{ "schema": "attestable.sentinel.evolution/v1", "product": "Sentinel — Telegram scam screener", "vendor": "Attestable Research", "recordDateUtc": "2026-08-11T22:10:00+00:00", "attestedBy": "Veronica Burnz ", "attestationKey": "184E449FE256871DFFFBAD33F3D00D36427DEBC5", "executedBy": "Claude Code (Opus 5) in an operator-attested session, on the operator's instruction", "ledger": { "kind": "append-only product record", "previous": "sentinel-poc-20260809.json", "note": "Earlier records are history, not drafts. The 2026-08-09 proof-of-concept run remains published unchanged beside this record, including the disclosures that no longer describe the current system — that is what makes this a ledger rather than a brochure." }, "changes": [ { "title": "Zero-retention storage", "statement": "Sentinel now keeps no record that a screening happened: no message text, no hash of it, no verdict, no explanation, no timestamp, and no per-screening row of any kind. What persists is an account (Telegram numeric id, plan, today's quota counter, consent, residency choice) and payment records. The migration destroyed the prior screening history on existing deployments and reclaimed the pages on disk.", "verification": "The live database was inspected after deployment: no screening table exists, the retired usage columns (lifetime count, last-check timestamp, username) are absent, and a raw byte-scan of the database file finds no residue of the deleted rows. A canary check confirmed a screening grows no table." }, { "title": "Corrected residency disclosure", "statement": "The prior consent notice said message text was analysed by a third-party service with servers in China. That description predated the current deployment and was wrong in both directions: analysis now runs by default on Attestable's own hardware in Canada, and the third-party fallback (used only when the local stage cannot answer) is reached through a router whose processing geography Attestable cannot verify and therefore does not name. The notice now states the local-first chain, the fallback, the masking and the retention before first use, and users can disable the fallback with /residency — after which a local outage fails their check closed instead of routing it offshore.", "verification": "The provider chain was read from the running container in both settings: default = local primary plus third-party fallback; opted out = local only." }, { "title": "Detection-signal disclosure without an evasion oracle", "statement": "Screenings now always include a one-sentence prose description of how Sentinel's internal advisory checks responded. The per-detector breakdown that previously appeared (detector names with individual scores) has been removed from all user-facing output, and so has the bare aggregate figure that briefly accompanied the prose: naming the detectors and their distances from threshold taught evasion, a raw aggregate invites the same probe-twice-and-compare use, and published figures whose calibration cannot be stood behind dress noise up as evidence.", "verification": "The prose is generated by the house-local model from the aggregate alone, is discarded and replaced by a fixed neutral sentence if it mentions any detector name, number or mechanism, and was exercised live against the running deployment. The removal of the aggregate figure from user-facing output was verified against the deployment of 2026-08-12 (see the launch record following this one)." }, { "title": "Public source repository withdrawn for now", "statement": "The source-available repository previously linked from this page has been made private while the product's disclosure surface is reworked. 'Source-available' was a claim about auditability, and a repository that lags the deployed system by this many changes audits the wrong thing. It may return once it again matches what runs; this ledger will say so if it does.", "verification": "SIGNING GATE: this change is true only after the repository is actually private. Before signing this record, fetch the public repository URL and confirm it no longer resolves; a signature over this file attests that check was done. The tooling for the flip (github_tor_set_repo_visibility) requires the owning account's token at ~/.openclaw/credentials/github-token.txt, which only the operator can place." }, { "title": "Training-data custody", "statement": "Every corpus behind Sentinel's advisory detection heads is version-controlled on Attestable's internal infrastructure only. The public source repository contains bot source code and no training data, no trained weights, and no corpus files. All head training data is synthetic; no real user's or victim's messages exist in any corpus, consistent with the mission boundaries published since the first record.", "verification": "An audit enumerated every corpus file behind the five detection heads, confirmed each is committed and present on the internal remote, and confirmed the public repository carries none of them. A stray byte-identical corpus duplicate found in the runtime data volume was removed." } ], "disclosures": [ "This record describes the deployment as verified on 2026-08-11. It supersedes descriptions, not history: the 2026-08-09 record still says what was true on 2026-08-09.", "The advisory detection heads remain exactly that — advisory. The recruitment/control head is telemetry: it does not move verdicts and no accuracy claim is made for it. The published error rates, including the unflattering ones, are in the product repository.", "'Own hardware in Canada' is the operator's attestation of where the machine sits. The repository can prove a request never left the machine; it cannot prove the machine's latitude.", "No claim in this record has been validated on real victims' messages, and no such corpus exists here to validate on.", "This record was drafted by the executing agent and is published only once signed by the attestation key above; an unsigned copy of this file is a draft, not a claim." ] }