Under what circumstances does the framework trigger the start connection?

Note — This answer for the VPN Services only

The Knox framework queries the state of the VPN profile. If the state of the VPN profile is either idle or failed, then the framework triggers the start connection. This usually happens after the network comes up.