Connection paths
The watcher captures coding assistants by reading their transcript files and uploading
completed turns — it does not intercept traffic. Agent SDKs send their calls to the
gateway directly.
The watcher replaces the earlier mitmproxy approach — there is no local proxy, no TLS
interception, and no CA certificate to trust.
Network requirements
No inbound connections are required. No firewall rules to open.
Ingest
The watcher uploads todata.enfors.ai; the gateway enqueues its captured calls via its own
callback. Both land on the same ingest queue, where a backend worker reconstructs each turn
into a decision — internal backend processing, not a client connection.