01LOGIC DRIFT
The control loop's decision logic changes over time while outputs remain plausible. The rule is no longer the rule.
VARUX LAB / CRITICAL SYSTEM MONITORING
FUTURE CONCEPT
A system can fail while
it appears to work.
SENTINEL is a monitoring intelligence concept for detecting logic drift, abnormal behavior, unauthorized state transitions and emerging risk patterns in critical system control loops.
A future concept for watching behavior, not just signals — so a control loop that quietly changes its logic does not pass unnoticed.
TRACE 01 PREMISE
System failure is not only a crash. It is also a control loop that keeps running — with its logic quietly changed.
Monitoring usually watches for the loud failures: a process that dies, an error rate that spikes, a resource that saturates. Those are signal-level failures. But in a critical system, the dangerous deviation is behavioral: a threshold that was silently relaxed, a transition taken outside policy, a rule that no longer matches its own documentation.
The system still returns results. The dashboards still update. The logic, however, has drifted. SENTINEL conceptualizes detection at this level — comparing observed behavior against an established baseline, and treating a quiet deviation as an event, not a coincidence.
SENTINEL is a future concept. It proposes detection surfaces — it does not ship a detector, an agent or an alerting product.
TRACE 02 THE SIGNAL
What the same loop looks like, before and after drift.
Two illustrative traces of the same control loop. One follows its established pattern. The other is still running — but its behavior no longer matches the baseline.
TRACE A — BASELINE
PATTERN: STABLE · PERIOD: CONSISTENT · STATE: NOMINAL
TRACE B — DRIFTED
PATTERN: SHIFTED · PERIOD: CHANGED · STATE: DEVIATION
TRACE 03 DETECTION TARGETS
What SENTINEL watches for.
Five deviation classes a monitoring intelligence concept would need to distinguish. Each is a different failure of behavior, not of process.
02BEHAVIORAL ANOMALY
Observable behavior departs from the established pattern — cadence, amplitude or sequence — without a declared cause.
03UNAUTHORIZED TRANSITION
The system moves between states through a path that policy does not permit, even if the end state is valid.
04POLICY DEVIATION
Behavior that violates a declared boundary — a threshold bypassed, an approval skipped, an envelope exceeded.
05CONTROL-LOOP DEGRADATION
The loop's responsiveness or stability decays gradually — slower correction, wider oscillation, growing lag.
TRACE 04 REFERENCE ARCHITECTURE
A temporal pipeline, not a dashboard.
Six conceptual stages from observation to escalation. This is a reference model for discussion — not an implemented stack.
STAGE 01
OBSERVE
Collect state transitions, execution traces and control-loop outputs into an ordered record.
STAGE 02
BASELINE
Establish what "normal" means for this specific loop — its pattern, cadence and valid transitions.
STAGE 03
COMPARE
Evaluate observed behavior against the baseline, in sequence, not in aggregate.
STAGE 04
CORRELATE
Link individual deviations into patterns: does this drift recur, spread, or align with policy changes?
STAGE 05
FLAG
Surface a deviation as a reviewable event with confidence, provenance and affected transitions.
STAGE 06
ESCALATE
Route to a human operator with the evidence required to decide. Detection ends where decision begins.
TRACE 05 CONTROL MODEL
What SENTINEL constrains: the state transition.
The unit of control is the transition between system states. SENTINEL conceptualizes three ways to act on it — always visible, never silent.
VALIDATE
Confirm the path.
Every transition is checked against the set of permitted paths for the current policy. A valid transition in an invalid order is still flagged.
TARGET: transition sequence
FLAG
Make deviation visible.
A detected deviation becomes a reviewable event with confidence and provenance — a record a human can inspect, not a buried log line.
TARGET: operator awareness
BLOCK
Hold the boundary.
An unauthorized state transition is refused at the boundary and held for review. The system does not repair itself; it stops, and reports.
TARGET: unauthorized transitions
TRACE 06 DEGRADATION MODEL
A detector that cannot state its own uncertainty is just a louder alarm.
SENTINEL's value depends on honest degradation: confidence must decay as baselines age, as coverage shrinks, or as the system under observation changes faster than the baseline can be re-established.
A monitoring intelligence concept that reports its own confidence is a decision support surface. One that does not is a liability — it trains operators to ignore it.
PROPOSED: CONFIDENCE IS PART OF EVERY EVENT — never a separate "health score".
D1BASELINE UNCERTAINTY
A weak or aging baseline weakens every comparison. Detection confidence must track baseline confidence.
D2SILENT BASELINE DRIFT
If "normal" shifts slowly, deviations stop looking like deviations. SENTINEL must detect drift in its own baseline.
D3COVERAGE LOSS
When observation stops seeing part of the loop, the gap is reported as reduced confidence — not as continued normalcy.
TRACE 08 RESEARCH DIRECTIONS
Open surfaces for future work.
Directions SENTINEL could explore next — each stated as a question, not a roadmap.
SEN-R-01
Baseline drift estimation
How to detect that "normal" itself has moved — without mistaking a legitimate change for a deviation.
SEN-R-02
Event correlation
Linking separate deviations into a single emerging pattern, rather than treating each signal in isolation.
SEN-R-03
Detection confidence models
Calibrated confidence that operators can rely on — including explicit statements of when detection is unsure.
SEN-R-04
Control-loop degradation signatures
Characteristic patterns of a loop losing responsiveness, before any single threshold is violated.
SEN-R-05
State history retention
How much transition history a reviewable record requires — and how it survives restarts and disputes.
SEN-R-06
Escalation policy
Which flags reach humans, in what form, and how review outcomes re-tune the detector.
TRACE 09 SCOPE
What this concept is — and is not.
SENTINEL IS
- ▸ a monitoring intelligence future concept
- ▸ a logic drift detection concept
- ▸ a behavioral anomaly concept
- ▸ a state transition validation concept
- ▸ a detection / decision separation surface
- ▸ an illustration of evidence-first monitoring
SENTINEL IS NOT
- ✕ a SIEM
- ✕ a traditional APM or observability product
- ✕ an intrusion detection system
- ✕ an auto-remediation engine
- ✕ an alert spam generator
- ✕ a released product, deployment or benchmark
TRACE 10 INTERACTIVE DEMONSTRATION
Event replay — concept simulation.
An illustrative replay of a deviation sequence inside a critical control loop. Play it, step through it, or click an event to inspect it. Everything here is simulated — no live telemetry is involved.
SENTINEL — EVENT REPLAY
PHASE: BASELINE
LOCAL SIMULATION · NO LIVE TELEMETRY
SYSTEM STATESTABLE
BEHAVIORNOMINAL
POLICYUNCHANGED
STATE TRANSITIONNONE
RISKLOW
DETECTION CONFIDENCE
0.98
Illustrative replay of a deviation sequence. All timestamps, event identifiers and confidence values are simulated for demonstration — this is not a live monitoring system and reflects no real system.
STATUS — FUTURE CONCEPT
SENTINEL is a future concept. It is a concept for monitoring intelligence — not a released product, not a deployed system, not a benchmarked implementation. This page documents the concept and its proposed shape.
The Future Needs Boundaries.
Critical systems require deterministic boundaries before intelligence scales. SENTINEL is a research surface for detecting when a system crosses its own boundaries — quietly, while still appearing to work.