feat(network): add experimental macOS transparency and durable Agent usage

[dufangshi]

Mac Agents currently rely on proxy environment variables, so programs that open ordinary sockets can bypass Treer identity, Policy and traffic accounting. This change adds an opt-in, owned macOS NetworkExtension backend and strengthens the shared Controller/Proxy network path. The macOS default remains proxy-env; the native backend is experimental and has not passed signed installation acceptance.

Changes

• Add a Swift transparent-proxy extension and launch helper with readiness/registration acknowledgements, audit-token and process birth-time validation, observed descendant tracking and same-boot identity checkpoints.
• Implement directional TCP half-close, bounded flow handling, shared persistent virtual DNS, exact-domain resolver ownership and a native UDP adapter.
• Add authenticated UDP datagrams, UDP service registration, Direct and cross-Proxy routing, flow control, active Policy revocation and disconnect handling.
• Add non-billable Direct payload accounting and Agent-level traffic API/Audit views. Persist cumulative usage in a Controller outbox and acknowledge only after transactional receipt deduplication and machine/Agent ledger updates.
• Include reproducible native/network labs, Apple Linux guest setup updates and maintained architecture, security, operator and verification documentation.

Validation

Completed during implementation: 25 Controller network tests; focused protocol/Proxy tests; real PostgreSQL traffic, receipt, rollback and legacy-schema migration tests; 8 Swift core and 7 platform tests; unsigned app/extension build; strict Rust Clippy and web TypeScript checks. Documentation links and staged whitespace checks were rechecked before this commit.

Live isolated labs exercised native TCP capture through the existing signed upstream helper, two Proxies/NATS, Policy allow/deny and active revocation, relay machine/Agent totals, Controller UDP routing and Direct durable usage acknowledgements. Generated binaries, logs, local credentials and reference checkouts are excluded.

Remaining gates and limitations

• The owned extension still needs valid Apple provisioning and signed install/capture/DNS/update/uninstall/sleep-wake acceptance. Upstream-helper experiments are not proof that the owned extension is installed or production-ready.
• Descendants that detach before their first observed flow can escape attribution; extension death/disable is not guaranteed fail-closed. These are implementation gaps independent of signing.
• macOS Agents share host ports. UDP over TCP inherits head-of-line blocking; Linux private Agent UDP ingress is unsupported.
• Direct usage is machine-reported, not independently verified billing. Abrupt crashes can lose uncheckpointed tails; delayed usage uses the commit-time hour.
• Earlier Apple guest Linux capture/service tests passed, but the latest guest preflight encountered host-to-guest reachability failure; the new revision has not passed full guest regression.

See native/macos-network/README.md and docs/research/2026-09-05-macos-network-execution.md for the evidence and remaining acceptance gates. This PR does not claim full Linux parity.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	treer-app-canary	f73b043	Commit Preview URL Branch Preview URL	Sep 13 2026, 03:26 AM