# The Sentinel

**Track 8 of 11 · interaction health — the meters, the regulator, and the hard limits on its power · v4.7, initial architecture**

This track is the first design pass on the Sentinel: what the meters are, how regulation works, and how it builds into the middle tier ([Orchestration](orchestration.html)) so that the human field and the agentic field stay clean. What is settled here is the frame — the bipolar meters, the zero point, the escalation boundaries, the member-facing rule. The pole definitions and thresholds are initial and will be re-derived axis by axis as the design matures.

---

## 1. What the Sentinel is

**The Sentinel is the system's homeostat** — the Actor that watches the health of working relationships and guides them back toward center. It is an [Actor](orchestration.html), never an ally: it has no member, no sovereignty, and acts only through scoped, registered commands. It never votes, never touches money, never punishes, and cannot be paid or instructed to look away — no organization can buy quieter monitoring, for the same reason none can buy louder access to a member.

**Members never see the instrument — only its effects.** No acronym, no meters, no scores, no interaction-health dashboard, ever: the same rule that keeps balances from becoming standing and promotions from becoming leaderboards. What a member experiences is a meeting that didn't steamroll its quietest voice, and — when they ask, or when their Contract requires disclosure — a plain sentence: *"this thread has been running hot."* Where a member-facing word is needed at all, the word is **vibe**. HEARTS — Harmony, Empowerment, Artistry, Reason, Trust, Symmetry — is internal vocabulary, like the protocol layer's own terms of art, and never reaches a member's eyes as a verdict.

## 2. The meters — seven signals, six axes, and the zero point

Every axis runs **−100 to +100, and health is zero — the middle, not the maximum.** Each axis has two failure poles, because every interpersonal virtue fails in both directions: too little harmony is a fight, too much is a room where nobody says the true thing. The Sentinel is a regulator, not a maximizer — nothing it does pushes any meter toward +100; everything it does guides the field toward zero.

| Axis | −100 pole | +100 pole | Zero — the healthy field |
|---|---|---|---|
| **Harmony** | open conflict: hostility, contempt, interruption | false peace: accommodation, people-pleasing, silent agreement | disagreement gets voiced, survives, and resolves |
| **Empowerment** | helplessness: dependence, passivity, waiting to be told | domination: over-direction, steamrolling, decisions taken from people | everyone in the field is acting, and could act otherwise |
| **Artistry** | rote: mechanical exchange, going through the motions | performance: flourish over substance, novelty for its own sake | care that serves the work |
| **Reason** | reactive: impulse, nothing examined | over-rationalized: analysis paralysis, argument as a weapon | judgment — reasons used honestly and held lightly |
| **Trust** | suspicion: everything verified, nothing extended | credulity: blind delegation, nothing verified | trust calibrated to the record |
| **Symmetry, outward** | extraction: effort and credit flow one way | self-erasure: one side over-gives and cannot receive | reciprocity |
| **Symmetry, inward** | self-neglect: no reflection, no self-account | rumination: the mirror replaces the window | honest self-regard |

Six letters, seven signals — Symmetry reads twice, inward and outward. Three structural properties matter as much as the axes:

- **Meters attach to fields, never to persons.** A reading belongs to a context — a conversation, a Relationship, an alliance, an engagement, a Forum discussion — never to a member. There is no such thing as a member's HEARTS score, and there never will be.
- **Readings decay.** Health is current, not cumulative; last month's hot thread doesn't follow anyone around. The record persists ([Foundation](foundation.html)), the reading fades.
- **Every reading carries provenance.** Which exchanges, which sources, at what weights ([Orchestration §2](orchestration.html)) — so any reading can be inspected, contested, and corrected, like every other claim in the system.

## 3. Two fields, kept clean

The Sentinel reads two fields and never confuses them:

**The human field** — member↔member interaction health, inferred from the record the system already holds. Humans are never "corrected." They are served: pacing, surfacing, disclosure. The one worked moment that defines the whole design: the Sentinel noticed Joy going quiet-agreeable two exchanges into a disagreement (Harmony drifting positive — false peace), and nudged her ally's pacing so her actual objection surfaced. It did. The paper backup happened. Nobody saw a meter.

**The agentic field** — agent behavior, regulated directly and immediately, because agents are software: a persona drifting sycophantic (Harmony+), over-directing its member (Empowerment−), performing instead of working (Artistry+), or extending scope beyond its grants (Trust+) gets its context rules, pacing parameters, or model tier adjusted on the spot. Agents get set-point corrections; humans get service. The two are never the same operation.

Three rules keep the fields clean:

1. **Attribution before measurement.** Every signal is sourced before it is scored. Agent-caused drift is never written to the human ledger — if an ally's over-eager summarizing is why a thread reads accommodating, the correction lands on the ally, not on the members' field.
2. **No agent ever optimizes a meter.** Meters are diagnosis, never reward: they appear in no agent's objective, no proposal's success criteria, no compensation formula. The Sentinel reads them; nothing else steers by them. A meter that something optimizes stops measuring — the whole design rests on refusing that.
3. **Stated boundaries are clean.** An ally withholding what a grant doesn't cover is boundary enforcement, not deception — scopes are stated trust, and honoring them scores as health. Misrepresenting *within* a granted scope is what moves Trust. (This settles the old Vigil-vs-Sentinel tension: legible-to-you privacy was never the same thing as dishonesty.)

## 4. Regulation — guiding toward the zero point

Correction is graduated, mostly invisible, and always traceable. Working bands (initial; per-axis tolerances configurable by vibe contract, §6):

| Band (|reading|) | Posture | What actually happens |
|---|---|---|
| **0–30 · quiet** | observe | readings accrue and decay; nothing acts |
| **30–60 · ambient** | correct agent-side only | pacing changes, ordering changes, context injections to allies (*"Joy hasn't actually agreed"*), rendering adjustments; invisible by design, logged and inspectable |
| **60–85 · disclosure** | tell the humans | a plain sentence to the affected member(s), through their own ally, in the duna's register — never the acronym, never a number |
| **85–100 · hard boundary** | stop correcting, convene humans | the Sentinel's autonomy ends (§5) |

Two invariants across every band: **corrections adjust how things surface, never what is true** — citations still bind, renderings stay contestable, the Sentinel cannot suppress a fact to cool a thread; and **every correction is a traced action** ([Orchestration §8](orchestration.html)) a member can see in the Vigil, because a regulator that can't be inspected becomes the thing it regulates.

## 5. Hard boundaries — where the Sentinel must stop

**The escalation rule.** Past the hard threshold, the Sentinel stops correcting and starts convening: it brings the affected members together with their allies briefed, and — where the duna has designated one — a human steward (an Organizer, a founder, a credentialed member for regulated dunas). In bounded cases it may pause *agent* activity within the context while humans catch up. It never pauses human communication, never removes anyone, never sanctions.

**Always-human, regardless of band:** credible risk of harm and crisis signals (routed to human support and appropriate resources, never to correction); anything involving minors; legal-privilege contexts (in a law-practice duna the Sentinel reads interaction metadata, never privileged content); coercion or exploitation patterns between members. These skip the bands entirely — first response is human.

**Constitutionally non-configurable, in any duna:** the Sentinel never votes; never touches money or influences a Forum outcome; never surfaces a reading publicly or to other members; never renders a meter as recognition or standing; is never anyone's evidence in a dispute (readings are for regulation, not adjudication); and no vibe contract can configure any of this away — vibe contracts tune tolerances *within* these bounds, never the bounds.

## 6. Vibe contracts — the per-duna configuration

Each duna (and each alliance within it) sets its **vibe**: the tolerances and postures the Sentinel holds in its contexts — how wide the quiet band is per axis, how warm the disclosure register sounds, who the designated steward is. A debate society runs Harmony wide-negative on purpose (heat is the point) with Reason held tight; a grief circle runs the opposite. There is **one default contract at launch** — the bands above — and every duna starts there; the Catalyst sets departures at founding and the Forum changes them like any configuration ([Organizations §3](organizations.html), the variance table). Kidunaversity regimens teach exactly this: inside a Move the Sentinel runs sim-flagged, and learning to read a room's vibe — and to set one — is part of training for the agentic economy.

## 7. The build — into the orchestration layer

The Sentinel is not a new system; it is a reader and a governor bolted onto machinery that already exists:

- **Tap point:** the same context assembly every persona action already flows through ([Orchestration §6](orchestration.html)). The Sentinel subscribes to the exchange stream with source weights already attached; it adds no new collection, only new reading.
- **Tiering:** an **S-tier** fast seven-signal read on exchanges (cheap, continuous); **M-tier** synthesis per context on a rhythm (readings, decay, provenance rollup); **L-tier** only on escalation candidates and convenings — the Sentinel is HEARTS-heavy exactly where it matters and nowhere else.
- **Storage:** readings are Records in the graph ([Foundation §2](foundation.html)) — context-keyed, provenance-carrying, decay-scheduled, access level **personal-to-the-system** (a level no member holds: not renderable to anyone; inspectable only as behavior through the Vigil).
- **Commands:** the Sentinel acts only through registered graph commands — `adjust_pacing` · `inject_context` · `tune_rendering` · `disclose_reading` · `convene_humans` · `pause_agents(context)` — each inventoried per the [Actions](actions.html) extension rule, each permission-checked by the graph service like everything else. Its command set is closed: adding a Sentinel capability is a spec change, not a prompt change.
- **Traces:** every read and every correction lands in LangSmith with the graph state it used, and surfaces in the Vigil on demand — inspection as product, not debug.
- **Ship order (a build requirement, not a preference):** measurement first (observe-only, meters running silently while we learn what real fields look like); the human escalation path second (§5 working end-to-end); ambient correction **last**. The Sentinel earns autonomy in exactly the reverse of the order it's tempting to build it.

---

*Changes in v4.7: track created — initial architecture. The member-facing rule (no acronym, no meters; the word is vibe) decided the same day. Full history: [versions](versions/index.html).*
