[Gwerdonatus]

Result

Sentinel 2 records authenticated audit events, publishes them through a transactional outbox, and applies explainable risk rules through Kafka as the single scoring trigger. Versioned HMAC signatures, credential-derived actor identity, API-key scopes and idempotent alerts support a working local investigation workflow.

The product uses the supplied original Sentinel logo and a consistent workspace design. Homepage links open actual pages and the schema. Severity drives the overview, badges and risk scores. Audit actor filters and alert pagination work.

Product evidence

The README now includes ten screenshots captured from the running application: homepage, overview, alert inbox, AI and human alert explanations, agent registry, actor timeline, audit log, scoped keys and completed report exports. It explains the scoring formula, delivery design, Kafka tradeoff, local setup and implementation boundaries. Screenshots use explicitly synthetic data; the fictional Stripe scenario has no live integration, affiliation, payment or external permission change.

A reporting regression is fixed: explicit timestamp ordering previously split actor groups and understated totals. Clearing ordering for that grouping now reports 22 events as 18 AI-agent and four human events while retaining chronological event details. Two regression tests cover grouped and empty summaries.

Validation

• 314 backend tests pass; 72.58% statement coverage. Ruff lint/format, Django system checks and migration consistency pass.
• Frontend lint, TypeScript check and isolated production build pass.
• Compose validates; all 14 services run and all nine configured health checks are healthy.
• Django, Next.js, Nginx, Prometheus and Grafana readiness endpoints return HTTP 200.
• Browser sign-in and investigation pages verified. Celery generated a ready PDF with consistent actor totals and two named agents.
• Seed idempotency is regression-tested and was separately verified during runtime setup; existing investigation states remain intact.
• Local verification details and caveats: docs/verification.md.
• Latest-head CI: all nine jobs pass on 1b67ba3. https://github.com/Gwerdonatus/Sentinel/actions/runs/37860831719

Security boundaries

HMAC authenticates individual signed fields; it does not prove completeness or ordering. Signing-key holders can forge records. The reported business activity remains dependent on the submitting system. Behavioral signals do not prove fraud or prompt injection. Delivery is at least once and scoring is eventually consistent. Reports are evidence packages, not compliance certification. The dependency scan is advisory; green CI does not imply vulnerability-free dependencies.

This pull request remains unmerged.