From 4c237b3f2387c6a569c9503a4ae31219a2a69ac2 Mon Sep 17 00:00:00 2001 From: Toni Bergholm Date: Thu, 9 Jul 2026 17:40:56 +0300 Subject: [PATCH] website: bring Sentinel status up to date with pkg-registry MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Sentinel page and homepage pillar still said 'auditing proxy live, policy & permissions next' — the pkg-registry repo has since shipped the whole layer (phases through 25): signed policy with lint + dry-run preview, control-plane role tokens, a deny-by-default sandbox (writes and $HOME reads), sentinel explain remediation, identity and release-anomaly signals, durable SQLite observability, and a hardened network trust boundary. Current work there is OSS launch prep. Sourced from pkg-registry's CLAUDE.md phase log and README as of 2026-07-09. --- website/src/pages/index.astro | 7 +++-- website/src/pages/sentinel.astro | 47 +++++++++++++++++++++++--------- 2 files changed, 38 insertions(+), 16 deletions(-) diff --git a/website/src/pages/index.astro b/website/src/pages/index.astro index 1518b0a..6f4394b 100644 --- a/website/src/pages/index.astro +++ b/website/src/pages/index.astro @@ -75,8 +75,9 @@ $ bash demo/run_demo.sh Agents run npm install and execute code nobody read. Sentinel is a transparent auditing proxy in front of registry.npmjs.org: every tarball is scored by a deterministic engine - and carries a verdict before install-time code runs. The - agent can request; only a human grants. + and carries a verdict before install-time code runs, and a + deny-by-default sandbox contains what does run. The agent can + request; only a human grants. 

  color-stream@1.4.1
   ────────────────────────────────────────
@@ -87,7 +88,7 @@ $ bash demo/run_demo.sh
critical [secret-exfil] reads ~/.npmrc, AWS credentials… HTTP 403 x-sentinel-verdict: block -

TypeScript · auditing proxy live · policy & permissions next

+

TypeScript · full security layer built · open-source launch prep

Full page →   GitHub →

diff --git a/website/src/pages/sentinel.astro b/website/src/pages/sentinel.astro index adb25ae..a77c042 100644 --- a/website/src/pages/sentinel.astro +++ b/website/src/pages/sentinel.astro @@ -11,7 +11,7 @@ const repo = 'https://github.com/git-agentic/pkg-registry';
- Auditing proxy live · policy & permissions next + Full security layer built · open-source launch prep Apache 2.0 TypeScript
@@ -71,29 +71,50 @@ $ sentinel audit is-odd 3.0.1
  • Deterministic scoring — start at 100, weighted penalties per finding, any critical forces block — fully reproducible in CI; an LLM adapter only adds context, never the score
    • -
  • Policy and approval gate: signed per-enterprise policy, capability - manifests, and a hard privilege boundary — the agent can request an - approval, only a human can grant it
    • -
  • Sandbox enforcement (macOS Seatbelt, Linux bubblewrap): lifecycle - scripts run with denied-by-default access to secrets and network; - detected violations quarantine that exact tarball fleet-wide
    • +
  • Policy and approval gate: signed per-enterprise policy — with a + lint and a dry-run impact preview against real audit history before + signing — capability manifests, and a hard privilege boundary: the + agent can request an approval, only a human can grant it, enforced + by signed Ed25519 role tokens on the control plane
    • +
  • Deny-by-default sandbox (macOS Seatbelt, Linux bubblewrap): + lifecycle scripts get no network, no credential env vars, no writes + outside a fixed floor, and no $HOME reads unless a + capability is approved; detected violations quarantine that exact + tarball fleet-wide
  • Agent-native surfaces: a stdio MCP server for agent hosts and a - CLI whose exit codes make sentinel audit a CI gate
    • + CLI whose exit codes make sentinel audit a CI gate; + sentinel explain turns a verdict into per-finding + remediation and a suggested last-known-good version — advisory + only, it never rewrites a lockfile
  • Whole-tree gates: audit every package in an npm/yarn/pnpm lockfile, write a CycloneDX SBOM, post the verdict to the PR via a GitHub Action
  • Signed audit attestations (DSSE/in-toto, Ed25519) verified offline as a deploy-time gate, plus known-malicious advisory and CVE-range (SCA) detection
    • +
  • Identity and history signals: typosquat and dependency-confusion + detection, and release-anomaly findings — maintainer takeover, + dormancy resurrection, new capabilities in a patch release
    • +
  • Durable history and observability (opt-in, zero-dependency + SQLite): verdict trends, top-flagged packages, and a violation + timeline on the dashboard, the CLI, and /-/metrics
    • +
  • Hardened trust boundary: tarball fetches pinned to allowlisted + origins (no SSRF), Host-header spoofing refused, byte caps and + opt-in rate limits on expensive routes

    • Status

    - The auditing proxy is the live wedge: deterministic engine, whole-tree - lockfile gate, sandbox enforcement with runtime quarantine, MCP server, - GitHub Action, signed policies and attestations, advisory + CVE - detection. The long arc is policy and install-time permissions for the - whole ecosystem. + What started as the audit-proxy wedge has grown into the full layer + (July 2026): signed per-enterprise policy and install-time permission + manifests, a deny-by-default capability sandbox, offline signature and + Sigstore-provenance verification, known-malicious (GHSA) and CVE-range + detection, supply-chain identity and release-anomaly heuristics, + whole-tree lockfile auditing with SBOMs and signed attestations, a + CI-native GitHub Action, an agent-native MCP server, durable + observability, and a hardened network trust boundary. Current work is + open-source launch prep; the long arc is policy and install-time + permissions for the whole ecosystem.