Sentinel

Sentinel is an AI-native incident investigation and verified recovery platform for distributed systems. During an outage, responders piece together metrics, logs, traces, deployments and service dependencies under time pressure, and the easiest answer, “roll back the last deployment”, is often wrong. Sentinel opens the incident from telemetry, sends six AI specialists after the evidence, builds competing explanations, tries to falsify the leading one, and shows every claim with the observations behind it. A deterministic consensus step decides from that evidence, abstaining when the signals do not support a safe conclusion. Sentinel then proposes a specific remediation with its rationale and expected recovery signals. Policy evaluation and a signed, single-use human approval govern execution; the only service holding production credentials acts, and fresh telemetry decides whether the system actually recovered. If the first remedy is not enough, Sentinel investigates again rather than closing the incident. The project includes a controlled reference system with thirteen reproducible incidents, scored against ground truth and against a deploy-blame baseline that runs beside every investigation. The scenarios cover misleading deployments, a poison message, instructions planted in logs for AI agents, a compound failure where the first fix is insufficient, and the same faults on AWS primitives. A guided incident view lets reviewers follow the evidence, decisions, approvals, actions and outcome. Sentinel runs locally as five .NET 10 services and a Next.js web app on Orleans, Temporal, Redis Streams, PostgreSQL and .NET Aspire.