sg-sentinel.sgit.ai / documents
The documents
The complete corpus behind SG/Sentinel — ~57,000 words — captured verbatim under briefs/ and readable here. Each page carries the same apparatus: a summary, the key concepts (linked to where they live on this site), the key ideas, and then the full document rendered in-page from the raw markdown. The raw file stays the source of truth; the page is presentation. Every claim on this site traces to one of these documents.
Start here
| Document | Type · date | In one line |
|---|---|---|
| The MVP implementation architecture | Arch brief · v0.27.59 · 23 May 2026 | The shortest path to the system: L1 decides + signals, L2 acts + writes, the signal spine, three targets, the parity matrix. |
| The file-by-file dev brief | Dev brief · v0.27.60 · 23 May 2026 | Exact schemas, six build phases, the parity test, and the Lambda@Edge gotchas. |
| The testing manual | Repo doc · 23 May 2026 | Every sg sentinel command across all three targets — plus the TUIs, the read-only chat, and the traffic tooling. |
The design series — day 68 (v0.27.58, 18 May 2026)
| Document | Type | In one line |
|---|---|---|
| Edge security & logging layer principles | Arch brief | The founding problems (visibility, Firehose cost, WAF rent) and the principles: substrate-independent, owned, hostile to bad traffic. |
| The execution model: layered responders | Arch brief | CloudFront Functions vs Lambda@Edge, the three responders, no-invalid-request, "not everything has to be online". |
| The edge layer MVP | Dev brief | Visibility, blocking, deployment — and the app-coupled WAF insight that names the differentiator. |
| The rules engine where rules are everything | Arch brief | Rules are the engine; the tiny high-privilege core; LLMs author rules but never run inline. |
| Interactivity & deployment phases | Arch brief | Not a spectator sport: every layer invocable, local-everywhere, dangerous dev-only rules, dev/main/prod. |
| Sentinel as codebase extension | Arch brief | Security as part of the code: Type_Safe validation at the trust boundary, agentic development. |
| Delegation & choke-points | Arch brief | Checks concentrate at choke-points; apps delegate to Sentinel; any QA-vs-prod difference is a major bug. |
| Time as a first-class dimension | Arch brief | Make good users faster; detect before damage, not instantly; damage prevented as the success metric. |
| Developer-friendliness & the evidence graph | Arch brief | Developer-friendliness as a quality multiplier; "what do you know about me?"; vault-per-user with anonymity modes. |
| Learning from standards & services | Research brief | ATT&CK, CRS/Coraza, STIX/TAXII, the threat-intel landscape — and IP reputation demoted to context. |
| Compliance as a living graph | Arch / strategy brief | Compliance computed from what is actually deployed, per rule-set, validatable — not a checkbox. |
| Rule architecture strategy: the fractal graph | Arch / research brief | Rules as a fractal graph with rich metadata; the deterministic-to-opinion spectrum; CRS patterns reused. |
| Architecture & data flows | Arch brief | The component map and both use cases end to end; Sentinel's logging job ends at S3. |
| The TUI mockups | Dev brief | Nine operator surfaces as ASCII acceptance criteria, chatbot-friendly by construction. |
| Rules of the game: the behavioural spec | Arch brief | The system's behaviour in plain English — the answer key the tabletop runs against. |
| Tabletop simulation 1: generic flows & logging | Tabletop | Five benign flows traced on paper; 11 gaps, including fingerprint storage and symmetry-blocks-deploys. |
| Tabletop simulation 2: blocking | Tabletop | Six attack flows; 14 gaps, 7 major — fast-track redesigned, per-IP dethroned, the honest limit stated. |
| The consolidated addendum | Addendum | Prior art positioned, five cross-cutting observations, and every tabletop gap resolved — the bridge to the build. |
| Future research & the path to MVP | Planning brief | "We have enough to build": the memos to record, the deep-dives to run, the parked list, the MVP boundary. |
The site's own provenance
| Document | Type · date | In one line |
|---|---|---|
| Brief: build the SG/Sentinel website | Website brief · v0.27.61 · 23 May 2026 | The brief this site was built from — narrative spine, content rules, definition of done. |
Adding a document is one entry in
admin/build/gen_documents.py plus the raw markdown in briefs/ — the generator produces the reader page, and the validate gate checks the links. The engineering page describes the pipeline.