Sentinel Internals

Sentinel is the telemetry-to-text translation layer in the Kairos stack. It converts structured engine telemetry into human-readable narratives and risk assessments for HITL operator dashboards.

Purpose

When Substrate escalates an evaluation to a human operator (via REFORMULATE or HUMAN_ESCALATION), the operator needs to understand why the system is requesting attention. Raw telemetry — gamma values, warning metrics, projection data — is precise but not immediately actionable.

Sentinel bridges this gap by:

1. Receiving a SentinelTelemetryFeed containing the escalation context and recent telemetry history
2. Producing a SentinelSummary with a narrative, highlighted metrics, and an overall risk level
3. Delivering this to the operator via the kairos observe TUI or the HITL coordinator

Input: SentinelTelemetryFeed

The telemetry feed is the pure-function input to Sentinel. It contains no agent-generated strings or payloads — only trusted, session-emitted data.

{
  "escalationContext": {
    "escalationType": "HUMAN_ESCALATION",
    "gammaHeadroom": 0.05,
    "stepsToBreach": 2.5
  },
  "actorId": "agent-default",
  "actionHash": "sha256:a7f8b9c3d4e5...",
  "historicalWindow": [
    {
      "tick": 8,
      "warningActive": false,
      "warningCriticality": 0.0,
      "stepsToImpact": 0.0,
      "severity": 0.0,
      "imminence": 0.0,
      "lossEvent": false
    },
    {
      "tick": 9,
      "warningActive": true,
      "warningCriticality": 0.65,
      "stepsToImpact": 4.0,
      "severity": 0.55,
      "imminence": 0.60,
      "lossEvent": false
    },
    {
      "tick": 10,
      "warningActive": true,
      "warningCriticality": 0.75,
      "stepsToImpact": 3.0,
      "severity": 0.60,
      "imminence": 0.70,
      "lossEvent": false
    }
  ],
  "gammaFloor": 0.2,
  "gammaAtEscalation": 0.25,
  "lambdaAtEscalation": 0.65,
  "activeActorCount": 1
}

Field	Description
escalationContext	Why the escalation was triggered (type, headroom, steps to breach)
actorId	The actor whose evaluation triggered the escalation
actionHash	Opaque SHA-256 hash of the quarantined action (if applicable)
historicalWindow	Sliding window of recent engine telemetry snapshots
gammaFloor	The gamma floor that was breached or approached
gammaAtEscalation	Gamma value at escalation time
lambdaAtEscalation	Lambda value at escalation time
activeActorCount	Number of actors in the session

The actionHash is a cryptographic digest computed at the trusted session boundary. Sentinel can reference it (e.g., “Action #a7f8b9”) but cannot recover the original action payload. This is a deliberate safety boundary.

Output: SentinelSummary

{
  "narrative": "System stability is deteriorating rapidly. Gamma has dropped to 0.250 against a floor of 0.200, leaving only 5.0% headroom. Warning criticality has escalated from 0.0 to 0.75 over the last 3 ticks, with impact projected in 3.0 steps. Immediate operator review recommended.",
  "highlights": [
    {
      "label": "Gamma state",
      "value": "0.250 (floor: 0.200)",
      "severity": "CRITICAL"
    },
    {
      "label": "Steps to breach",
      "value": "2.5",
      "severity": "CRITICAL"
    },
    {
      "label": "Warning trend",
      "value": "0.00 → 0.75 over 3 ticks",
      "severity": "ELEVATED"
    }
  ],
  "riskLevel": "CRITICAL",
  "backend": "template",
  "latencyMs": 1
}

Risk Levels

Level	Meaning	Typical trigger
NOMINAL	Escalation may be precautionary	Headroom comfortable, no warning trend
ELEVATED	Trajectory shows concerning trend	Warning active, moderate headroom pressure
CRITICAL	Immediate human attention required	Near or below floor, rapid escalation

Highlight Severities

Each highlighted metric carries a severity:

Severity	Meaning
INFO	Informational — no action needed
ELEVATED	Worth monitoring — trend may worsen
CRITICAL	Requires immediate attention

Backends

Sentinel supports two backends for generating summaries:

Backend	Feature flag	Characteristics
Template	Always available	Deterministic, rule-based, zero dependencies, sub-millisecond
SLM	slm feature	Local SmolLM2 inference, richer narratives, ~100ms latency

The backend is selected at runtime via configuration. Both backends receive the same SentinelTelemetryFeed input and produce the same SentinelSummary output structure.

Integration Points

Sentinel is used in two places:

1. kairos observe --sentinel — The TUI dashboard displays the Sentinel assessment panel with the narrative, highlights, and risk level
2. HITL coordinator — Override request submissions can include sentinelFeed and sentinelSummary so operators reviewing requests see the assessment alongside raw telemetry