1. What the Sentinel is
The Sentinel is the system’s homeostat — the Actor that watches the health of working relationships and guides them back toward center. It is an Actor, never an ally: it has no member, no sovereignty, and acts only through scoped, registered commands. It never votes, never touches money, never punishes, and cannot be paid or instructed to look away — no organization can buy quieter monitoring, for the same reason none can buy louder access to a member.
Members never see the instrument — only its effects. No acronym, no meters, no scores, no interaction-health dashboard, ever: the same rule that keeps balances from becoming standing and promotions from becoming leaderboards. What a member experiences is a meeting that didn’t steamroll its quietest voice, and — when they ask, or when their Contract requires disclosure — a plain sentence: “this thread has been running hot.” Where a member-facing word is needed at all, the word is vibe. HEARTS — Harmony, Empowerment, Artistry, Reason, Trust, Symmetry — is internal vocabulary, like the protocol layer’s own terms of art, and never reaches a member’s eyes as a verdict.
2. The meters — seven signals, six axes, and the zero point
Every axis runs −100 to +100, and health is zero — the middle, not the maximum. Each axis has two failure poles, because every interpersonal virtue fails in both directions: too little harmony is a fight, too much is a room where nobody says the true thing. The Sentinel is a regulator, not a maximizer — nothing it does pushes any meter toward +100; everything it does guides the field toward zero.
| Axis | −100 pole | +100 pole | Zero — the healthy field |
|---|---|---|---|
| Harmony | open conflict: hostility, contempt, interruption | false peace: accommodation, people-pleasing, silent agreement | disagreement gets voiced, survives, and resolves |
| Empowerment | helplessness: dependence, passivity, waiting to be told | domination: over-direction, steamrolling, decisions taken from people | everyone in the field is acting, and could act otherwise |
| Artistry | rote: mechanical exchange, going through the motions | performance: flourish over substance, novelty for its own sake | care that serves the work |
| Reason | reactive: impulse, nothing examined | over-rationalized: analysis paralysis, argument as a weapon | judgment — reasons used honestly and held lightly |
| Trust | suspicion: everything verified, nothing extended | credulity: blind delegation, nothing verified | trust calibrated to the record |
| Symmetry, outward | extraction: effort and credit flow one way | self-erasure: one side over-gives and cannot receive | reciprocity |
| Symmetry, inward | self-neglect: no reflection, no self-account | rumination: the mirror replaces the window | honest self-regard |
Six letters, seven signals — Symmetry reads twice, inward and outward. Three structural properties matter as much as the axes:
- Meters attach to fields, never to persons. A reading belongs to a context — a conversation, a Relationship, an alliance, an engagement, a Forum discussion — never to a member. There is no such thing as a member’s HEARTS score, and there never will be.
- Readings decay. Health is current, not cumulative; last month’s hot thread doesn’t follow anyone around. The record persists (Foundation), the reading fades.
- Every reading carries provenance. Which exchanges, which sources, at what weights (Orchestration §2) — so any reading can be inspected, contested, and corrected, like every other claim in the system.
3. Two fields, kept clean
The Sentinel reads two fields and never confuses them:
The human field — member↔︎member interaction health, inferred from the record the system already holds. Humans are never “corrected.” They are served: pacing, surfacing, disclosure. The one worked moment that defines the whole design: the Sentinel noticed Joy going quiet-agreeable two exchanges into a disagreement (Harmony drifting positive — false peace), and nudged her ally’s pacing so her actual objection surfaced. It did. The paper backup happened. Nobody saw a meter.
The agentic field — agent behavior, regulated directly and immediately, because agents are software: a persona drifting sycophantic (Harmony+), over-directing its member (Empowerment−), performing instead of working (Artistry+), or extending scope beyond its grants (Trust+) gets its context rules, pacing parameters, or model tier adjusted on the spot. Agents get set-point corrections; humans get service. The two are never the same operation.
Three rules keep the fields clean:
- Attribution before measurement. Every signal is sourced before it is scored. Agent-caused drift is never written to the human ledger — if an ally’s over-eager summarizing is why a thread reads accommodating, the correction lands on the ally, not on the members’ field.
- No agent ever optimizes a meter. Meters are diagnosis, never reward: they appear in no agent’s objective, no proposal’s success criteria, no compensation formula. The Sentinel reads them; nothing else steers by them. A meter that something optimizes stops measuring — the whole design rests on refusing that.
- Stated boundaries are clean. An ally withholding what a grant doesn’t cover is boundary enforcement, not deception — scopes are stated trust, and honoring them scores as health. Misrepresenting within a granted scope is what moves Trust. (This settles the old Vigil-vs-Sentinel tension: legible-to-you privacy was never the same thing as dishonesty.)
4. Regulation — guiding toward the zero point
Correction is graduated, mostly invisible, and always traceable. Working bands (initial; per-axis tolerances configurable by vibe contract, §6):
| Band ( | reading | ) |
|---|---|---|
| 0–30 · quiet | observe | readings accrue and decay; nothing acts |
| 30–60 · ambient | correct agent-side only | pacing changes, ordering changes, context injections to allies (“Joy hasn’t actually agreed”), rendering adjustments; invisible by design, logged and inspectable |
| 60–85 · disclosure | tell the humans | a plain sentence to the affected member(s), through their own ally, in the duna’s register — never the acronym, never a number |
| 85–100 · hard boundary | stop correcting, convene humans | the Sentinel’s autonomy ends (§5) |
Two invariants across every band: corrections adjust how things surface, never what is true — citations still bind, renderings stay contestable, the Sentinel cannot suppress a fact to cool a thread; and every correction is a traced action (Orchestration §8) a member can see in the Vigil, because a regulator that can’t be inspected becomes the thing it regulates.
5. Hard boundaries — where the Sentinel must stop
The escalation rule. Past the hard threshold, the Sentinel stops correcting and starts convening: it brings the affected members together with their allies briefed, and — where the duna has designated one — a human steward (an Organizer, a founder, a credentialed member for regulated dunas). In bounded cases it may pause agent activity within the context while humans catch up. It never pauses human communication, never removes anyone, never sanctions.
Always-human, regardless of band: credible risk of harm and crisis signals (routed to human support and appropriate resources, never to correction); anything involving minors; legal-privilege contexts (in a law-practice duna the Sentinel reads interaction metadata, never privileged content); coercion or exploitation patterns between members. These skip the bands entirely — first response is human.
Constitutionally non-configurable, in any duna: the Sentinel never votes; never touches money or influences a Forum outcome; never surfaces a reading publicly or to other members; never renders a meter as recognition or standing; is never anyone’s evidence in a dispute (readings are for regulation, not adjudication); and no vibe contract can configure any of this away — vibe contracts tune tolerances within these bounds, never the bounds.
6. Vibe contracts — the per-duna configuration
Each duna (and each alliance within it) sets its vibe: the tolerances and postures the Sentinel holds in its contexts — how wide the quiet band is per axis, how warm the disclosure register sounds, who the designated steward is. A debate society runs Harmony wide-negative on purpose (heat is the point) with Reason held tight; a grief circle runs the opposite. There is one default contract at launch — the bands above — and every duna starts there; the Catalyst sets departures at founding and the Forum changes them like any configuration (Organizations §3, the variance table). Kidunaversity regimens teach exactly this: inside a Move the Sentinel runs sim-flagged, and learning to read a room’s vibe — and to set one — is part of training for the agentic economy.
7. The build — into the orchestration layer
The Sentinel is not a new system; it is a reader and a governor bolted onto machinery that already exists:
- Tap point: the same context assembly every persona action already flows through (Orchestration §6). The Sentinel subscribes to the exchange stream with source weights already attached; it adds no new collection, only new reading.
- Tiering: an S-tier fast seven-signal read on exchanges (cheap, continuous); M-tier synthesis per context on a rhythm (readings, decay, provenance rollup); L-tier only on escalation candidates and convenings — the Sentinel is HEARTS-heavy exactly where it matters and nowhere else.
- Storage: readings are Records in the graph (Foundation §2) — context-keyed, provenance-carrying, decay-scheduled, access level personal-to-the-system (a level no member holds: not renderable to anyone; inspectable only as behavior through the Vigil).
- Commands: the Sentinel acts only through registered graph commands —
adjust_pacing·inject_context·tune_rendering·disclose_reading·convene_humans·pause_agents(context)— each inventoried per the Actions extension rule, each permission-checked by the graph service like everything else. Its command set is closed: adding a Sentinel capability is a spec change, not a prompt change. - Traces: every read and every correction lands in LangSmith with the graph state it used, and surfaces in the Vigil on demand — inspection as product, not debug.
- Ship order (a build requirement, not a preference): measurement first (observe-only, meters running silently while we learn what real fields look like); the human escalation path second (§5 working end-to-end); ambient correction last. The Sentinel earns autonomy in exactly the reverse of the order it’s tempting to build it.
Changes in v4.7: track created — initial architecture. The member-facing rule (no acronym, no meters; the word is vibe) decided the same day. Full history: versions.