IronSovereign Features
The out-of-band zero-trust platform — forensic-grade evidence with zero production risk
AI agents hallucinate. Packets don't.
1. Out-of-Band Observation
Never in the data path. Observe everything, touch nothing.
eBPF Kernel Tap
tc hook (ingress + egress) mirrors port-whitelisted packets into a 1 MB kernel ring buffer. Zero blocking, zero inline risk, zero SPOF.
Fail-Open Circuit Breaker
Dual-layer defense: hot-path queue watermark (>80%) + slow-path procfs sampling. Under pressure, Drop-Tail fail-open with automatic recovery — traffic never feels it.
2.1 MB Static Binary
~1.7k lines of Rust + eBPF C. Idle footprint: 36 MB RAM, <0.5% CPU. Single static binary, no runtime dependencies.
2. Forensic-Grade Evidence Chain
Every packet becomes a cryptographically committed, court-ready exhibit
64-Byte WAL Contract
Magic → Length → CRC32 triple validation rejects dirty tails. No silent bad data — the contract is standard across the pipeline.
LMDB Epoch Isolation
sovVault's zero-copy LMDB with generational (epoch) isolation physically seals off ghost packets from late ACK/RSTs — cross-generation contamination is impossible.
QR Pair Matching
A request/response pair exists from the moment the request is born. Slow, unmatched, and abnormal requests are never lost — every byte accounted for.
3. Automated Technical Judgment
Deterministic context for secure edge intelligence — from gateways to judicial systems
The Technical Judge
Physical network truth becomes the arbiter for AI context. When agents are anchored to immutable packet truths, the hallucination gap is permanently closed.
Secure AI Context
Uncompromised truth and secure AI context directly from raw network noise — the ultimate context engine for the Agent Swarm era.
MetaBind Fingerprinting
Protocol detection from magic_prefix + Shannon entropy + fixed headers — HTTP / TLS-SNI / DNS-qname / JSON — plus stable pseudo-keys for private binary protocols.
4. Verified on Real VMs
Data-driven, not marketing-driven
5. Zero Production Risk
Three iron proofs — the guarantees that make out-of-band the only sane choice
Pure Out-of-Band Tap
Never enters the production data path. Observes only — your traffic flows exactly as designed.
Fail-Open, Always
Degradation drops tail writes and auto-recovers. The probe fails open — it can never become the cause of an outage.
Quarantine, Not Block
Resource overflow triggers internal quarantine only — never an on-wire RST. Business traffic is never disturbed.