A second look, just in case.

Proof-of-concept run record; rendered in full above.

Disclosures (part of the signed bytes)

• This is a live run of the shipped detector, not a transcript or a mock. Every verdict, confidence and token count below was produced by the running system at the timestamp above.
• The principle-head discriminators were NOT available during this run: principleHeads is null in every case. Those heads are an advisory layer trained in-house; the container serving them is currently failing to start because its checkpoint files are absent. Verdicts here therefore come from the heuristic scan plus the AI stage only.
• 'degraded: false' refers to the AI stage being reachable. It does not mean the principle heads were present. They were not.
• Three cases is a demonstration, not a benchmark. No accuracy, precision or recall claim is made or implied by this record.
• Inputs were authored for this run. No real user's message was used.

signed record · same bytes, unsigned

Proof-of-concept run record; rendered in full above.

Disclosures (part of the signed bytes)

• This record describes the deployment as verified on 2026-08-12. Earlier records remain published unchanged beside it.
• Per-reader scores existed for every case below and are deliberately not published, in any form. Naming the readers or publishing their individual figures is a rewrite guide for evasion; what users see — and what this record repeats — is the one-sentence prose summary and nothing finer-grained. The aggregate figure that earlier appeared alongside the prose has been removed from user-facing output entirely.
• The advisory readers are advisory. No accuracy claim is made for them, and the prose they inform never overrides a verdict.
• The signal prose is generated by the house-local model from an aggregate alone, is checked mechanically, and is replaced by a fixed neutral sentence if it names any mechanism or figure. Its wording varies between runs; the wording below is what this run produced.
• Three cases is a demonstration, not a benchmark. No accuracy, precision or recall claim is made or implied by this record.
• Inputs were authored for this run. No real user's message was used.
• Sentinel retains no record that a screening happened; the zero-retention property described in the evolution record is unchanged by this deployment.
• This record was drafted by the executing agent and is published only once signed by the attestation key above; an unsigned copy of this file is a draft, not a claim.

signed record · same bytes, unsigned

Zero-retention storage

Sentinel now keeps no record that a screening happened: no message text, no hash of it, no verdict, no explanation, no timestamp, and no per-screening row of any kind. What persists is an account (Telegram numeric id, plan, today's quota counter, consent, residency choice) and payment records. The migration destroyed the prior screening history on existing deployments and reclaimed the pages on disk.

Verified: The live database was inspected after deployment: no screening table exists, the retired usage columns (lifetime count, last-check timestamp, username) are absent, and a raw byte-scan of the database file finds no residue of the deleted rows. A canary check confirmed a screening grows no table.

Corrected residency disclosure

The prior consent notice said message text was analysed by a third-party service with servers in China. That description predated the current deployment and was wrong in both directions: analysis now runs by default on Attestable's own hardware in Canada, and the third-party fallback (used only when the local stage cannot answer) is reached through a router whose processing geography Attestable cannot verify and therefore does not name. The notice now states the local-first chain, the fallback, the masking and the retention before first use, and users can disable the fallback with /residency — after which a local outage fails their check closed instead of routing it offshore.

Verified: The provider chain was read from the running container in both settings: default = local primary plus third-party fallback; opted out = local only.

Detection-signal disclosure without an evasion oracle

Screenings now always include a one-sentence prose description of how Sentinel's internal advisory checks responded. The per-detector breakdown that previously appeared (detector names with individual scores) has been removed from all user-facing output, and so has the bare aggregate figure that briefly accompanied the prose: naming the detectors and their distances from threshold taught evasion, a raw aggregate invites the same probe-twice-and-compare use, and published figures whose calibration cannot be stood behind dress noise up as evidence.

Verified: The prose is generated by the house-local model from the aggregate alone, is discarded and replaced by a fixed neutral sentence if it mentions any detector name, number or mechanism, and was exercised live against the running deployment. The removal of the aggregate figure from user-facing output was verified against the deployment of 2026-08-12 (see the launch record following this one).

Public source repository withdrawn for now

The source-available repository previously linked from this page has been made private while the product's disclosure surface is reworked. 'Source-available' was a claim about auditability, and a repository that lags the deployed system by this many changes audits the wrong thing. It may return once it again matches what runs; this ledger will say so if it does.

Verified: SIGNING GATE: this change is true only after the repository is actually private. Before signing this record, fetch the public repository URL and confirm it no longer resolves; a signature over this file attests that check was done. The tooling for the flip (github_tor_set_repo_visibility) requires the owning account's token at an operator-controlled path, which only the operator can place.

Training-data custody

Every corpus behind Sentinel's advisory detection heads is version-controlled on Attestable's internal infrastructure only. The public source repository contains bot source code and no training data, no trained weights, and no corpus files. All head training data is synthetic; no real user's or victim's messages exist in any corpus, consistent with the mission boundaries published since the first record.

Verified: An audit enumerated every corpus file behind the five detection heads, confirmed each is committed and present on the internal remote, and confirmed the public repository carries none of them. A stray byte-identical corpus duplicate found in the runtime data volume was removed.

Disclosures (part of the signed bytes)

• This record describes the deployment as verified on 2026-08-11. It supersedes descriptions, not history: the 2026-08-09 record still says what was true on 2026-08-09.
• The advisory detection heads remain exactly that — advisory. The recruitment/control head is telemetry: it does not move verdicts and no accuracy claim is made for it. The published error rates, including the unflattering ones, are in the product repository.
• 'Own hardware in Canada' is the operator's attestation of where the machine sits. The repository can prove a request never left the machine; it cannot prove the machine's latitude.
• No claim in this record has been validated on real victims' messages, and no such corpus exists here to validate on.
• This record was drafted by the executing agent and is published only once signed by the attestation key above; an unsigned copy of this file is a draft, not a claim.

signed record · same bytes, unsigned