max-network-modes

name	max-network-modes
description	Define, review, and apply the `learn` and `enforce` network modes for the MAX isolation project. Use when working on guest firewall rules, allowlists, connection logging, network classification, flow verification, or any change that affects what MAX may reach over the network.

Max Network Modes

Overview

Use this skill to keep network-control work consistent across the project.

Treat learn as evidence collection and classification. Treat enforce as strict default-deny with only approved destinations allowed.

Read references/modes.md when you need the exact classification rules, evidence standard, or expected outputs.

Workflow

1. Confirm the user flow under test.
2. Confirm the active mode: learn or enforce.
3. Keep voice and video out of scope unless the user explicitly expands scope.
4. Group observed traffic by purpose, not just by hostname.
5. Classify each destination as core, media, updates, telemetry, or unknown.
6. Only promote destinations into enforce after repeatable evidence shows they are required.

Learn Mode

Use learn mode when the project needs to discover what MAX tries to reach for:

• first login
• opening chats
• text messaging
• sending or receiving images
• sending or receiving files

In learn mode:

• prefer logging over blocking
• record DNS lookups and outbound connections
• tie observations to a specific user action
• re-run the same flow before marking a destination as required
• keep a clear list of what is still unknown

Do not treat "MAX contacted it once" as enough evidence to allow it permanently.

Enforce Mode

Use enforce mode when the project is ready to block everything except approved access.

In enforce mode:

• default to deny
• allow only destinations already justified by evidence
• allow core traffic first
• add media only if file and image flows require it
• keep updates, telemetry, and unknown blocked by default

If a required flow fails in enforce, move back to targeted learning for that flow instead of widening the rules blindly.

Rules

• Keep NAT networking unless the user explicitly changes the design.
• Keep VPN and proxy out of v1 unless the user reopens that decision.
• Keep calls out of scope for v1.
• Prefer categories and evidence tables over one long flat allowlist.
• Call out any change that weakens isolation for convenience.

Expected Outputs

When using this skill, produce one or more of these:

• a proposed learning plan for a specific flow
• a destination classification table
• an enforce candidate policy
• a short explanation of what remains unproven