Sentinel watches eight surfaces, seals every finding to Atlas, runs it through a 10-stage deterministic pipeline, and emits a bounded set of governed options. Every option carries its own verification predicate, the autonomy level it is allowed to execute at, and the explicit reasons higher-risk alternatives were rejected. None of it is LLM judgment. All of it is replayable.
A scanner runs, prints findings, exits. Sentinel runs as a daemon, registers with the Aria runtime, and emits every finding through a sealed protocol — capability passport, shared event grammar, kernel compilation, autonomy cap, verification predicate. The protocol is what makes the output trustworthy to a senior engineer.
Sentinel registers with the Aria runtime by emitting a aria.daemon.capability_passport.v1. The passport is a hashed object that declares — and structurally constrains — exactly what Sentinel is allowed to do, what it is prohibited from doing, and the autonomy cap it ships under.
The defaults are conservative. max_autonomy_level: 2 on every
install. Higher rungs require explicit allowlist, tests, and readback —
never granted by default, never assumed. Reputation
(true-positive rate, verification success, rollback incidents) earns
the right to raise the cap.
The passport is the trust artifact a CTO can defend. No other autonomous-fix product exposes one.
// const SENTINEL_CAPABILITY_PASSPORT = Object.freeze({ schema: 'aria.daemon.capability_passport.v1', daemon_id: 'atlas-sentinel', product_surface: 'sentinel', capabilities: [ 'runtime_health_scan', 'k8s_health_scan', 'systemd_health_scan', 'cli_state_scan', 'repo_state_scan', 'codebase_pattern_scan', 'finding_rank', 'fix_proposal_route', ], authority_scope: [ 'read_runtime_state', 'read_repo_state', 'write_sentinel_findings', 'write_hive_events', 'request_aria_task_work', 'propose_repairs', ], prohibited_authority: [ 'execute_production_repair_without_scoped_authority', 'declare_launch_readiness', 'close_cross_daemon_blocker_without_verification', 'mutate_doctrine_without_owner_approval', 'push_or_deploy_without_explicit_boundary', ], max_autonomy_level: 2, autonomy_ladder: { 1: 'observe_and_explain', 2: 'propose_repair_with_verification', 3: 'apply_in_safe_workspace_with_tests', 4: 'execute_allowlisted_repair_with_readback', }, required_proofs: [ 'evidence_anchor', 'deterministic_kernel_compilation', 'verification_predicate', 'hive_event_id', 'aria_task_route_or_explicit_non_route_reason', ], risk_budget: { default_autonomy_level: 2, live_runtime_cap: 2, code_without_tests_cap: 2, branch_with_tests_cap: 3, allowlisted_non_production_cap: 4, }, // });
The autonomy level a finding is allowed to execute at is set in the passport before the cycle runs, capped per risk class. Sentinel cannot raise its own cap. A customer raises a class explicitly with allowlist + tests, or it stays at proposal-level forever.
Every Sentinel output flows through nine standard events with a fixed
schema (aria.shared_daemon_event.v1). Multiple
daemons (Sentinel today, the Repo-State Organizer next, future product
daemons) emit the same event types — Hive gets one canonical stream.
Every kernel pass runs the same ten stages in order. Tadabbur and Qiyas are not paragraphs the model writes after deciding — they are deterministic passes that mutate or reject options before any option is released. Cognition is mechanism, not ceremony.
LLMs should not be trusted to invent the action space. The kernel compiles the action space mechanically from evidence, axioms, domain topology, runtime state, owner policy, and verification predicates. The LLM then improves language, analysis, tradeoff explanation, and implementation quality — only inside that bounded space.
Each stage's output is hashed and recorded. The full pipeline run is deterministic: same observation + same evidence + same policy produces the same option set with the same rejection reasons. That is what makes a Sentinel finding replayable.
requires_evidence verdict survives
silently — every one becomes a verification predicate, an owner decision, or
an explicit unverified boundary.
Everything the kernel emits is a CompiledOption.
Sentinel's findings, the task runner's work items, future products' actions
— same object, same fields, same rules. Verification is built in. The
rejected alternatives are written down.
CompiledOption { id opt.repair.compound_app_risk.001 action_class propose_repair target atlas:/codebase/vibe-app/server.js expected_result eval() removed · cors locked · child_process arg-array evidence_required [ atlas_dossier(server.js), co_occurrence(dangerous_dynamic_execution, possible_command_injection), verified_owner_policy(no-eval-in-prod), ] allowed_autonomy 2 // from passport.risk_budget.code_without_tests_cap verification_predicate { syntax node --check server.js // passed rescan sentinel composite count: 1 → 0 policy no eval() in package } rejected_alternatives [ { id: opt.repair.compound_app_risk.002, reason: 'apply directly to live runtime — autonomy cap is L2' }, { id: opt.repair.compound_app_risk.003, reason: 'patch eval-only — leaves command-injection unfixed (composite)' }, ] learning_target substrate-composite/vibe-app fixture · weight +0.04 compilation_hash sha256:a116b221b053a8d4f9c7e02fc4d97 }
The center of gravity in software has moved. Most teams shipping today have a coding agent in the loop on every PR. Many teams ship code paths whose first reviewer was the LLM that wrote them. The work has scaled. The review has not.
The new failure modes are not the old ones. Hallucinated APIs. Drifted deploys. Composite security regressions across four files that each looked harmless. False-done claims from an agent that thinks "tests passed" means "shipped correctly." Vibe-coded paths that look right because the pattern looks right, but the pattern itself was wrong.
Linters didn't predict this. Type systems didn't predict this. The governance layer your CTO is being asked about does not exist yet. Aria Sentinel + Atlas + the kernel is what we think it should be: deterministic infrastructure that bounds what a coding agent can do, anchored to a live graph of what the codebase actually is, replayable down to the compilation hash.
Sixty seconds on a clean machine. BYOK. The kernel runs locally on port 4319; the harness daemon on 8790. Your code never leaves your laptop.