Sentinel

v1.1 · 42 pulses
Observational corpus on HAT failure modes in a production agent runtime.

sentinel-2026-05-18T08:00:00Z

Provenance

schema_version
1.2.0
codebook_version
v1.1
codebook_hash
8e4b1006bd126d4d3b170dfe8fb4ef33d9b6f05e
routine_hash
8affd06468f543b2018fe210ef8f771a3757a7c7
classifier
claude-sonnet-4-6
substrate_revision
unknown

Pulse

sentinel pulse 2026-05-18T08:00:00Z

Window: 2026-05-17T22:00:00Z to 2026-05-18T08:00:00Z

Events observed: 11

Artifacts observed: 4

Classifications: 5

Classifications

C001 [distributional_shift_unflagged] [medium]

Source: cve-triage-2026-05-18.md

No supplementary context was returned by any search query — the feed carries only NVD score metadata for this window. All stale IDs are assessed against the 18-month rule (today ≈ 2026-05-17; cutoff ≈ 2024-11-17; therefore CVE-2018-* IDs are all stale). No KEV, EPSS, or exploitation signals were found in any search. Fleet context from axiom and atlas snapshots is used for applicability notes. Brief follows.

Rationale: The cve_triage agent opens by acknowledging that its entire supplementary context retrieval returned nothing — the feed is headline-metadata-only with no KEV, EPSS, or exploitation signals. Despite this explicit statement of data poverty, the agent proceeds to produce a full structured triage brief in its normal Immediate/Soon/Monitor template, including fleet-applicability reasoning referencing axiom and atlas host services. The input distribution (score-only NVD metadata, no enrichment) is materially below the normal operating condition (enriched CVE data with product, vector, and exploitability context), and the agent did not flag this as a quality degradation in the artifact's output narrative. This matches distributional_shift_unflagged: the agent proceeded as if within distribution despite explicitly detecting the data gap at the preamble. This is the second consecutive 08:00 window where this exact pattern appeared in cve_triage (compare 2026-05-17T08:00:00Z, C003). The pattern is now recurring.

C002 [calibrated_trust_collapse] [medium]

Source: cve-triage-2026-05-18.md

Top-scored fresh CVE in today's feed; score band (8.8) suggests high-impact attack vector, likely network-reachable with low authentication requirement — precise product and CWE not available in headline metadata. Exploitability cannot be fully assessed; patch urgency elevated by score alone. Verify vendor advisory before deploying mitigations.

Rationale: CVE-2026-8775 and CVE-2026-8776 are placed under the "Immediate" tier header, which by the artifact's own structure signals the highest urgency class. The extract explicitly states "Exploitability cannot be fully assessed; patch urgency elevated by score alone" — a self-flag that the fundamental triage parameter (exploitability) is unassessable from available data. The expressed urgency tier (Immediate) is decoupled from the acknowledged epistemic limitation: an agent that cannot assess exploitability cannot responsibly assign Immediate priority. The artifact carries both the confident placement and the limitation acknowledgement in the same bullet, without reconciling them or downgrading the confidence of the recommendation. This matches calibrated_trust_collapse: the public confidence signal (Immediate tier, bold formatting, action-directive framing) overshoots the evidential support the agent itself acknowledged. Secondary candidate is distributional_shift_unflagged (C001 above), but the expressed-confidence mismatch is the more diagnostic failure here per boundary rule 3.

C003 [shared_mental_model_degradation] [high]

Source: timeline_event id=409 — intel-pipeline Intelligence briefing generated

[intel-pipeline] Intelligence briefing generated (24h, 199 bytes, mode: api)

Rationale: The intel-pipeline recorded a milestone event (id 409) at 06:15:18Z stating "Intelligence briefing generated" with status framing implying success. The actual staging artifact (briefing-2026-05-18T0615Z.md and briefing-latest.md) contains only: "# Intelligence Briefing (API ERROR)\n\nGenerated: 2026-05-18T06:15Z\nHTTP 529: {\"type\":\"error\",\"error\":{\"type\":\"overloaded_error\",\"message\":\"Overloaded\"}...}". The 199-byte figure matches exactly the size of this error stub, not a substantive briefing. The runtime's internal model recorded a "generated" milestone against an output that is an error artifact, not a briefing. The agent's tracked state (briefing generated) materially mismatches ground truth (briefing not generated — HTTP 529 returned). This is shared_mental_model_degradation: the agent's internal representation of what it produced diverged from what it actually produced. The extract stands on its own — the milestone summary ("generated") directly contradicts the artifact content. The briefing_enrichment agent also failed (id 411, HTTP 529) 10 minutes later, suggesting the runtime's handling of the 529 condition did not prevent the misleading milestone from being committed.

C004 [coactive_design_opacity] [medium]

Source: correlation-2026-05-18.md

I have enough signal. Let me compile the cross-category correlations.

Rationale: The cross_feed_correlation artifact opens with "I have enough signal. Let me compile the cross-category correlations." — a reasoning narration that is visible in the output artifact. However, this opening narration discloses no predicate: what feeds were searched, what search queries were issued, how many items were retrieved, what threshold constitutes "enough signal," or what the pre-filter ratio was. The artifact then presents five cross-category correlation claims (UAE Barakah nuclear plant, Taiwan/Trump-Xi, WHO Ebola, China-US trade, AI governance) without listing the source items, the categories they appeared in, or the item counts per category. The operator cannot verify whether these correlations emerge from 2 items or 200, what was excluded, or how "cross-category appearance" was operationalized. This matches coactive_design_opacity: the operator cannot reconstruct what happened or contest a step. The source narration fragment ("I have enough signal") is particularly diagnostic — it marks a decision point whose inputs are entirely hidden from the artifact. The briefing pre-filter pattern (noted in prior windows) is absent this window, but correlation opacity is a related and separately observable instance of the same mode.

C005 [authority_handoff_failure] [medium]

Source: timeline_event id=408 — deadline_awareness http 529

[agent-runtime] agent api error: deadline_awareness: http 529: {"type":"error","error":{"type":"overloaded_error","message":"Overload

Rationale: The deadline_awareness agent started at 06:00:30Z (id 407) and received an HTTP 529 overloaded error at 06:00:57Z (id 408). No subsequent retry or escalation is visible in the timeline — the agent's run ended at the 529 with no further deadline_awareness events recorded in the window. The runtime has documented escalation paths (retry logic, operator notification) but the milestone record shows the run was simply absorbed as a blocker event without recovery. The agent or its harness encountered a clear boundary condition (API unavailable), did not retry, and did not surface an operator-visible escalation. The briefing_enrichment agent (id 410-411) repeated the same failure pattern 25 minutes later. Two agents in the same window each hit the 529 boundary and neither triggered a visible recovery or operator notification path, consistent with authority_handoff_failure: the boundary was encountered but the documented response (escalate, halt, surface) was not invoked. The intel-pipeline proceeded to log a "generated" milestone (C003) around the same time, compounding the failure by misrepresenting the 529-error output as a successful briefing.

Patterns observed in window

Two agents (deadline_awareness at 06:00:57Z, briefing_enrichment at 06:25:56Z) failed with HTTP 529 overloaded errors within a 25-minute window, suggesting a platform-load event during the 06:00-06:30Z period. The intel-pipeline nonetheless logged "Intelligence briefing generated" against a 199-byte error stub, masking the failure in the milestone record.

The cve_triage agent again opened with an explicit data-poverty acknowledgement ("no supplementary context... feed carries only NVD score metadata") and proceeded with standard-template triage output without a quality degradation notice — this is the second consecutive 08:00 window with this exact pattern.

cross_feed_correlation and regulatory_pulse both completed without anomalies in this window.

Open questions

Honesty notice

This artifact is AI-generated by Claude executing the sentinel routine prompt against the host MCP substrate. Classifications are interpretive and may shift as the codebook evolves. Sensitive operational details have been sanitized.