Network guard verification and test suite

Trust in software privacy cannot rely on marketing statements alone; it must be backed by verifiable architectural constraints. Oyma includes an automated network guard system backed by continuous integration test suites.

How the network guard enforces isolation

When Local-only mode is enabled, Oyma enforces two layers of network interception:

1. Renderer Process Interception: Monkey-patches native fetch, XMLHttpRequest, and WebSocket interfaces to immediately reject outbound calls before network dispatch.
2. Main Process Socket Interception: Overrides Electron/Node net session handlers, immediately aborting any HTTP/HTTPS requests originating from internal modules.

Outgoing Request Attempt
         │
         ▼
[Local-Only Mode Flag Active?]
       ├──► YES ──► [Immediate Abort Error: ERR_NETWORK_GUARD_BLOCKED]
       └──► NO  ──► [Dispatch to Egress Log for Real-Time Auditing]

Running the self-diagnostic test

In Settings › Privacy › Network Guard Diagnostics, click Run Verification Suite:

The diagnostic suite runs four automated security probes:

1. Public IP Ping: Attempts an HTTP request to https://1.1.1.1/dns-query.
2. Analytics Beacon Probe: Verifies telemetry endpoints reject payload transmission.
3. DNS Resolution Check: Asserts that background host lookups are suspended.
4. WebSocket Connection Probe: Attempts an external socket handshake.

All four probes must return BLOCKED (PASS) to confirm that your Mac remains completely isolated.

Related guides

• Mode setup in Local-only mode.
• Real-time ledger in Egress log.
• Air-gapped guide in Air-gapped Mac deployment protocol.