Ingressandpassivefingerprinting

Accept inbound traffic, read weak pre-handshake signals, set a prior, and never reject on the prior alone.

The gateway is an asyncio TCP/TLS proxy. Before a byte of application traffic moves, it can read GeoIP and ASN, a JA4/JA4S TLS fingerprint, an SSH HASSH, address reputation, and protocol quirks. All of that is real signal, and none of it is a verdict.

What comes out is a single number: a prior in [0,1] that sets where the session's risk score starts and how sensitively L2 will react to what happens next. A connection from a hosting ASN with a scanner-shaped TLS fingerprint starts warmer. It still gets a shell.

The reason is base rates. CGNAT puts thousands of unrelated users behind one address. Residential proxy networks rent out ordinary home connections. uTLS lets a client mimic any fingerprint it likes. Every one of those breaks the inference from identity to intent, and a system that blocks on the prior mostly blocks real users.

Takes

Raw TCP/TLS connection
Source address
Handshake bytes

Emits

PRIOR ∈ [0,1]
Fingerprint record
Session opened

Rules this layer holds to

Each of these is written down because relaxing it would be locally convenient and globally wrong.

L0 never rejects a connection because the passive fingerprint looks suspicious.

The prior sets a starting score and a sensitivity. It is never a conversion decision on its own.

Where this is uncertain

Pre-handshake signals are genuinely weak. Treating them as anything stronger than a prior is the mistake this layer exists to avoid.

Next · L1Universal sandboxing

All ten layers