Architecture
SunLionet separates the data plane (sing-box) from the local control plane (detector → policy engine → optional bounded advisor). Two binaries cooperate: Inside (restricted networks) and Outside (stable networks) for curated delivery via trusted channels.
Planes
A strict separation keeps the tunnel simple and the decision logic auditable.
Network
Data plane
- sing-box runs the tunnel/outbound.
- Atomic reload applies new config without losing process state.
- No telemetry or external control channel required.
Local
Control plane
- Detector emits privacy-safe events (no domains, bounded buffer).
- Policy Engine resolves routine cases deterministically.
- Advisor is invoked only for ambiguous multi-signal cases.
Coordination
Distribution stays peer-to-peer to reduce blocking and central points of failure.
Delivery model
- Signal bundles: Outside → Inside signed + encrypted profile delivery.
- Offline mesh: Bluetooth / Wi‑Fi Direct for local transfer during partial outages.
- No central seed API: the website never hosts live proxy seeds.
Flow
Core loop: observe → decide → apply → measure.
Signals
Detector
Active probes + passive stats → event stream with jitter and budgets.
Deterministic
Policy engine
Scores and ranks profiles, applies switch/cooldown rules and diversity.
Apply
Supervisor
Generates config → atomic reload → updates health metrics.