SPL

Sovereign Packet Layer

SENTINEL data-plane boundary gateway · jurisdiction {{ primary }} · every packet classified, tokenized, policy-checked, logged

What this is: a sovereign overlay / policy gateway. At our boundary, every packet is classified DOMESTIC (stays on the private overlay, no public internet) or INTERNATIONAL (must exit through the gateway — tokenized, policy-checked, logged). Tokens are HMAC-SHA256 signed, scoped credentials bound to a jurisdiction; the signing key never leaves the data center, so a token is useless if it leaves.
What this is not: we cannot re-plumb the public internet or force foreign routers to honor our tokens. This operates only on infrastructure we own, and never touches, blocks, or reaches into anyone else's network.

Packets processed

Domestic (on-overlay)

International

Blocked at border

Packet decision ledger

Append-only SQLite ledger. Most recent first. Token verified = the minted token passes verification at its home gateway.

{% for r in rows %} {% else %} {% endfor %}

Route	Class	Decision	Payload & policy reason	Token
{{ r.src_region }} → {{ r.dst_region }} {{ r.tenant }} · {{ r.direction }}	{% if r.classification == 'DOMESTIC' %} domestic {% else %} intl {% endif %}	{% if r.decision == 'ALLOW' %}allow {% elif r.decision == 'INSPECT' %}inspect {% else %}block{% endif %}	{{ r.payload_summary }} {{ r.policy_reason }}	{% if r.token_jti %} {{ 'verified' if r.token_verified else 'fail' }} {{ r.token_jti[:8] }} {% else %} no token {% endif %}
Ledger empty. Run `python demo_seed.py` then reload.

How a packet travels

Domestic stays local; international is tokenized and inspected; blocked never crosses.

Domestic — stays on sovereign overlay, no public internet

{{ primary }} node

origin

——

Private overlay

owned fabric

——

{{ primary }} node

DOMESTIC token

International — must exit through the boundary gateway

{{ primary }} endpoint

origin

→

tokenize + policy + log

→

Foreign endpoint

INTERNATIONAL token

Blocked — refused at the border, logged with reason

Endpoint

origin

→

policy = BLOCK

Refused

no token issued

Sovereign isolation — live proof

A US-minted token, verified at home vs by a different leased tenant.

Cross-tenant token verification

verify @ {{ cross.issuer }} {{ 'valid' if cross.home_valid else 'fail' }}

verify @ tenant {{ cross.cross_tenant }} {{ 'valid' if cross.cross_valid else 'FAIL' }}

Different tenants sign with different keys, so a token that leaves its home infrastructure cannot be verified — it “rips up.”

Tenants & leases

Each leasing country runs a fully isolated instance with its own signing key, jurisdiction, and policy set.

{% for t in tenants %}

DC {{ t.dc_id }} · domestic {{ t.domestic_regions|join(', ') }}

{% for dst, pol in t.policy.items() %} {{ dst }}:{{ pol[0] }} {% endfor %} *:{{ t.default[0] }}

{% endfor %}

{{ primary }} sovereign overlay

Domestic nodes reachable without the public internet.

{% for n in overlay_nodes %}

{{ n.label }} · {{ n.node_id }}

{% endfor %}