The One-Layer rule

Surfil intercepts each agent's traffic at exactly one point on your device, and never introduces a second. Every product is a stage inside that one interception layer - not a separate proxy stacked on top of another.

What it means

One install wires one adapter beside each agent, pointing it at a single local interception point.
Adding a product (Guard, Cap, Mind, …) adds a stage to that layer. It does not add a new hop, a new proxy, or a new place your traffic can be inspected.
There is one event spine and one Weave. Products coordinate through it instead of re-intercepting each other's output.

Why it matters

A second interception layer is where correctness and trust break. Two proxies can disagree about what a request was, double-count metering, or race on which one blocks a dangerous call. Worse, each extra hop is another place a prefix hash can be altered - breaking the provider cache and quietly raising your cost. One layer keeps interception byte-exact: the bytes the provider sees are the bytes your agent sent, so caching keeps working.

How it is enforced

The rule is checked in the runtime and in CI: passthrough must preserve provider prefix hashes exactly, and the interception path asserts the hash in tests. If a change would introduce a second layer or alter a passthrough byte, the build fails. It is an invariant, not a guideline.

Verify it yourself: run a session with and without Surfil and compare provider cache-hit rates. Byte-exact interception means they match. See The pipeline for how the stages share the one layer.

Practically, this is also why surfil uninstall can restore your configs byte-for-byte: there is only one thing to unwire.