Sentinel reflex arcs

Read sentinel_status, enforce reflex policies, clear pain only after remediation.

What you will learn

Inspect status
Understand pain→reflex
sentinel_enforce / clear

Prerequisites

Surface

MCP	sentinel_status · sentinel_get · sentinel_enforce · sentinel_clear

What this feature does

Sentinel maps pains (raw git commit, license fail, doctor broken) to reflexes that block or remediate. Agents clear pain only after the underlying violation is fixed.

How to call it

Call these MCP tools through your AGS / tower-gov host — sentinel_status, sentinel_get, sentinel_enforce, sentinel_clear.. Prefer scan/get before validate/diff, and enforce only when the change set is ready.

sentinel_status
Remediate cited pain
sentinel_enforce
sentinel_clear if required

MCP: sentinel_status json

{
  /* Example MCP call — fill args from schema_get / docs */
  "tool": "sentinel_status",
  "arguments": {}
}

Example reflex

Raw git commit pain routes to gate.commit_msg deny + MCP redirect.

Conceptual reflex yaml

pain: commit:raw_git
reflex: gate.commit_msg
action: deny

What success looks like

No active blocking pains

sentinel_enforce ok

Common failure modes

sentinel_clear without fix

Ignoring reflex.license_enforce

Fighting hooks instead of using commit_checkpoint