SS
sift sentinel
overview validators trust model enter console →
SIFT SENTINEL  ·  GROUNDED FORENSIC REASONING
sift-sentinel · analysis run TEST-001
{{ ln.label }} {{ ln.text }} {{ ln.tail }}

A grounded forensic reasoning engine. Every finding is anchored to a specific, human-verifiable artifact — and factual hallucinations are caught by deterministic code, not by more AI.

open the evidence graph → github ↗
case TEST-001 loaded  ·  10 findings  ·  6 evidence sources  ·  1 fabrication eliminated
THE THESIS

Find less.
Fabricate nothing.

Sentinel deliberately trades recall for precision. It reports fewer findings than a naive agent, but every finding is real and verifiable. A report that finds less but invents nothing beats one that finds more but fabricates some of it.

A NAIVE AGENT
~maximises findings — including invented ones
~citations point at artifacts that may not exist
~hallucinations corrected by more AI, if at all
SIFT SENTINEL
✓every finding anchored to one verifiable artifact
✓five deterministic validators — zero AI in the loop
✓eliminated findings shown, not hidden — visible self-correction
sift sentinel · find evil! · grounded forensic reasoning engine agent v0.1.0 · trust through traceability
SS
sift sentinel evidence graph
CASE
{{ caseMeta.caseId }}
{{ caseMeta.findingCount }} findings · {{ caseMeta.sourceCount }} sources
{{ nav.label }} {{ nav.count }}
agent v{{ caseMeta.agentVersion }}
{{ caseMeta.toolExec }} tool executions
● integrity verified
{{ caseMeta.caseId }} / {{ viewCrumb }}
{{ viewTitle }}
analysis {{ caseMeta.startShort }} → {{ caseMeta.endShort }}
duration {{ caseMeta.duration }}
PRECISION OVER RECALL
This case reports fewer findings — and fabricates none.
Every finding below is anchored to a verifiable artifact. One fabricated finding was caught by a deterministic validator and eliminated — kept visible as proof of self-correction.
{{ valTotals.runs }}
validator runs
0 fabrications survived
{{ m.value }}
{{ m.label }}
{{ m.sub }}
FINDINGS BY STATUS
{{ b.label }} {{ b.count }} · {{ b.pct }}%
FINDINGS BY CATEGORY
{{ b.label }} {{ b.count }} · {{ b.pct }}%
STATUS
{{ c.label }}
CATEGORY
{{ c.label }}
VERDICT
{{ c.label }} {{ c.label }}
showing {{ filteredCount }} of {{ totalFindings }} findings
{{ f.id }} {{ f.statusLabel }} {{ f.categoryLabel }} {{ f.mitreStr }} {{ f.corrLabel }} {{ f.validText }}

{{ f.summary }}

{{ f.contraTag }} {{ f.flagTag }} {{ f.checksTotal }} validators · open →
← all findings
{{ selected.id }}
{{ selected.statusLabel }} {{ selected.categoryLabel }} {{ selected.corrLabel }} corroboration

{{ selected.summary }}

EVIDENCE ANCHOR ● verifiable artifact
SOURCE
{{ selected.anchor.sourceId }}
TOOL EXECUTION
{{ selected.anchor.toolExec }}
FILE HASH
{{ selected.anchor.fileHashD }}
BYTE OFFSET / RAW REF
{{ selected.anchor.offsetD }} · {{ selected.anchor.rawRefD }}
ARTIFACT PATH
{{ selected.anchor.artifactPathD }}
LOG ENTRY
{{ selected.anchor.logEntryD }}
REASONING CHAIN
{{ selected.reasonNote }}
{{ p.n }}{{ p.text }}
{{ selected.reasoning.logic }}
{{ selected.corrLabel }} · {{ selected.corrSub }}
VALIDATION RESULTS · 5 DETERMINISTIC CHECKS
{{ v.name }} {{ v.glyph }}{{ v.verdict }}
{{ v.detail }}
PROMOTION HISTORY · AUDIT TRAIL
{{ p.from }} → {{ p.to }}
{{ p.reason }}
{{ p.trigger }}
{{ p.time }}
MITRE ATT&CK
{{ t.id }} {{ selected.mitreFallback }}
LINKED FINDINGS
{{ l.id }} {{ selected.linkedFallback }}
CONTRADICTIONS
{{ c.id }} {{ selected.contraFallback }}
FLAGS
{{ fl.text }}
 {{ selected.flagsFallback }}

Five deterministic validators run against every finding. No AI sits in this loop — each is plain code that can only return PASS, FAIL, or NOT_APPLICABLE. A single hard fail eliminates a finding.

{{ c.value }}
{{ c.label }}
THE FIVE VALIDATORS
{{ v.idx }}
{{ v.name }} {{ v.tag }}
{{ v.desc }}
{{ v.pass }}
pass
{{ v.failHard }}
hard
{{ v.failSoft }}
soft
{{ v.na }}
n/a
FLAGS & REJECTIONS · {{ rejectionCount }}
{{ r.finding }} {{ r.validator }} {{ r.verdict }}
{{ r.detail }}

Every evidence source is mounted read-only and fingerprinted with SHA-256 at acquisition. Findings cite a source by id, so any claim can be traced back to a hash-verified artifact.

{{ s.id }} {{ s.type }} ● sha-256 verified
{{ s.path }}
SHA-256{{ s.sha }} MOUNTED{{ s.mounted }} METADATA{{ s.meta }}
{{ contraOpen }}open
{{ contraResolved }}resolved

When two findings disagree, Sentinel records the conflict rather than silently picking one — and spawns follow-up tasks to resolve it.

{{ c.id }} {{ c.a }} {{ c.vs }} {{ c.status }}
THE CONFLICT
{{ c.desc }}
RESOLUTION
{{ c.resD }}
{{ c.taskD }}
{{ q.count }}{{ q.label }}
{{ f.label }}
{{ t.id }}
{{ t.desc }}
triggered by {{ t.trigger }} {{ t.resultD }}
{{ t.priority }}
{{ t.stLabel }}

A counsel-ready forensic report. Switches to a light, paper-like document and prints clean.

↓ print / save pdf
Forensic Analysis Report
Case {{ report.caseId }} · prepared by sift sentinel agent v{{ report.agentVersion }}
GROUNDED · VERIFIED
{{ report.start }}
→ {{ report.end }}
EXECUTIVE SUMMARY

This report documents the findings of an automated forensic analysis of case {{ report.caseId }}. The investigation mounted {{ report.nSources }} hash-verified evidence sources and evaluated each finding against five deterministic validators. In keeping with a precision-over-recall mandate, every finding below is anchored to a specific, human-verifiable artifact. {{ report.nElim }} finding was disproved and eliminated by automated validation and is retained in this record for transparency.

{{ report.nConfirmed }}
confirmed
{{ report.nInferred }}
inferred
{{ report.nHypo }}
hypotheses
{{ report.nElim }}
eliminated
SUPPORTED FINDINGS
{{ f.id }} {{ f.statusLabel }} {{ f.categoryLabel }} · {{ f.mitreStr }}

{{ f.summary }}

anchor: {{ f.anchorLine }}
OPEN HYPOTHESES · PENDING VERIFICATION
{{ f.id }} {{ f.summaryShort }}
ELIMINATED · SELF-CORRECTION RECORD
{{ f.id }} eliminated

{{ f.summary }}

Caught by Tool Output Fidelity: claimed artifact appears nowhere in the parsed tool output. Retained, struck through, as a transparency record.
EVIDENCE REGISTER
SOURCETYPESHA-256
{{ s.id }} {{ s.type }} {{ s.shaShort }}
VALIDATION METHODOLOGY

Each finding was independently checked by five deterministic validators. Across the case, {{ report.valTotals.runs }} validator runs were executed: {{ report.valTotals.pass }} pass, {{ report.valTotals.failHard }} hard fail, {{ report.valTotals.failSoft }} soft flag, {{ report.valTotals.na }} not applicable. A single hard failure eliminates a finding; no AI participates in the validation decision.

sift sentinel · grounded forensic reasoning · {{ report.caseId }} {{ report.toolExec }} tool executions · trust through traceability