> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blackops.army/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy enforcement

> What happens at session start, during a session, and at session end  the runtime view of how the four layers operate together.

## The session lifecycle

Every privacy guarantee BlackOps OS makes is bounded by a session. This is what actually happens from the moment one starts to the moment it ends.

<Steps>
  <Step title="Identity resets">
    A fresh identity context is generated. Cookies, local storage, MAC address,
    hostname, locale, timezone, NTP source, DNS resolver the entire
    client-distinguishable surface is wiped clean. Nothing from prior sessions
    is reachable from inside this one.
  </Step>

  <Step title="Routing comes online">
    The routing layer is brought up before any process can reach the network.
    Until it is healthy, all outbound traffic is dropped at the kernel boundary.
    There is no clear-net fallback. Apps that try to bind to a non-managed
    interface fail.
  </Step>

  <Step title="Apps launch inside sandboxes">
    Each app starts in its own confined environment with a private filesystem
    root and explicit IPC boundaries. No app can read state owned by another.
    The browser, wallet, and messenger are each their own sandbox the session is
    what ties them together, not shared memory.
  </Step>

  <Step title="Everything shares one session">
    Messenger and the wallet do not have separate identity contexts or routing
    paths. They run behind the same routing layer, scoped to the same session
    identity. There is no second privacy surface to configure separately.
  </Step>

  <Step title="Session ends  everything is wiped">
    Closing the session triggers a full teardown. Storage areas are unmounted
    and zeroed. The routing identity is rotated. In-memory secrets are
    overwritten. The next session starts from a clean state with no carryover.
  </Step>
</Steps>

## What an observer sees

<CardGroup cols={2}>
  <Card title="Single session" icon="user">
    Looks like activity from a fresh, unrelated client. IP, MAC, hostname,
    fingerprint none of them match anything from a prior session.
  </Card>

  <Card title="Two sessions, same user" icon="users">
    Look like activity from two completely unrelated clients. There is no
    persistent signal connecting them on any surface the OS controls.
  </Card>
</CardGroup>

<Warning>
  This holds only as long as the user does not voluntarily link sessions.
  Logging into a personal account ties that session to that account for its
  duration. The OS does not retroactively unlink.
</Warning>

## What you do not configure

There is no privacy mode toggle because there is no non-private mode. The enforcement is the system.

* No per-app privacy settings to remember to enable
* No "connect" step for routing
* No "new private window" for identity isolation

Where settings exist, they govern **preference** which exit region to use, which wallet to default to not whether enforcement is active.

## Boundaries

The enforcement layers protect the system from below the application layer. They do not:

* Police what an app voluntarily discloses over the network
* Change the privacy posture of services on the other end of a connection
* Eliminate behavior-level correlation across sessions by the same user

## Continue from here

<CardGroup cols={2}>
  <Card title="Session model" icon="arrows-rotate" href="/architecture/session-model">
    The formal specification: states, transitions, what persists, and what is
    wiped.
  </Card>

  <Card title="Threat model" icon="bullseye" href="/architecture/threat-model">
    Adversaries the enforcement layer is designed to defeat and those it is not.
  </Card>
</CardGroup>