01 / Core Architecture & API
FastAPI App Factory & Lifespan
AEGIS utilizes a highly modular FastAPI app factory. On startup, it initializes the PostgreSQL async engine, the durable EventBus, the ResourceGovernor (for concurrency limits), and wires the MCP Gateway.
def create_app(settings: Settings | None = None) -> FastAPI:
app = FastAPI(title="AEGIS", version="0.1.0")
# Instantiate deterministic concurrency governor
governor = ResourceGovernor(
max_ai_calls=settings.max_concurrent_ai_calls,
max_tool_calls=settings.max_concurrent_tool_calls
)
app.state.governor = governor
# Attach durable PostgreSQL EventBus
engine = get_async_engine(settings.database.database_url)
app.state.event_bus = EventBus(get_async_session_factory(engine))
return app
The System Overview dashboard showing aggregate risk and real-time telemetry.
OpenAPI documentation generated by FastAPI.
JWT Auth & RESTful Routing
The REST API is secured via JWT Bearer tokens. Passwords are hashed with bcrypt. Routers are cleanly mounted by domain (e.g., /incidents, /missions, /policies).
async def login(payload: LoginRequest, session: AsyncSession = Depends(get_db_session)):
repo = UserRepository(session)
user = await repo.get_by_email(payload.email)
if not verify_password(payload.password, user.hashed_password):
raise HTTPException(status_code=401, detail="Invalid credentials")
token = create_access_token(subject=user.email)
return TokenOut(access_token=token)Real-Time Telemetry (SSE)
AEGIS avoids WebSocket complexity. It uses authenticated Server-Sent Events (SSE) to stream live mission updates and tool calls to the React frontend.
@router.get("/stream")
async def stream_updates(request: Request, current_user: User):
event_bus = request.app.state.event_bus
q = event_bus.attach_stream()
return StreamingResponse(
event_generator(request, q),
media_type="text/event-stream"
)
The Audit Log page actively consuming the SSE stream.
