• Decision: Intercept egress with an eBPF cgroup/connect4 transparent redirect to a pass-through L4 relay, and extract TLS keys passively via eBPF uprobes on the app's TLS library — no iptables, no TLS termination, no MITM CA.
• Reason: Works where iptables is forbidden; requires zero app changes; is cert-pinning-proof and never weakens the app's trust store; decrypts forward-secret TLS 1.3 via the app's own ephemeral secrets.
• Trade-off: Requires kernel ≥ 5.8 caps and per-libssl symbol/offset knowledge; reads app process memory; accepts a double TCP-stack traversal (no sockmap in MVP).
• Scope: Whole project (all features).
• Date: 2026-09-09
• Status: superseded by AD-010 (the redirect half stays eBPF; key extraction moves to an LD_PRELOAD interposer)