Harden Windows DLP enforcement and Electron runtime packaging

docs/local-dlp-relay.md

@@ -0,0 +1,37 @@
+# Windows browser transport containment
+
+Electron's HTTP request hooks do not intercept WebTransport payloads. A native
+receiver test with Electron 44.7.0 demonstrated data from both a page and a
+dedicated worker bypassing those hooks, including with the tested QUIC/Blink
+disable flags. The implementation therefore forces every managed browser URL
+through a private non-DIRECT Chromium proxy, with implicit loopback bypass removed.
+The tested Chromium HTTP/3 WebTransport client rejects that proxy route before
+opening its UDP connection. Ordinary HTTP and HTTPS remain available.
+
+`local-dlp-relay.cjs` binds numeric loopback only and authenticates Chromium with
+an ephemeral capability. It forwards approved HTTP or CONNECT traffic; it is not
+a replacement for the native content-DLP gates. Native hooks still inspect text,
+files and headers before release. Policy replacement, quarantine and shutdown
+invalidate relay authority and terminate pending/live sockets. Resolution uses
+the approved Chromium resolver and numeric connection addresses.
+
+The management session retains the centrally configured system/fixed/PAC proxy.
+The relay resolves upstream routes through that session. DIRECT, HTTP PROXY and
+HTTPS PROXY routes are supported; an unsupported or failed route never silently
+falls back to DIRECT. SOCKS and integrated upstream NTLM/Kerberos authentication
+currently fail closed and require an additional integration. Optional Basic
+credentials require `SAFETYNET_PROXY_AUTH_HOST` and `SAFETYNET_PROXY_AUTH_PORT`
+to match the selected upstream endpoint, in addition to protected deployment
+username/password variables. They are not distributed in policy bundles.
+
+Native evidence: `artifacts/webtransport-native-proof.json`. The receiver got
+zero packets/bytes with the private relay while ordinary HTTP loaded. The
+Windows core DLP and real restart fixtures also passed with relay integration.
+Chromium upgrades must repeat this receiver proof; it is version-specific.
+WebTransport-specific denial audit events are not yet observed because the
+native rejection occurs before existing HTTP/relay callbacks. Do not claim
+complete transport-attempt SIEM coverage from the ordinary DLP event pipeline.
+
+Inspected WebSocket/WebRTC support remains the intended compatibility goal.
+Uninspected transports remain restricted until their content gates have their
+own actual receiver and bypass tests.