Session modes and guarantees

This page explains the three ways Barry can attach to a harness, what Barry controls in each, and which modes each harness supports. The mode decides how much of a session’s policy Barry can enforce, so it matters as much as the policy itself when you rely on a bound.

Who drives

A mode says who sits at the controls and what Barry holds:

Mode	Who drives	What Barry holds
hosted	Barry	The session: every event, message delivery, interrupt, and a ruling on each tool call the harness asks about
instrumented	You, in the harness’s own interface	The side doors Barry opens at launch: delivery, live capture, and tool gating
guest	You, in the harness’s own interface	What the harness leaves behind: its transcript, and delivery when the agent calls a Barry tool

Barry holds the harness’s engine only in hosted mode, so hosted gives it the most control. Even in hosted mode, how firmly Barry gates the harness’s own tools depends on the harness: some rule each call, some gate through hooks, and Cursor runs a few native tools without asking. The other two modes reach the session from outside, so their guarantees are partial by design.

Every adapter defaults to hosted. You choose another mode per session, or set one per harness on the identity:

Terminal

<identity> session start --mode instrumented
<identity> identity adapters set codex --mode guest

The older name guest-plus still means instrumented.

What Barry controls

Barry first resolves the session’s traits and bounds into one policy. Four enforcement points then carry that policy to the harness, and a mode decides which of them apply.

• The MCP tool filter. The harness reaches Barry’s tools through Barry’s MCP server, which lists only the tools the policy grants.
• The call-time guards. When a granted Barry tool runs, Barry checks it against the bound: file patterns, shell commands, and network rules.
• The native ceiling and hook gate. Native tools start off. Traits grant them and bounds take them back. Barry gates the harness’s own tools in one of three ways. With per-call gating, the harness asks, and Barry answers each time. With hooks, a Barry hook inside the harness can veto a call. With static, a denylist fixed at launch applies for the whole session. When a bound requires denying a native tool the mode can’t control, the session refuses to launch.
• The egress sandbox. A proxy filters outbound traffic by hostname, and the agent can’t lift it. A hosted session whose bound asks for the sandbox on a harness or endpoint without one refuses to start. In every mode, a bound that asks for the sandbox takes back the native shell and network tools.

What each harness supports

Each cell shows how much of the conversation Barry captures. “Not offered” means the adapter has no such mode. For the native gate, the tools a mode can’t turn off, the operator override, and the egress sandbox in each cell, see the canonical enforcement coverage table.

Harness	Hosted	Instrumented	Guest
Antigravity	Total	After the fact	After the fact
Claude Code	Total	Near-total	After the fact
Codex	Total	Total	After the fact
Cursor	Near-total	After the fact, macOS only	After the fact
OpenCode	Total	Not offered	None
Pi	Total	Not offered	Not offered

Some details behind the table:

• Antigravity is experimental: its hosted evidence comes from a scripted endpoint, not the vendor’s real API. In its instrumented and guest modes, the operator can turn Barry’s hook gate off with /hooks.
• Claude Code keeps its own interface only in the instrumented and guest modes, and those modes have no interrupt and no per-call gating. Hosted Claude Code runs without the vendor interface. Instrumented capture comes from telemetry, which truncates long bodies.
• Codex in instrumented mode attaches its interface to the engine of a hosted session, so Barry keeps hosted capture and delivery. The operator still has the terminal: /hooks turns Barry’s gate off until the next turn starts, so instrumented Codex doesn’t keep hosted gating. In guest mode, /hooks turns the gate off for the rest of the session.
• Cursor offers instrumented mode only on macOS.
• OpenCode in guest mode denies native tools at launch and offers only Barry’s. Barry doesn’t read the conversation while it runs.
• Pi runs only hosted.

Only hosted Claude Code declares an egress sandbox, and Ollama and llama.cpp endpoints lose it. Elsewhere, a hosted session that asks for the sandbox refuses to start rather than run on guards alone.

Each adapter declares and records its guarantees

Each adapter declares, per mode, what it guarantees: capture, delivery, steering, interrupt, gating, whether you keep the vendor interface, and how the session’s identity reaches Barry. Each declaration names the harness build it holds for and a check that proves it. The adapter contract defines these fields, and Claude Code’s modes show a full set.

A session records the mode, guarantees, and harness version of what ran, not the adapter’s defaults. When the running build differs from the build a mode holds for, Barry marks that session’s guarantees unverified rather than reporting them as fact.

Terminal

barry adapter list
barry adapter doctor

Related

Policy resolution explains how Barry computes the policy these modes enforce. Adapters covers choosing a harness and model, and the adapter notes cover the contracts in depth.