MÓDULO HyperBridge.Art¶
Inline DUT validation tap — a commodity 1U appliance that slots between an upstream device and a TLS-inspecting middlebox, transparently forwards every packet at wire rate, AND feeds the SPAN.Art 6-pillar effectiveness framework without needing a switch SPAN session.
Function¶
HyperBridge.Art removes the SPAN-port dependency that previously blocked SOHO / MSP / compliance-locked / SPAN-exhausted customers from running the full SPAN.Art effectiveness framework. The appliance behaves as a transparent L2 bridge between two NIC ports, with vendor-specific hardware fail-to-wire (Silicom T1) or software fail-to-wire (Mellanox T2) protecting the operator's production traffic during forwarder service crashes.
Closes a large unreachable TAM segment compared with the prior alternative of $30k+ commercial packet brokers (Gigamon / Ixia / cPacket).
Status¶
| Phase | Scope | Status |
|---|---|---|
| HB-1 (PR #705, v3.7.0) | T3 lab tier — Linux bridge backend + AF_PACKET capture + heartbeat watchdog + audit log | ✅ |
| HB-1.6 / 1.7 / 1.8 (PR #705) | SPAN-1 forwarder + capture engine + IPFIX synthesizer to FLOW.Art | ✅ |
| HB-2 (PR #1025) | Driver HAL + registry + Silicom T1 HW-FTW driver | ✅ |
| HB-3 (PR #1026) | Mellanox T2 SW-FTW driver + watchdog DriverBypasser adapter | ✅ |
| HB-4 (PR #1027) | Dashboard bypass-event hash-chain viewer + driver info | ✅ |
| HB-5 (this PR) | Provisional patent Family D + customer datasheet + ADR-0036 → Accepted + module docs 3 langs + recovery memo | ✅ |
| Future | Napatech / Endace / BlueField drivers; mixed-mode (SPAN + inline) routing UI | ⏳ |
See ADR 0036 for the locked decisions and patent Family D draft for the IP posture.
Identity¶
| Element | Value |
|---|---|
| Plane | DATA |
| Internal code | pkg/hyperbridge-art/ |
| K8s namespace | oobi-fabric |
| OOBI slot | .260 (per canon) |
| Two binaries | hyperbridge-orchestrator (:9099, data path + status) + hyperbridge-watchdog (:9100, heartbeat + bypass control) |
| Tier label | hyperbridge.art/tier=T1|T2|T3 (DaemonSet nodeSelector) |
| Audit log | /var/log/hyperbridge/bypass-events.jsonl → dashboard hyperbridge_bypass_events table (HB-4) |
Hardware tier matrix¶
| Tier | Driver | NIC examples | Failover | Throughput | Production-ready |
|---|---|---|---|---|---|
| T1 production HW-FTW | silicom |
Silicom PE2G6BPI / PE3G6BPI / PE310G2BPI71 / PE325G2BPI | bp_lib ioctl 5–50 ms |
up to 100 Gbps | ✅ |
| T1 production HW-FTW | napatech |
Napatech NT40A01 / NT50 / NT100A01 SmartNIC | NTAPI ioctl 8–60 ms | up to 100 Gbps | ✅ |
| T1 forensic-grade HW-FTW | endace |
Endace DAG 10X4-S / DAG 100X | DAG dsapi ioctl 2–20 ms | up to 100 Gbps | ✅ |
| T2 software FTW | mellanox |
Mellanox ConnectX-5 / 6 / 6 Dx, Intel Fortville | Kernel bridge 200 ms–1 s | up to 100 Gbps | ✅ (non-critical paths) |
| T2+ DPU software FTW | bluefield |
NVIDIA BlueField-2 / BlueField-3 DPU | DPU-local kernel bridge (MVP); FW-custom HW-FTW future | up to 100 Gbps | ✅ (non-critical paths; needs NVIDIA NDA for HW-FTW) |
| T3 lab / test-bench | linuxbridge (default) |
Any dual-port NIC | None — link drops on crash | up to 10 Gbps | ❌ lab only |
Tier guard: both binaries check at startup that driver.Identify().Tier == cfg.Tier. Mismatch hard-stops. This catches "selected --driver=silicom but BridgeConfig.Tier is still T3" (would silently disable production audit) AND "stayed on default linuxbridge but config asked for T1" (would silently lose HW-FTW).
Operator controls¶
/admin/hyperbridge-art— config + live status, runtime driver selection/admin/hyperbridge-art/bypass-history(HB-4) — tamper-evident hash-chain timeline of every bypass engagement / recovery, filterable by tier / vendor / reason; "Verify chain" button re-walks the SHA-256 chain
Env vars¶
| Var | Default | Effect |
|---|---|---|
OOBI_AUTH_TOKEN |
(unset → fatal) | Bearer token for the HTTP listeners; lab mode bypass via --auth-lab-mode |
(orchestrator) --driver |
linuxbridge |
Driver registry lookup (linuxbridge / silicom / mellanox) |
(orchestrator) --silicom-bp-device |
/dev/silicom_bp |
Silicom bypass control device path (T1 only) |
(orchestrator) --mellanox-fallback-bridge |
hb-fallback0 |
Kernel bridge name created on SW-FTW activation (T2 only) |
(watchdog) --driver --port-a --port-b |
empty / empty / empty | When --driver is set, wires the driver into a DriverBypasser so missed heartbeats actually engage bypass. Empty --driver keeps the legacy LogOnlyBypasser (HB-1 behaviour) |
KALI_TTYD_PUBLIC_URL |
n/a | (Unrelated — KALI module) |
Bypass behaviour summary¶
| Trigger | T1 (silicom) | T2 (mellanox) | T3 (linuxbridge) |
|---|---|---|---|
| 3 consecutive missed heartbeats (300 ms grace) | bp_set_bypass_state(BYPASS) ioctl (5–50 ms) |
ip link add … type bridge → set master portA portB (200 ms–1 s) |
log-only audit entry |
| Recovery (10 s healthy hysteresis) | bp_set_bypass_state(NORMAL) ioctl |
ip link set nomaster portA portB → ip link del bridge |
log-only audit entry |
| SIGTERM | Engage HW bypass before exit (so upgrade does not drop traffic) | Engage kernel bridge before exit | log-only audit entry |
Every transition writes one JSON-Lines BypassEvent to /var/log/hyperbridge/bypass-events.jsonl. A small sidecar tailer POSTs each line to /api/hyperbridge-art/bypass-events for the HB-4 dashboard viewer.
Cross-MÓDULO consumers¶
- SPAN.Art (
pkg/span-collector/) — receivesPacketBatchJSON from HyperBridge's capture engine. Wire-format identical to switch-SPAN-fed ingest; downstream pillars (decryption-posture, canary-injector, fast-path-passive, dut-annex) work unchanged - FLOW.Art (slot .234 / .235) — receives IPFIX records synthesized from the capture stream (HB-1.8). Removes the need for the operator to enable NetFlow on the DUT itself
Patent posture¶
Patent Family D — Inline DUT Validation Tap via Bypass-Capable NIC with Integrated Effectiveness Measurement. Provisional draft at docs/patents/provisional-hyperbridge-inline-tap.md. FTO scan budget 6–8 hours (bypass-NIC space is crowded — Silicom 2003+, Gigamon, cPacket, Apcon, Ixia, NVIDIA BlueField); the novelty lever is the combination with the ADR 0035 6-pillar framework + the deployment-time tier guard, not the bypass primitive. Filing target 2026-Q4 (sequenced after Families B + C).
Customer trial¶
A 30-day proof-of-value 1U appliance is cheap enough to leave at customer site (vs $30k+ Gigamon). See the datasheet for the customer-facing one-pager.
Related¶
- ADR 0036 — Authoritative design (Accepted 2026-05-24)
- ADR 0024 — SPAN.Art parent (this MÓDULO is its T6 ingest)
- ADR 0034 — 3-way fusion correlator
- ADR 0035 — 6-pillar effectiveness framework
- ADR 0029 — sealed audit hash chain (consumes BypassEvent)
- Patent Family D draft
- Customer datasheet
pkg/hyperbridge-art/README.md— operator runbookk8s/oobi/95-hyperbridge-art.yaml— K8s DaemonSet + RBAC + NetworkPolicy- Memo —
discuss_hyperbridge_art_2026_05_13.md(strategic intent)