Sovereign Edge Intelligence

Zion can classify the origin of every request by IP — Italian government, Italian residential ISP, Italian datacenter, an EU-27 country baseline, and the EU role equivalents — and expose that as a log field, a metric label, and (optionally) a hard 403 deny. The classification data (CIDR → role) is baked into the binary from authoritative sources, so lookups are a lock-free binary search with no runtime dependency.

This is an opt-in feature: the classification tables are only compiled when you build with a geo-* feature, and even then Zion only classifies when [sovereign] enabled = true.

Build

Cargo feature	What it bakes in
geo-ita	Italian ASN-role table (GovIta / ResidentialIta / DatacenterIta).
geo-eu	Everything in geo-ita plus the EU-27 hybrid table: a country-level Eu baseline for every EU-27 allocation, overridden by curated GovEu / ResidentialEu / DatacenterEu roles where known.

cargo build --release --features geo-eu     # EU + Italy
cargo build --release --features geo-ita     # Italy only

With neither feature, classify() always returns Unknown and the whole subsystem is compiled out (zero cost).

Configuration

[sovereign]
enabled            = true      # master switch (default: false)
region             = "eu"      # "ita" | "eu" — labelling hint; both tables are
                               # always searched when compiled in
log_classification = true      # add ip_class to structured request logs (default: true)

# Optional: turn classification from a pure signal into a hard gate.
[sovereign.enforce]
enabled = true
deny    = ["unknown"]          # IpClass labels denied with 403. On a geo-eu
                               # build, ["unknown"] denies every non-EU source
                               # while EU classes pass — an allowlist BY COMPLEMENT.
# mesh_score_deny_above = 0.9  # deny when the AIMP mesh reputation exceeds this
                               # (0.0 = off; requires --features sovereign-aimp)

Classification is a signal by default — it only affects logs/metrics until you enable [sovereign.enforce]. The class labels used in deny are the snake-case IpClass names: gov_ita, residential_ita, datacenter_ita, eu, gov_eu, residential_eu, datacenter_eu, unknown.

Where the data comes from — and what keeps it honest

The tables are generated by scripts/generate_sovereign_data.py from two authoritative feeds:

• RIPE NCC delegated stats — IP allocations by country (the EU-27 baseline).
• IPtoASN (Team Cymru) — ASN → prefix mapping, for the curated ASN roles.

A weekly CI job (.github/workflows/sovereign-data.yml) regenerates them and opens a refresh PR. To regenerate by hand:

curl -sL https://ftp.ripe.net/pub/stats/ripencc/delegated-ripencc-latest -o ripe.txt
curl -sL https://iptoasn.com/data/ip2asn-v4.tsv.gz | gunzip > v4.tsv
curl -sL https://iptoasn.com/data/ip2asn-v6.tsv.gz | gunzip > v6.tsv
python3 scripts/generate_sovereign_data.py \
    --region ita --ripe ripe.txt --iptoasn v4.tsv --iptoasn6 v6.tsv \
    --output src/sovereign/data_ita.rs

The holder-validation guarantee

The curated ASN sets in the generator are not bare numbers with a comment — each ASN carries its expected holder as data, e.g. 3269: "Telecom Italia". Before emitting anything, the generator fetches each ASN's live holder from RIPEstat and compares it (accent- and case-insensitive, ignoring legal-form/noise words) to the expected name.

This closes a silent-wrongness hole: RIPE reassigns ASNs. When a curated ASN moves to a different — even foreign — holder, the old pipeline would diligently pull the new holder's ranges and re-label them with the Italian/EU role. The generator now fails closed on any such drift and refuses to regenerate; the weekly job's PR is blocked, not opened, and a human must either update the expected holder (a legitimate reassignment still in scope) or remove the ASN (reassigned out of national/EU sovereignty). --allow-drift overrides this for a deliberate one-off. The generated file header records the snapshot date the holders were validated on.

The offline matcher tests live in scripts/test_generate_sovereign_data.py (fixture-based, no network) and the pinned golden_classify_* tests in src/sovereign/mod.rs are a regression net for the classification itself.

What it guarantees

• Correct-and-small over wrong-and-big. An ASN that drifts to a foreign holder is removed rather than silently mislabelled — the classifier never claims a Russian or German range is Italian sovereign.
• Zero runtime cost when off (feature-gated tables, enabled = false).
• Signal first, gate second — enforcement is a separate, explicit opt-in.