Skip to content

Commit 3f6cd08

Browse files
Harshith029Harshith029
authored
Merge pull request #9 from Harshith029/project-site
Project site with an animated landing page, rea-style README, community files; remove the Render demo and deck
2 parents f98be0e + 9be7264 commit 3f6cd08

54 files changed

Lines changed: 6910 additions & 857 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/ISSUE_TEMPLATE/bug_report.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: Bug report
2+
description: Something in SENTINEL does not work as documented.
3+
labels: ["bug"]
4+
body:
5+
- type: markdown
6+
attributes:
7+
value: |
8+
Thanks for taking the time to report this.
9+
10+
**Is it a security vulnerability?** (an action let through that policy should refuse, an authentication or tenant-isolation bypass, leaked redacted data) Then please do not file it here: [report it privately](https://github.com/Harshith029/Sentinel/security/advisories/new) instead.
11+
12+
Never paste real tokens, keys, customer data or unredacted tool payloads. Use synthetic values.
13+
- type: textarea
14+
id: what-happened
15+
attributes:
16+
label: What happened?
17+
description: What you did, what you expected, and what happened instead.
18+
validations:
19+
required: true
20+
- type: textarea
21+
id: reproduce
22+
attributes:
23+
label: Steps to reproduce
24+
description: The smallest config, policy and calls that show the problem.
25+
placeholder: |
26+
1. sentinel.yaml with ...
27+
2. policy.yaml with ...
28+
3. The agent calls ...
29+
validations:
30+
required: true
31+
- type: textarea
32+
id: logs
33+
attributes:
34+
label: Logs or output
35+
description: Relevant lines from `sentinel serve` or `sentinel check`, with secrets removed.
36+
render: text
37+
- type: input
38+
id: version
39+
attributes:
40+
label: SENTINEL version
41+
description: Output of `pip show sentinel-prox`, or the commit you run from.
42+
placeholder: "0.2.2"
43+
validations:
44+
required: true
45+
- type: dropdown
46+
id: install
47+
attributes:
48+
label: How do you run it?
49+
options:
50+
- pip install
51+
- Docker / deploy/compose.yaml
52+
- From a checkout
53+
- Other
54+
validations:
55+
required: true
56+
- type: input
57+
id: environment
58+
attributes:
59+
label: Environment
60+
description: Operating system, Python version, and your MCP client and servers.
61+
placeholder: "Ubuntu 24.04, Python 3.12, MCP Python SDK client"

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
blank_issues_enabled: false
2+
contact_links:
3+
- name: Report a security vulnerability
4+
url: https://github.com/Harshith029/Sentinel/security/advisories/new
5+
about: Please report vulnerabilities privately, never in a public issue.
6+
- name: Documentation
7+
url: https://harshith029.github.io/Sentinel/
8+
about: Guides, configuration, policy reference and FAQ.

‎.github/ISSUE_TEMPLATE/documentation.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Documentation
2+
description: Something in the docs, README or examples is wrong, missing or unclear.
3+
labels: ["documentation"]
4+
body:
5+
- type: input
6+
id: location
7+
attributes:
8+
label: Where?
9+
description: The page URL or file path.
10+
placeholder: "https://harshith029.github.io/Sentinel/guide/policy"
11+
validations:
12+
required: true
13+
- type: textarea
14+
id: problem
15+
attributes:
16+
label: What is wrong or missing?
17+
description: Quote the text if it is inaccurate, and say what actually happens.
18+
validations:
19+
required: true
20+
- type: textarea
21+
id: suggestion
22+
attributes:
23+
label: Suggested change

‎.github/ISSUE_TEMPLATE/feature_request.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Feature request
2+
description: Suggest a capability or an improvement.
3+
labels: ["enhancement"]
4+
body:
5+
- type: markdown
6+
attributes:
7+
value: |
8+
Please check the [known limitations](https://harshith029.github.io/Sentinel/guide/limitations) first: some gaps are already tracked there.
9+
- type: textarea
10+
id: problem
11+
attributes:
12+
label: What problem would this solve?
13+
description: The situation you are in and what SENTINEL does not let you do today.
14+
validations:
15+
required: true
16+
- type: textarea
17+
id: proposal
18+
attributes:
19+
label: What would you like to happen?
20+
description: The behaviour, configuration or policy syntax you have in mind.
21+
validations:
22+
required: true
23+
- type: textarea
24+
id: security
25+
attributes:
26+
label: Security impact
27+
description: Could this weaken a guarantee (default-deny, fail-closed, provenance as a set over the whole ancestry, tenant isolation)? How would it stay safe?
28+
- type: textarea
29+
id: alternatives
30+
attributes:
31+
label: Alternatives you considered

‎.github/pull_request_template.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
## What and why
2+
3+
<!-- What this changes, and the problem it solves. Link the issue: "Fixes #123". -->
4+
5+
## Security invariants
6+
7+
<!--
8+
SENTINEL is a security proxy: the bar is "does this preserve the guarantees".
9+
See the list in CONTRIBUTING.md. If this change touches one, explain why it
10+
still holds. Never open a PR that discloses an unfixed vulnerability; report it
11+
privately first (SECURITY.md).
12+
-->
13+
14+
- [ ] This change does not weaken a security invariant, or the PR explains why it is still safe.
15+
16+
## Checklist
17+
18+
- [ ] Tests cover the change. A security fix includes a test that fails without the fix.
19+
- [ ] `python -m pytest`, `python -m ruff check src tests` and `python -m mypy src` pass locally.
20+
- [ ] Docs are updated where behaviour changed (README, `website/`, `.env.example`).
21+
- [ ] `CHANGELOG.md` has an entry under *Unreleased* for a user-visible change.

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ jobs:
8686
/tmp/wheel-env/bin/sentinel --help
8787
8888
container:
89-
# The image render.yaml and deploy/ ship. Checks it builds, starts, is
89+
# The image deploy/ ships. Checks it builds, starts, is
9090
# fail-closed with no credential, and does not run as root.
9191
name: container (build + smoke)
9292
runs-on: ubuntu-latest

‎.github/workflows/docs.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: docs
2+
3+
# Builds the project site (website/, VitePress) on every change to it, and
4+
# publishes it to GitHub Pages from main. Pull requests only build: a broken
5+
# link or page fails here before it can reach the published site.
6+
7+
on:
8+
push:
9+
branches: [main]
10+
paths: ["website/**", "assets/**", ".github/workflows/docs.yml"]
11+
pull_request:
12+
branches: [main]
13+
paths: ["website/**", "assets/**", ".github/workflows/docs.yml"]
14+
workflow_dispatch:
15+
16+
permissions:
17+
contents: read
18+
19+
jobs:
20+
build:
21+
runs-on: ubuntu-latest
22+
defaults:
23+
run:
24+
working-directory: website
25+
steps:
26+
- uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
27+
with:
28+
fetch-depth: 0 # "last updated" dates come from git history
29+
30+
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
31+
with:
32+
node-version: "24"
33+
cache: npm
34+
cache-dependency-path: website/package-lock.json
35+
36+
- name: Install (locked)
37+
run: npm ci
38+
39+
# The site's dependencies are build tools only, but a known vulnerability
40+
# in them still fails the build, as pip-audit does for the package.
41+
- name: Audit dependencies
42+
run: npm audit --audit-level=moderate
43+
44+
- name: Build (fails on dead links)
45+
run: npm run build
46+
47+
- name: Upload site
48+
if: github.event_name != 'pull_request'
49+
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
50+
with:
51+
path: website/.vitepress/dist
52+
53+
deploy:
54+
if: github.event_name != 'pull_request'
55+
needs: build
56+
runs-on: ubuntu-latest
57+
permissions:
58+
pages: write
59+
id-token: write
60+
concurrency:
61+
group: pages
62+
cancel-in-progress: false
63+
environment:
64+
name: github-pages
65+
url: ${{ steps.deployment.outputs.page_url }}
66+
steps:
67+
- name: Deploy to GitHub Pages
68+
id: deployment
69+
uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

‎.gitignore‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,12 @@ sdk_verification_dump.json
6565
# but belt-and-braces: never let it slip into a commit.
6666
_phase0_planted_secret_DELETE_ME.txt
6767

68+
# Project site (website/): dependencies, build output, and the images copied
69+
# in from assets/ before each build.
70+
website/node_modules/
71+
website/public/
72+
website/.vitepress/cache/
73+
website/.vitepress/dist/
74+
6875
# Scratch dependency dump from a dependency audit; never part of the repo.
6976
.audit-deps/
70-
deck/snapshots/

‎.pre-commit-config.yaml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,5 @@ repos:
3333
- id: check-toml
3434
- id: check-merge-conflict
3535
- id: check-added-large-files
36-
# 2MB: the hackathon submission deck (deck/SENTINEL_Submission.pptx,
37-
# ~1.3MB with embedded dashboard screenshots) lives in the repo.
38-
args: ["--maxkb=2048"]
36+
# The hook's default limit (500 KB). The largest tracked files are the
37+
# README screenshots in assets/, at about 260 KB.

‎CHANGELOG.md‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,34 @@ All notable changes to this project are documented here. Format follows
66

77
## [Unreleased]
88

9+
### Added
10+
- A documentation site, built from `website/` with VitePress and published to
11+
GitHub Pages: quick start, how it works, policy guide, configuration,
12+
authentication, logs and forensics, deployment, limits, backends,
13+
limitations and FAQ. CI builds it on every change and fails on a dead link
14+
or a vulnerable dependency. Its landing page is animated (an attack-flow
15+
replay synced to a step list, a typing decision log, a before/after outbox)
16+
and holds still for visitors who ask for reduced motion.
17+
- `assets/flow.svg`, an animated diagram of SENTINEL refusing an exfiltration
18+
attempt, used at the top of the README and on the site.
19+
- `SECURITY.md` (supported versions, private reporting, scope),
20+
`CODE_OF_CONDUCT.md`, issue forms for bugs, features and documentation, and a
21+
pull request template with the security-invariant checklist.
22+
23+
### Changed
24+
- The README is reorganised around a quick start, with the reference material
25+
moved to the site. The package's project URLs point at the site and the
26+
changelog.
27+
28+
### Removed
29+
- The hosted demo on Render and its `render.yaml` blueprint. It ran in
30+
anonymous mode on the public internet, which is not how SENTINEL should be
31+
seen running. The demo runs locally instead (`SENTINEL_ALLOW_ANONYMOUS=1
32+
sentinel serve --dashboard`).
33+
- The hackathon pitch decks, submission documents and video script (`deck/`).
34+
They remain in the git history. The large-file check is back to its default
35+
limit, which the decks had needed raised.
36+
937
### Security
1038
- The Cosmos store writes spans with `create_item`, which fails atomically if
1139
the id exists. It read first and then upserted, so two writers of one span
@@ -15,6 +43,9 @@ All notable changes to this project are documented here. Format follows
1543
gateway paths are explicit checks, which `python -O` does not strip).
1644

1745
### Fixed
46+
- The README's demo command, `sentinel serve --dashboard`, served a dashboard
47+
whose every data route answered 503: the demo needs anonymous mode
48+
(`SENTINEL_ALLOW_ANONYMOUS=1`), which the command did not set.
1849
- Documentation: what "durably emitted" means per store; the trust penalties
1950
that actually apply; that the evasion page is written against the local
2051
shield; which keys `sentinel.yaml` accepts; that the non-bypassability test

0 commit comments

Comments
 (0)