{"schema":"marketnow-security-layers/1.0","generated_at":"2026-09-25T02:40:00Z","sentinel_version":"v3.0","pipeline_stages":12,"claim":"10-layer audit pipeline: L1 index certification, L1.5-L1.9 static analysis, L2 deep tarball scans, L2.5 sandbox, L3 runtime monitoring","layers":[{"layer":"L1","name":"index certification","status":"live","runs":"catalog build + regenerate","public_evidence":["/api/certification.json","/api/stats.json (l1_index_certified)"],"counts":{"certified":68388,"checks":10,"checks_failed":4}},{"layer":"L1.5","name":"metadata static checks (real-time)","status":"live","runs":"every /api/audit-skill call (~200ms, Vercel)","public_evidence":["/api/audit-skill?skillId=mn-gen-00003","api/audit-skill.js (repo)"],"counts":{"checks":6}},{"layer":"L1.6","name":"Semgrep-equivalent + secret patterns + OSV","status":"live","runs":"real-time + weekly batch","public_evidence":["/api/audit-skill?sentinel-status=1","uta-monorepo/packages/sentinel-rules"],"counts":{"semgrep_rules":18,"secret_patterns":18,"batch_findings_secrets":1257,"batch_osv_vulns":1}},{"layer":"L1.7","name":"binary & malware detection (nested archives, PE)","status":"live","runs":"import-time + on-demand ?deep=1","public_evidence":["lib/sentinel-l17.mjs (repo, con regression test del incidente #9)","/_data/quarantine_decisions/"],"counts":{"documented_catches":1,"regression_vectors":1}},{"layer":"L1.8","name":"malware family signatures (YARA-class)","status":"live","runs":"with L1.7 on import/batch","public_evidence":["lib/sentinel-l18.mjs (repo)"],"counts":{"families":1,"catches":0,"role":"backstop"}},{"layer":"L1.9","name":"prompt injection firewall","status":"live","runs":"import-time + audit calls","public_evidence":["lib/sentinel-l19.mjs (repo)","/_data/quarantine_decisions/2026/08/ (qd_001)"],"counts":{"documented_catches":1}},{"layer":"L2","name":"deep tarball scan (29 rules on shipped artifacts)","status":"live","runs":"weekly batch over top-2,868 npm targets","public_evidence":["/api/certification-scans.json","/api/certification?package=<name>"],"counts":{"targets":2868,"scanned":2839,"completion_pct":99,"clean":885,"flagged_warning":791,"flagged_error":1156,"rules":29}},{"layer":"L2.5","name":"sandbox execution (Docker --network none + seccomp; gVisor roadmap)","status":"partial","runs":"GitHub Actions on repo-linked skills (async)","public_evidence":["lib/sentinel-l2-sandbox.sh (repo)","/api/audit-skill?sentinel-status=1 (L2 trigger)"],"counts":{"sandbox_profile":"no-network, read-only, cap-drop ALL, seccomp","gvisor":"planned (Sentinel v3.1)"}},{"layer":"L3","name":"runtime monitoring & drift detection","status":"live","runs":"Interceptor + re-audit cycles","public_evidence":["/api/interceptor.json","/api/crl","/api/ocsp"],"counts":{"interceptor_rules":6,"revocation":"CRL + OCSP vivos"}},{"layer":"L4-L9","name":"dependency scan / secrets / families / SBOM / policy / post-exec filter","status":"live","runs":"batch + CI (OSV 0 vulns on 688 locked deps)","public_evidence":["/api/owasp.json","scripts/osv_batch_locks.py (repo)",".github/workflows/ci-tests.yml + codeql-analysis.yml"],"counts":{"osv_vulnerabilities_locked_deps":0,"deps_checked":688,"sast":"CodeQL security-extended (monthly)"}}],"ledger":{"quarantine_decisions":3,"url":"/_data/quarantine_decisions/MANIFEST.json","purpose":"Tamper-evident public record of every quarantine decision. Allows third parties to audit false positive rate and false negative rate over time."},"benchmark":{"f1":0.857,"url":"/api/sentinel-benchmark.json"},"pentest":{"independent_pentest":"NOT PERFORMED YET — honestly reported. Scope draft published; automated compensating controls live (CodeQL SAST, OSV, headers, sandbox).","scope_url":"/security/audit-2026-08-19#pentest"},"notes":["Cada capa cita el artefacto público donde verificarla. No se reclama nada sin URL.","El estado \"partial\"/\"planned\" es deliberado: la honestidad es parte del producto."],"computed_at":"2026-09-25T06:19:03.032Z","computed_from":"lib/security-layers.json + quarantine MANIFEST + stats stamp (repo artifacts)","endpoints":{"overview":"/api/security","quarantine_ledger":"/api/security?view=quarantine (alias /api/quarantine)","honeypot":"/api/security?view=honeypot (alias /api/honeypot)","threat_intel":"/api/security?view=threat-intel (alias /api/threat-intel)","analytics":"/api/security?view=analytics (alias /api/agent-analytics)"},"human_pages":{"sentinel_v3":"/security/sentinel-v3.0","evidence_matrix":"/security/evidence","benchmark":"/security/sentinel-benchmark","audit_2026_08_19":"/security/audit-2026-08-19","latest_audit":"/trust/aud-2026-0925.html"}}