TPT Open Source

tpt-argus

Rust

Zero-overhead, formally verified observability platform in Rust. A DSL compiles alerting rules to provably contradiction-free, loop-free Rust — no alert storms — paired with a Linux eBPF collector. No runtime interpreter, no unverified rule logic.

0 stars0 forks0 watchers
View on GitHub

Languages

Rust100.0%
README

tpt-argus

Zero-overhead, formally-verified distributed observability platform.

Named after the mythological giant with a hundred eyes — total, mathematically guaranteed system visibility.

tpt-argus replaces the fragmented Prometheus/Loki/Tempo stack with a unified, memory-safe Rust workspace that guarantees bounded memory usage, loop-free alerting logic, and seamless eBPF-based auto-instrumentation.

Architecture

                         ┌─────────────────────────────────────────────┐
                         │              tpt-argus workspace              │
                         │                                               │
   kernel / apps         │   ┌──────────┐    ┌──────────────────────┐    │
   ┌───────────┐  eBPF   │   │argus-    │    │   argus-logic        │    │
   │ syscalls, │────────▶│   │ probe    │───▶│ (verified alert DSL) │    │
   │ net flows │         │   │ (Linux)  │    │  compile() ─▶ verify │    │
   └───────────┘         │   └──────────┘    │   ├ loop-freedom (DAG)│    │
                         │        │          │   └ contradiction-free │    │
                         │        ▼          └───────────┬──────────┘    │
                         │   ┌──────────┐    ┌──────────┐│                │
                         │   │argus-    │◀───│ Metric   ││  VerifiedRuleSet
                         │   │ core     │    │ Sample   │▼  .evaluate()    │
                         │   │(TSDB,     │    └──────────┘                 │
                         │   │ P2)      │                                │
                         │   └──────────┘                                │
                         │   ┌──────────┐                                │
                         │   │argus-    │  ◀── queries (P3)              │
                         │   │ view     │                                │
                         │   │ (WASM)   │                                │
                         │   └──────────┘                                │
                         └─────────────────────────────────────────────┘

Component status

Crate naming: the bare names argus-logic / argus-probe are the preferred publish targets. The crates.io namespace already contains several unrelated argus-* crates, so if either bare name is taken at publish time we will fall back to the tpt-argus-* prefix (per the project spec) rather than squatting or colliding. Cargo.toml of consumers would then use tpt-argus-logic / tpt-argus-probe.

CratePhaseStatus (v0.1.0)Published
argus-logic1✅ Full DSL, verifier (loop + contradiction), codegen, testsyes
argus-probe1✅ Linux eBPF collector + off-Linux no-op stubyes (Linux)
argus-core2🚧 Stub only (columnar TSDB lands later)no
argus-view3🚧 Stub only (WASM dashboard lands later)no

What "formally verified" means (v0.1.0)

argus-logic proves two static guarantees before any rule set runs:

  1. Loop freedom — the rule dependency graph is checked to be a DAG (cycle detection). Evaluation therefore always terminates.
  2. Contradiction freedom — a range/threshold-overlap analysis over rules observing the same signal proves no two declared-mutually-exclusive rules can both fire on the same value.

Out of scope for v0.1 (documented honestly in the crate docs): temporal / cross-window contradictions, contradictions between different metrics not linked by a derivation, and full SMT theorem proving. The overlap check is a sound, conservative over-approximation.

Building

# Whole workspace (Linux, macOS, Windows). argus-probe is a stub off-Linux.
cargo test --workspace
cargo clippy --workspace --all-targets -- -D warnings

# Real eBPF probe (Linux / WSL2 / VM only):
cargo build -p argus-probe --features ebpf

See crates/argus-probe/README.md for the Linux-only build/test story, and crates/argus-logic/README.md for the DSL quickstart.

Repository layout

crates/
  argus-logic/   verified alerting DSL + verifier + codegen
  argus-probe/   eBPF collector (Linux) / stub (others)
  argus-core/    columnar TSDB (stub in v0.1)
  argus-view/    WASM dashboard (stub in v0.1)

License

Licensed under either of MIT or Apache-2.0 at your option.