harden macOS networking port

docs/MAC_OPERATOR_NOTES.md

@@ -0,0 +1,44 @@
+# Proxy God Mac Operator Notes
+
+## Launch
+
+Use `make run`, `run_mac.command`, or `open "Proxy God.app"`.
+
+The launcher chooses a Python runtime with Tk support. If Homebrew Python lacks
+`_tkinter`, it will use a Python.org or system Tk-capable runtime instead.
+
+## Networking Permissions
+
+Proxy God applies and clears macOS HTTP/HTTPS proxy settings with
+`networksetup`. If macOS requires elevated permission, the app uses the standard
+administrator prompt through `osascript`.
+
+## Removed Windows-Only Controls
+
+The Mac build intentionally does not expose:
+
+- Windows `netsh` firewall kill-switch
+- Windows registry Chrome/Edge WebRTC policy
+- Windows telemetry kill
+- Windows LAN broadcast lockdown
+- Windows MAC spoofing
+
+The equivalent Mac posture is loopback-only GOST, system proxy enforcement,
+DNS flush, hardened Firefox profile controls, chain exit verification, and
+health-triggered rotation.
+
+## Cleanup
+
+On stop or quit, the app terminates GOST and clears macOS system proxy settings.
+If a manual cleanup is ever needed:
+
+```sh
+networksetup -setwebproxystate "Wi-Fi" off
+networksetup -setsecurewebproxystate "Wi-Fi" off
+```
+
+Repeat for any active network service shown by:
+
+```sh
+networksetup -listallnetworkservices
+```