[CodeBuildder]

Summary

Phase 2 connects Argus to the Sentinel World Model through a schema-compatible, idempotent, and failure-isolated write path.

Once Argus completes enrichment, reasoning, action routing, and audit logging, it publishes the completed security finding into shared cross-agent state. Eligible high-confidence decisions also raise the affected pod or node's security posture. Sentinel can now consume Argus evidence without becoming a runtime dependency of the local security pipeline.

Closes #92.

This is a stacked PR targeting agent/build-week-phase-1. Its diff contains only Phase 2. After #91 merges, this PR can be retargeted to main.

Why this change

The Sentinel platform needs one shared operational model across its specialist agents:

• Argus contributes security evidence and response decisions;
• Phoenix contributes failure, healing, and verification outcomes;
• Sentinel correlates both into cross-domain incidents and coordinated plans.

The initial Argus integration draft established HTTP calls but was not safe to publish:

• generated event IDs were prefixed hashes rather than schema-compatible UUIDs;
• rule-only identity could collapse alerts from different workloads;
• endpoint configuration was captured at import time;
• duplicate, disabled, and failed writes had no structured outcome;
• 5xx and transport failures had no bounded retry;
• non-success posture updates were effectively invisible;
• there was no Argus-side contract or failure-isolation test coverage.

Architecture

World Model synchronization happens only after the complete local pipeline:

Falco alert
    → enrich → reason → act → audit
                              |
                              └─ best-effort synchronization
                                   ├─ POST /findings
                                   └─ PATCH /entities/{entity_id}

The webhook response remains asynchronous, and local remediation is never gated on shared-platform availability.

What changed

Deterministic event identity

Each finding receives a UUIDv5 derived from:

• the Falco deduplication identity, which includes rule, pod/container, namespace, and process;
• the original alert timestamp.

Reprocessing the same alert produces the same UUID and is safely handled as a duplicate. Different workloads, processes, namespaces, or alert times produce different IDs.

Shared finding contract

Argus publishes:

• event_id, type, source, timestamp, severity, and entity_id;
• original Falco rule, priority, tags, output, and raw fields;
• Argus confidence, assessment, recommended action, false-positive judgment, and blast radius;
• a required human-readable finding description.

Entity posture synchronization

Entity IDs match Sentinel's Kubernetes topology reconciler:

Object	Entity ID
Pod	pod/{namespace}/{pod-name}
Node	node/cluster/{node-name}

Critical, high, and medium decisions update posture only when Argus does not classify the finding as a likely false positive.

Failure isolation and observability

World Model operations return structured outcomes:

• disabled
• accepted
• duplicate
• skipped
• failed

Transport errors and 5xx responses receive one bounded retry. Client errors and 4xx responses fail immediately. Every synchronization completes with structured logs containing finding and posture status, while no integration exception can escape into the local response pipeline.

Deployment and documentation

• Adds WORLD_MODEL_URL to central Argus configuration.
• Configures the in-cluster sentinel-world-model.sentinel-platform service address.
• Documents local endpoint configuration and the complete write contract.
• Updates the Build Week phase record with issue and implementation scope.

Test coverage

New tests verify:

• deterministic UUIDv5 generation;
• unique identity across workloads and alert times;
• pod and node entity resolution;
• shared finding request shape;
• duplicate idempotency;
• disabled integration behavior;
• bounded 5xx retries;
• bounded transport retries;
• missing-entity and HTTP-error posture outcomes;
• false-positive posture suppression;
• webhook propagation of the accepted Falco deduplication key.

Validation

• make test
  • 86 backend tests passed
  • TypeScript compilation passed
  • Vite production build passed
• git diff --check

Reviewer guide

1. Start with agent/src/world_model.py for identity, contract, and failure semantics.
2. Review agent/src/webhook.py to confirm synchronization occurs after local action and audit completion.
3. Review agent/tests/test_world_model.py for contract and outage coverage.
4. Compare entity IDs with Sentinel Platform's topology reconciler.
5. Confirm deployment DNS matches the sentinel-world-model Service in sentinel-platform.

Operational behavior

• If WORLD_MODEL_URL is empty, synchronization reports disabled and performs no I/O.
• If Sentinel is unavailable, Argus retries once, logs failed, and completes normally.
• If an event is replayed, the World Model reports duplicate without storing it twice.
• If topology has not reconciled an entity yet, the finding is still accepted; a posture PATCH may report a 404 without affecting Argus.

Out of scope and follow-ups

• Phoenix World Model integration hardening
• Sentinel cross-agent correlation engine
• coordinated Argus/Phoenix response planning
• shared incident visualization
• dashboard content polish
• judge-mode packaging and final demo video