# Aegis Developer Docs

This file is an LLM-oriented index for the Aegis platform developer documentation.

## Scope

- Public developer documentation only.
- API explorer content is restricted to public endpoints.
- Private/elevated endpoints are intentionally excluded from explorer routing.

## Product Security Story

- Aegis follows a user-owned master key model for vault access.
- Vault payloads are encrypted client-side before sync.
- Platform services enforce policy, tenancy, and scoped authorization but are not intended to hold plaintext master key material.
- Credential brokerage uses short-lived leases, explicit selectors, and sender-constrained proofs.

## Primary Docs

- /developer
- /developer/api
- /developer/quickstarts
- /developer/mcp
- /developer/architecture
- /developer/auth
- /developer/patterns
- /developer/security
- /developer/security-controls
- /developer/errors
- /developer/limits
- /developer/versioning
- /developer/sdks
- /developer/examples
- /developer/sandbox
- /developer/changelog
- /developer/support
- /developer/feedback
- /developer/automation

## API Contract Source

- OpenAPI is generated from protobuf via `protoc-gen-connect-openapi`.
- Visibility and operation metadata are defined with `gnostic.openapi.v3.operation` annotations in `proto/aegis/v1/aegis.proto`.
- Public/private tags are emitted into OpenAPI and consumed by the explorer.

## Authentication + Security Model (Summary)

- End-user docs routes cover public API patterns and integration guidance.
- Workload and broker patterns use short-lived tokens, sender-constrained proofs, and audit trails.
- MCP onboarding supports OAuth device flow for keyless login (no static API keys).
- SPIFFE bootstrap and credential lease lifecycle are documented in usage/security pages.
- User API tokens are mintable with credential-selector scoped access (no wildcard selectors).
- Lease create/redeem/revoke checks enforce action + resource selector authorization.

## Canonical Developer Routes

- /developer
- /developer/api
- /developer/quickstarts
- /developer/mcp
- /developer/architecture
- /developer/auth
- /developer/patterns
- /developer/security
- /developer/security-controls
- /developer/errors
- /developer/limits
- /developer/versioning
- /developer/sdks
- /developer/examples
- /developer/sandbox
- /developer/changelog
- /developer/support
- /developer/feedback
- /developer/automation

## Discovery + Navigation

- Command palette supports `⌘K` or `Ctrl+K` on developer routes.
- Search results include guide pages and public API endpoints only.
- Private endpoints are excluded from both sidebar routing and command palette results.

## Notes for Agents

- Prefer `/developer/api` for operation-level request/response details.
- Prefer `/developer/auth` and `/developer/security-controls` for secure token lifecycle and scoping controls.
- Prefer `/developer/patterns` for integration flow guidance.
- Prefer `/developer/security` for broker authn/authz and control requirements.