Argus 👁

OIDC identity provider for the AI governance ecosystem governed through Governance Hub. The hundred-eyed guardian: one never-sleeping watchman over every gateway.

Humans sign in once (password or GitHub) and every ecosystem product trusts the same identity. Agents (Hive agents, CI jobs, MCP connectors) get their own machine identities — owned by a human, scope-bounded, and revocable instantly via the kill switch.

GET  /.well-known/openid-configuration   discovery
GET  /jwks.json                          public signing keys
GET/POST /login, /register               interactive sessions
GET  /auth/github[/callback]             GitHub upstream login
GET/POST /authorize                      authorization + consent
POST /token                              authorization_code | refresh_token | client_credentials
GET  /userinfo                           human or agent profile from bearer token
POST /introspect                         RFC 7662 — honors agent kill switch instantly
GET  /health
POST /api/agents                         register an agent (session required)
GET  /api/agents                         list own agents
POST /api/agents/{id}/status             revoke / re-activate (kill switch)
POST /register-client                    RFC 7591 dynamic client registration

cargo run --release -- argus.toml
# → http://127.0.0.1:8443

cargo test   # e2e: register→login→authorize(PKCE)→consent→token→userinfo,
             #      agent lifecycle incl. kill-switch introspection flip

• Passwords + agent secrets: Argon2id, constant-time compares everywhere.
• /register-client creates public clients only (token_endpoint_auth_method=none), restricts redirect URIs to HTTPS or localhost, and limits scopes to the OIDC set.
• PKCE S256 enforced whenever a challenge is present; exact-match redirect URIs.
• CSRF double-submit on all forms; session cookies HttpOnly/SameSite=Lax.
• Agent tokens carry ≤15-min TTLs; /introspect refuses revoked agents even with unexpired JWTs — resource servers get instant revocation without key rotation.
• Security headers on every response (nosniff, DENY, HSTS).

See deploy/ — hardened systemd unit + nginx vhost template (TLS at id.rajeev.me). Put secrets in /etc/argus/env (GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET).