Skip to content

Latest commit

 

History

History
22 lines (18 loc) · 1.03 KB

ARCHITECTURE.md

File metadata and controls

22 lines (18 loc) · 1.03 KB

Architecture

Layers (Onion Model)

  1. Firmware/Hardware → measured boot, TPM anchors, anti‑evil‑maid
  2. Bootloader/Kernel → signed kernel, IMA/EVM, lockdown
  3. OS/Privilege → immutable base (Nix), A/B atomic updates, ephemeral admin
  4. Apps → Flatpak/containers, portals, micro‑VMs for high‑risk
  5. Network → eBPF/XDP firewall, per‑app egress allowlists, DoH + DGA detection, WireGuard
  6. Identity/Cloud → passkeys/FIDO2, TPM‑sealed token vault, client‑side encrypted backups
  7. Human → Secure Action Advisor, phishing classifier, USB quarantine, SafeView

Aegis AI Stack

  • Watchtower: anomaly detection (syscalls, FIM, DNS, flows)
  • Sage: local LLM for explanations + policy recommendations
  • PolicyBrain: learns habits, suggests tighter policies

Data Flows

  • Event bus (auditd/eBPF) → Watchtower → Sage (explain) → Policy action (allow/deny/isolate) → User prompt

Update/Recovery

  • A/B updates, reproducible builds, cosign signatures
  • Read‑only recovery environment with firmware tools