[FEATURE]: Build Non-Invasive Layer-4 Kernel Socket Shunting Engine Using eBPF sockmap Bypass Arrays

Problem

Traditional cloud observability tools like Middleware.io deploy heavy client-side userspace logging agents that run continuous thread reflection polling over system metrics [0.1.1, 1.5]. This approach creates massive CPU context-switching overhead and introduces microsecond processing tail latencies that choke real-time distributed workflow streams under concurrent traffic surges [1.5, 1.6].

Proposed Solution

Scaffold an ultra-low-overhead socket redirection micro-runtime engine under internal/kernel/shunter.go:

1. The eBPF Socket Map Interceptor: Inject a programmatic sk_msg kernel classifier to intercept raw ingress packet streams at the network interface layer without allocating heap objects in memory [1.5, 1.6].
2. Sub-1ms Hardware Socket Shunting: On catching transient connection closed trace signatures (tcp_set_state:TCP_CLOSE), hot-swap the active file descriptors directly inside the kernel transport layer, shifting bytes to a pre-warmed standby target under less than 1 millisecond flat [1.5, 1.6].

Use Case

Establishes clear product defensibility to venture evaluation bots. While application-layer wrappers audit faults reactively after memory drops hit, FaultPlane shields computational traffic lines actively inside the operating system [0.1.1, 1.5, 1.6].

Start by inspecting internal/kernel/shunter.go and the repository's existing kernel integration, if any. Define how the eBPF sk_msg interceptor, TCP_CLOSE handling, descriptor shunting, and sub-1ms target are to be validated; done requires the proposed runtime behavior rather than only a scaffold.