ghostroute_check

ai.tunnelmind/data · Verify this server

GhostRoute is TunnelMind's fourth lens: routing-integrity / sovereignty verification. It answers "is this infrastructure where it claims to be, owned by who it claims, routing where it says — and does that match the sovereign jurisdiction it asserts?" It resolves the originating ASN owner, RPKI validity, the certificate-issuing CA's jurisdiction, and matches the subject against a curated AI-infrastructure corpus to recover any sovereignty CLAIM (e.g. an "EU-sovereign" AI service), then scores reality against claim. Use this tool when: - An agent is about to route data/inference to an endpoint that claims a jurisdiction (e.g. EU data residency, FedRAMP, sovereign-AI). - You want to detect a US-fronted (Cloudflare/AWS/GCP) endpoint masquerading as sovereign-EU infrastructure, an RPKI-invalid origin (possible hijack), or a sanctioned operator. Inputs: - `entity` (path, required): an IPv4/IPv6, domain, ASN (AS####), or cert SHA-1/256. - `receipt` (query, optional): when `true`, issues a signed, persisted GhostRoute receipt (GR-YYYY-NNNNNNN) instead of an ephemeral verdict. Returns: - `sovereign_tier`: VERIFIED | PLAUSIBLE | MISMATCH | CRITICAL_MISMATCH (or null if no claim). - `sovereign_integrity`: [0,1] score; `origin_as`, `rpki_status`, `cert_ca`, `claimed_sovereign_zone`, `is_ai_infrastructure`, `ai_owner`, `sanctions_match`. - `_meta.caveats` / `_meta.penalties`: what was and wasn't determinable. Latency: - Typical 300-900ms on a cold subject (live BGP/RPKI/cert lookups), faster when cached.