tpt-argus

Zero-overhead, formally-verified distributed observability platform.

Named after the mythological giant with a hundred eyes — total, mathematically guaranteed system visibility.

tpt-argus replaces the fragmented Prometheus/Loki/Tempo stack with a unified, memory-safe Rust workspace that guarantees bounded memory usage, loop-free alerting logic, and seamless kernel-level auto-instrumentation (eBPF on Linux, ETW on Windows).

Architecture

                          ┌───────────────────────────────────────────────┐
                          │              tpt-argus workspace               │
                          │                                                │
    kernel / apps         │   ┌─────────────────┐    ┌───────────────────┐ │
    ┌───────────┐ eBPF/   │   │tpt-argus-probe  │    │  tpt-argus-logic  │ │
    │ syscalls, │ ETW ───▶│   │(Linux/Windows)  │───▶│ (verified alert   │ │
    │ net flows │         │   └─────────────────┘    │  DSL) compile() ──▶│ │
    └───────────┘         │        │                 │  verify:           │ │
                          │        ▼                 │   ├ loop-freedom   │ │
                          │   ┌─────────────────┐    │   └ contradiction- │ │
                          │   │tpt-argus-core   │◀───│     free (DAG)     │ │
                          │   │ (TSDB, P4)      │    └────────┬────────────┘ │
                          │   │ Count-Min      │    Metric  │ Verified      │
                          │   │ HLL            │    Sample  ▼ RuleSet       │
                          │   │ Parquet        │    └────────┘ .evaluate()  │
                          │   │ OTLP / Binary  │                               │
                          │   └───────┬────────┘                               │
                          │           │ HTTP / WebSocket                      │
                          │   ┌───────▼────────┐                              │
                          │   │tpt-argus-view  │  ◀── queries (P5)            │
                          │   │ (WASM)         │                              │
                          │   │ reactive       │                              │
                          │   │ dashboard      │                              │
                          │   └────────────────┘                              │
                          └───────────────────────────────────────────────────┘

Component status

All crates will publish under the tpt-argus-* prefix (per the project spec), but none have been published to crates.io yet — the workspace is still at its first, unreleased 0.1.0 across every crate.

Crate	Version	Status	Published
tpt-argus-logic	0.1.0	✅ DSL + verifier + codegen + proptest fuzz	no
tpt-argus-probe	0.1.0	✅ eBPF (Linux) + ETW (Windows) collector + macOS stub	no
tpt-argus-core	0.1.0	✅ CMS/HLL sketches, columnar store, Parquet, ingestion, server	no
tpt-argus-view	0.1.0	✅ Reactive WASM dashboard scaffold + components + pages	no

What "formally verified" means (v0.1.0)

tpt-argus-logic proves two static guarantees before any rule set runs:

1. Loop freedom — the rule dependency graph is checked to be a DAG (cycle detection). Evaluation therefore always terminates.
2. Contradiction freedom — a range/threshold-overlap analysis over rules observing the same signal proves no two declared-mutually-exclusive rules can both fire on the same value.

Out of scope for v0.1 (documented honestly in the crate docs): temporal / cross-window contradictions, contradictions between different metrics not linked by a derivation, and full SMT theorem proving. The overlap check is a sound, conservative over-approximation.

Building

# Whole workspace (Linux, macOS, Windows). tpt-argus-probe is a stub unless
# built with its platform feature below.
cargo test --workspace
cargo clippy --workspace --all-targets -- -D warnings

# Real eBPF probe (Linux / WSL2 / VM only):
cargo build -p tpt-argus-probe --features ebpf

# Real ETW probe (Windows only; enabling the kernel provider needs an
# elevated/Administrator process, otherwise it falls back to the stub):
cargo build -p tpt-argus-probe --features etw

# tpt-argus-core server (single-node binary protocol):
cargo run -p tpt-argus-core --bin argus-server -- --addr 127.0.0.1:9000

# tpt-argus-view (WASM) — built with Trunk (see crates/tpt-argus-view/Trunk.toml
# and build-wasm.sh / build-wasm.ps1). Produces a ready-to-serve dist/.
trunk build --release -p tpt-argus-view
# or, just verify the crate compiles to wasm32:
cargo build -p tpt-argus-view --target wasm32-unknown-unknown

See crates/tpt-argus-probe/README.md for the Linux (eBPF) and Windows (ETW) build/test story, and crates/tpt-argus-logic/README.md for the DSL quickstart.

Repository layout

crates/
  tpt-argus-logic/   verified alerting DSL + verifier + codegen              (v0.1.0)
  tpt-argus-probe/   eBPF (Linux) + ETW (Windows) collector / stub (macOS)   (v0.1.0)
  tpt-argus-core/    columnar TSDB + probabilistic sketches + server         (v0.1.0)
  tpt-argus-view/    WASM reactive dashboard + components                   (v0.1.0)

License

Licensed under either of MIT or Apache-2.0 at your option.