RDIE is a deterministic C++17 userspace model for validated security-flow decisions. It maintains bounded endpoint and session state, scores risk with integer arithmetic, requests endpoint transitions and one ONB domain, checks simulated INE authorization and abstract TME epoch state, and emits stable decision records. Milestone 2 adds bounded restart-safe snapshots, Milestone 3 defines one engine-owned serialization boundary, and Milestone 4 adds synchronous bounded event admission with explicit overload and replay outcomes.
This milestone does not capture or redirect packets, modify host networking, implement encryption, migrate TCP sessions, or provide deployed enforcement. It is not production ready. Addresses are validated and retained as strings for this userspace milestone; they are not a final packet-processing representation.
No dependency is downloaded during configuration.
cmake -S . -B build/debug -DCMAKE_BUILD_TYPE=Debug
cmake --build build/debug --parallel
ctest --test-dir build/debug --output-on-failure
./build/debug/rdie_replaySanitizers may be enabled with -DRDIE_ENABLE_ASAN=ON -DRDIE_ENABLE_UBSAN=ON. ThreadSanitizer uses a separate build with -DRDIE_ENABLE_TSAN=ON; it cannot be combined with ASan/UBSan. GCC and Clang-family compilers are supported. Strict warnings include -Wall -Wextra -Wpedantic -Wconversion -Wsign-conversion -Wshadow.
DecisionEngine::process, recover, and restore operations are thread-safe mutations serialized by one non-reentrant engine mutex. Lock acceptance order is the observable mutation order. That provides state safety and a replayable accepted order, but it does not claim cross-run semantic ordering for intrinsically simultaneous calls that have no caller-defined order. Callers requiring cross-run ordering must submit operations in a deterministic order using their validated event/order metadata.
endpoint returns a value copy. capture_state returns an immutable state value. They observe either the complete state before a mutation or the complete state after it. checkpoint captures one complete state under the engine lock and performs serialization/file I/O after releasing it. restore_from loads and parses temporary bytes before taking exclusive mutation authority for the atomic replacement. APIs are non-reentrant. The injected synchronous TME/ONB/INE interfaces execute under the mutation lock; their contract forbids callbacks into the engine, blocking work, or independent concurrent mutation. The injected journal must likewise not be independently accessed or mutated concurrently while attached to an engine; journal inspection is safe after engine operations have quiesced.
DecisionEngine::admit synchronously validates and serializes one event. Its typed result distinguishes accepted events, exact replay, conflicting identity reuse, invalid/stale input, unsupported schema, bounded-capacity exhaustion, and safe internal failure. process remains the compatibility wrapper that returns the embedded decision. There is no RDIE transport queue: a caller receives a result before the call returns, and ANIMAL or another upstream transport owns retry policy.
Event tokens (event, endpoint, flow, session, application, and optional identity) are limited to 128 bytes each; IP address strings are limited to 64 bytes each. The dependency-free canonical event correlation is limited to 1024 bytes. It is deterministic correlation data, not authentication. Exact replay and conflicting reuse are rejected without changing endpoint, session, journal, or replay state. Accepted correlations persist in schema-v2 snapshots; schema-v1 files fail closed as unsupported because they do not contain enough information to distinguish exact from conflicting replay.
RDIE owns the deterministic decision/control plane. Packet forwarding, encryption, transport, and enforcement are external responsibilities, including during later integration milestones. Laboratory network adapters and dissertation experiments live separately in rdie-research, with RDIE pinned by commit; they are experimental apparatus, not RDIE enforcement.
- Event validation and stable value types
- Bounded endpoint and session state
- Deterministic integer classifier with decay and hysteresis
- Explicit endpoint state machine
- Deterministic ONB domain-assignment model
- Fail-closed INE authorization model (no encryption)
- Abstract deterministic TME epoch validator (no cryptography)
- Explicit simulated recovery authorization
- Bounded journal and stable text serialization
- Complete decision-engine orchestration and embedded replay
- Versioned canonical snapshots with fail-closed atomic restore
- Explicit file checkpoint/startup boundary with corruption detection
- Single-writer mutation serialization and complete-state reader snapshots
- Bounded synchronous admission with explicit replay, conflict, and overload results
See Milestone 0, Milestone 2 persistence, Milestone 3 concurrency, Milestone 4 ingress, the threat model, and the validation matrix. License selection is pending; no license has been added or changed.