Sentinel: a machine language, a programming language, and an analytics lab

Most of what a computer does badly, it does badly for one reason: the program is trusted with raw memory. Sentinel starts from the opposite premise — the machine disciplines the program.

This post introduces three things built on that idea, all now live on the portal: a custom virtual machine, a language called Senlang, and an Analytics Lab that runs entirely in your browser.

The machine

Sentinel is a virtual machine with its own instruction set — not a wrapper over C, and not a compiler target for an existing language. Programs never hold pointers. They hold handles: a slot number plus a generation counter. Every access goes through a single inspection chokepoint, and when a block is freed, its generation advances, so every outstanding handle to it becomes detectably stale.

The result is that the classic C catastrophes stop being silent:

*** SENTINEL TRAP at bytecode addr 13 ***
    LOAD through STALE handle (use-after-free): slot 0 is generation 1,
    handle carries generation 0. Block was freed at bytecode addr 7.

That is a use-after-free, caught at the instruction that committed it, naming the rule broken and the history of the memory involved. In C the same bug corrupts memory quietly and surfaces as a crash somewhere unrelated, hours later.

The machine also keeps its own books. audit is a keyword, and it reports what the program owns right now — allocations, frees, bytes in use, peak, and the exact allocation site of anything still live.

The ownership rule

Sentinel's second idea is runtime ownership: a function owns what it allocates, and the machine reclaims it automatically when that function returns — unless ownership is explicitly transferred to the caller with give.

func make_scores() {
    var s = alloc(3 * 8);
    s[0] = 90; s[1] = 80; s[2] = 70;
    return give s;          # ownership moves to the caller
}
func scratch_work() {
    var tmp = alloc(1000);  # never freed, never given...
    tmp[0] = 1;
    return tmp[0];          # ...auto-reclaimed the instant this returns
}

Rust proves ownership at compile time with a borrow checker that famously takes months to internalise. Sentinel enforces it at runtime with a rule you can learn in one sentence. They sit at opposite ends of the same design axis — and runtime-enforced ownership with a self-auditing machine is a corner of that axis that is not otherwise occupied.

You can try all of this in the Senlang Playground: the language runs in your browser with the same semantics as the native VM. Load the "Trap: use-after-free" example and watch the machine catch it.

Speed, honestly measured

Safety is usually sold as a trade against speed. The numbers say otherwise, because the checks happen once per operation rather than once per element:

The identical-weights result matters more than the timing: the speed is not bought with sloppier mathematics. Both engines converge to exactly the same coefficients. Sentinel's numbers arrive with 1.5 billion bounds-checked memory accesses recorded on the audit ledger.

The native interpreter runs at 386M instructions/sec and ships with 163 automated tests, fuzzing, and sanitizer verification.

The Analytics Lab

The Analytics Lab brings the same discipline to data work. Load a CSV — it streams, so 100 MB and a million rows are unremarkable — and benchmark nine algorithms across five analysis families:

• Classification — logistic regression, neural network, SVM, naive Bayes, decision tree,

random forest, gradient boosting, k-NN

• Regression — linear/ridge, trees, forests, boosting, k-NN
• Clustering — k-means, scored by silhouette
• Anomaly detection — Isolation Forest and Mahalanobis distance, unsupervised
• Forecasting — lag features with walk-forward validation

Measured on a million rows by twelve features: the file parses in 1.9 seconds, the feature matrix occupies 46 MB as a flat typed array, and logistic regression trains on 800,000 rows in 1.3 seconds — all inside a Web Worker, so the page never freezes.

Nothing is uploaded. The data never leaves your browser.

Honest evaluation, which is rarer than it should be

Most demo tools quietly score the model on the data it trained on. This one does not:

• Every model is scored on a held-out test set, or a separate test file, or 5-fold CV
• Feature scaling is fitted on training data only
• Rare events are judged on PR-AUC and precision@k — accuracy is meaningless when 2% of rows

are anomalies

• Time series use temporal splits, never random ones

That last point deserves a demonstration. On the same forecasting problem:

The random split looks better. It is a lie. The lab uses the temporal one.

The verification that built this found two real bugs in its own code — a stratified split that returned class-ordered indices (producing a fake 100% k-NN score) and a variance guard leaking into metric reporting. Both were fixed before release. A tool that reports R² ≈ 0 for noise and silhouette ≈ 0.04 for a single blob is telling you the truth.

The 3D data view

Any dataset, however many dimensions, is projected to three via PCA and rendered live — coloured by class, by cluster, or by anomaly score, with the variance explained by each component shown on its axis. Drag to rotate. It is the fastest way to see whether your classes actually separate before you spend an afternoon tuning a model that never had a chance.

The requirements agent

The last piece is the one that changes how the tool is used. After every analysis, an agent inspects the dataset and the results and writes a Model Requirements Specification — a versioned document that updates itself across runs.

It is deterministic: every requirement traces to measured evidence. It detects class imbalance and mandates PR-AUC. It flags a 99.9% accuracy as probable target leakage rather than celebrating it. It spots overfitting from the train-test gap. It notices when a linear model matches the best non-linear one and recommends the simpler model under an explicit Occam constraint. And it says nothing when nothing is wrong — on healthy data it raises zero critical findings.

Between runs it diffs itself: new findings appear, resolved ones are recorded, and the accepted model is re-justified. The specification is the deliverable — not the accuracy number.

What this is, and what it is not

This is a learning lab. It is deliberately non-commercial, it runs on one VPS, and the browser engine tops out around a few million rows before the native engine should take over. Senlang v1 is integer-first; floats, strings, and direct database syntax are the next milestone.

What it demonstrates is a thesis: that a machine can be built which watches itself, that safety need not cost speed, and that the honest answer — including "there is no signal here" — is more useful than a flattering one.

Try it: Analytics Lab · Senlang Playground · About

Comments (0)