# Proxy transport encryption research — 16 October 2026

Completed: 36 controlled lab trials, six successful paid-proxy HTTPS requests,
one unauthenticated live TLS handshake attempt, and a ten-page documentation
audit covering nine providers. Article: [article.html](article.html) or
[article.md](article.md). Funding and affiliate relationship are disclosed there.

## Main evidence

- `evidence/20261016T071406Z/`: complete main run, 36 synthetic PCAPs, exact
  executing source snapshots, manifests, versions and origin/proxy events.
- `analysis.json`, `lab-summary.csv`, `validation.json`: measured lab results.
- `live-results.json`, `live-validation.json`, `live-source-hashes.json`:
  redacted completed paid-proxy replication and separate TLS handshake outcome.
- `documentation-audit.json`, `source-index.json`: source-linked coding,
  short exact anchors, fetch dates and full-page hashes. Ten purposively selected
  pages, nine providers, not representative of the industry.
- `protocol.md`: initial method and dated amendments, including exclusions.
- `evidence/20261016T071322Z/`: excluded 12-trial development pilot.
- `evidence/20261016T071024Z/`: failed launch before trials, certificate file
  permissions. Initial failed live configuration is separately summarized in
  `live-excluded-configuration-error.json`. None are included in main totals.

The raw field `marker_in_client_response` means marker present anywhere in
stdout, including an exception. `analyze.py` parses the actual JSON response body
and origin events instead. Do not interpret a failed exception's echoed URL as
an origin response.

All public PCAPs contain **synthetic credentials only**. Real paid-proxy captures,
credentials, downloaded full source pages, temporary CA keys and response bodies
are in ignored `private/` and are excluded from the publication bundle.
`validate_live.py` needs those private inputs and cannot be rerun from the public
bundle. Its redacted validation output is supplied; this transparency limit is
intentional because publishing authentication captures exposes credentials.

## Reproduce the controlled experiment

Prerequisites: Docker access, Python, OpenSSL, and the pure Python packages below.
Do not add your user to a privileged Docker group merely to run this study.
Use an already authorized Docker environment.

```sh
python3 -m venv .venv
.venv/bin/pip install requests==2.32.3 urllib3==2.3.0 idna==3.10 certifi==2025.1.31 chardet==5.2.0
docker build -t fpt-proxy-encryption-reproduction .
FPT_LAB_IMAGE=fpt-proxy-encryption-reproduction .venv/bin/python prepare_lab.py
```

Run from this study directory. The preparation script generates fresh short-lived
fixture keys, snapshots its sources, and starts an isolated network-disabled
container with only NET_RAW added. It creates a new dated evidence directory;
never overwrite the original run. It does not change host trust stores, network
routing or VPN settings. No traffic leaves the local lab container.

The original run used an existing local observer image, content digest recorded
in its manifest. Its observer entrypoint was overridden and never executed. The
reproduction Dockerfile uses the same pinned Alpine base and installs only the
needed runtime; APK package versions may have changed. Consult `versions.json`
for the measured versions, and report any differences in replications.

To verify the **supplied original** captures and tables:

```sh
python3 analyze.py
```

The analyzer currently targets the original main-run directory explicitly. For
new runs, change its `RUN` path in your replication copy and save that change.
Do not silently merge new results into the original dataset.

`fetch_sources.py` archives full source pages privately. `build_audit.py` checks
that the chosen exact anchors occur in those archives. Public pages can change;
a fresh fetch may require a dated audit amendment rather than an unchanged claim.
The public package provides source hashes but not copyrighted full-page archives.

## Live scope and protections

The user reports the provider team authorized research use and supplied the credit
through an affiliate relationship. No support message was sent by this agent.
One purchased USA IPv4 endpoint was used, with renewal off. There were six valid
HTTPS GETs to the publisher's site and one unauthenticated TLS handshake probe.
Six earlier failed requests plus one failed setup probe are excluded. No scans,
load tests, VPN changes, schedules, publishing or external outreach were performed.

The live capture point was the container interface, before any possible host VPN
encapsulation. It establishes emitted proxy authentication bytes, not what an ISP
can see. Live origin receipt logs were unavailable. No TLS-to-proxy session was
established on the documented HTTP(S) port; no claim is made about alternatives.

`run_live.py` is supplied for review, but must not be run without an authorized
endpoint, private connection URI, verified documented ports and an authorized
HTTPS target. It has the measured ports and target in its source. Six requests
are bounded; no automatic provider order or account modification occurs.

## Publication

`publication.zip` contains an explicit allowlist of public files and the main
synthetic evidence. It excludes all private inputs, development runs and account
screenshots. The article is a reviewed local draft; nothing has been published.
Original measurements do not guarantee coverage or backlinks. A news pitch should
lead with the two encryption boundaries and reproduce the exact measured scope.