Run a reviewer that cannot write

Use this when you want an agent to read a change and report on it, with no way to edit a file, run a shell command, push, or make an outbound write. The recipe uses the readonly bound that ships with Barry, so it needs no extra bag. The commands act as the bonanza identity from Build a Barry; use your own identity’s command in its place.

Before you begin

You installed Barry, and bonanza starts a session.
You know which harness and session mode the session runs in. A bound holds only as firmly as that harness and mode let Barry enforce it, so read enforcement coverage for yours.
The change you want reviewed sits in a local checkout.

Check what the bound removes

List the bounds on your machine and read the readonly entry:

barry bound list

The readonly bound denies the Bash, Write, and Edit tools, removes every tool that writes, and denies network writes such as git push. A bound only takes access away, so the reviewer keeps the file reads its traits grant.

Hand the reviewer the change

The reviewer has no shell, so it cannot run git diff itself. Write the diff to a file from your own terminal first:

git diff main > /tmp/review.diff

Replace main with the branch the change targets.

Start a read-only session

From the checkout, start a session under the bound. The -r flag grants every packed bag’s tools under readonly and skips the trait picker:

bonanza session start -r

To guard secret files as well, add the no-secrets bound. It blocks Barry’s file tools from .env files, SSH keys, and certificate files, and withholds the shell and the harness’s native file tools. It is a best-effort guard, not a sandbox:

bonanza session start -r --bound no-secrets

Then ask for the review:

Review the change in /tmp/review.diff against the files in this checkout.
Report problems by file and line. Do not try to fix anything.

Make every session of an identity read-only

When an identity exists only to review, require the bounds in its identity.yaml, so no session of it can start without them:

bounds:
  - readonly
  - no-secrets

<identity> identity bounds add readonly writes the same entry from the command line.

Verify

When the session starts, Barry prints the traits it granted and the bound it applied, for example readonly. Then test the bound on purpose: ask the agent to add a comment to any file, or to run ls. Barry refuses the write and the shell call, and the agent sees each call denied. A refused call is the result you want.

If it fails

The agent edited a file or ran a command. Check the enforcement coverage table for your harness and mode. In the terminal modes of Codex and Antigravity, the person at the terminal can switch Barry’s gate off with /hooks, and Cursor runs a few native tools Barry cannot turn off. Start the session in hosted mode with --mode hosted for the firmest coverage. See A bound did not stop the agent.
The session refuses to start. A bound that must take back a native tool the mode cannot control stops the launch. Pick a mode that can turn the tool off, using the coverage table.
A tool the reviewer needs is missing. readonly removes every tool that writes, including write tools a bag offers. Grant read tools through a trait; see Empowering with traits.