v1 scope promises:
Packaged as a standalone binary installable on macOS and Linux.
Linux is straightforward. macOS is where this gets expensive, and the document should say what mediation degrades to there.
- Network egress filtering needs a Network Extension. That means Apple Developer Program membership and the
com.apple.developer.networking.networkextension entitlement, which Apple grants on request rather than automatically. Without it there is no supported way to filter another process's traffic.
- Filesystem and process interception at the level the paper implies needs the Endpoint Security framework, which needs its own entitlement and, in practice, a case by case approval.
- Library interposition as a fallback is blocked for hardened runtime binaries and under SIP, so it is not a general answer.
- Distribution of the binary itself needs a Developer ID signature and notarisation, or every user meets Gatekeeper on first run.
sandbox-exec (Seatbelt) needs none of the above and is worth a look for exactly that reason, which ties into the separate Alternatives issue.
There is an organisational dimension too. The contributor resources page is honest that NC is pre sponsor and pre partnership. Apple Developer Program membership is a recurring cost with a named owner and a signing identity that has to live somewhere and be renewed. That is a small amount of money and a real amount of process, and it is the kind of thing that stalls a project six months in if nobody agreed to it up front. Issue #72 raises the same question for Scriptura, so the collective may want one answer covering both.
Related: how is fail closed actually guaranteed?
Fail-safe. If the gateway crashes, the agent fails closed. A broken mediator must never silently grant access.
If the gateway is a separate daemon and the agent holds its own file descriptors and its own network stack, the default when the daemon dies is fail open, not closed. Fail closed only comes for free when the restriction lives in the kernel and applies to the agent's process tree regardless of whether anything is listening.
Otherwise it depends on the agent noticing and refusing to continue, which makes the guarantee a property of the agent rather than of the gateway. Worth stating which it is, plus what happens to an in flight session when the daemon restarts, and whether a session resumes under the same policy or has to be re established.
What would help: a short platform support paragraph in v1 scope saying what is enforced on each platform and what is not, plus one sentence on the fail closed mechanism.
Raised during the public review window (closes 2026-09-19).
v1 scope promises:
Linux is straightforward. macOS is where this gets expensive, and the document should say what mediation degrades to there.
com.apple.developer.networking.networkextensionentitlement, which Apple grants on request rather than automatically. Without it there is no supported way to filter another process's traffic.sandbox-exec(Seatbelt) needs none of the above and is worth a look for exactly that reason, which ties into the separate Alternatives issue.There is an organisational dimension too. The contributor resources page is honest that NC is pre sponsor and pre partnership. Apple Developer Program membership is a recurring cost with a named owner and a signing identity that has to live somewhere and be renewed. That is a small amount of money and a real amount of process, and it is the kind of thing that stalls a project six months in if nobody agreed to it up front. Issue #72 raises the same question for Scriptura, so the collective may want one answer covering both.
Related: how is fail closed actually guaranteed?
If the gateway is a separate daemon and the agent holds its own file descriptors and its own network stack, the default when the daemon dies is fail open, not closed. Fail closed only comes for free when the restriction lives in the kernel and applies to the agent's process tree regardless of whether anything is listening.
Otherwise it depends on the agent noticing and refusing to continue, which makes the guarantee a property of the agent rather than of the gateway. Worth stating which it is, plus what happens to an in flight session when the daemon restarts, and whether a session resumes under the same policy or has to be re established.
What would help: a short platform support paragraph in v1 scope saying what is enforced on each platform and what is not, plus one sentence on the fail closed mechanism.
Raised during the public review window (closes 2026-09-19).