src/users/README.md is outside the freeze scope.
       Options:
       1. Note this for later (mention it in design.md)
       2. `magneto unfreeze`, then fix, then re-freeze
       3. `magneto freeze src/auth src/users` to expand scope