EGRESS.

18 outbound destinations from production runtime. 5 not declared in the egress allowlist. 1 talks to a domain registered 14 days ago.

Most exfil paths start with a "harmless" outbound POST.

EG-014 · talks to telemetry-2.cdn-cache.io NEW DOMAIN

Domain registered 2025-10-30. Not in allowlist. 2.4MB sent.

Block at egress proxy, investigate origin, write IR memo.