sentinelos-agent 1.0.1

The self-improving AI agent — creates skills from experience, improves them during use, and runs anywhere

SentinelOS

Privacy-first enterprise AI workstation. Run large language models locally, govern access with RBAC policies, and give every team a secure, auditable AI assistant — without sending a single prompt to the cloud.

SentinelOS combines a desktop chat application, an enterprise governance layer, a local RAG pipeline, and an admin console into a single deployable stack. Models run on your hardware via Ollama. Every action is logged. Every tool call is policy-gated. Data never leaves your network.

Key Capabilities

Capability	Description
Local Model Inference	Run Qwen, Holo3, Llama, and other open models via Ollama. No API keys required for local models.
RBAC Governance	Define groups (Engineering, Sales, Legal) with per-group tool policies and model access.
Tool & Model Policies	Allowlist which MCP tools each group can invoke. Whitelist models with privacy badges (local vs. third-party).
Local RAG	Ingest company documents (PDF, text). Chunks are embedded and stored locally in ChromaDB.
Admin Console	Web-based dashboard for group management, model configuration, RAG ingestion, branding, and audit review.
Audit Trail	Chronological log of every administrative and governance action.
Desktop Application	Electron-based chat interface with streaming responses, tool output display, and conversation history.
Agent Runtime	Self-improving agent with skill creation, memory, scheduled automations, and multi-platform messaging.
Default-Deny Security	Fail-closed policy enforcement, timing-safe token auth, local-first data model.

Architecture

┌─────────────────────────────────────────────────────────┐
│                     Desktop App                         │
│              (Electron + React + TUI)                   │
└────────────────────┬────────────────────────────────────┘
                     │
┌────────────────────▼────────────────────────────────────┐
│                  Agent Runtime                          │
│     Skills · Memory · Tools · Subagents · Scheduler     │
├─────────────────────────────────────────────────────────┤
│                Enterprise Layer                         │
│  Auth · Groups · Tool Policies · Model Whitelist · RAG  │
│         Governance · Audit · Config Validation          │
├─────────────────────────────────────────────────────────┤
│                  Admin Console                          │
│        (React SPA ← FastAPI backend @ :18830)           │
└────────────────────┬────────────────────────────────────┘
                     │
┌────────────────────▼────────────────────────────────────┐
│              Local Model Backend                        │
│           Ollama (Qwen, Holo3, Llama, …)                │
└─────────────────────────────────────────────────────────┘

Desktop App — Electron application providing a chat interface, conversation management, and tool output rendering.

Agent Runtime — Python-based agent with autonomous skill creation, persistent memory, cron-scheduled tasks, subagent delegation, and multi-platform messaging (Telegram, Discord, Slack, CLI).

Enterprise Layer — RBAC identity and governance. Groups define which tools and models each team can access. Policy enforcement is default-deny: if a tool or model isn't explicitly allowed, it's blocked. Auth uses timing-safe token comparison.

Admin Console — React single-page application served by a FastAPI backend. Manages groups, tool policies, model whitelists, RAG document ingestion, organization branding, and audit logs.

Local Model Backend — Ollama provides local inference. Models are pulled once and served from disk. External providers (OpenRouter, OpenAI) are supported but clearly marked with privacy badges.

Quick Start

See docs/INSTALL.md for full installation instructions.

# 1. Run the enterprise setup script
bash sentinel-enterprise/setup.sh

# 2. Start the admin console
SENTINEL_ADMIN_TOKEN=$(cat ~/.sentinel/admin/token) \
  ./venv/bin/python sentinel-enterprise/admin/serve.py

# 3. Open the admin console at http://127.0.0.1:18830

Documentation

• Installation Guide — Prerequisites, setup, configuration
• Admin Guide — Groups, policies, RAG, audit, branding
• Architecture — Component design, data flows, security model

License

This project is licensed under the MIT License — see LICENSE for details.

SentinelOS is a fork of Nous Research Hermes Agent. The original work is copyright © 2025 Nous Research and contributors, licensed under MIT. See the LICENSE file for the full copyright notice.