sg-sentinel.sgit.ai / code
The prototype code, as it was written
The sentinel/ package — 115 files of Python and JS — captured verbatim from the website source packet (23 May 2026) under code/sentinel/ in this repository. It is the prototype the May 2026 design exercise produced — a design artefact, not a product: unmaintained, not deployed anywhere, not packaged to install. It is published as proof the design is buildable, and as the source of every code excerpt on this site — nothing is invented.
Where to look
| Path | What it is |
|---|---|
runtime/layer1/sentinel_l1.js | The single best file to read. The whole L1 engine: six rules, evaluate, the CloudFront handler — one dependency-free file that decides and signals, never acts. rules.embedded.json beside it holds the banned-IP list inlined at deploy time. |
runtime/layer2/Sentinel__L2__Actor.py | The sole actor: enforce (pass/403/404), build the record, write the sink. lambda_handler.py is its Lambda@Edge origin-request adapter. |
runtime/local/ | The offline stack: the harness that drives L1 via node or Docker and plays L2; the CF-env simulation Dockerfile and server.node.js listener. |
schemas/ | The Type_Safe contracts — Schema__Sentinel__Signal (the parity spine), Captured, Enforcement, Log_Record, Rule, deploy request/response. |
service/ | The deployer composing the sg aws clients; Signal__Codec; the log sinks (S3, local FS, in-memory) with the shared key layout. |
rules/Sentinel__Rule__Registry.py | The metadata registry: ids, names, MITRE ATT&CK tags, confidence, actions for the six rules. Logic stays in the JS engine. |
cli/ | The sg sentinel Typer surface: deploy, local, logs, blocks, rules, status. |
tui/ | The Textual operator screens (rules/logs/blocks/status/traffic), the structured TUI API provider, and the read-only chat. |
traffic/ | The labelled use-case corpus, the generator/sender, and the httpget echo origin used for impact measurement. |
primitives/ · enums/ · collections/ | The Safe_Str / Enum / typed-list building blocks the schemas are made of. |
Conventions worth noticing while reading. Every schema subclasses
Type_Safe — no Pydantic, no raw dicts as contracts; every AWS client has exactly one boto3 seam, overridden in tests by a dict-backed in-memory double (no mocks, no patches, no network in unit tests); every file opens with a header box stating its purpose. The unit-test suite (149 tests, in the main codebase) mirrors this tree.