AI initialized opfilter with only the baseline rule before syncing managed policies, leaving MDM and user file-access rules unenforced until GUI interaction.

 let adapter = ESInboundAdapter(interactor: interactor)-adapter.start(initialRules: faaPolicy)+let server = XPCServer(interactor: interactor, adapter: adapter) -XPCClient.shared.onPolicyUpdate = { rules in-    adapter.updatePolicy(rules)+interactor.onEvent = { event in+    server.handleEvent(event) } -XPCClient.shared.onAllowlistUpdate = { entries in-    interactor.updateAllowlist(entries)-}+adapter.start(initialRules: server.mergedRules())+server.setMonitoringActive(true)+server.start()  dispatchMain()

+//+//  XPC server that exposes policy management to the GUI app.+//  Replaces the former DaemonXPCServer — opfilter is now the single+//  privileged process for both ES enforcement and GUI communication. //  import Foundation  private let dataDirectory = URL(fileURLWithPath: "/Library/Application Support/clearancekit") -final class DaemonXPCServer: NSObject {-    static let shared = DaemonXPCServer()-+final class XPCServer: NSObject {     private var listener: NSXPCListener?     private let lock = NSLock()     private var guiClients: [ObjectIdentifier: NSXPCConnection] = [:]-    private var filterClients: [ObjectIdentifier: NSXPCConnection] = [:]     private var monitoringActive = false-    private var opfilterVersion: String = ""     private var recentEvents: [FolderOpenEvent] = []     private var managedRules: [FAARule] = []     private var userRules: [FAARule] = []     private var xprotectEntries: [AllowlistEntry] = []     private var managedAllowlist: [AllowlistEntry] = []     private var userAllowlist: [AllowlistEntry] = []     private let maxHistoryCount = 1000-    private var database: Database!+    private let database: Database+    private let interactor: FilterInteractor+    private let adapter: ESInboundAdapter -    private override init() {-        super.init()-    }+    init(interactor: FilterInteractor, adapter: ESInboundAdapter) {+        self.interactor = interactor+        self.adapter = adapter+        self.database = Database(directory: dataDirectory) -    func start() {-        database = Database(directory: dataDirectory)         userRules = database.loadUserRules()         managedRules = ManagedPolicyLoader.load()         userAllowlist = database.loadUserAllowlist()         managedAllowlist = ManagedAllowlistLoader.load()         xprotectEntries = enumerateXProtectEntries()-        NSLog("DaemonXPCServer: Discovered %d XProtect allowlist entry/entries", xprotectEntries.count)-        // Both rule tiers must be loaded before the listener resumes so that-        // mergedPolicyData() is complete the moment the first filter client connects.-        listener = NSXPCListener(machServiceName: XPCConstants.daemonServiceName)+        NSLog("XPCServer: Discovered %d XProtect allowlist entry/entries", xprotectEntries.count)++        super.init()++        applyPolicyToFilter()+        applyAllowlistToFilter()+    }++    func start() {+        listener = NSXPCListener(machServiceName: XPCConstants.serviceName)         listener?.delegate = self         listener?.resume()-        NSLog("DaemonXPCServer: Listening on %@", XPCConstants.daemonServiceName)+        NSLog("XPCServer: Listening on %@", XPCConstants.serviceName)     } -    // MARK: - Client registration+    // MARK: - Direct filter integration -    fileprivate func addGUIClient(_ connection: NSXPCConnection) {+    func setMonitoringActive(_ active: Bool) {+        broadcastMonitoringStatus(active)+    }++    func handleEvent(_ event: FolderOpenEvent) {+        broadcastEvent(event)+    }++    // MARK: - Policy / allowlist assembly++    func mergedRules() -> [FAARule] {         lock.lock()-        guiClients[ObjectIdentifier(connection)] = connection

-//  Created by Craig J. Bass on 19/02/2026.-//--import Foundation--final class XPCClient: NSObject {-    static let shared = XPCClient()--    var onPolicyUpdate: (([FAARule]) -> Void)?-    var onAllowlistUpdate: (([AllowlistEntry]) -> Void)?--    private var connection: NSXPCConnection?-    private let reconnectInterval: TimeInterval = 5.0--    private override init() {-        super.init()-    }--    func start() {-        guard connection == nil else { return }--        let conn = NSXPCConnection(machServiceName: XPCConstants.daemonServiceName)--        let remoteInterface = NSXPCInterface(with: DaemonServiceProtocol.self)-        let allowedClasses = NSSet(array: [FolderOpenEvent.self, NSDate.self, NSString.self]) as! Set<AnyHashable>-        remoteInterface.setClasses(-            allowedClasses,-            for: #selector(DaemonServiceProtocol.reportEvent(_:)),-            argumentIndex: 0,-            ofReply: false-        )-        conn.remoteObjectInterface = remoteInterface--        conn.exportedInterface = NSXPCInterface(with: FilterClientProtocol.self)-        conn.exportedObject = self--        conn.invalidationHandler = { [weak self] in-            NSLog("XPCClient (opfilter): Connection to daemon invalidated")-            self?.handleDisconnection()-        }-        conn.interruptionHandler = { [weak self] in-            NSLog("XPCClient (opfilter): Connection to daemon interrupted")-            self?.handleDisconnection()-        }--        conn.resume()-        connection = conn-        NSLog("XPCClient (opfilter): Connecting to daemon at %@", XPCConstants.daemonServiceName)--        registerAndFetchPolicy()-    }--    func reportEvent(_ event: FolderOpenEvent) {-        guard let proxy = connection?.remoteObjectProxy as? DaemonServiceProtocol else { return }-        proxy.reportEvent(event)-    }--    func reportMonitoringStatus(_ isActive: Bool) {-        guard let proxy = connection?.remoteObjectProxy as? DaemonServiceProtocol else { return }-        proxy.reportMonitoringStatus(isActive)-    }--    private func handleDisconnection() {-        connection?.invalidate()-        connection = nil-        NSLog("XPCClient (opfilter): Connection lost, scheduling reconnect")-        scheduleReconnect()-    }--    private func scheduleReconnect() {-        DispatchQueue.main.asyncAfter(deadline: .now() + reconnectInterval) { [weak self] in-            self?.start()-        }-    }--    private func registerAndFetchPolicy() {-        guard let proxy = connection?.remoteObjectProxyWithErrorHandler({-            NSLog("XPCClient (opfilter): registerFilterClient error: %@", $0.localizedDescription)-        }) as? DaemonServiceProtocol else { return }--        // Daemon pushes current merged policy immediately after registration via policyUpdated(_:).-        proxy.registerFilterClient(BuildInfo.gitHash as NSString) { success in-            guard success else {-                NSLog("XPCClient (opfilter): Failed to register as filter client")-                return

 interactor.onEvent = { event in     server.handleEvent(event) }@@ -94,8 +90,9 @@ let initialRules = server.mergedRules() server.startJailAdapterIfEnabled() jailAdapter.startSweepTimer() adapter.start(initialRules: initialRules, onXProtectChanged: { server.handleXProtectChange() })-adapter.clearCache()-jailAdapter.clearCache()+server.applyPolicyToFilter()+server.applyAllowlistToFilter()+server.applyJailRulesToFilter()  let metricsLogger = Logger(subsystem: "uk.craigbass.clearancekit.metrics", category: "metrics") let metricsTimer = DispatchSource.makeTimerSource(queue: metricsQueue)