Ouroboros Implementation Overview

This page gives an overview of what the Ouroboros prototype implements today. It follows the directory structure of the repository and, for each component, says what is there, what is partial and what is missing. It reflects the be branch at commit 2ae2baea (0.25.0 plus three commits, 8 October 2026). The to-do list lives on the kanban board. The road to a usable production version is long, and some big items, most prominently management of namespaces (ownership and scalability of service names), have not started.

Status words used below:

• done: implemented and exercised by unit or integration tests;
• partial: implemented with known gaps, listed next to it;
• missing: not implemented.

Library

src/lib builds three shared objects: libouroboros-common (shared-memory transport, crypto, hashing, serialisation, utilities), libouroboros-dev (the application API, FRCT and the points of attachment, compiled into one translation unit) and libouroboros-irm (the management API). Applications link -louroboros-dev; the irm tool links -louroboros-irm. Installed headers: cep.h, cdefs.h, dev.h, errno.h, fccntl.h, fqueue.h, ipcp.h, irm.h, name.h, proto.h, qos.h, version.h.

Application API

Six calls in dev.h: flow_alloc, flow_accept, flow_join, flow_dealloc, flow_read, flow_write. Manual pages: flow_alloc(3), flow_read(3), fccntl(3), fset(3), fqueue(3).

Function	Status	Notes
flow_alloc, flow_accept	done	Return a flow descriptor and write the negotiated QoS back. A NULL QoS means qos_raw. Authentication and encryption are set up by the IRMd (OAP, below) before the call returns. A stream service with loss > 0 is rejected.
flow_join	done	Joins a broadcast layer by layer name; always raw QoS.
flow_dealloc	done	Lingers until unacknowledged data is sent (FRCT linger flag), drains the transmit ring, then tells the IRMd.
flow_write	done	Raw flows: one packet per call, -EMSGSIZE above the MTU. FRCT flows: waits for the window; message flows fragment SDUs larger than the MTU (SDU-atomic); stream flows chunk.
flow_read	done	Partial reads unless FLOWFRNOPART is set; FRCT reassembles before delivery.
fccntl	done	Send and receive timeouts, flags, QoS spec, queue lengths, MTU, transmit queueing delay; FRCT flags, maximum SDU, stream ring size, minimum RTO. Not yet in fccntl(3): FLOWGMTU, FRCTSMAXSDU, FRCTSRRINGSZ, FRCTSRTOMIN and their getters.
fset, fqueue, fevent	done	Event types FLOW_PKT, FLOW_UP, FLOW_DOWN, FLOW_DEALLOC and FLOW_PEER (peer timed out). A flow belongs to at most one set; 32 sets per process. FLOW_PEER is not yet in fqueue(3); FLOW_ALLOC is declared but never raised.

QoS. A qosspec_t carries the service class (raw, message, stream), delay, bandwidth, availability, loss, bit error rate, maximum gap and peer timeout. Six presets exist: qos_raw, qos_raw_safe, qos_rt, qos_rt_safe, qos_msg and qos_stream; _safe adds an integrity check, rt favours latency over reliability. The library acts on four fields: service selects FRCT, loss > 0 disables retransmission, ber = 0 adds a CRC32 trailer, and timeout drives the keepalive. Delay, bandwidth, availability and max_gap only choose the QoS cube (best effort, video, voice) inside the IPCP. The CRC32 trailer is switched off at build time by default (QOS_DISABLE_CRC).

Error codes. Ouroboros adds ENOTALLOC, EIPCPTYPE, EIRMD, EIPCP, EIPCPSTATE, EFLOWDOWN, EFLOWPEER, ENAME, ECRYPT, EAUTH and EREPLAY to errno.

FRCT

The Flow and Retransmission Control Task is the end-to-end protocol in the library. It runs for every flow with a message or stream service. The 16-byte header carries flags, a CRC-16 header checksum, window, sequence number and acknowledgement number; stream packets add an 8-byte byte-range extension.

Feature	Status	Notes
Connection management	done	Delta-t style, no handshake: a data run flag on the first packet of a run, random initial sequence numbers rotated after inactivity, sender and receiver inactivity timers derived from MPL, A and R. FIN for teardown, linger on deallocation.
Acknowledgements	done	Delayed ACK (10 ms), ACKs piggybacked on data, SACK (up to 2048 blocks, MTU permitting), D-SACK for duplicates.
Loss recovery	done	RACK reorder window, tail loss probe, RFC 6582 style recovery, head-of-line retransmission on RTO. Integration-tested under loss, delay, duplication, reordering and corruption.
RTT and RTO	done	RFC 6298 estimator with the Linux deviation damping, Karn's rule, RTT probe packets, windowed minimum RTT over five minutes, exponential backoff bounded by the R timer. Minimum RTO about 1 ms, settable per flow.
Flow control	done	Receiver-advertised window, initial window of 128 packets, rendezvous when the window is closed.
Fragmentation and reassembly	done	SCTP-style first, middle and last flags; maximum reassembled SDU 1 MiB by default.
Stream service	done	Reliable ordered byte stream over a receive ring (1 MiB by default, up to 128 MiB). Tutorial 10.
Loss-tolerant ordered service	done	loss > 0: ordering and fragmentation without ACKs or retransmission.
Keepalive and peer liveness	done	When the QoS timeout is set; raises FLOW_PEER when the peer goes silent.
Integrity	done	CRC-16 header checksum always; CRC32 body trailer when ber = 0.
Statistics	done	About 70 counters per flow in the RIB under /tmp/ouroboros/proc.<pid> (PROC_FLOW_STATS, needs FUSE). Tutorial 08.
Timers	done	One hierarchical timer wheel per process, advanced from the API calls; no timer thread.
Congestion control	n/a	Not in FRCT by design; congestion avoidance lives in the unicast IPCP.

Gaps: retransmissions keep a heap copy of each packet, so that path is not zero-copy; an RTO that exceeds the R timer retries nothing (noted in the source).

Encryption

Needs OpenSSL 3.0 or later. Without it every crypto call returns -ENOTSUP and a sec.conf is refused. libgcrypt is optional and only backs hashing and random numbers.

Feature	Status	Notes
Data-plane ciphers	done	AEAD only: aes-128-gcm, aes-192-gcm, aes-256-gcm (default) and chacha20-poly1305. A 6-byte key selector travels as additional authenticated data; 12-byte nonce, 16-byte tag.
Key rotation	done	Per-flow HKDF tree: 128 node keys, per-direction leaf keys, one leaf per 2^20 packets; the selector holds a 4-bit epoch, 12-bit node and 32-bit sequence. Anti-replay window of 2048 packets. Lock-free key swap with liburcu, rwlock fallback.
Re-keying	done	Triggered by a packet-count watermark or by the IRMd's periodic re-key (every 120 s by default). The new seed comes from the IRMd; transmission switches once the peer is seen on the new key or after a grace period. Tutorial 07.
Key exchange	done	ECDH (prime256v1 by default, secp384r1, secp521r1, X25519, X448), FFDHE (2048, 3072, 4096), ML-KEM (512, 768, 1024) and the hybrids X25519MLKEM768, X448MLKEM1024, SecP256r1MLKEM768 and SecP384r1MLKEM1024. KEMs need OpenSSL 3.5.
KDF and digests	done	HKDF with sha256 (default), sha384, sha512, sha3-256, sha3-384, sha3-512, blake2b512 or blake2s256.
Secure memory	done	OpenSSL secure heap for key material, sized per process.

Flows between an application and its IPCP are never encrypted: encryption is end-to-end between the applications.

Authentication

Feature	Status	Notes
Certificates	done	X.509 from PEM or DER; trust anchors plus untrusted intermediates; chain verification, digitalSignature key usage, optional CA pinning, common-name check against the service name.
Signatures	done	Any OpenSSL key type: ECDSA, Ed25519 and Ed448, RSA, and with OpenSSL 3.5 the post-quantum ML-DSA and SLH-DSA. Classical keys sign with the configured digest; post-quantum keys bring their own.
Handshake	done	The exchange itself is OAP, in the IRMd (below).

Shared-memory transport

src/lib/ssm. Packets move between processes as offsets into POSIX shared memory; data is not copied as long as both sides use the same pool.

Component	Status	Notes
Packet pools	done	A global shared packet pool (about 60 MB, for root and the ouroboros group) and one per-user pool (about 7.5 MB) per unprivileged user. Nine size classes from 256 B to 1 MiB, four shards per class, robust mutexes, reclaim of orphaned buffers after 60 s. The IRMd creates the pools; the IPCP copies between pools where needed. Tutorial 01.
Ring buffers	done	One per flow endpoint, 1024 slots of pool offsets. Out-of-band flags for flow down, peer gone and re-key. A transmit queueing-delay limiter (10 ms target, settable) keeps a reserve for retransmissions.
Flow sets	done	Per-process event queues behind fevent; drops redundant packet events when full, never control events.

Points of attachment

src/lib/poa. A unicast or broadcast IPCP attaches to a lower network with irm ipcp poa attach; up to 16 per IPCP. The PoA code resolves peers, runs the flow request and reply through a 16-byte management message, carries the OAP handshake, and reads and writes the socket directly. A link monitor brings flows down and up with the interface.

PoA	Status	Notes
Ethernet	done	DIX framing, ethertype 0xA000 by default, 5-byte header (EID, length, CRC-8). Backends: AF_PACKET raw sockets on Linux, BPF on BSD and macOS, netmap as an opt-in. Peers are found with a broadcast name query. Integration-tested on veth pairs and loopback, including link failover. Tutorial 04.
UDP	done	IPv4 and IPv6, port 3435 by default, 4-byte EID header, path MTU from the kernel on Linux. Host names are resolved by the IRMd. Integration-tested, including encrypted flows over an impaired link. Tutorial 05.

Management API

irm.h, linked with -louroboros-irm. Every call is one request and reply to the IRMd over its Unix socket. IPCPs: create, destroy, bootstrap, enroll, connect, disconnect, list, set flags (transit). PoAs: attach, detach, list. Names: create (with a load-balancing policy and per-name security paths), destroy, list, register and unregister in a layer. Binding: bind and unbind a program (optionally auto-started) or a process to a name. Status: done. This is the API behind the irm tool, pyOuroboros and the configuration file.

Serialisation

protobuf-c messages define the control plane: model.proto (shared types), irm.proto (applications and IPCPs to the IRMd, 36 message codes), ipcp.proto (IRMd to IPCPs, 17 codes), ipcp_config.proto (bootstrap configuration), enroll.proto and cep.proto (connection establishment between IPCP components). Hand-written serialisers cover the hot paths. Hashes: SHA3-224, 256, 384 and 512 (also the directory hash), MD5, CRC-8, CRC-16, CRC-32 and CRC-64/NVMe with PCLMUL and PMULL acceleration.

Unit tests

src/lib/tests: authentication (ECDSA, ML-DSA, SLH-DSA), bitmap, B-tree, capacity estimator, ciphers, hashes, key exchange (DHE, ML-KEM and hybrids), key rotation, MD5, PoA addresses and frames, SHA3, sockets, time macros, thread pool, timer wheel. ssm/tests: pools, sharding, ring buffers, flow sets. crc/tests: known-answer vectors. dev.c, frct.c, irm.c and the PoA sockets have no unit tests; the integration suite covers them.

IRMd

src/irmd. The IPC Resource Manager daemon runs as root, one instance per system. Command line: --stdout (log to the terminal instead of syslog), --config <file>, --version. A systemd unit is installed when systemd is detected.

Component	Status	Notes
Lifecycle	done	Opens the socket (/var/run/ouroboros/irm.sock) and the global packet pool, starts a thread pool (8 to 64 threads), loads the trust store from /etc/ouroboros/security/cacert and untrusted, and starts the acceptor, the sanitizer (cleans up after dead processes) and the re-key worker. A stale instance's resources are cleaned at start. On shutdown it terminates applications first, then IPCPs, with SIGKILL after 30 s. SIGHUP shuts down; it does not reload the configuration.
Registry	done	Flows, IPCPs, names, processes, programs, per-user pools and spawned children under one lock. Flow states: init, alloc pending, accept pending, allocated, dealloc pending, deallocated.
Names and binding	done	A name is bound to processes (by pid) or to programs (by path). Load balancing per name: round-robin or spillover. Auto-instantiation: a program bound with auto is started when a flow arrives for its name and nobody is accepting. Per-name security paths. Tutorial 03.
Flow allocation	done	Direct IPC between two processes on the same host without any IPCP, falling back to the first IPCP whose directory knows the name. The flow owner's uid is tracked so that per-user pools stay separate. Flow join for broadcast layers by layer name.
PoA flows	done	Flows an IPCP allocates over its own points of attachment are brokered by the IRMd, so they get the same OAP handshake as application flows.
Re-key worker	done	Every 120 s it re-keys encrypted flows in batches of 64; collisions are resolved in favour of the initiator; direct flows re-key in-process.
Configuration file	partial	TOML (tomlc17); DISABLE_CONFIGFILE builds without it. Stanzas [name.<n>], [local.<ipcp>], [broadcast.<ipcp>], [unicast.<ipcp>]. Creates, bootstraps or enrols IPCPs, attaches PoAs, registers names, binds programs with autostart and connects to peers. Gaps: connections are only made on the enrol path, not after a bootstrap; no disconnect, unbind or destroy; the first error aborts the daemon.
Authorisation	partial	The socket is world-writable and management commands carry no uid check. Peer credentials are checked for process announcements and flow updates only.

OAP

The Ouroboros Allocation Protocol runs inside the IRMd on both sides of a flow allocation and travels as piggybacked data in the IPCP's flow request and reply. src/irmd/oap.

Feature	Status	Notes
Header	done	36-byte fixed part (128-bit id, 64-bit timestamp, cipher, KDF and digest identifiers, lengths), then certificate, key-exchange data, piggybacked data, response tag and signature.
Server authentication	done	Required by default on the client; the server's chain is verified and its common name must equal the service name.
Client authentication	done	Optional by default; auth=required in the server's sec.conf makes it mutual.
Key exchange	done	Ephemeral (EC)DHE, or a KEM with server-encapsulate (default) or client-encapsulate against a cached static server key. Cipher and KDF are negotiated upward only; downgrades are rejected.
Sealed responses	done	The server's certificate, data and signature are AEAD-sealed under a handshake key, hiding the server identity from the network.
Key confirmation	done	HKDF-derived tag checked in constant time; the session key is bound to the transcript.
Replay protection	done	20 s timestamp window, replay cache of 4096 ids per generation, fails closed when full.
Re-keying	done	Certificate-less signed OAP exchange inside a flow update, verified against the cached peer certificate.
Anonymous flows	done	No certificates and no sec.conf gives an unauthenticated, unencrypted flow.

The per-service security directories are /etc/ouroboros/security/server/<name>/ and client/<name>/, each with sec.conf, crt.pem and key.pem. sec.conf keys: kex, cipher, kdf, digest, kem_mode, auth, cacert and encryption=none. Tutorial 06 and Tutorial 07 show this in use.

Unit tests

reg/tests covers the registry objects, binding, waits and the flow state machine. oap/tests covers round trips for every suite, malformed input, downgrade attempts, replay, authentication failures, sealing and re-keying, with separate ML-DSA and ML-KEM tests. main.c, configfile.c and the IPCP RPC have no unit tests; the integration suite covers them.

IPCPs

src/ipcpd. There are three IPCP types: local, unicast and broadcast. Each is a separate binary (ipcpd-local, ipcpd-unicast, ipcpd-broadcast) spawned by the IRMd and implementing struct ipcp_ops.

Framework

ipcp.c provides the common machinery: the Unix socket to the IRMd, a thread pool (4 to 32 threads), the state machine (init, boot, operational, shutdown), the transit flag, PoA attach, detach and list, and the RIB. The RIB is a read-only FUSE file system under /tmp/ouroboros/<ipcp name> with info/ (state, type, layer), flow-allocator/ and dt.<addr>/ per-flow statistics (IPCP_FLOW_STATS), lsdb/ and dht/. Without FUSE the RIB is compiled out.

Common

Component	Status	Notes
Enrolment	partial	The enrollee opens an enrolment connection, receives the full layer configuration and the peer's clock, starts its components and acknowledges. The enrolment exchange itself carries no credentials; the flow it runs over can be authenticated and encrypted by the layer below, which is how Tutorial 06 authenticates joining IPCPs.
Connection manager	done	Accepts and allocates component connections (Data Transfer, Management, Enrolment) with a connection-establishment exchange (cep.proto) that checks protocol name, version and syntax. Raises connection up, down and delete notifications.

Local IPCP

Same-host loopback. It keeps a list of registered name hashes; a flow request is handed to the IRMd and the two endpoints are cross-linked; one packet loop moves packets between them, without copying inside one pool and with one copy across pools. MPL 50 ms, MTU 65000 bytes. No enrolment, connections or broadcast. Status: done.

Unicast IPCP

The full layer. Bootstrap parameters (irm ipcp bootstrap): hash (SHA3-224, 256, 384, 512), address size, EID size, maximum TTL, maximum RTT, routing (link_state, lfa, ecmp), DHT parameters (alpha, k, expiry, refresh, replication), congestion (none, mb-ecn), transit on or off, autobind. Tutorial 02.

Component	Status	Notes
Flow allocator (fa)	done	Flow request, reply, update (ECN feedback), heartbeat and acknowledgement messages; 64-bit random endpoint ids; piggybacked OAP data; relays IRMd flow updates for re-keying. Per-flow statistics in the RIB.
Data transfer (dt)	partial	16-byte header with the defaults: destination address, QoS cube, TTL, ECN, capacity code, EID. No source address. Forwards per QoS cube, decrements TTL, marks ECN from the egress queue, drops transit traffic when non-transit. By design it never fragments: fragmentation is end-to-end in FRCT, so the network does not repeat the IP fragmentation mistake. Gaps: the layer MTU is a fixed 1400 rather than derived from the path below, and forwarding uses the incoming flow's QoS cube rather than the header's.
Packet scheduler (psched)	done	Three QoS cubes (best effort, video, voice), two reader threads per cube, round-robin per flow with deadline-based pacing for congestion-controlled flows; real-time priorities outside containers.
Routing	partial	Link state: own-link origination with sequence numbers, flooding over management connections, full database sync to new neighbours, periodic refresh and timeout, Dijkstra with a hop-count metric. Variants: link_state (single next hop), lfa (loop-free alternates, switched in when a flow goes down), ecmp (equal-cost multipath, per-packet round-robin). Gaps: no link weights, no QoS-aware routing, one graph shared by all cubes.
Forwarding (pff)	done	A hash table per QoS cube with simple, alternate and multipath policies matching the routing variants.
Directory (dir)	partial	A Kademlia-style DHT keyed by name hash that stores the registering IPCP's address, with alpha, k, expiry, refresh and replication parameters, contact bootstrap from the enrolment peer, republish and replicate. Gaps: unregister is local only (remote copies expire), unresponsive contacts are not evicted, distance uses the first 64 bits of the hash.
Address authority	partial	Only flat: a random 32-bit address, no collision detection.
Congestion avoidance (ca)	done	none or mb-ecn: a rate-based controller with multi-bit ECN marking at every hop, the echoed mark averaged over a pricing window, a capacity code carried in each packet, slow start plus additive increase and proportional decrease, start-time fair queueing between flows sharing a path, heartbeat RTT samples. 64 unit tests, a shared-bottleneck simulation lab and 15 integration tests. Tutorial 09 and Tutorial 10.

Broadcast IPCP

Enrolment, the connection manager and a flooding forwarder. flow_join checks that the destination is the hash of the layer name and adds the flow as a neighbour; each packet is written to every neighbour except the one it came from; a non-transit IPCP only relays to and from joined applications. Status: partial. Gaps: no header, TTL or duplicate suppression, so the topology must be loop-free; packets are copied once per hop.

Unit tests

All IPCP unit tests are under unicast/: capacity codes, the congestion-avoidance façade, mb-ecn (64 tests plus the lab), the DHT (26), the forwarding table and the routing graph. local, broadcast and common have no unit tests and rely on the integration suite.

Tools

Tool	Status	Notes
irm	done	The administration CLI, main page Ouroboros Command Line Interface. irm ipcp {create, destroy, bootstrap, enroll, connect, disconnect, list, set, poa attach, poa detach, poa list}; irm name {create, destroy, register, unregister, list}; irm bind and irm unbind {program, process, ipcp}. Documented in ouroboros(8).
oping	done	Ping: count, duration, interval, flood and busy modes, QoS selection, packet size, per-packet timeout, quiet mode; RTT statistics and an out-of-order count. The server has polling and busy-poll modes.
oecho	done	Minimal echo client and server with the fixed name oecho.
ocbr	done	Constant-bit-rate generator: rate, size, duration, flood, sleep or spin pacing; QoS from the OCBR_QOS environment variable.
operf	done	Throughput test, unidirectional or bidirectional, with rate and size limits.
oftp	done	File transfer over a reliable stream flow with a CRC-64 check; FRCT minimum RTO and ring size tunable through environment variables.
obc	done	Broadcast test: join a broadcast layer and send or listen.
ovpn	partial	IP tunnel over a flow through a TUN device, Linux only; no TAP (Ethernet) mode.

The tools other than irm have no manual pages.

Build and platforms

CMake 3.19 or later, C89 with all warnings as errors. Build types: Release (default), Debug, DebugASan, DebugTSan, DebugLSan, DebugUSan, DebugAnalyzer. make check runs the unit tests, make sbom writes a CycloneDX 1.7 bill of materials, and checkbuild.sh sweeps compilers, build types and feature flags and enforces the 80-column limit. The full option list is on Ouroboros Build Parameters.

Dependency	Required	Provides	Switch
protobuf-c	yes	control-plane messages
OpenSSL 3.0	no	encryption, key exchange and signatures; 3.5 adds ML-KEM, ML-DSA and SLH-DSA	DISABLE_OPENSSL, DISABLE_ML, DISABLE_SLH
libgcrypt 1.7	no	hashing and random numbers	DISABLE_LIBGCRYPT
libfuse 2.6	no	the RIB and per-flow statistics	DISABLE_FUSE, IPCP_FLOW_STATS, PROC_FLOW_STATS
liburcu	no	lock-free key rotation (rwlock fallback)	DISABLE_LIBURCU
tomlc17	no	the IRMd configuration file	DISABLE_CONFIGFILE
raw sockets, BPF or netmap	no	the Ethernet point of attachment	DISABLE_RAW_SOCKETS, DISABLE_BPF, ENABLE_NETMAP
systemd	no	the service unit	SYSTEMD_INSTALL_FILES

Linux is the primary and best-tested platform; the integration suite runs on Linux. FreeBSD and macOS are supported in the code (BPF Ethernet backend, arc4random, Homebrew paths), but ovpn is Linux only. Shared-memory names use the prefix ouroboros and the RIB mounts under /tmp/ouroboros. Install layout: daemons and irm in sbin, the other tools in bin, headers in include/ouroboros, pkg-config files ouroboros-dev.pc and ouroboros-irm.pc, a CMake package, configuration and security directories under /etc/ouroboros, man pages in sections 3, 7 and 8.

Logging

Lines look like this:

==02067== irmd(II): Ouroboros IPC Resource Manager daemon started...
==02084== ipcpd/ipcp(II): Bootstrapping...

that is, ==<pid>== <component>(<level>): <message>. Levels: EE error, WW warning, II info, DB debug, PP protocol dump. Debug and protocol lines exist only in Debug builds, and the protocol dumps for OAP, the DHT, link state and enrolment have their own switches (DEBUG_PROTO_*). The daemons log to syslog by default; --stdout switches to the terminal, with colours. Lines about one OAP exchange carry a 64-bit id in brackets. A machine-parsable format is still to be done.

Programming language support

Language	Status	Notes
C	done	The native API.
Python 3	done	pyOuroboros: CFFI bindings for the flow API (Flow objects, fccntl, QoS presets, flow sets and event queues) and the management API (IPCPs, PoAs, names, bindings, configuration dataclasses), plus a mirror of the irm CLI. Python 3.8 or later, version-locked to the installed library. Used by Rumba and the integration suite.
Rust	unknown	OuroboRs is a separate project. It is not maintained by this project and has not been checked against the current API, which changes freely before 1.0.

Other tools

Project	Notes
Rumba	Python framework for defining recursive networks and running scripted experiments. It models unicast, broadcast and local layers, Ethernet and UDP links with delay, loss and rate, nodes with registrations and storyboards. Testbeds: local, localnet (bridges and veth with netem), nstb (one network and mount namespace per node, each with its own IRMd), Docker, Emulab and jFed. It drives the IRMd through pyOuroboros or through generated irm commands over SSH.
Ouroboros Metrics	oexport reads the RIB and pushes IPCP, flow allocator, link-state, DHT, data transfer, PoA and FRCT counters to InfluxDB 2, or to a line-protocol file; a Grafana dashboard is included.
Integration suite	pytest in a privileged Docker container built on Rumba and pyOuroboros: 38 files with 216 test functions across smoke, IPCP, flow, FRCT, security, congestion avoidance and per-user-pool groups. Runs one container per subsystem in parallel, with options for sanitizer builds, packet capture, endurance and time-series runs.
Style checker	o7s-style checks and fixes C, CMake, Dockerfile, man, Markdown, Python, shell and TOML files against the project style, and runs as an editor hook.

Not started

• Namespace management: ownership and scalability of service names.
• QoS-aware routing and link weights.
• A per-flow layer MTU derived from the path below.
• Authorisation of management commands on the IRMd socket.
• Piggybacking application data in the flow request.

Licenses

The library is LGPLv2.1, the IRMd and the IPCPs are GPLv2, and the tools are 3-clause BSD. The SBOM records the combined expression LGPL-2.1-only AND GPL-2.0-only AND BSD-3-Clause.