Trust is the product

How the parts trust each other

1. Machine

   • Orgus Agent runs as the user, next to the agents
   • Ed25519 node key, owner-only file
   • Local ceilings the server cannot raise
   • One outbound connection

2. Hub

   • Signs every command it sends
   • Evaluates policy, budgets and approvals
   • Keeps the hash-chained audit log
   • Serves the console

3. People

   • GitHub, Google or Microsoft sign-in
   • Four roles, enforced on every route
   • Scoped API tokens for agents
   • Approvals from the console or a phone

Available today

• Watching is read-only

  Watching reads transcripts, git and the process table, and writes nothing into your repositories. Orgus changes a repository only when you ask, for a mission worktree or a landing.

• What the hub stores

  Everything here stays in the hub's own folder, ~/.orgus/hub/. Nothing is sent to us.

  Sent by each machine

  Session state: folder, first prompt and last reply (cut short), status, model, token and tool-call counts, what a waiting session asks, subagent descriptions, and each checkout's branch, last commit and changed files.

  Passes through

  Full transcripts and job output, when the console, a mission report or an agent you allowed asks for them. Not written to disk, except a short report per mission.

  Kept

  Machines, members and hashed tokens, the audit log, the activity feed, recent approval requests, policy, budgets, missions, Assistant conversations, files you attach, encrypted secrets and the cost ledger.

• Every machine has its own key

  Each machine makes an Ed25519 key pair and proves it on every connection. The private key never leaves the machine; a copied machine secret alone is refused.

• Signed, expiring commands

  Every command to a machine is signed, sequenced, single-use, bound to that connection and expires after 30 seconds.

• Hash-chained audit log

  Who, what, where, when and the result, for every action. Each entry carries the sha256 of the one before; orgus audit verify finds the first broken line offline.

• Machines dial out, and keep their own limits

  One outbound connection, so no open port. The owner can deny any action locally, and nothing the server sends can raise that ceiling.

• Policy and approvals before action

  Deny, ask or allow by tool, command and path, per org and per project; the defaults ask before network access. Unanswered requests are denied after 15 minutes unless you set another limit.

• Roles and scoped tokens

  Sign in with GitHub, Google or Microsoft under your rules. Owner, admin, operator and viewer on every route. API tokens are scoped, last at most 30 days and are stored hashed.

• Local by default

  A hub listens on 127.0.0.1 unless you choose otherwise. Sign-in is an HttpOnly, SameSite=Strict cookie, every change needs a CSRF header, and failed sign-ins are rate limited.

• Kill switches

  Freeze the org, pause one project, or require a minimum agent version. Stopping sessions still works while frozen, so an incident can be contained.

• Single sign-on

  Google Workspace or Microsoft Entra ID beside GitHub, restricted to your domains and tenants.

Planned

Designed, not shipped yet.

• Directory sync

  Members provisioned and removed from your Google or Microsoft directory.

  Planned

• Passkeys for high-risk actions

  Taking over a live terminal and other high-risk actions will ask for a passkey, in the console and on the phone.

  Planned

• Mutual TLS and hardware-backed keys

  Mutually authenticated TLS 1.3 between every machine and the server, with node keys in the operating system keystore where that needs no admin rights.

  Planned

• Content capture off by default

  Capturing prompts and tool output becomes a per-project opt-in with a retention limit. Today the hub relays transcripts and keeps only a short report per mission: see what the hub stores.

  Planned