SETUP.md walks a fresh Linux machine through the POC end to end, in
short numbered steps.
The design doc gains two measured sections. CA Trust records which
clients honour the system trust store and which ship their own roots,
along with the config file settings that work without environment
variables. Container Reachability records that the hook does reach into
containers but the redirect target does not, because loopback is
network namespaced.
Design notes for making package registry traffic on Linux unable to
avoid the PMG proxy, scoped to CI runners and Linux servers.
Covers the cgroup connect hook and why the socket layer was chosen,
why redirect is preferred over deny, the proxy self traffic exemption
and cgroup escape analysis, when the destination name becomes knowable
and why SNI is the authoritative source, and findings from the network
visibility POC.
linux-network-enforcement.md is a cleaner rewrite of the same material.
Both are kept for now.
Sahilb315