Add deterministic no_std Sentinel core

[cryptofixyup]

Adds the standalone sentinel-core crate on top of the existing sentinel-wire package.

• no_std + forbid(unsafe_code)
• bounded fixed-capacity event ring
• 64-byte cache-line alignment for hot structures
• AtomicU8 Monitor/Anomalous/Breached state machine using Acquire/Release
• bounded byte scanning for shell/proc/self/cmdline indicators
• fixed-window entropy signal
• deterministic scoring and sticky breach state
• regression tests

The existing wire ABI remains unchanged. ML, telemetry, and policy distribution stay outside the enforcement core.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
api	Ready	Preview	Sep 24, 2026 9:24am UTC

[ecc-tools]

ECC Tools / Security Evidence

Commit: a617da84ffd950d3357d6aab0f5b7e467dbfc961

Security evidence gate passed (success)

No security-sensitive scanner-evidence gap detected.

Mode: enforce

Scanned 5 changed file(s). No missing scanner-evidence signal was detected.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / PR Risk Taxonomy

Commit: a617da84ffd950d3357d6aab0f5b7e467dbfc961

PR taxonomy review recommended (neutral)

Detected 1 PR taxonomy bucket(s): CI/CD Recommendation.

Scanned 5 changed file(s).

Roadmap taxonomy buckets:

CI/CD Recommendation

CI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work.

Signals:

• Regression coverage may lag behind the diff
• 0 CI or workflow path(s) changed

Paths:

• Cargo.toml
• crates/sentinel-core/Cargo.toml
• crates/sentinel-core/src/lib.rs
• crates/sentinel-core/tests/core.rs

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / Reference Set Readiness

Commit: a617da84ffd950d3357d6aab0f5b7e467dbfc961

Reference set readiness gaps detected (neutral)

Reference evidence present for 0/7 areas (0%) across 5 changed file(s).

This check is based on files changed in this PR. Repository-level readiness is still reported by /ecc-tools analyze comments and generated manifests.

Area	Status	Evidence / Next Step
Deep analyzer corpus	Missing	Add analyzer fixture, golden, benchmark, or reference-set files that can catch analyzer regressions.
RAG/evaluator comparison	Missing	Add retrieval or evaluator reference-set comparison fixtures with expected ranking behavior.
PR salvage/review corpus	Missing	Add stale-PR, review-thread, reopen-flow, or salvage reference cases for queue cleanup automation.
Discussion triage corpus	Missing	Add public discussion triage fixtures, golden cases, or reference sets for informational, answered, and no-response classifications.
Harness compatibility	Missing	Add cross-harness, adapter-compliance, or harness-audit evidence for Claude, Codex, OpenCode, Zed, dmux, and agent surfaces.
Security evidence	Missing	Attach security evidence such as SBOMs, SARIF, audit reports, or AgentShield evidence packs.
CI failure-mode evidence	Missing	Add captured CI failure logs, dry-run fixtures, or troubleshooting docs for common workflow failure modes.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / Hosted Promotion Readiness

Commit: a617da84ffd950d3357d6aab0f5b7e467dbfc961

Hosted promotion readiness passed (success)

No hosted promotion evidence gaps detected across 5 changed file(s); 0 corpus scenarios had matching evidence.

This check compares PR file changes against the evaluator/RAG promotion corpus in src/analyzers/fixtures/evaluator-rag-corpus.ts.
Hosted output scoring inspected 0 completed cached hosted job results.

No evaluator corpus scenarios matched this PR.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 1e4694b0-13bc-44b1-a85f-4cf9ffef31a3

📥 Commits

Reviewing files that changed from the base of the PR and between aa61190 and a617da8.

📒 Files selected for processing (5)

• Cargo.toml
• crates/sentinel-core/Cargo.toml
• crates/sentinel-core/README.md
• crates/sentinel-core/src/lib.rs
• crates/sentinel-core/tests/core.rs

 __________________
< X marks the bug. >
 ------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.