# SENTINEL — Shared Build Brief (read before building any component)

## Product name (working): SENTINEL Track-Back Defense Platform

## Founder's intent (verbatim spirit)
The founder HATES hackers and will NEVER attack anyone. This is a **track-back**
platform, NOT a hack-back platform. It lures attackers into decoys, records
everything they do, analyzes captured malware in an isolated lab, and hands a
forensic evidence package to law enforcement. It protects individuals, families,
businesses, and government with air-gapped, encrypted, tokenized vaults.

## ABSOLUTE LEGAL GUARDRAILS — do not violate in any code or doc
1. NEVER write code that reaches OUT to, accesses, damages, corrupts, or exfiltrates
   from any system the user does not own. No hack-back. No retaliation. No draining
   accounts. No corrupting an attacker's files or data center. That is a federal
   crime under the CFAA (18 U.S.C. 1030). We do the OPPOSITE of that.
2. "Track-back" = PASSIVE beacons/canary tokens/watermarked decoy files that phone
   home when the ATTACKER voluntarily opens them on THEIR machine. We never touch
   their machine — their machine reports to us. This is legal (honeypots, beacons,
   canary tokens are explicitly lawful active-defense).
3. All malware analysis happens in OUR OWN isolated sandbox on samples that came to
   us. No live malware execution outside containment. Prototype = SIMULATED analysis
   only; never actually detonate real malware.
4. Evidence is preserved with chain-of-custody and forwarded to authorities
   (CISA / FBI IC3). It is NEVER used by us to pursue or identify a private person
   ourselves. We collect and report; law enforcement acts.
5. All "attacker data" in prototypes is SYNTHETIC/DUMMY. No real PII. No real IPs
   tied to real people. Phishing simulator sends only to opted-in internal testers.

## Design system (for any UI / dashboard)
- Dark security-console aesthetic. Background #0D1117, surface #161B22, border #30363D.
- Accent teal #20808D (primary), success #6DAA45, warning #E8AF34, danger #DD6974.
- Text #C9D1D9 primary, #8B949E muted. Monospace for logs (JetBrains Mono / Consolas).
- Fonts via CDN for any web UI: Space Grotesk (headings), Inter (body), JetBrains Mono (logs).
- Clean, calm, "operations center" feel. No clip art.

## Tiers (all components should reflect these)
- TIER 1 Individual/Family  → TIER 2 Business  → TIER 3 Government/High-Security (air-gapped, nuclear-grade)

## Tech
- Python 3 (FastAPI or Flask), SQLite for prototype persistence, plain HTML/JS/CSS dashboards.
- Everything must run locally with `pip install` + a single run command. Include README per component.
