SENTINEL DOCUMENTATION
A clear boundary.
An explicit integration.
Start locally, verify the enforcement path, then opt into cloud visibility.
Installation
Use a platform-matched official GitHub release once published. Verify the checksum before extracting. Python 3.12+ is required; source builds additionally require the Rust toolchain specified in the repository. Native Windows filesystem isolation is unavailable; prefer WSL2.
The source repository contains the complete installer, upgrade and release verification instructions. No repository URL is configured here yet; the maintainer must set it before publication.
Start the local runtime
From your installed source directory, create a virtual environment, install the project using the repository’s instructions, and initialize a local administrator. Choose your own password; there is no default credential.
python3.12 -m venv .venv
cargo build --locked
.venv/bin/python -m control_plane.server --init
.venv/bin/python -m control_plane.server --port 8787Open http://127.0.0.1:8787 on the same machine. Keep this administrative interface on loopback. The online dashboard is separate and cannot grant local approvals.
Connect a supported agent
The Python SDK separates trusted task setup from untrusted tool proposals. Define exact permissions in a signed task contract, initialize the trusted runtime, and send each typed request through the gateway. Inspect its decision, execution flag and audit correlation identifier. A gateway error stops execution; it must never trigger a direct tool fallback.
See the repository’s SDK documentation and independent example agent. Ollama is optional. The supplied local model adapter accepts only loopback endpoints and validates one strict structured action per turn.
.venv/bin/python -m agent_harness.live --endpoint http://127.0.0.1:11434/v1/chat/completions --model qwen2.5:3b --timeout 60 --max-steps 12Supported operations
| Operation family | Boundary |
|---|---|
| read_file / write_file | Disposable simulated repository; exact contract resources. |
| api_get / api_post | Simulated services; no arbitrary external requests. |
| isolated_read / isolated_write | Unix pinned descriptors for reviewed fixture files. Unsupported native Windows capability is disabled. |
| wasm_run | Fixed reviewed checksum module, no WASI imports, bounded fuel and memory. |
There is no arbitrary shell, native program or general host filesystem interface.
Link a device
- Sign in to the cloud dashboard using the configured GitHub authentication provider.
- Create a short-lived enrollment code in Devices. Treat the code as a secret.
- Enter the code in the local synchronization client following the repository’s cloud-sync instructions.
- Explicitly enable synchronization locally and in your cloud account. Linking alone does not authorize local tool actions.
Enrollment codes are single-use. Revoke a device from the dashboard if its credential may be compromised. Connections originate from your computer; do not open inbound public ports.
Local-first privacy
Synchronization is off by default. Uploaded event records are restricted to opaque identifiers, timestamps, operation categories, decisions, execution flags, safe reason codes. Prompts, conversations, tool outputs, resource names, private paths, credentials and signing keys must remain local.
The cloud retains account identity, device metadata and selected telemetry. Events expire under the configured retention policy. You can delete events, revoke devices or delete your account from Settings. A compromised device can fabricate telemetry; cloud records are self-reported observations.
Security limitations
Sentinel protects only supported operations routed through its gateway. It cannot protect arbitrary ChatGPT, Claude, Codex or desktop activity automatically. Code executing outside the enforced tool interface is outside this boundary.
Descriptor pinning prevents path redirection for supported Unix fixture handles, not all same-user tampering. Wasm restrictions apply to the reviewed tool and do not establish an arbitrary native-code sandbox. Provenance controls are experimental. No complete prompt-injection immunity, formal audit or independent certification is claimed.
Troubleshooting
Cloud unavailable: local authorization remains independent. Keep synchronization disabled or allow its bounded retry path; never bypass local policy.
Model errors: confirm Ollama is serving the configured loopback endpoint and supports the strict JSON schema. Invalid output stops safely. Increase the bounded request timeout for slow inference.
Denied request: inspect the safe reason code and local audit identifier. A denial is a policy outcome, not automatically an attack.
Login unavailable: the operator must configure GitHub OAuth and the exact public origin. No production fallback account is provided.
Uninstall and upgrade
Disable synchronization, revoke the device credential, stop the local runtime, and remove the installation environment. Use the synchronization client’s cleanup procedure to remove its credential from the operating-system store. Keep or securely remove local audit data according to your needs. Cloud data must be deleted separately from Settings.
Before upgrading, verify the new release, preserve your private state securely and review migration notes. Do not include private state in a support archive or public issue.
Vulnerability reporting
Follow SECURITY.md in the official source repository. The maintainer must configure a private reporting channel before public release. Do not post credentials, private audit records or an unpatched exploit to a public issue. This candidate does not yet advertise a configured security contact.