1
The Witness — eBPF Kernel Tap
Kernel-level raw packet observation at the tc hook (ingress + egress). Production traffic flows unchanged; only port-whitelisted packets are mirrored into a 1 MB ring buffer.
Out-of-Band Technical Judge
AI Agents Hallucinate. Packets Don't.
Rethink Digital Sovereignty. IronSovereign is the definitive Out-of-Band Technical Judge — extracting uncompromised forensic truth from raw network noise.
Zero production risk. Pure unadulterated sovereignty.
MIT open source · Pure Rust · fail-open by design · no inline risk
topology · live mirror
passive
production path untouched — mirrored bytes land in a 1 MB ring buffer
Don't Block. Observe.
Security tools traditionally sit in the data path — intercepting traffic, adding latency, introducing a new failure surface, and interfering with business flows. IronSovereign flips the model: observe everything out-of-band, touch nothing.
🛑
In-Band Interception
The legacy pattern. Every packet pays a toll — in latency, in risk, in uptime.
hover to see the damageThe Damage
- Latency on every packet, on every hop
- New single point of failure in the critical path
- Interferes with business traffic at the protocol level
- Fail-closed == production outage
⚖️
IronSovereign · Out-of-Band
A passive witness on the wire. It watches; it never stands in the way.
hover to see the freedomThe Freedom
- Never in the data path — zero added latency
- Port-whitelisted passive tap at the tc hook
- Dual-layer circuit breaker, fail-open by design
- Zero inline risk. Zero SPOF anxiety.
The Court of Network Truth
From raw kernel bytes to judicial-grade evidence — a chain of custody nobody can break.
click to zoom
tap → mirror → WAL → vault · every byte retraceable
2
The Evidence — 64-Byte WAL Contract
sovProbe commits every capture as a 64-byte header (Magic → Length → CRC32). Triple validation rejects dirty tails — no silent bad data, ever.
3
Chain of Custody — slimSync & LMDB Vault
Evidence ships via FastCDC-dedup + ChaCha20 encryption over Zenoh, sealed into sovVault's zero-copy LMDB with generational (epoch) isolation — physically separated from late packets and ghost data.
4
The Judge — Automated Technical Arbitration
AIs can lie; packets can't. sovVault's QR-pair matching reconstructs request/response truth from raw noise, feeding deterministic context to secure edge intelligence.
5
The Verdict — Forensic-Grade PCAP Export
Judicial-grade audit trail: WAL → PCAP offline decoding, orig_len vs incl_len faithfully reproduced, Wireshark-ready. Every byte retraceable.
11/11
WAL segments md5 byte-identical
64B
header contract
fail-open
circuit breaker
epoch
isolated LMDB
The Ecosystem Pipeline
One sovereign stack, from physical ground truth to edge intelligence — every layer feeding the next.
🗄️
↑
🧠
↑
↑
dockDB
The data engine layer — deploy, manage, monitor the databases that hold it all.
slimRAG
The edge AI consumer — LMDB-anchored RAG fed by deterministic packet context.
⚖️
🏗️
IronSovereign
you are hereThe arbiter of truth. Physical signals become tamper-proof, legal-grade evidence.
Build Ur Station / IronCurtain
The uncompromised local/APU hardware foundation — sovereign compute with zero public-cloud dependency.
AI agents can hallucinate. But when their context is anchored to ironSov's immutable packet truths, the hallucination gap is permanently closed.
Next in the pipeline
Next: slimRAG →
Feed deterministic packet truth into edge intelligence — the anchor that ends hallucination.
The Developer Playground
One command. Passive tap on. Evidence flowing. This is the whole pitch.
sovprobe@ironsovereign: ~
Fail-open by design: if the mirror channel ever faults, the breaker opens and production flows on — the judge goes silent, the court never blocks.
Physical ground truth, now open source.
No black boxes. Audit the tap, audit the WAL contract, audit the vault. Sovereign security you can hold in your hands.
×
IronSovereign Out-of-Band Architecture — tap → mirror → WAL → vault