Audit native transports and retain secure export diagnostics

docs/native-transport-observability.md

@@ -0,0 +1,76 @@
+# Native WebTransport security observation
+
+The private HTTP relay is the release boundary. Observation does not inspect
+WebTransport payloads and cannot replace native transport containment.
+
+Electron webRequest does not observe the tested Chromium WebTransport path.
+The browser now subscribes privately to native Created, Established and Closed
+events through the existing clipboard security owner's CDP connection.
+The [Electron debugger API](https://www.electronjs.org/docs/latest/api/debugger)
+and [Chromium Network protocol](https://chromedevtools.github.io/devtools-protocol/tot/Network/)
+describe this instrumentation. No debugger port or protocol dispatcher is
+exposed to websites, UI JavaScript or local agents.
+
+## Ownership and lifecycle
+
+The clipboard guard owns the only debugger attachment. Its fixed transport
+lease can enable network observation, attach related targets and resume startup
+targets; it cannot submit arbitrary commands or detach clipboard protection.
+Initial about:blank navigation completes before setup commands, which Chromium
+can otherwise defer indefinitely. Setup finishes before real page navigation.
+Worker observation is queued before startup resume, covering the tested worker's
+first statement. Disposal unsubscribes observation, resumes waiting targets and
+releases auto-attachment while preserving clipboard protection.
+
+Commands, targets, pending attempts and audit queues are bounded. Unexpected
+detach, command timeout, overflow or audit failure makes the browser remain
+quarantined until restart. Unexpected native establishment also quarantines
+synchronously in the native event handler, before entering the serialized audit
+queue. A held Created-audit regression verifies this ordering. This is a containment alarm;
+it is not proof that an observer could prevent already transmitted bytes.
+
+## Security records
+
+`transport.created`, `transport.closed` and `transport.established` carry an
+application-generated UUID, protocol, phase, realm, associated native tab UUID,
+connection-established flag and canonical destination hostname. Creation policy
+and owner context survive subsequent navigation or policy changes. Native CDP
+identifiers, URLs, query strings, initiators, certificates, headers and bodies
+are absent. Backend validation rejects contradictory phases, extra fields and
+noncanonical host data. Monitor failures accept only fixed reason identifiers.
+
+Records use the protected durable event pipeline. ECS and CEF preserve the
+lifecycle facts as observations with unknown outcome: a Closed event is not
+automatically claimed as an inspected or blocked payload. Operational traces
+use fixed browser.transport stages and correlate audit encryption, persistence
+and delivery without destination or content attributes. The signed diagnostics
+switch still controls operational exports independently of security auditing.
+
+## Actual Windows evidence
+
+The current shared-owner native fixture proves Window and first-statement
+dedicated Worker behavior through enrollment, reviewed DIRECT and fetched HTTPS
+PAC→DIRECT policies. The unguarded control delivered 132 bytes. Managed cases
+delivered zero packets or bytes, while three public HTTPS submissions worked.
+Six Created and six Closed records reached the central backend; none Established.
+All twelve exported phase traces have matching audit-stage parents. Ordinary
+webRequest callbacks remain zero, so these are actual native observations.
+
+Evidence: ignored `artifacts/fullmain-webtransport-native-proof.json`, source
+hashes and `artifacts/cdp-webtransport-native-proof.json`. The latter additionally
+checks real DevTools coexistence and verifies that observer disposal preserves
+clipboard ownership. Earlier literal/restart and real local Gemma regressions
+passed on the same source hashes. The later final-source literal/restart test
+also passes; the later semantic DLP checks pass but its debug acceptance records
+three export timeouts and one concurrency rejection. Those failures remain
+open and are separate from receiver containment. These scenarios do not prove every worker, iframe,
+shared-worker attribution or future Chromium transport implementation.
+
+## Measured limits
+
+During concurrent native source checkout/build work, semantic paste took
+2.9–3.7 seconds and public-file inspection 14.3 seconds. Protected audit fsync
+reached 414 ms. These traces identify work to profile; they do not isolate an
+observer regression or justify weakening scanning, isolation or persistence.
+The separate initial-about:blank WebRTC engine crash remains unresolved until a
+fixed native runtime is compiled and passes its paired receiver tests.