Trust kernel for agents2026Active

Sentinel OS

A local-first trust kernel for agent systems with policy checks, append-only history, and verification.

Back to projectsRepository

At a glance

Problem

Serious agents need enforceable boundaries and a trustworthy record of what they actually did.

Approach

A local-first trust kernel with default-deny policy checks, signed transitions, and an MCP enforcement proxy.

Why it matters

Policy decisions and execution history can be checked without relying on the model's account of its own actions.

System sketch

01Constrain

Seatbelt evaluates transition intent before execution using a deterministic default-deny policy.

02Record

Sentinel writes canonical execution digests, policy references, signatures, and hashes to an append-only ledger.

03Verify

The command-line verifier reconstructs the chain and checks integrity offline.

04Extend

The next system boundary is auditable memory writes, retrievals, and state replay.

Design notes

Execution should be reconstructable

A signed transition chain gives operators evidence beyond application logs.

Authorization belongs outside the client

The agent can request an action, but the authoritative policy decision comes from the enforcement layer.

Verification should be vendor-neutral

Canonicalization, hashing, and Ed25519 signatures let operators verify the record without a model provider.

Question

Serious agent use requires actions that can be constrained, reconstructed, and verified without trusting the model's own account.

Sentinel OS puts that responsibility in a policy and integrity layer outside the agent.

Approach

  • Use append-only execution history instead of scattered logs.
  • Require explicit permission through a deterministic default-deny policy.
  • Package outcomes so they can be verified offline after execution.
  • Treat memory and state transitions as objects that should eventually be auditable too.

Open questions

  • What is the smallest useful policy surface for practical agent systems?
  • How should memory mutations be represented if they need the same audit trail as actions?
  • Which guarantees are worth paying for in exchange for complexity and friction?

Project spec

RoleConcept, system design, and implementation.
StatusActive
TypeTrust kernel for agents
UpdatedFeb 2026
Primary objectCanonical, signed transitions in an append-only hash chain.
System boundaryPolicy evaluation, MCP tool interception, proof generation, and offline verification.
Current artifactv0.3 prototype with a filesystem MCP proxy and Seatbelt enforcement.
Pressure pointExtending the audit model from tool calls to memory and state mutation.

Topics

trustworthy agentspolicy enforcementcryptographic verificationexecution integrity

Where it is now

  • The v0.3 prototype intercepts filesystem MCP calls before execution and binds the policy decision into the proof chain.
  • The next milestone is a clearer model for replay, memory writes, and state transitions.