Mnemosyne.NET.Sentinel 0.7.0

Mnemosyne.NET.Sentinel

A capture guard that runs AI.Sentinel's detectors over a capture before the Reasonlet is stored. SentinelCaptureGuard is an ICaptureGuard: it blocks the capture when a detector reaches the configured severity, and allows it otherwise.

dotnet add package Mnemosyne.NET.Sentinel

The package depends on Mnemosyne.NET.Abstractions and AI.Sentinel 4.x. The host registers AI.Sentinel itself.

Registration

AddMnemosyneSentinel registers the guard as the singleton ICaptureGuard, which AddMnemosyne then picks up. The order of the two Add calls does not matter.

using AI.Sentinel;
using Mnemosyne.NET;
using Mnemosyne.NET.Sentinel;

services.AddAISentinel();
services.AddMnemosyneSentinel();
services.AddMnemosyne();

The guard resolves AI.Sentinel's IDetectionPipeline and SentinelOptions when it is first resolved. A host that did not register AI.Sentinel fails then, not at registration. Invalid options throw an ArgumentException at registration.

Options

using AI.Sentinel.Detection;

services.AddMnemosyneSentinel(new SentinelCaptureGuardOptions { BlockAtSeverity = Severity.Medium });

The default High leaves out what AI.Sentinel rates lower. Its PiiLeakageDetector rates a credit card number Critical, and an IBAN, SSN, BSN, passport number and tax ID High, so those block. It rates an email address, a phone number and a date of birth Medium, so a question carrying one is stored at the default. A host that wants contact PII kept out of memory sets BlockAtSeverity = Severity.Medium, which blocks with the detail ai-sentinel/SEC-23. That also blocks every other Medium detection, so watch for false positives.

What is scanned

The pipeline sees the capture's question, its intent and its name, as one user message each, in that order. A blank intent or name is left out. It sees nothing else: not the answer, the graph or the provenance tags.

The session is the run id of the capture's provenance, or mnemosyne-capture when it has none. The sender and receiver are the defaults of the SentinelOptions the host configured.

The verdict

The guard allows the capture when no detection reaches BlockAtSeverity. Otherwise it blocks, and the verdict names the blocking detection with the highest severity. On a tie, the first one wins. The facade then fails the remember with Blocked.

The verdict carries the detector id only. The detection's reason is never read and never kept, because it can quote the capture. The guard has no logger, so nothing about the capture or the detection leaves it beyond the verdict. An id longer than the limit is cut, and an id that is not valid UTF-16 or is blank once cut is replaced by invalid-detector-id.

Failures

The guard never returns an error. An exception from the pipeline itself reaches the facade, which treats the guard as down: the remember fails closed with Unavailable, because a capture that the pipeline did not inspect is not stored. The caller's own cancellation propagates.

Known limitation: this holds for the pipeline as a whole, not for each detector in it. AI.Sentinel 4.1.1 catches an exception from a single detector, skips that detector for the scan, calls SentinelOptions.OnDetectorFailure and counts its result as clean. PipelineResult carries no failure signal, so the guard cannot tell. A semantic or escalating detector whose endpoint is down is therefore skipped, and the capture can be stored without that control. Set OnDetectorFailure in the host's AI.Sentinel options to learn about it. The gap is tracked upstream as AI.Sentinel#550.

Slow detectors and GuardTimeout

Semantic and LLM-escalating detectors can be slow. The facade stops waiting for the guard after MnemosyneOptions.GuardTimeout, 30 seconds by default, cancels the token it passed, and fails the remember with Unavailable. A slow guard therefore drops captures, so tune the timeout, or take the slow detectors out of the guard's pipeline as described next.

A pipeline for the guard

Set PipelineName to give the guard its own pipeline, so it can run fewer detectors than the host's chat client does. AI.Sentinel 4.1.1 needs the host to register the default pipeline as well: the shared detector pool resolves the unnamed SentinelOptions, and a host that registers only a named pipeline fails at resolution.

AI.Sentinel's own README says to register the default pipeline first, so put that call before the named one.

using AI.Sentinel;
using AI.Sentinel.Detectors.Security;
using Mnemosyne.NET.Sentinel;

services.AddAISentinel(opts => { /* the host's own settings */ });
services.AddAISentinel("capture", opts =>
{
    opts.Configure<PromptInjectionDetector>(c => c.Enabled = false);
});
services.AddMnemosyneSentinel(new SentinelCaptureGuardOptions { PipelineName = "capture" });

Every pipeline sees the same detector pool. A named pipeline starts from fresh SentinelOptions and tunes the pool with Configure<T>, where c.Enabled = false switches a detector off for that pipeline only. The guard resolves the keyed pipeline and options of that name. PromptInjectionDetector is a semantic detector that embeds the text and can call out to a reviewer. Replace it with the slow detectors of your own setup.

The answer is not scanned

The guard protects what goes into the store. The agent's answer is protected by AI.Sentinel's chat middleware on the host's IChatClient, with UseAISentinel(). That is the host's wiring, not this package's.