Coverage
Which agents the guardrail covers, on which kinds of machine, and whether the agent is pointed at it or forced through it.
By agent
| agent | how it is pointed at the guardrail | default model endpoint | inside the egress wall |
|---|---|---|---|
claude-code | an environment variable set per run | https://api.anthropic.com | covered on every lane that carries the wall: local and remote Linux, local and remote macOS, and the agent harness. On a remote Mac it needs the current saphan, and a fixed guardrail.listen makes the run uncoverable there |
codex | an argument set per run | https://chatgpt.com/backend-api/codex | covered on Linux walls; not on macOS |
droid | your own customModels[].baseUrl — the product writes nothing into its settings | none: set guardrail.codec.droid, guardrail.upstream.droid and a fixed guardrail.listen | covered on Linux walls only, and for bring-your-own-key models only |
qwen-code | a per-run copy of its profile | none: set guardrail.upstream.qwen-code | not covered inside the wall |
cursor | — | — | not covered |
When a judged run cannot be covered, it is refused as guardrail-unavailable rather than run
unjudged. A recorded-only run in the same situation runs, and its run record says it was not
recorded and why.
⚠ Of these cells, the remote Mac, the agent harness and droid inside the wall are built and selected
automatically but are not yet proven end to end with a full agent turn. Treat them as unproven.
Remote machines
On a machine reached over ssh, the proxy runs on that machine, beside the agent. Before a judged run
starts, the remote saphan is checked for the options the run needs; an older build refuses the
judged run by name, and a recorded-only run proceeds unrecorded with a note.
Console sessions
Conversations, terminal sessions and shells started from the console go through the same proxy — they
are recorded and, when judging is on, judged under the same modes and acts — for claude-code
only. A judged console session with another agent is refused as guardrail-unavailable. For a
remote terminal, the proxy runs on the console's machine and is reached from the remote machine over
the ssh connection.
Pointed or forced
On most lanes the agent is pointed at the guardrail — told its address — but nothing at the network layer stops an agent that ignored the address from calling its model directly.
The model hosts are sealed, so that only the guardrail can reach them, only when all of these hold:
- the run is on a Linux network wall — local, or a remote Linux machine whose measured rung is
netns; - under the
legacyharness and the engine's own jail (not container or vendor confinement); - the run is judged by its backend's baseline — a run dispatched with
--egress-policyis not sealed.
See How egress control works. When a seal is attempted, the run record says whether it held and, if not, why; elsewhere the proxy's own start line in the run's capture says the run is not sealed.