# S2 — launchd system domain

This surface covers the root-side launchd domain: 11 third-party daemon plists under `/Library/LaunchDaemons`, plus five non-`com.apple.*` registrations that do not have a local third-party plist. The resulting union is 16 items. Seven had a live PID at scan time: Docker vmnetd, NordVPN's helper and Threat Protection extension, Paragon extfsd, both OpenVPN helpers, and Tailscale's Network Extension.

⚠ The human-fired sudo capture was not present, so this is built from the unprivileged `launchctl print system` registry, which independently yielded the complete 16-label union for this run. ⚠ `systemextensionsctl list` returned an OS error unprivileged, and the NordVPN helper plist denied read access. Those rows are marked `unknown`; no secret value was exposed or recorded.

## What runs at root

Boot-loaded third-party services are Docker socket/vmnetd, Paragon's ExtFS loader, both OpenVPN helpers, Wireshark's BPF helper, and the Docker and OpenVPN services currently live. XPC/on-demand root helpers include CleanMyMac, Paragon extfsd, XQuartz, and Zoom. NordVPN's plist trigger is unknown because the plist is unreadable, but its helper is presently live. The two system extensions are app-managed registrations, not plist-backed launch daemons.

Three of the 15 non-`com.apple.*` system registrations are nevertheless Apple-owned: `com.vix.cron`, `org.cups.cupsd`, and `com.openssh.sshd`. The first two have matching `/System/Library/LaunchDaemons` plist names; SSH is defined in `ssh.plist` with Label `com.openssh.sshd`. All are idle. The remaining twelve registered labels are genuinely third-party, while `us.zoom.ZoomDaemon` is the sixteenth union item solely because its local plist exists.

`us.zoom.ZoomDaemon` is installed but not bootstrapped: its target binary exists, yet `launchctl print system/us.zoom.ZoomDaemon` says it cannot find the service. This is the clearest installed-but-not-loaded item. Paragon's loader is also worth attention: it is bootstrapped but idle after a concrete `EX_OSERR` (71), whereas its extfsd companion is live.

## Risk and disposition

| Item | Disposition | Reason / impact if disabled |
|---|---|---|
| com.docker.socket | keep | Docker Desktop's privileged local socket endpoint; Docker integration may fail. |
| com.docker.vmnetd | keep | Active VM networking daemon; Docker networking breaks. |
| com.macpaw.CleanMyMac5.Agent | investigate | Idle privileged CleanMyMac helper; disable only if the product is no longer wanted. |
| com.nordvpn.macos.helper | keep | Active NordVPN root helper; VPN control likely breaks. ⚠ Trigger unreadable. |
| com.paragon-software.extfs.loader | investigate | Exit 71 identifies a failed loader; investigate before keeping or pruning. |
| com.paragon-software.extfsd | keep | Active ExtFS daemon; mounted ExtFS volumes/features break if removed. |
| org.openvpn.client | keep | Active OpenVPN client agent; OpenVPN connections break. |
| org.openvpn.helper | keep | Active OpenVPN helper; OpenVPN connections break. |
| org.wireshark.ChmodBPF | investigate | Root BPF permission helper; packet capture setup breaks if removed. |
| org.xquartz.privileged_startx | keep | On-demand XQuartz helper; X11 startx flows break. |
| us.zoom.ZoomDaemon | investigate | Installed but not loaded; its Zoom updater/user helpers remain in S1. |
| com.vix.cron | keep | Apple BSD cron support; do not remove system content. |
| org.cups.cupsd | keep | Apple printing subsystem; manage printers in System Settings. |
| com.openssh.sshd | keep | Apple Remote Login service, currently idle; toggle Remote Login rather than removing it. |
| W5W395V82Y.com.nordvpn.macos.Shield | keep | Active Endpoint Security/Threat Protection extension; disabling loses that NordVPN protection feature. ⚠ Extension registry inaccessible. |
| NetworkExtension.io.tailscale.ipn.macsys.network-extension.1.98.9.101.98.9 | keep | Active Tailscale Network Extension; disabling breaks Tailscale tunnel networking. ⚠ Extension registry inaccessible. |

The security-sensitive subset is Docker's two privileged network services, NordVPN's helper and Endpoint Security extension, both OpenVPN root helpers, both Paragon filesystem components, Wireshark's BPF-permission helper, SSH, and Tailscale's Network Extension. The operational consequence of removing each is recorded row-by-row above; removal commands are documented in the inventory only and were not run.

There are two intentional vendor pairings rather than proven duplicates. Paragon has a boot loader plus a live filesystem daemon, with S1's notification agent/menu helper; the loader's failure makes it an investigation target, not a reason to delete the live daemon. Docker's root vmnetd/socket services pair with S1's `com.docker.helper`; CleanMyMac's root helper pairs with S1 menu/health services; XQuartz and Zoom each pair with their S1 launch agents. S1 contains no OpenVPN or NordVPN label in its inventory evidence.

## If removing third-party root services

Only remove a product after confirming Wolf no longer uses it, and use its vendor uninstall path where possible. A conservative order is: first the failed Paragon loader after checking ExtFS need; then idle CleanMyMac, Wireshark, XQuartz, and the not-loaded Zoom helper if those apps are unwanted; then the full Paragon ExtFS product; then OpenVPN, NordVPN (including its system extension), Tailscale, and Docker only when their respective network/container features are deliberately being retired. This ordering avoids first breaking active VPN, filesystem, container, or network-extension services. Apple cron, CUPS, and SSH are not candidates for deletion.

## Self-use answers

1. Root boot services are the RunAtLoad daemon rows: Docker socket/vmnetd, Paragon loader, both OpenVPN helpers, Wireshark ChmodBPF; their operation is independent of user login. The active live subset is Docker vmnetd and both OpenVPN helpers.
2. Apple-owned prefix exceptions are cron, CUPS, and SSH; all other scoped labels are third-party by their local plist, signed binary, or system-extension identity.
3. Zoom is installed but not loaded; Paragon's loader has an exit-71 failure. The other inactive rows are bootstrapped idle/on-demand services rather than missing files.
4. The security-sensitive services and feature-loss consequences are in the disposition table; NordVPN and Tailscale's app-owned extension state remains a named verification gap.
5. Paragon has two complementary services (loader plus filesystem daemon), not a proven duplicate; the loader's failure warrants investigation.
6. S1 companions are documented above: Docker, Paragon, CleanMyMac, XQuartz, and Zoom pair intentionally with GUI/user agents; S1 evidence contains no OpenVPN or NordVPN label.
7. The ordered third-party removal approach above maps every product family to the feature that would stop working; do not delete Apple-owned system services.