Developers · Event model

Everything is an event. Every event is recorded.

Sentinel has no free-floating chat: investigations open on events, proceed as events, and close as events. That's what makes the workflow match real operations, and what makes the ledger a complete account rather than a partial log.

Triggers

Three shapes of incoming event

Alert-shaped

A monitoring alert, an error-rate threshold crossed on the ingestion service, arrives with its labels and firing context intact, and maps to an agent and policy.

Incident-shaped

A declared incident from your on-call tooling, with severity, service, and responder context, so the investigation attaches to the incident your team is already tracking.

Operator-dispatched

A teammate selects, edits, validates, and dispatches an event sample by hand, for exploratory testing, rehearsal, and ground-truth evaluation runs.

States and entries

A small state machine, a rich ledger

STATES

Investigations move through explicit states

triggered → investigating → reported | escalated. The transitions are few and meaningful; the detail lives on the ledger, not in the state machine. A run reaches exactly one final state, and the transition that got it there is itself an entry.

states · run lifecycle

triggered · event accepted entry

investigating · agent active entry

reported · review complete final

ENTRIES

Five entry types cover everything

Tool calls with their outputs, model prompts with their responses, evidence artifacts, configuration overlays, and human interventions. Every entry is typed, timestamped, and appended, never rewritten, so the ledger reads as one causal story.

ledger-entry.json

{
  "type":  "tool_call",
  "tool":  "grafana.query",
  "input": { "panel": "ingest-5xx" },
  "output_ref": "ev-07",
  "policy": "observability-readonly",
  "seq": 12   // append-only ordering
}

OUTCOMES

Reports and escalations are events too

A posted report carries its citations; an escalation carries the reason and the human it went to. Downstream systems, your incident tracker, your chat, subscribe to these the same way Sentinel subscribed to your alerts.

outcome.json

{
  "type": "report_posted",
  "findings": 3,
  "citations": ["ev-07", "ev-08", "ev-09"],
  "ledger": "/v1/runs/inc-4212/ledger"
}