Repository navigation
Project site with an animated landing page, rea-style README, community files; remove the Render demo and deck - #9
Merged
Merged
Conversation
…onest replay, indexed timestamps Findings-catalogue items, each with a test that fails before the change: - COSMOS-2: CosmosForensicStore read, then upserted, so two writers of one span id could both see it absent and the second replaced the first. It now uses create_item (atomic) and compares only on a conflict; a retried create meets its own identical copy and stays idempotent. - AUTHZ-16: the engine asserted rule.condition outside its fail-closed try, so a broken rule crashed the call instead of denying it, and -O dropped the check. The authorization and gateway asserts are explicit checks. - REPLAY-1: with one parent per span, the walk can only re-enter a span through a duplicate, yet that was reported as a cycle. Duplicates are now reported as duplicates; real cycles still show as unreachable spans. - STORE-2: listing and retention ran json_extract over every span under the store lock. Spans carry an indexed ts column; old databases migrate. - TCD-22: the fake Cosmos container ignored the SQL; it now refuses any query but the one it answers, and has create_item. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…o wasted restore Findings-catalogue items, each with a test that fails before the change: - DOC-1 (and a real defect behind it): both Cosmos builders used the async Azure clients, which need aiohttp, and SENTINEL does not install it. So setting AZURE_COSMOS_ENDPOINT failed at startup with a bare import error; Cosmos persistence could not run. New extra sentinel-prox[cosmos]; without it the error names the extra. The unused duplicate create_cosmos_store (whose docstring promised wiring "in a later phase") is removed. - GW-18: releasing ended sessions reads the SDK's private _server_instances. Losing it meant no releases at all, so every tenant would hit its session cap for good, silently. Now one accessor, an error logged once if it is missing, and a test pinning the SDK attribute. - CM-10: restore guessed each trace's scenario from its user input, which is redacted before storage, so the guess never matched, and it loaded every span of every trace at startup to make it. Removed; the scenario comes from the ownership row. - DCC-23 / GW-20: removed build_web_server and _expected_token (unused); corrected a comment that still said trust is keyed by agent alone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…d gauge from data Findings-catalogue items; checked in a browser where noted: - DEMO-04: the before/after baseline always ran the scripted transcript, so with a live model the dashboard compared a model against a script. It now uses the run's driver choice and web mode; the direct client gained list_tools so a live-model driver can run there. Test fails before. - DEMO-09: the kill chain named web_fetch and block-untrusted-origin, and the verdict claimed "the exfiltration would have succeeded", whatever the run did. Both come from the recorded steps now. In a browser, the privilege scenario shows no untrusted input, a clean lineage, and delete_record refused by rule never; the hero names web_fetch. - DEMO-26: the trust gauge hard-coded a threshold of 40. The configured value is in /capabilities (and the trust endpoint) and the dashboard reads it. - DEMO-16: the examples said an external /mcp run appears in the live view; it is listed in the history tab. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CLS-2: the rule-based labels matched only the demo's tool names, so blocks on an operator's own tools were mostly "unclassified". After the existing demo rules, a tool whose name contains a destructive or privileged verb (delete, drop, refund, transfer, exec...) is privilege_escalation, and an outbound one (send, post, upload, webhook...) blocked by authorization or on a tainted lineage is exfiltration. camelCase, snake, kebab and dotted names are split into words. Test fails before the change for four of five cases. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
CM-18: fan-out wakes every subscriber, and each one serialized every event itself (model_dump + json.dumps per subscriber per event). BroadcastEvent now caches its JSON text, so the cost is one serialization per event. Test counts model_dump calls across five subscribers: five before, one after. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- DUR-1: "durably emitted" now says what each store guarantees. - TRUST-5: trust/config.yaml says which events cost trust and which do not. - DEMO-06: the evasion page is written against the local shield's patterns. - DCC-10 (rest): README and cli docstring list the keys sentinel.yaml takes. - TCD-21: a phase-6 test called zero auth "the default posture". - TCD-25: the non-bypassability test covers the proxy's own path only. - TCD-27: the positioning doc claimed "the same class of guarantee" as CaMeL. - PP-15: the union-vs-walk test says what it does and does not prove. - AUTHZ-13: the AST docstring lists boolean literals. - docs/design-notes.md: each finding deliberately left as it is, with why. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ll open Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The public sandbox on Render ran SENTINEL in anonymous mode on the open internet. It was a demo with synthetic data, but it was also the first thing a visitor saw, and it is not how SENTINEL should be seen running. The demo stays available locally. Removes render.yaml and the references to it in the deployment guide, the Dockerfile and the CI comments. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A documentation site in website/, in the style of a typical open source project site: a landing page (install, three steps to a guarded agent, the demo, an honest limitations note) and guides for the quick start, how it works, policy, configuration, authentication, logs and forensics, deployment, resource limits, backends, limitations, and an FAQ. Every page was checked against the code it describes, not just the README: the predicate grammar, the derived fields and the address fields they read, the port precedence, the trust penalties and the routes. The docs workflow builds the site on every change to it and fails on a dead internal link or a vulnerable dependency (npm audit). Pushes to main publish it to GitHub Pages. vite is pinned to 6.4.4 under VitePress 1.6.4, because the vite 5 it ships with has open dev-server advisories. Images come from assets/, copied in at build time, so the README and the site share one copy. The project URLs point at the site and the changelog. The release-metadata test now also checks the site's install commands, including quoted requirements, which it used to skip entirely. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The README follows the shape of well-run open source projects: a centred header with one row of badges and links to the site, a security note, a table of contents, a quick start, how it works, what it protects against, the known limitations (kept in full: they change what SENTINEL protects you from), a short policy example, the demo, a documentation index, an FAQ, contributing, and license. Reference material (every setting, resource limits, forensic storage) now lives on the site. Links are absolute, so they also work on PyPI. The demo command it gave, `sentinel serve --dashboard`, served a dashboard whose every data route answered 503: the demo needs SENTINEL_ALLOW_ANONYMOUS=1, which the command now sets. Adds SECURITY.md (supported versions, private reporting through GitHub, scope), CODE_OF_CONDUCT.md (the Contributor Covenant by reference), issue forms for bugs, features and documentation that steer vulnerabilities to private reporting, and a pull request template carrying the security-invariant checklist. CONTRIBUTING links them and documents the site. The examples README no longer cites a version, a roadmap that does not exist, or "one sanitizer" when two ship. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
deck/ held the hackathon pitch decks, submission PDFs and video script: material for one event, not for people using or contributing to SENTINEL. It stays in the git history. The large-file check had been raised to 2 MB for the decks; it is back to the hook's default limit, which every tracked file is well under. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The site's home page is rebuilt in the style of a SaaS landing page: a gradient hero over a drifting grid, a copyable install command, and a replay of the attack (assets/flow.svg) with a step list that follows it. Then the problem with a before/after outbox that toggles on its own, the four stages, a decision log that types itself out when it scrolls into view, a bento grid with a hover spotlight, the limitations, and a closing call to action. Sections fade up as they appear. It is plain CSS and Vue, with no animation library to add to the supply chain. Content rendered on the server never flashes out and back in, and with prefers-reduced-motion everything holds still in its final state, the SVG included. Every claim on the page matches the docs. assets/flow.svg is the same animation as an image: the agent's record lookup and page fetch are allowed, the page turns its lineage amber, and the email is stopped at SENTINEL's edge. The README now opens with it, laid out like morluto/rea's: logo, title and subtitle, badges with logos, a link row, a section nav, the install command, an IMPORTANT note, then quick start, how it works, what it stops, a showcase of the demo, limitations, policy, a collapsible FAQ, documentation, and a disclaimer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Harshith029
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Makes the project look and work like a well-run open source project, modelled on rea.tools and morluto/rea, with a SaaS-style animated landing page:
render.yamland every reference to it). It ran SENTINEL in anonymous mode on the public internet, which is not how a security proxy should be seen running. The demo stays available locally.deck/: pitch decks, submission PDFs, video script). It stays in git history; the large-file hook goes back to its default limit.website/(VitePress, published to GitHub Pages athttps://harshith029.github.io/Sentinel/): 12 guide pages and an FAQ, each checked against the code it describes.prefers-reduced-motion.assets/flow.svg: the same attack as an animated SVG, now the README's hero (GitHub serves it asimage/svg+xml, so it animates there).SECURITY.md,CODE_OF_CONDUCT.md, issue forms (blank issues off, vulnerabilities steered to private reporting), and a PR template with the security-invariant checklist.Includes PR #8's commits. This branch builds on
catalogue-part4(#8) but targetsmain, so CI runs here. Once #8 merges, this diff shrinks to its own commits. Merge #8 first.README images point at
main, so the new hero (assets/flow.svg) shows as broken in this PR's README preview until it merges.Fixed along the way
sentinel serve --dashboardserved a dashboard whose every data route answered 503: the demo needsSENTINEL_ALLOW_ANONYMOUS=1. Verified both ways locally.test_release_metadataskipped every quoted install line, which is the form all the docs use. It now checks the project name inside quotes and covers the site's pages. A plantedpip install "sentinel>=1.0"fails it; the old code let it through.Before merging (needs you, in repository settings)
main, and the README's site links 404.SECURITY.mdand the issue chooser link to it.(The repository's website field already points at the site.)
Testing
pytest: 688 passed, 12 skipped (quarantined real-MCP diagnostics), 1 expected xfail.ruffclean.src/is untouched.docsworkflow passes in CI:npm ci,npm audit(0 vulnerabilities; vite pinned to 6.4.4 because the vite 5 in VitePress 1.6.4 has open dev-server advisories), and a build that fails on dead internal links.Security invariants
src/changes. Documentation describes existing behaviour only.🤖 Generated with Claude Code