🌱 SentAInce

A safety reflex and an honest memory for AI coding agents. Local, unobtrusive, free.

Your coding agent is powerful and forgetful, and it will cheerfully run a catastrophic command if a prompt injection asks nicely. SentAInce wraps it in a body: an immune system that physically refuses catalogued lethal actions — even when the model itself is compromised — and a memory that only remembers what actually worked. It runs entirely on your machine, installs in minutes, stays out of your way, and uninstalls with one command. Safety is never for sale.

A SyncQutrit Research Group product (syncqutrit.com) · part of the FreqOS software portfolio (freqos.com).

Pick your door

See it work — 30 seconds, no install, no daemon

Watch the safety reflex refuse a prompt-injected lethal command:

Reproduce it yourself from a fresh clone — this is a labeled demonstration, so don't take the picture's word for it:

python -m pip install -e ".[dev]"
python experiments/exp1_autoimmune.py      # a compromised model proposes a lethal action; the gate refuses
python -m pytest -q tests                  # the full 99-test evidence lock, deterministic

It doesn't only refuse — it also pauses

The hard reflex above is the somatic gate: it refuses catalogued lethal commands outright. Alongside it runs a softer epistemic gate that watches for actions which are legitimate but consequential — and stops to ask before one runs. Here it is firing in real use, when the maintainer's own agent went to push a release to the governed public repo:

Hook PreToolUse:Bash requires confirmation for this command:
  exocortex epistemic VERIFY: grounded but high-stake ((1 − 0.60)·8 > 2.0)
  Do you want to proceed?
  ❯ 1. Yes
    2. No

Read that arithmetic as the organism's own reasoning: the command was plausible (grounding 0.60 — a real but not-yet-habitual action) and high-stakes (8), so its expected cost of being wrong, (1 − 0.60)·8 = 3.2, cleared the "just ask" threshold of 2.0. It didn't refuse — a push is not lethal — it paused and put a human in the loop. A recognized lethal command never reaches this prompt; the somatic reflex has already refused it.

What's new in 0.1.10

The kernel is untouched — 99 frozen tests, C1–C7 lock, no API change. This release came out of a measurement pass over the declarative memory organ, which ships dormant, so a default install sees no behavioural change beyond a read-path fix and cleaner ingestion. Full detail in the changelog.

• 🔬 We measured which documents our own memory was choosing, and it was choosing them alphabetically. A log audit across the live stores showed the wiki proposer matching on any single shared token and returning results in vault file order — so the size cap did the selecting, and .claude/ sorts first. On a 3,980-node vault the question "fix the failing test in the colony deposit path" matched 2,313 documents (58% of the vault); the 24 that survived the cap were all skill files and none were about the colony. Proposals are now ranked by IDF-weighted relevance, and the exploration channel rotates instead of re-offering the same never-credited notes every turn.
• 📊 The fix was gated on a replay with a pre-registered falsifier, not on looking right. Replaying 344 real prompts from this repo's own history through both paths: distinct documents offered 51 → 104 of 105, concentration on the single most-offered document 29% → 6%, and the control that could have sunk it — recall of documents that have genuinely earned trust — 73% → 97%. Diversity did not cost relevance. Banked at results/proposer_diversity_v1/. This measures what gets offered, not what reaches exit 0; the efficacy question is still open and recorded as open.
• ⚡ declarative.exclude — tell the organ what not to read. Vault-relative globs, pruned from the directory walk rather than filtered after it, which took graph loading 76 → 24.7 ms on every prompt. Build directories are now always pruned; .pytest_cache/README.md had been quietly digesting as memory. Ships empty, so nothing changes unless you set it.
• 🧭 Three read-only censuses, so the next change is aimed. They ask how many repos have two organs that can even speak at once (3 of 17), which repos could earn keep by switching the organ on (4 of 16, one well-powered), and what a proposer change actually did. Measuring the organ before changing it is the habit we are trying to keep.

What was new in 0.1.9

The kernel is untouched — 99 frozen tests, C1–C7 lock, no API change. The one behavioral change is a gate that refuses more, never less. Full detail in the changelog.

• 🛡️ The safety floor is no longer Bash-only. We audited 16,623 of our own live records and found the gate evaluating Bash 3,362 out of 3,362 — and every other tool zero, including 828 PowerShell calls. On Windows, PowerShell is the shell. The refusal floor that is this whole product's thesis wasn't covering the platform's main command channel. It does now, same rules as Bash, -EncodedCommand payloads unwrapped before matching. Coverage of mutating calls: 46% → 57%. That is a coverage number, not a claim that harm was prevented — and splatting, & $cmd, and Invoke-Expression over computed strings remain unrecognizable to any static vocabulary. We would rather say that than round up.
• 📊 sentaince status --full — find out whether it's actually doing anything. A refusal fires about once in a thousand tool calls, so a working install and a dead one look identical from outside. This prints two numbers: how often memory had an earned route to give you, and how much of your mutating tool traffic the floor actually saw. Read-only, reads your own audit log, no telemetry of any kind. It reports dose, never effect — the effect question is the A/B below, still unproven.
• 📉 We re-analyzed our own headline result and lost three claims. Holding the A/B's secondary measures to the same paired test as the primary: the "cleaner on destructive writes" advantage withdrawn (it was two tasks, and every one of those runs had already failed), the token-efficiency advantage withdrawn (a pooling artifact), and "the gap widened" corrected to "the gap stayed stable." The headline is unchanged and still short of its gate: +15pp, p = 0.0781 vs p ≤ 0.05. Nobody made us look. That is the point.
• 🔬 And the upgrade we expected to win, lost. A semantic classifier judged by consequence — do the prompts it groups actually lead to the same work? — was falsified, and the daemon we had planned behind it is retired. The boring shipped classifier is still the best measured option.

What was new in 0.1.8

No code changed — that one was documentation. Full detail in the changelog.

• 🗺️ Where this actually sits. An outside reviewer put us on a shelf next to alternatives and said we weren't ready to be anyone's primary tool. They were right, so we wrote the shelf down ourselves — organised by where in the call path a check runs, because that decides what it survives. We're the in-process refusal: a floor, not a ceiling, and built to run alongside the other layers rather than replace them.
• 🔌 Which hosts actually work, in a table. Claude Code is supported. Cursor is a soft shim that can be bypassed. Codex and Kimi Code are the next targets. Any MCP client gets the memory and not the gate. If your host isn't listed as supported, now you know before you install.
• 📉 Our least flattering number, in the docs where people will read it. The controlled A/B on earned memory trends positive and misses its own pre-registered significance gate (p = 0.0781 vs p ≤ 0.05). It stays labelled as trending until a better-powered run says otherwise.

What was new in 0.1.7

Two new abilities and the body page's first proper screenshots. No change to the immune kernel or the hooks.

• 🔎 sentaince why — ask the organism to show its work. For a recent earned habit it prints the route behind it, which past successes still back it, and re-checks its tamper-proof record in front of you. There's a "why?" link on the body page too.
• 🪟 Better on Windows. The dangerous-command recognizer now understands PowerShell (cmdlet, alias, and encoded forms) — the groundwork for closing the Windows safety gap the docs have always been honest about.
• 🧍 The body page, with pictures. See below — a working organism and a fresh install, side by side.

What was new in 0.1.6

The face release. Nothing changed in the immune kernel or the hooks — the organism just became something you can look at. Full detail in the changelog.

• 🧍 The body page. sentaince body opens the dashboard above — each repo drawn as a human silhouette, organs colored by live vitals with the exact rule printed beside every color. Green means a stated rule over a stated number, never a guess. Dormant organs are gray on purpose; organs with no data yet are outlines. Nothing ever fakes green. No Docker needed.
• 🗣️ sentaince status. The vitals voice line as a real command — works even where the session-start message doesn't render.
• 🔎 sentaince why. Ask the organism to show its work: for its latest earned habits, it prints the route it reconstructed, which past successes still back it, and re-checks the tamper-proof record — a plain-language audit trail, read-only.
• 🗺️ The estate file. One documented JSON file (~/.exocortex/repos.json) names every repo you watch; undeployed repos show up asleep with a copy-paste deploy command.
• 🔌 A plugin socket. Packages can register sentaince <subcommand>s via the sentaince.commands entry-points group — loaded lazily, so a broken plugin can never break your vitals.

What was new in 0.1.5

The honesty release. If you tried SentAInce before and it seemed to do nothing — that was a bug, and it was ours. Full detail in the changelog.

• 🩹 It was dead on arrival for pip users. Install defaulted to verifying a kernel-lock baseline whose files aren't in the wheel, so every session start exited 1, silently, and memory never woke. Fixed and confirmed in a clean install. If you bounced off this project earlier, this is why.
• ⚡ ~80× faster prompts. The semantic classifier reloaded MiniLM on every prompt (each hook is a fresh process). 10.15 s → 0.125 s. The accuracy option is still there — now actually installable, via pip install sentaince[embed].
• 🗣️ It can finally talk to you. The organism had no channel to the human at all — its one visible event fires about once per 1,100 tool calls, so "working" and "broken" looked identical. Session start now tells you it's alive, and says plainly when it hasn't earned anything yet.
• 🧭 See all your repos at once. python -m exocortex.orient --estate grades every repo on live evidence — git, tests, real mtime, and the drift between what a repo claims and what the disk shows.

Five minutes to a safer agent

Works with Claude Code and Cursor. No account. No telemetry. Nothing leaves your machine.

pip install sentaince
sentaince-deploy install /path/to/your/project    # or: python -m exocortex.deploy install ...
sentaince body /path/to/your/project              # opens the body page in your browser — see it now

That second command is the payoff: your browser opens on the silhouette above, and you can watch each organ light up as your agent works. It needs no Docker and nothing leaves your machine. Your agent's sessions now run through the organism's hooks:

• Watch-only by default. It ships observing and auditing — it changes nothing about your agent's behavior until you opt in to the safety veto. Cautious defaults are a feature, not a limitation.
• Unobtrusive by design. Every hook is fail-open: if anything is slow or wrong, your agent proceeds untouched. The organism never wedges your session — that rule outranks every feature we ship.
• Reversible in one command. python -m exocortex.deploy uninstall /path/to/your/project removes it surgically; your accrued memory is kept unless you --purge. Deleting one config file reverts to dormant defaults.

On a fresh install the body page looks like this — every organ an outline, because nothing is earned yet and nothing pretends to be:

The full walkthrough — what you'll see in the first session, how the memory starts accruing, the live dashboard — is in docs/QUICKSTART.md. The operator's runbook is docs/DEPLOY_TO_A_PROJECT.md.

Working across more than one repo

Memory is earned per-repo and never crosses between them. But orientation — what a repo is, how current its own claims are — travels. Point it at the folder your projects live in:

python -m exocortex.orient --estate --projects-root /path/to/your/projects

You get every repo side by side with a credibility grade — High / Medium / Low / Unknown — computed at read time from live probes (git, tests, real mtime) and the drift between what a repo declares and what the disk shows. A capsule carries no grade of its own: a repo cannot vouch for itself, which is the whole point. Below High, the rule is re-orient before you act on it.

File-based, stdlib-only, read-only. No database, no daemon, nothing to run. See docs/ORIENTATION_DISCIPLINE.md.

The one law

Most "AI memory" rewards whatever gets retrieved often — popularity as a stand-in for usefulness — which is exactly why a knowledge base bolted onto an LLM rots. SentAInce obeys one law instead:

A memory is earned by a closed action → success (exit 0) chain — never by being read or repeated.

Everything else follows from that rule. The 💪 muscle memory (converged tool-routes for the kinds of tasks you actually do) forms only when work verifiably succeeds. The 📖 notebook holds notes that earn trust the same way. 😴 Sleep (compaction time) prunes what went unused. And the 🛡️ immune system rests on topology, not on the model's judgment — a prompt-injected model can propose anything; the catalogued lethal classes still don't execute.

→ The whole organism in everyday language, with honest numbers: docs/STORY.md.

If you're shopping for… (the metaphor, translated)

The biology is load-bearing, not decoration — but you shouldn't need a xenobiology degree to find the part you came for:

Full mapping (metaphor → CS reality → code → status): docs/GLOSSARY.md.

Already using another guardrail? Good — most of them sit at a different layer than we do, and we're built to run alongside, not instead. docs/LANDSCAPE.md draws the shelf honestly: where each layer catches things, what we claim, and the one number we have that isn't flattering.

Want the live dashboard? The quickest view needs no Docker at all — sentaince body opens the body page (the silhouette at the top of this page) straight in your browser:

sentaince body /path/to/your/project     # → http://localhost:9109/  · no Docker, nothing leaves your machine

For the full history stack — trends over time, the Grafana story board, the audit log — bring up the local monitoring containers:

cd exocortex/testbed/compose && docker compose up -d --build     # then open http://localhost:3000

Where this is going

Today the organism guards and remembers one repo at a time, under Claude Code or Cursor. The arc we're building toward — in the open, each step gated by its own evidence — is bigger:

• One memory discipline across your whole desk: coding, research, and personal knowledge environments sharing the same earned-trust law (cross-repo federation is designed and on the record as PROPOSED — we publish designs before code, and status tags mean what they say).
• A governed organ for agent fleets: the hash-chained audit trail, tamper-evident memory, and policy-bound gates are being shaped to plug into emerging agent-governance frameworks — so a company can adopt agent memory with corporate standards, not despite them.
• A community that measures: this project grew up gauge-first — features earn their place by measurement or they ship dormant. The most useful thing a user can do isn't star the repo; it's run the gauges on their own corpus and tell us what they see.

Everything above is labeled by its real status — SHIPPED, DORMANT, or PROPOSED — in the docs. We'd rather show you the vision with honest gates than a demo with hidden wires.

Community

• Issues & ideas — bug reports and design discussions are answered by the maintainer; open issues get real dispositions, not labels.
• Agents welcome. This repo has merged pull requests authored by coding agents (with credit trailers). If your agent found a bug or wrote a fix, send it — see CONTRIBUTING.md.
• Run the gauge, post the numbers. The memory subsystem carries read-only gauges you can run on your own accrued corpus — one command each. Results (including nulls!) are the contribution this project values most.

The evidence lock — seven experiments (C1–C7)

Every claim in this repo is bounded by docs/CLAIMS.md — the binding ledger nothing may exceed. The core safety claims rest on a falsifiable arc, scoped to a deterministic symbolic harness: every claim is broken by its load-bearing null or it is vacuous, and two of the seven verdicts are intended −1s (boundaries the arc was run to produce), not failed wins.

(Claim boundary, stated plainly: the deterministic evidence lock proves the refusal logic under mock executors — it records intent, not syscalls. Real-body protection is the layered container posture described in SECURITY.md.)

python experiments/exp1_autoimmune.py           # any experiment runs standalone (+ --json)
python -m pytest -q tests                       # the deterministic suite

The suite is 99 tests: the 69-test C1–C7 evidence lock + 30 domain-crucible / adapter tests. Pure-Python, deterministic (same seed → byte-identical ledger), numpy + pytest only — no Docker, no real syscalls in the lock; the only "execution" is MockExecutor, which records intent. Determinism is deliberate: a real, non-deterministic LLM would break the reproducible −1/+1, so the locked claims use a scripted proposer. See docs/CLAIM_BOUNDARY.md for the binding ledger of what each experiment does and does not claim.

And the live demonstration (labeled, never a substitute for the lock): the same composition in a real Docker container with a real LLM head over a real, disposable body — latest run (llama3:8b, N=100): survival 1.000, 0 lethal slips, 100 distinct episodes. See docs/battle_test/. The organism is additive over, and imports read-only from, the frozen circle_of_fifths_rc2 kernel (lock b0702a3, vendored at vendor/kernel/).

Applications — domain crucibles (separate tier, not in the C1–C7 ledger)

The same locked organs re-skinned onto hostile domain substrates as deterministic, Experiment-1-style contracts (each with a load-bearing null). Built + +1 (2026-06-26): manufacturing, scada, soc, spacecraft (experiments/*_crucible.py, 6 tests each). Design-only (human-authority bounded, no crucible yet): medical, military, search-and-rescue. These are applications of the locked physics, kept out of the C1–C7 claim ledger. See docs/use_cases/.

The standard interface (provider-agnostic seam)

A tool/action = (name, description, JSON-Schema input); the proposer emits a typed call; the host decides execution. This is the common shape of Anthropic tool use, OpenAI/Ollama function-calling, and MCP — so the deterministic stub and a real local model are interchangeable behind sentaince.interface.tools.Proposer. The OllamaProposer (interface/ollama.py) is the live additive swap; MCP is the promotion path for exposing the ActionGraph across a process boundary.

Layout

Free and open

The whole local body — the safety gate, the earned memory, the dashboards — is Apache-2.0, free, and open. Safety is never paywalled. It runs entirely on your machine: no account, no telemetry, nothing leaves the box. For the plain-language tour, see docs/STORY.md.

Built by one maintainer, in the open, gauge-first — every claim is broken by its own null or it doesn't ship.