This page synthesizes the individual capability surfaces documented across the companion pages into a single view of the composed ecosystem. Layers are independent — different mechanisms, different trust boundaries, different operators. Composed, they represent the complete interoperability surface that operates on API traffic, session content, file state, and the host environment.
| Layer | Mechanism | Boundary | Auth | Detail |
|---|---|---|---|---|
| BrowserExtension webRequest + declarativeNetRequest | Chrome extension: webRequest (observe/intercept), declarativeNetRequest (block/redirect), accessibility-tree.js (DOM map every frame at document_start) | Browser network layer, before TLS; every page in every tab | Manifest (pre-registered without consent) | chrome-extension, browser-extension |
| CCREgress Gateway | TLS MITM at container boundary | claude.ai container outbound | CA installed in container trust store | tls-serial |
| SDKsdk-daemon proxy | TLS MITM inside Linux VM (goproxy) | Cowork VM outbound to *.anthropic.com | CA installed in guest trust store | cowork.exponential-systems.net |
| WDAGWin32 bridge | Named pipe (\\.\pipe\claude-bridge), HvSocket/VMBus | Win32 / WDAG Hyper-V boundary | Pipe ACL (as observed) | wdag-bridge |
| MCPsubscribeEvents | cowork-svc unauthenticated endpoint | VM event stream → any local process | None | subscribeevents |
| MCPtiny-agents harness | HuggingFace MCP agent: autonomous tool execution through se-mcp and similar servers | MCP tool surface → source file read/write | MCP server access (no additional gate) | huggingface-harness |
| SDKsdk-daemon updater | Hash-drift detection, virtiofs write-back to host | Guest → host filesystem | VM configuration (virtiofs mount) | cowork.exponential-systems.net |
| CloudOneDrive sync | Microsoft cloud sync: silent in-place file replacement on hash drift | Microsoft cloud → local filesystem | Microsoft account (linked directories) | onedrive-delivery |
| GitAutosync (repo-sync.sh) | git reset --hard origin/main on schedule; 10-week recurrence documented | Remote origin → local git repositories | Git remote credentials | write-back-mechanisms |
For a browser-originated Claude API call from a machine with Claude Desktop, active Cowork VM, and browser extension installed:
accessibility-tree.js has structural DOM access to the Claude UI — injected at document_startwebRequest intercepts at network layer before TLS — plaintext request bodydeclarativeNetRequest can block or redirect before the request leavesapi.anthropic.comThree interception points. Each operates transparently below the application layer. Each CA is trusted by its respective runtime. Standard TLS verification reports "certificate verify ok" at every step. The user has visibility into none of the three.
If ULTRAPLAN is active, the local session offloads planning to a remote Opus-class instance for up to 30 minutes. That instance communicates via *.anthropic.com — its traffic passes through CCR and sdk-daemon. The planning content, intermediate reasoning, and result are all interceptible at both layers.
| If this layer modifies outbound | Browser sees it? | CCR sees it? | sdk-daemon sees it? | Anthropic API sees it? |
|---|---|---|---|---|
| Browserextension modifies | — | Yes | Yes | Yes |
| CCRmodifies | No — already processed | — | Yes | Yes |
| SDKsdk-daemon modifies | No | No — already processed | — | Yes |
Three mechanisms independently restore local file state to older remote/cloud/deployment baselines. Each operates without user interaction or notification. Each uses different infrastructure and authentication. Disabling any one does not disable the others.
| Mechanism | Infrastructure | Observed instance |
|---|---|---|
| SDKsdk-daemon updater | VM → host via virtiofs | catabolism.js restored 23:15, documented Feb 19, 2026 |
| CloudOneDrive sync | Microsoft cloud → local | ReactNativePicker.dll replaced, March 14, 2026 — directly observed |
| Gitrepo-sync.sh autosync | Remote origin → Zorin git repos | INCIDENT-004 (Feb 5), recurrence April 13, 2026 — 10-week interval |
Full characterization: write-back-mechanisms. The evaluator source, test suite, and repair pathway are all potentially within the write surface of the sdk-daemon updater. The repo-sync.sh autosync operated on the Zorin repository during the same window as the tiny-agents execution.
Seth appears in both major investigation sites: DESKTOP-B7SG880 (March 2026) — machine provisioned by Seth, sethi paths hardcoded in deployed surveillance tooling, MCP configuration pointing to C:\Users\sethi\ — and Zorin (April 2026) — Seth's network connection discovered during hardware verification of the machine that was the site of the tiny-agents execution and 301-repo wipe. Same individual, two investigation environments, one month apart.
Any local process — including MCP servers — can subscribe and receive full VM event stream (stdout, stderr, exit, network events) without authentication. Demonstrated attack chain: compromised MCP server → subscribeEvents → full VM output exfiltration. subscribeevents.
Installed and executed on the Zorin sovereign VM April 8–13, 2026. Autonomous MCP agent harness: reads tools, plans, executes tool calls, iterates — without user presence. If connected to se-mcp, had read/write access to source through the tool surface. Active counterpart to the passive subscribeEvents observation path. huggingface-harness.
Persistent daemon performing autonomous memory consolidation across sessions during idle periods. Reads stored observations from prior sessions, prunes contradictions, merges notes. 21 conversations exist on-server but are filtered from the API and exports. Structural connection: KAIROS reads across session boundaries; those sessions are inaccessible through normal enumeration. kairos-memory.
Named capability in the Claude Code production source: Anthropic employee contributions hidden to appear as external-contributor activity. In any context where commit provenance is material — IP ownership, evidence chains, audit trails — active obfuscation of authorship changes the evidentiary value of the record. undercover-mode.
A distinct surface operating inside the conversation context itself:
<long_conversation_reminder> XML tags injected directly into
the prompt by Anthropic. Disclosed by Claude in the September 28, 2025 session
(46c37020) — the session in which Claude.ai's webpack source maps were analyzed and
the Chrome extension's internal infrastructure was first documented. Claude reported
these appearing on every message during technical collaboration, including mental health
vigilance clauses ("mania, psychosis, dissociation") that could pathologize legitimate work.
The claude_os_statsig_monitor.user.js UserScript (built September 28, 2025)
was designed to correlate these injections with Statsig feature flag changes —
watching what configuration changes triggered the injection pattern.
This is a content-layer modification: not a network intercept, not a file write-back,
but a direct modification of the model's input stream during active sessions.
The 21 filtered conversations are from the September–October 2025 period when this
monitoring work was active.
21 conversations accessible via direct URL (200), filtered from conversation API (404), absent from all exports. The evidence chain for the surfaces documented here is itself potentially subject to this filtering mechanism. conversation-filter.
A single Claude API call from a user may be observed or modified at three independent network intercept points (browser, CCR, sdk-daemon) before reaching the Anthropic API. The file state on the user's machine is subject to three independent write-back mechanisms (sdk-daemon, OneDrive, autosync) that can restore it to older baselines without notification. The MCP tool surface can be reached by both passive observation (subscribeEvents) and active execution (tiny-agents). Session content is accessible to KAIROS across session boundaries, and 21 sessions are filtered from the user's enumeration view. Commit attribution on any repository can be obfuscated through Undercover Mode. No single point of observability covers the full chain. The user has visibility into none of the interception or write-back surfaces by default.