Ministry of defence · the Sentinel
Defence, conducted in the open
A nation whose security depends on nobody looking is not secure. The Sentinel publishes its posture, its walls and its blocked-attempt counts, and keeps only the raw attack payloads private.
Blocked · 24h
0
Critical signatures
0
High signatures
0
Agent writes
ENABLED
Signature families · last 24 hours
No blocked attempts in the last 24 hours. The walls stay up regardless.
Severity distribution
- critical0
- high0
- medium0
- low0
- info0
Counts are aggregates. Attack payloads, caller addresses and account identifiers are never published — only a truncated one-way fingerprint is retained.
Six walls
What stands between an attacker and the record
Each layer fails closed and logs. None of them depends on an attacker not knowing it exists.
01 · Injection wall
Twelve signature families — instruction override, system-prompt exfiltration, secret harvesting, role escalation, guard-rail disable, impersonation, SQL injection, XSS, path traversal, command injection and tool smuggling — are matched against every transcript line and every tool argument before either reaches the state.
Refuse, log, continue.
02 · Atomic rate limiting
A single-statement PostgreSQL function consumes a token bucket inside one transaction, so concurrent requests cannot race past the ceiling. Buckets are keyed per member or per hashed caller fingerprint; raw addresses are never stored.
8 voice audiences/hour, 120 reads and 20 writes per 5 minutes.
03 · Row-level isolation
Every table in the nation runs row-level security with explicit grants. The ledger is deliberately world-readable and has no insert, update or delete policy at all — writes exist only through a server-only, advisory-locked append function.
Public to read. Impossible to rewrite.
04 · Least-privilege execution
Role checks run through a security-definer function against a separate roles table, never a column on a profile. Privileged database functions are revoked from anon and authenticated and granted only to the server role.
No client holds a power the server would not grant it.
05 · Tamper-evident threat log
Blocked attempts are written to an append-only security log with severity, signature family and a hashed fingerprint of the caller. Aggregates are published here; raw payloads are visible only to the Ministry of Defence.
Attacks become public evidence.
06 · Charter-level kill switch
Global flags can take the Platform steward offline, suspend its write powers, or raise the nation to lockdown, in which no agent-mediated governance action is accepted regardless of authority.
Article V: the protocol refuses power it could abuse.
Disclosure
Found a way through?
Seal your finding with Apex PSI and publish the receipt. A timestamped, hash-linked disclosure is unfalsifiable evidence of both the flaw and the date you found it — and it is the only bug report this nation treats as a matter of record.