Mnemosyne.NET.Sentinel 1.0.0

Mnemosyne.NET.Sentinel

A capture guard that runs AI.Sentinel's detectors over a capture before the Reasonlet is stored. SentinelCaptureGuard is an ICaptureGuard: it blocks the capture when a detector reaches the configured severity, and allows it otherwise.

Mnemosyne.NET follows SemVer from 1.0.0. An analyzer baseline locks the public API, and the compatibility policy says what a release may change.

dotnet add package Mnemosyne.NET.Sentinel

The package depends on Mnemosyne.NET.Abstractions and AI.Sentinel 4.x. The host registers AI.Sentinel itself.

Registration

AddMnemosyneSentinel registers the guard as the singleton ICaptureGuard, which AddMnemosyne then picks up. The order of the two Add calls does not matter.

using AI.Sentinel;
using Mnemosyne.NET;
using Mnemosyne.NET.Sentinel;

services.AddAISentinel();
services.AddMnemosyneSentinel();
services.AddMnemosyne();

The guard resolves AI.Sentinel's IDetectionPipeline and SentinelOptions when it is first resolved. A host that did not register AI.Sentinel fails then, not at registration. Invalid options throw an ArgumentException at registration.

Options

using AI.Sentinel.Detection;

services.AddMnemosyneSentinel(new SentinelCaptureGuardOptions { BlockAtSeverity = Severity.Medium });

The default High leaves out what AI.Sentinel rates lower. Its PiiLeakageDetector rates a credit card number Critical, and an IBAN, SSN, BSN, passport number and tax ID High, so those block. It rates an email address, a phone number and a date of birth Medium, so a question carrying one is stored at the default. A host that wants contact PII kept out of memory sets BlockAtSeverity = Severity.Medium, which blocks with the detail ai-sentinel/SEC-23. That also blocks every other Medium detection, so watch for false positives.

What is scanned

The pipeline sees the capture's question, its intent and its name, as one user message each, in that order. A blank intent or name is left out. It sees nothing else: not the answer, the graph or the provenance tags.

The session is the run id of the capture's provenance, or mnemosyne-capture when it has none. The sender and receiver are the defaults of the SentinelOptions the host configured.

The verdict

The guard allows the capture when no detection reaches BlockAtSeverity. Otherwise it blocks, and the verdict names the blocking detection with the highest severity. On a tie, the first one wins. The facade then fails the remember with Blocked.

The verdict carries the detector id only. The detection's reason is never read and never kept, because it can quote the capture. The guard has no logger, so nothing about the capture or the detection leaves it beyond the verdict. An id longer than the limit is cut, and an id that is not valid UTF-16 or is blank once cut is replaced by invalid-detector-id.

Failures

An exception from the pipeline itself reaches the facade, which treats the guard as down: the remember fails closed with Unavailable, because a capture that the pipeline did not inspect is not stored. The caller's own cancellation propagates.

The guard itself answers Unavailable in a second case, a scan that does not complete. When a detector fails, AI.Sentinel 5.1.1 skips it, calls SentinelOptions.OnDetectorFailure and reports it through PipelineResult.Failures and IsComplete. This covers any failure AI.Sentinel reports: a detector that throws or times out, texts or examples it could not embed, and a review that failed. If no detector blocked, the guard returns Unavailable with the message "The Sentinel scan did not complete." and the number of failed detectors as the detail, such as "1 detector failed", never a detector's message. A blocking detection still wins, so the capture is then Blocked. The facade keeps only the code of a guard error, so RememberAsync fails with Unavailable and the facade's own message, with no detail, exactly as for a timeout through the guard timeout. The message and the count reach callers of ICaptureGuard directly. A semantic or escalating detector whose endpoint is down therefore rejects captures instead of letting them through unchecked; set OnDetectorFailure to see which detector failed and alert on it.

Slow detectors and GuardTimeout

Semantic and LLM-escalating detectors can be slow. The facade stops waiting for the guard after MnemosyneOptions.GuardTimeout, 30 seconds by default, cancels the token it passed, and fails the remember with Unavailable. A slow guard therefore drops captures, so tune the timeout, or take the slow detectors out of the guard's pipeline as described next.

A pipeline for the guard

Set PipelineName to give the guard its own pipeline, so it can run fewer detectors than the host's chat client does. AI.Sentinel 5.1.1 needs the host to register the default pipeline as well. Checked with a host that registers only the named pipeline: resolving the guard throws InvalidOperationException, "No service for type 'AI.Sentinel.SentinelOptions' has been registered". AI.Sentinel's own README gives a wider reason for the same rule, the shared audit store, forwarders, alert sink and tool-call guard that the default call wires.

AI.Sentinel's own README says to register the default pipeline first, so put that call before the named one.

using AI.Sentinel;
using AI.Sentinel.Detectors.Security;
using Mnemosyne.NET.Sentinel;

services.AddAISentinel(opts => { /* the host's own settings */ });
services.AddAISentinel("capture", opts =>
{
    opts.Configure<PromptInjectionDetector>(c => c.Enabled = false);
});
services.AddMnemosyneSentinel(new SentinelCaptureGuardOptions { PipelineName = "capture" });

Every pipeline sees the same detector pool. A named pipeline starts from fresh SentinelOptions and tunes the pool with Configure<T>, where c.Enabled = false switches a detector off for that pipeline only. The guard resolves the keyed pipeline and options of that name. PromptInjectionDetector is a semantic detector that embeds the text and can call out to a reviewer. Replace it with the slow detectors of your own setup.

The answer is not scanned

The guard protects what goes into the store. The agent's answer is protected by AI.Sentinel's chat middleware on the host's IChatClient, with UseAISentinel(). That is the host's wiring, not this package's.

Documentation

• Capture, redaction and review: the guard in the capture path, what the adapter scans, the fail-closed handling of an incomplete scan and the review gate.