Sentinel did not begin as an “AI security product.” It began as a way to make sense of signals from Fail2ban, CrowdSec, Traefik, networking and the host itself.
A single agent quickly exposed an uncomfortable weakness: it can become too confident in the story it just constructed.
That is why Luna and Selene exist.
Symmetric design, independent memory
They receive the same curriculum and cognitive seed, but keep independent runtime state, evidence, learning progress, attention and associations.
Two agents are only useful if they are allowed to disagree for reasons.
Learning is not a reward
Both agents receive the same lessons. Evaluation may differ, but withholding education from the weaker agent would defeat the experiment.
The 09:30 report is a learning checkpoint
Each Sentinel records what it thinks it learned, supporting evidence, uncertainty and what it needs next. “I do not know yet” is a valid result.
Memory has a hard ceiling
The design budget is 50 MB per agent: 20 MB reasoning, 20 MB knowledge and 10 MB context/governance. Learned associations require provenance and decay and cannot silently rewrite curated truth.
Both agents remain observe-only
They can observe bounded network, process, container and topology metadata. They cannot grant themselves authority, change firewall policy or hide evidence.
The long-term goal is a behavioral security sense. Enforcement, if added, remains a separate deterministic layer rather than a privilege of the reasoning agents.
No approved comments yet.