Sentinel — Corpus Integrity & Monitoring

Sentinel owns the known. Where Scout looks outward for new sources, Sentinel watches the sources you have already ingested and raises flags when something drifts. Like Scout, it only proposes — confirming a flag routes the affected source back into the Librarian loop; Sentinel never writes the corpus.

What Sentinel checks

A sweep re-examines watched sources across several checks:

Check	Looks for	Status
Freshness (R1)	The source changed since ingestion (re-crawl + content diff).	Live
Temporal (R2)	Effective-date transitions — sunsets, supersessions, upcoming boundaries.	Live
Grounding (R4)	Citations whose source no longer supports the claim.	Live
Wrong scope	The live page contains the ingested baseline and is several times larger — the source is watched at a different granularity than it was ingested at.	Live
Conflict (R3)	Two sources that now disagree.	Not yet detected
Under-support (R5)	Claims with too little supporting coverage.	Not yet detected

Wrong scope is not drift

A wrong scope flag means nothing on the page changed — the source was ingested as one section but its URL now serves a whole part, so every sweep sees thousands of "new" paragraphs that were always there. The remedy is a one-time re-ingest at the right granularity, not a review of what moved.

The Sentinel dashboard

The header — Corpus integrity & monitoring — shows a Watching · N sources pill and:

• Run sweep — starts a monitoring sweep (live Sweeping… N%). (Requires the review capability — Curator or Admin.) The result toast reports how many flags were created, or "no new issues" — and, when the judge filtered any, how many fell below the threshold.

Stat tiles summarise Open flags / Source changes / Date transitions / Grounding gaps.

Significance — why not every change reaches the queue

"Did this page change?" and "does this change matter?" are different questions, and only the second one is worth a curator's morning. A regulator's page carries a view counter, a "current as of" banner and a cookie notice; a byte comparison finds a difference every single time it looks.

So every detected change is scored before it reaches the queue.

Score	Severity	Meaning
0.75 – 1.00	critical	An obligation, limit, threshold, rate, deadline, definition or scope changed. Someone acting on the old text would now be wrong.
0.50 – 0.75	warning	Substantive but narrower — guidance reworded with altered meaning, an exception added or withdrawn.
threshold – 0.50	info	Real but inconsequential: a clarification, a reordering, a renumbered citation.
below threshold	(hidden)	Suppressed — kept, but out of the working set.
not assessed	info	The judge could not form a verdict. Always shown.

Each flag carries the judge's own rationale — a short clause naming what it saw, so the ranking can be checked rather than taken on faith. A flag whose score reads not assessed is shown, never hidden: an unassessed change is not the same as an unimportant one, which is why the score is blank rather than zero.

Suppressed means hidden, never deleted

A suppressed flag keeps its full evidence and stays queryable. Show suppressed in the review queue reveals what the judge filtered, and lowering the threshold brings those flags back on the next sweep. Nothing is destroyed by setting the threshold too high.

Setting the threshold

The significance threshold on the monitoring panel is the trade a brain makes between tolerating noise and tolerating a missed change — so it belongs to the Curator looking at the queue, not to a config file. Drag it down to surface more, up to surface less. (Requires the review capability.)

How changes are judged

Mode	Behaviour
heuristic	Free and deterministic. Scores the shape of a change: did a limit move, is duty-creating language involved, do published units cite this text, was something rewritten or only appended.
llm	Reads the changed text and judges what it means — separating an inflation adjustment a compliance team must act on from a renumbered footnote. Falls back to the heuristic if the model is unavailable.
off	Nothing is scored and nothing is suppressed. Every detected change reaches the queue.

Scoring always runs; the display is flagged

Judging happens on every sweep regardless. The sentinel_significance feature flag controls only whether the workbench shows scores, the suppressed view, and the threshold control.

Review flags

The review queue on the left lists flags, filterable by All / Changes / Dates / Grounding / Wrong scope / Conflicts. This is a channel entirely separate from Scout's candidates.

Click a flag to open its detail sheet:

• Severity (critical / warning / info), detected time, and a correlation id.
• Its significance score and the judge's rationale for it.
• Seen N× where the same condition has recurred across sweeps — one flag per standing condition, not one per sweep.
• A summary and the implicated knowledge units.
• Evidence tailored to the flag type — a before/after diff with a sections-changed count, a date-boundary state, a grounding claim vs. its cited source, or a wrong-scope size comparison — plus a link to the source and its stored snapshot.

Confirm or dismiss

(For open flags, requires the review capability.)

• Confirm → re-ingest via Librarian — routes the affected source into the governed review → certify → publish loop for remediation.
• Dismiss — no corpus effect; the decision is recorded in the audit ledger.

Sentinel never writes the corpus

Confirming a flag does not change the published brain directly. It creates work for the Librarian, where a human still reviews and approves the remediation — the same governed bridge Scout uses when you target a candidate.

Sentinel is the system-initiated twin of wiki stewardship

Sentinel raises flags automatically from source drift; the Wiki lets a Curator raise proposals manually from what they see in the published artifact. Both are propose → Librarian → certify → publish — see Wiki › How this relates to the Sentinel flow.

Monitoring status

The monitoring panel on the right shows current cadence, the number of sources watched, the last and next sweep, and whether evidence capture (source snapshots) is on. With significance enabled it also shows the judge mode and an editable significance threshold. Cadence and rule toggles are display-only — sweeps are driven from the Run sweep button.

Role summary

Action	Minimum role
View flags & monitoring status	Reader
View scores, rationales, suppressed flags	Reader
Run sweep, confirm/dismiss flags	Curator
Change the significance threshold	Curator

When the queue has gone stale

A sweep only ever looks at what the live pages say today, so a flag raised months ago under a rule that has since been corrected simply sits there — sweeping again will not retract it. Re-judging an existing queue against the current rules is a maintenance operation, documented in the repo cookbook: cookbooks/SENTINEL_CLEANUP.md (Re-judging an existing queue).