feat(sentinel): add provenance-aware memory and declarative skills

[tuxevil]

Implements #21 as a stacked PR on top of #25 (sentinel-model-routing).

What changes

• keeps Sentinel episodic memory in the existing sentinel_cases ledger and adds a separate learned-memory store with scope, confidence, evidence provenance, counter-evidence, validation state, TTL, supersession and expiry;
• adds a declarative skill store and lifecycle: DRAFT -> VALIDATED -> SHADOW -> TRUSTED -> DEPRECATED/REVOKED;
• statically rejects skill steps that are not existing read-only Tool Registry entries, and never accepts embedded shell/code/SQL/arbitrary HTTP/commands or model-supplied arbitrary tool arguments;
• replays skills against historical Case evidence bounded by the evaluation timestamp, detects unsafe evaluations, records replay/shadow evidence, and promotes only through deterministic thresholds;
• counts distinct Cases for promotion metrics so repeated evaluation of one Case cannot inflate trust;
• exposes only VALIDATED non-expired learned memories and TRUSTED skills to the Context Compiler as learned_knowledge;
• keeps tool arguments controller-owned and Case-scoped even when a trusted skill contributes an additional read-only tool to the evidence plan;
• integrates Sentinel harness: add local-first model routing #20 curation as optional/offline-queueable work: model output can create only memory CANDIDATEs and skill DRAFTs after strict JSON/evidence validation;
• runs shadow evaluation only after Case evidence is durably persisted and keeps shadow work observation-only;
• adds ADMIN-gated lifecycle APIs for validation, rejection, counter-evidence, supersession, replay, shadow, promotion, deprecation and revocation;
• adds expiry maintenance and retention rules that preserve source Cases and every Case referenced by active memory evidence/counter-evidence;
• documents the trust model and SENTINEL_AUTO_CURATION=false opt-in configuration.

Security invariants

• World State remains authoritative and is never written from learned memory or skills;
• model/tool output cannot write directly to trusted memory or a trusted skill;
• learned artifacts cannot modify Tool Registry, Safety Kernel, policy/trust roots, executor or the skill interpreter;
• TRUSTED skills can only select already-registered read-only tools; the controller reconstructs arguments from Case scope;
• replay cannot read evidence captured after its historical as_of timestamp;
• shadow mode cannot mutate state, create execution authority or alter the operator answer;
• curation is disabled by default and requires the explicit curation route introduced in Sentinel harness: add local-first model routing #20.

Validation

The final cleaned head is 0e70abaccd696dac247a0f53f436ca56848fc51c.

Because the repository CI is configured to run only for PRs targeting main, this PR was temporarily retargeted to main, reopened, and validated without changing the head. CI #125 / run 34082094945 completed successfully, then the PR was returned to its stacked base.

Full green suite:

• Go module verification;
• go vet ./...;
• build;
• go test -race;
• coverage;
• golangci-lint on new code;
• full-repo lint informational pass;
• govulncheck;
• Vue install/type-check/unit tests/build;
• device and Compose contracts;
• secret scan;
• Docker image build.

The final cross-Case provenance retention hardening also independently passed gofmt, go vet ./..., and go test ./... before the temporary patch infrastructure was removed.

Closes #21.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0e70abaccd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Make validation atomic with counter-evidence updates

When validation and counter-evidence requests overlap, validation can read an empty counter-evidence list, the other request can append evidence while leaving the row CANDIDATE, and this unconditional state transition can then mark that contradicted row VALIDATED. Because validated rows are immediately included in model context, perform the counter-evidence check and state change atomically, such as with a conditional update or row lock.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Preserve cases referenced by active skill evaluations

When a resolved replay Case crosses the retention cutoff while its skill is still VALIDATED or SHADOW, this guard preserves only the skill's source Case. Deleting any other replay Case cascades through sentinel_skill_evaluations, reducing the distinct replay count; a shadow skill can consequently become impossible to promote after its historical Cases have already been removed. Active evaluation Cases need the same retention protection as source Cases.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Match skills against normalized selectors

For a draft containing a selector such as " log_anomaly ", validation accepts it after trimming and lowercasing, but ValidateSentinelSkillSpec receives the spec by value and never persists that normalized selector. This comparison therefore uses the original whitespace-bearing value, so the validated skill never matches during replay, shadow evaluation, or trusted execution; normalize again here or store the normalized spec.

Useful? React with 👍 / 👎.