Rover Mariner

Multipath routing intelligence

Rover Mariner

Mariner decides which path every flow takes, and keeps deciding. It probes the WAN paths you actually have, scores each one against what that class of traffic requires, and compiles the result straight into the forwarding path. Every decision is recorded with the reasoning that produced it.

Multipath Autonomous Routing Intelligence for Networked Encrypted Resilience

Fail-closed Per-flow decisions Multi-WAN Auditable reasoning

Talk about a deployment Runs on Datum

Four principles that decide the behaviour

Most path selection optimises. Mariner also refuses.

01

Fail-closed, never a silent downgrade

When no available path meets the compliance profile a sensitive class requires, Mariner queues or drops the traffic and raises an alert. It does not quietly move that traffic to a path that does not qualify, which is the failure mode that matters most and the one least likely to be noticed.

02

Envelopes are worst case, not average

A 30 ms path that spikes to 50 ms is treated as an 80 ms path. Planning against the average is how a link that looks healthy on a dashboard still breaks the application that depends on it.

03

Hysteresis by design

A marginally better path does not re-home an established flow. Path selection that chases every small improvement produces flapping, and flapping costs more than the improvement was worth.

04

Every decision carries its reasons

Each decision is logged with the full chain that produced it: which paths were considered, which were excluded, and why. That is an operations aid most of the time and the answer to an assessor the rest of it.

The interesting part of this picture is the arrow that is crossed out. A non-qualifying path is usually sitting right there, healthy and available, and taking it would keep the traffic flowing. Mariner queues and alerts instead, because a sensitive class quietly running over a path that does not qualify is a failure nobody notices until it matters.

Metered links

Traffic flow security that admits its own arithmetic

Constant cover traffic hides the shape of what you send. On a metered satellite link it also consumes the allowance: a steady 3 Mbps is roughly 972 GB a month, which does not fit inside a 1 TB bucket alongside the traffic you meant to send.

Mariner does not pretend otherwise. On failover to a metered link it relaxes the cover-traffic class explicitly and reports that it has done so, rather than silently spending the allowance or silently stopping. Bulk classes carry hard monthly caps for the same reason.

This is the pattern throughout: where a constraint cannot be engineered away, Mariner surfaces it as a decision you can see rather than absorbing it somewhere you cannot.

Shape of a deployment

Roles

Edge: On the CPE, including Rover Router
Boundary: Inline on the WAN links, where the decisions are enforced
Hub: One per failure domain
Core: Enrollment and telemetry, deliberately out of the packet path

Operating detail

Footprint: A single static binary, role chosen at start
Enrollment: Nodes dial out and authenticate with mTLS. No inbound listener on a node
Datapath: nftables verdict maps, or eBPF on a recent kernel
Paths: Fiber, carrier, cellular, and LEO satellite, each with its own cost model and envelope
Policy: Declarative, validated, and reloaded without a restart
Decisions: Sub-millisecond on compiled paths, with negligible added latency for established flows

Operator view

Observe

The live decision stream

What each policy is doing right now, on which path, in which class, and for what stated reason.

Atlas

Path risk scoring

Paths scored by the networks and countries they traverse, so the route a packet takes is a policy input rather than an assumption.

Map

Live topology

Boundary nodes, WAN legs, and current decisions drawn together, with risk carried in the colouring.

Policies

Edit and validate

Policies are checked before they are saved and applied without restarting the decision plane.