# Sentinel single-wallet release — 2026-10-14 ## Implemented outcome The existing Sentinel dashboard now presents one personal agent and the wallet that authenticated with Phantom. Connection activates the personal agent automatically and queues its baseline. Reconnection is idempotent; a deliberately paused agent stays paused. Existing multi-wallet records remain audit history, but other agents are paused and other-wallet jobs are fenced during migration. The main screen shows real coverage, wallet activity, findings, checking stages and emergency-destination readiness. Supplied Sentinel branding, BTCHPC retro-blue clouds and typography remain. Technical tools and the existing detector demonstration are under Advanced Settings. ## Operational status and limits | Capability | Implemented and tested | Deployment limitation | | --- | --- | --- | | Single-wallet activation and private records | Verified wallet message sessions, automatic activation, owner isolation, scoped personal state, pause/resume and persisted baseline jobs | Actual human Phantom approval and browser layout are not tested here; a Node DOM contract harness exercises the actual interface against the backend | | Wallet transaction monitoring | Wallet history/checkpoints advance independently of token-discovery failures; finalized history catch-up, job leases, retries and deduplication retained | Existing independent hourly worker remains enabled. HTTP failures can still interrupt transaction discovery | | Live dashboard | Private SSE stream, server-side Solana logs/account subscriptions, confirmed polling fallback, durable event hints, actual status/finality and evidence drawers | Page subscriptions end on browser closure. Dedicated WebSocket provider, authenticated provider webhook or an always-on event runner must be configured before claiming continuous low-latency background coverage | | Continuous event adapters | Authenticated webhook ingress and independently deployable Node event runner; per-agent listener heartbeat, retry and reconciliation; untrusted event hints require mainnet RPC verification | Adapters are implemented, but neither the external runner nor provider webhook is deployed. No independent live event listener is claimed | | Transaction inspection | Read-only legacy/v0/v1 JSON transaction decoding, SPL/Token-2022 instruction checks, balance evidence, explicit unsupported coverage, preliminary confirmed display, finalized investigations and signed receipts | Unsigned pre-sign wire inspection remains legacy/v0 only. Unknown programs are not automatically malicious. Partial evidence is not a complete assessment | | Permissions/baselines | Both token programs, complete baseline retention, permission comparisons and scheduled retry | Hosted legacy SPL and Token-2022 token discovery still return HTTP403 on shared providers. Current permissions and a complete mainnet baseline remain unavailable | | AI, malicious-address intelligence and off-site alerts | Existing evidence-bound AI pipeline, feed freshness/source checks and verified Telegram outbox retained, tested with controlled transports | No AI key, malicious-address feed or Telegram credentials/verified live recipient are configured. GoPlus token capabilities are not a malicious-address feed. No live inference or notification delivery is claimed | | Emergency destination | Keypair generated only locally after user action; explicit private-backup download, domain-bound proof from both wallet keys; backend stores only verified public destination | User must retain/import the private backup. No server-controlled emergency wallet and no automatic rescue | | Safe recovery preparation | Exact SOL amount/fee/balance checks, verified destination binding, unsigned simulation, explicit Phantom approval and exact finalized transaction verification | SOL only; no token recovery. Preparation and independent SDK decoding tested; no mainnet transfer or funded recovery approval performed | | Existing protection and evidence | Simulation, safe delegate revoke, fixed synthetic lab, receipt verification/download and investigation evidence retained under Advanced Settings | Real wallet signing/broadcast approval remains untested. Receipt integrity is not proof that a security conclusion is correct | | Pre-sign interception and secured vault | Research/design retained in INTEGRATIONS.md | Planned; no unrelated-app transaction interception, unrestricted autonomous transfers or guaranteed asset recovery | ## Reproducible tests **88 tests pass** with: ```sh node --test tests/*.test.js artifacts/api-server/src/lib/guardian.test.mjs node hosting/build.mjs ``` New tests cover idempotent one-wallet activation, migration scope, paused reconnects, verified confirmed-to-finalized transitions, signed automatic investigations, late-response monotonicity, unrelated-signature rejection, RPC failures retaining previous evidence, token403 independent wallet catch-up, actual WebSocket subscription acknowledgments, account-change deduplication, session/webhook authorization, sticky history gaps, scoped/expired event heartbeats, dual-owner emergency proofs, nonce replay, exact unsigned SOL decoding through the bundled SDK, fees/reserved balance, simulation failure and missing-data handling. Existing tests cover background processing after logout, model evidence validation, notification delivery/retry, RPC429/fallback, worker lease recovery, revocation, simulation, tampered receipts and real interface/backend journeys. Controlled security fixtures are isolated in SQLite and never create synthetic live wallet alerts. ## Actual mainnet read-only verification A real public mainnet transaction was retrieved from the official mainnet API: signature `5RfgPn5pPf4QK8gPCSLDuCpZxUrpN7cLEn87Qsxm7oXnfjhN6cY75FRUgrVTkpUoxqMkUjk1UfqJxoLM2aoP4fry`, slot **456659533**, version **1**, signer `AvocW1HYwENdgbY89es1nAhJMPgtVdbdVmC29tLpCiGv`. The previous maximum supported version0 request failed with RPC -32015; version1 returned actual transaction data. This immutable public-chain response is preserved as a reproducible detector test fixture. Supported transfer and Token-2022 instructions decode; an unparsed program keeps the result partial and is not labeled malicious merely because it is unfamiliar. No transaction was signed or broadcast. Primary documentation: [Solana transaction versions](https://solana.com/docs/core/transactions/versioned-transactions), [Solana logs subscriptions](https://solana.com/docs/rpc/websocket/logssubscribe), [Helius authenticated event delivery](https://www.helius.dev/docs/webhooks). Live read-only retrieval does not establish complete coverage for a connected user's wallet. ## Required configuration before full operation 1. Supply a dedicated mainnet RPC key/credential with token discovery, history and simulation capability through server-side secrets: HELIUS_API_KEY or SOLANA_RPC_URL with the supported auth configuration. Browser keys are never exposed. Existing public endpoints still fail token discovery403; the release does not disguise this as success. 2. Supply SOLANA_WS_URL and deploy guardian/event-runner.mjs to an always-on Node22+ host with separately provided service/worker credentials, or configure a provider webhook using SOLANA_EVENT_WEBHOOK_TOKEN. Credentials must stay in environment memory. Current hosting has no configured always-on background socket facility; no new hosting subscription is purchased. 3. Configure an approved AI model key, fresh reputable address intelligence, Telegram bot webhook and verified opt-in recipient to enable those integrations. 4. Run real Phantom/browser verification, a complete dedicated-provider mainnet assessment, actual after-browser-close event delivery and a user-approved devnet protection pilot before treating those integrations as live-tested. The existing hourly retries remain active for provider recovery. Worker heartbeat and HTTP200 show invocation, not successful assessment. No runtime credentials were rotated and sharing was preserved. --- ## Previous release history # Sentinel consumer experience update — 2026-10-14 The existing application now presents a guided Connect Phantom → Activate Sentinel → First assessment journey. The Home screen centers on a large shield, five plain-language status states, monitored-wallet count, actual findings awaiting review, and the last successful security check. Only Home, My Wallets, Threats, Protection and Settings are primary navigation destinations. Technical operations remain in Advanced Terminal. BTCHPC branding, clouds, fonts and the existing backend are preserved. | Release feature | Verification | Limits | | --- | --- | --- | | Guided activation and Home status | Real interface code executed against the wallet-authenticated backend in a Node DOM contract harness; status tests cover absent baseline, stale results, outages, paused agents and open alerts | Real browser layout and actual Phantom approval are untested in this environment; no browser-control plugin is available | | Agent activity, schedule and progress | Reads persisted observations/checks, memory, logs and next eligibility; progress marks only backend-completed operations; unknown checks stay unavailable | Hourly observations, not signature interception; next eligibility is explicitly tied to the next hourly run | | Plain-language threat review | Controlled delegate change creates a real stored case/alert after logout; UI reauthentication displays the warning and evidence drawer; pause/resume and acknowledgment persist | Indicators require user review; ordinary account revoke cannot remove a mint permanent delegate | | See Sentinel in Action | Public fixed synthetic examples execute the production detector; delegation, Token-2022 authority, outflow, failed-approval and unrelated-wallet controls pass | Public demos create no wallet records, jobs, receipts, alerts or transactions. Authenticated signed test runs remain available separately | | Advanced tools | Investigation cases, signed receipts/download/verification, raw logs, health, monitoring configuration, benchmarks, unsigned firewall, simulation and approved revoke workflows retained | No unrestricted automatic recovery or cross-app signature blocking | | Notifications | Controls reflect actual configured/verified opt-in state; existing persisted outbox and delivery tests retained | Telegram is not configured live; no live off-site delivery is claimed | The test suite contains **69 passing tests**: 63 retained security/backend tests plus six consumer status, progress, public-demo, HTML contract and interface/backend journey tests. Controlled fixtures are isolated in SQLite and never become live wallet security events. Existing tests additionally exercise AI evidence validation, alert delivery/retry, simulation, signed receipts, wallet authentication, owner isolation, rate limits and worker recovery. Live provider verification during this update: both legacy SPL and Token-2022 discovery continue to return **HTTP403**. Basic balance/network checks respond; transaction-discovery availability has fluctuated between checks. No dedicated RPC key, AI model key, Telegram credentials or fresh malicious-address feed is configured. These failures are **not resolved** and no complete hosted assessment or full monitoring coverage is claimed. Missing checks stay visible under Limited Protection; existing recovery retries remain enabled. Recommended configuration: supply a dedicated method-capable mainnet RPC through server-side secrets, an approved model-provider key, and verified opt-in Telegram credentials. Then repeat live wallet assessments and real Phantom/browser verification. This UI release does not purchase a provider, rotate credentials, alter sharing, or fabricate a successful scan. --- # Sentinel Personal Agent implementation report — 2026-10-13 This release preserves the existing BTCHPC website and retro-blue identity. The Sentinel homepage is now an Agent Command Center with a named persistent personal agent as its central element. Manual scanning remains an optional tool. | Capability | Implemented and tested | Live verification / remaining requirement | | --- | --- | --- | | Personal identity | Wallet-only authentication; names, wallet selections, policy priorities, thresholds, pause/resume and private operational workspaces | Anonymous signature authentication was verified in the prior live release. Actual Phantom interaction remains untested here. | | Persistent observations | Deployment automatically queues a baseline; independent worker jobs inspect balances, SPL/Token-2022 accounts, permissions and recent finalized history; actual phases persist | PublicNode/official fallback still reject token discovery with HTTP403. A dedicated RPC credential is absent. No fully successful hosted wallet baseline can be claimed. | | Agent memory | Complete inventories persist; later delegates/allowances/close authorities are compared against previous state; failed inventory cannot overwrite memory | Controlled integration tests pass; real mainnet permission-memory establishment remains blocked by RPC access. | | Automatic investigations | Finalized transaction cases and real snapshot-change cases; policy-aware alerts; prior-program context; signed receipts; atomic completion/deduplication | Verified in isolated integration tests, including after session logout. No synthetic live-wallet incidents are created. | | Command Center | Server-calculated active/paused/degraded/offline state; Full/Partial/Interrupted/Not Established coverage; monitored wallets, last observation/slot, lag, schedule, worker heartbeat, queues and persistent totals | UI is connected to real private records and health data. Browser visual/Phantom QA is unavailable. Full always means configured supported scope, never guaranteed safety. | | Real operation console | Actual persisted agent deployment, configuration, queue, provider failure/recovery, observation, receipt and verification events | System telemetry remains separate from personal incidents. No random metrics. | | AI analyst | Strict structured model outputs with instruction/account evidence validation; actual provider adapter; signed account-change explanations | No model key supplied. OpenAI Developers must be enabled for secure OpenAI credential provisioning, or another provider configured securely. A key's presence alone is not treated as verified inference. | | Threat intelligence | Configured fresh source-backed indicators plus GoPlus token capability observations; timeout regression repaired; stale evidence excluded | A verified malicious-address feed is not connected. Token capabilities alone do not establish malicious intent. | | Off-site notifications | Telegram private-chat verification, authenticated webhook, persisted outbox, retries and opt-out; controlled change → alert → delivery integration passes after logout | No Telegram bot credentials or verified live recipient supplied. Live off-site delivery is not claimed. | | Protection / Test Sentinel | Unsigned legacy/v0 inspection and simulation; explicit owned delegate revoke preparation/Phantom approval/confirmation; isolated actual-detector lab | Prior live lab receipts and simulation-error handling verified. A funded user-approved revocation is untested. No automatic fund transfers. | | Proof of Defense | Real signed input/output commitments; account-change/AI output included; opening a receipt requests actual stored-key verification; JSON download | Signature integrity is not proof that the security conclusion is correct. | | Browser interception / smart vaults | Existing compatibility/research design retained in INTEGRATIONS.md | Planned; no universal interception or guaranteed recovery claim. | ## Reproducible validation 68 tests pass: ```sh node --test tests/agents.test.js tests/guardian.test.js tests/security.test.js artifacts/api-server/src/lib/guardian.test.mjs node hosting/build.mjs ``` New tests demonstrate deploy → logout/close session → independent worker → successful controlled baseline → changed delegation → real case/alert → durable notification delivery. They verify Full/Partial/Interrupted/Not Established coverage, error retention/retry eligibility, expired sessions, job deduplication, policy suppression, account-evidence AI outputs and signed commitments. Existing tests cover nonce replay, cross-owner access, real-shaped Solana discovery, failed/unrelated transaction controls, RPC403/429/fallback/network checks, worker lease recovery, unsigned firewall/simulation, revoke binding and receipt tampering. Integration tests use isolated SQLite and controlled HTTP fixtures. This is distinct from live third-party verification. No user funds are used or transferred. ## Exact deployment requirements - Dedicated method-capable mainnet/archive RPC: configure secret `HELIUS_API_KEY`, or a credentialed `SOLANA_RPC_URL` / optional primary auth token and separate fallback. Public RPC remains shared capacity and is currently blocked for hosted token discovery. - Model credential: `OPENAI_API_KEY` through the secure OpenAI Developers setup flow, or `AI_API_KEY` plus the compatible HTTPS endpoint/model. - Notifications: server-secret `TELEGRAM_BOT_TOKEN`, `TELEGRAM_WEBHOOK_SECRET`, bot username, registered authenticated webhook and a verified opted-in recipient. - A reputable timestamped malicious-address/program feed if that monitoring priority is enabled. - Real Phantom/browser testing and an explicitly approved funded devnet defense pilot before treating wallet approval/revocation as live-tested. ## Production readback At the start of this change, hosted token-account discovery was rechecked and returned HTTP403 for both token programs; basic balances/network requests still worked. No dedicated RPC, AI or Telegram credential was configured. Live verification finished at **2026-10-13 21:34:31 UTC**: - Anonymous wallet authentication: HTTP200, without a ChatGPT access credential. - Personal named-agent deployment: HTTP201, baseline automatically queued. Private operational workspace: HTTP200, accurate `Not Established` coverage. - Independent worker after user logout: HTTP200, three actual jobs attempted and heartbeat persisted. The engineering agent's observation report retained successful network/balance/history checks and unavailable SPL/Token-2022 discovery/current permissions. No baseline was fabricated. - Its scheduled observation receipt verified; the actual-detector Token-2022 lab test passed with a valid signed receipt. - Rename and pause persisted; paused state read back correctly. Temporary engineering records were removed afterward. - No AI/model or Telegram credential was configured, so no live inference or off-site delivery was claimed. The existing hourly monitoring schedule is being resumed for ongoing backend observations and provider recovery attempts. This is hourly polling, not instant interception. Required token discovery remains blocked (HTTP403), so repeated worker invocations **do not** establish full wallet coverage. A fully successful hosted mainnet assessment and reliable dedicated capacity still require a dedicated provider credential.