[Feat/Infra]: Implement eBPF sockmap TCP Stream Splicing for Zero-Copy Kernel-Space Cross-Worker Redirection

Problem

When an upstream agent worker or automated inference cluster node encounters an infrastructure degradation, hardware fault, or 504 gateway timeout signature, traditional user-space reverse proxies handle connection interception and failure routing reactively. This requires reading the network packet byte streams out of the client socket descriptor, buffering them into user-space application memory chunks, and writing them down to a secondary fallback socket descriptor.

At extreme multi-gigabit line-rate traffic speeds (5,000+ connections/sec), this continuous user-to-kernel data-plane round-trip context switching introduces severe CPU instruction stalls, system memory bus locks, and noticeable garbage collection allocation spikes, running up tail latency variance and preventing sub-2ms failure masking.

Proposed Solution

Refactor the network ingress gateway connection routing engine inside internal/gateway/ to leverage Linux Kernel eBPF BPF_MAP_TYPE_SOCKMAP arrays and bpf_msg_redirect_hash helper primitives.

• Initialize and configure an accelerated kernel-level lookup map layout that natively links the ingress client TCP connection streams directly to healthy available downstream worker destinations inside the kernel socket memory tier.
• Implement an upstream failure signature parsing routine that instantly updates map indicators via the control plane when a degradation boundary is crossed.
• Upon failover execution, the eBPF layer dynamically splices the network traffic streams from the degraded client socket straight to the target worker destination buffer natively inside the kernel space, completely bypassing user-space runtime reading loops and executing socket hot-swapping under < 500 microseconds.

Alternatives

• Standard user-space asynchronous connection pooling driven via Go channels and mutex allocations, which provides robust execution isolation but remains fundamentally bounded by kernel-to-user memory copy performance overhead.
• Deploying heavy traditional Layer 7 service mesh proxies (such as standard Envoy or Istio sidecar filters), which introduce noticed integration friction, heavy configuration abstractions, and notice CPU scheduling overhead during scaling surges.

Use Case

Creates an undisputed technical performance boundary for high-throughput distributed agent pipelines, enabling fault-tolerant, line-rate failure recovery and connection hot-swapping natively inside the operating system layer without dropping a single active network connection frame or leaking context state data.

Additional Notes

This configuration must maintain complete structural alignment and compliance layers with the lock-free circular buffers and cache-line padding dimensions established under issue #6 and internal storage layout parameters definitions.

Start by inspecting internal/gateway/ and the lock-free circular-buffer and cache-line-padding definitions from issue #6. Determine how the existing ingress routing and failure handling work before evaluating the proposed Linux eBPF sockmap approach. Done would require an agreed design, implementation, and validation of the stated failover and latency goals, but this issue names no tests or concrete entry point.