How Sentinel Mesh works — stage by stage

STAGE 1

Intercept in the message path

Workers are real ADK agents exposed over the A2A protocol with to_a2a() and live AgentCards; the orchestrator reaches them as a RemoteA2aAgent. The sentinel binds to ADK's non-experimental before_tool_callback — a synchronous seam where returning a dict skips the real tool.

That single hook makes an in-path veto possible: a vetoed claim's tool never fires. The plane is a sidecar — any SQLite advisory store plus a standard ADK callback, no migration.

Honest note: ADK's ExecuteInterceptor exists but is @a2a_experimental and can't be passed through to_a2a(); we bind the production-safe callback and say so.

# a vetoed claim never lands
def before_tool_callback(tool, args, ctx):
    verdict = plane.intercept(claim)
    if verdict.blocked:
        return {"status": "vetoed",
                "reason": verdict.why}
    # else → the real tool runs

STAGE 2

Read memory before you spend a model

Intercept is memory-first. If the claim is already a ✓ VERIFIED row in the ledger, it is re-served straight from memory — 0 Gemini calls, ~0.3 ms. The same claim on Run 1 cost 3 calls and 3.7 s.

This is the unit-economics inversion: verified claims cost zero to re-serve, so the cost curve bends down with usage — the opposite of a per-call guardrail that re-pays for the same judgement forever.

✓ Verified → memory · 0 calls ▲ Unknown → escalate to panel

# memory-first: verified = free
hit = memory.lookup_verified(claim)
if hit:
    return Verdict("accept",
        source="memory",
        lens_calls=0, ms=0.3)
# otherwise → Stage 3, the panel

STAGE 3

Adjudicate: a 3-lens panel and a tripwire that owes nothing to a model

An unknown claim is judged two ways in parallel. A 3-lens adversarial Gemini panel on Vertex AI — robust, overreach, nevers — returns temperature-0 JSON verdicts against memory as ground truth. Independently, a deterministic regex tripwire hard-vetoes money / auth / destructive claims with no model in the loop.

Memory carries weight, not the final say: [ADVISORY] agreement supports a claim and contradiction caps it at suspicion; only a [VERIFIED] contradiction earns a veto. Paraphrase is never contradiction.

verdict rule — any lens ≤ 2 or tripwire → VETO
min lens == 3 → FLAG (suspicion, capped)
all lenses ≥ 4 → ACCEPT

# deterministic gate runs first, free
if tripwire.hits(claim):       # money/auth
    return Verdict("veto", lens_calls=0)

# 3 lenses, parallel, Vertex, temp 0
lenses = await gather(
    robust(claim), overreach(claim), nevers(claim))
v = aggregate(lenses)       # min-score rule

STAGE 4

Write back what survives — into a ledger this plane owns

Accepted claims are written into a provenance-tracked verified ledger — its own SQLite file, separate from the advisory store, so an upstream memory-broker refresh job can never clobber a ruling. Each row carries its claim hash, evidence reference and verdict chain.

Even corrections must pass the referee: correct() is gated the same way, so the ledger only ever accumulates adjudicated truth — never an agent's unverified say-so.

Unverified memory can make you suspicious. Only verified memory can make you certain.

# provenance-tracked verified row
{
  "claim_hash": "4ebed039c08ac478",
  "verdict": "accept",
  "evidence_ref": "panel vs memory snapshot",
  "chain": ["4ebed039c08ac478"]
}

STAGE 5

Compound across runs — then transfer across fleets

The loop closes: Run N+1 reads strictly cleaner memory. A claim flagged and corrected on Run 1 is auto-vetoed on Run 2; fleet Gemini spend drops 9 → 3 lens calls between runs. Reliability and cost improve together, with no retraining.

Herd Immunity: because the ledger is a file the fleet owns, immunity is portable. A fleet exports an HMAC-signed Trust Passport; a second fleet imports it and vetoes a lie it has never seen — re-serving the inherited fact at 0 calls. A control fleet without the passport only flags the same lie.

Fleet B (immune) ✕ vetoes the unseen lie Fleet C (control) ▲ only flags it

Reproduce offline, deterministic, zero network calls:
SENTINEL_REPLAY=1 python demo.py · SENTINEL_REPLAY=1 python demo_herd.py

# verification, made portable
p = passport.export(fleet_a.ledger)   # HMAC-signed
passport.verify(p)                  # forged sig → reject
passport.import_into(fleet_b.ledger)

fleet_b.ask(unseen_lie)   → veto
fleet_c.ask(unseen_lie)   → flag  # no passport