Security and identification layer: device fingerprinting, behavioral biometrics, risk scoring, and session replay
| Tier | observability |
| Role | unclassified (baselined) |
| Path | crates/observability/sentinel |
| Edition | 2021 |
| Targets | observability_sentinel |
| Public items | 46 across 28 modules |
| Tests | 21 |
What it is for
Sentinel: Security and identification layer
Provides device fingerprinting, behavioral biometrics, continuous authentication signals, risk scoring, and session replay on top of telemetry.
Telemetry answers: "What happened?" Analytics answers: "What does it mean?" Sentinel answers: "Who is this, and should we trust them?"
Capabilities
BiometricsConfig
_No module-level documentation is present in the source._
| Item |
|---|
pub struct BiometricsConfig |
BiometricsConfig :: fn default() -> Self |
KeystrokeConfig
_No module-level documentation is present in the source._
| Item |
|---|
pub struct KeystrokeConfig |
KeystrokeConfig :: fn default() -> Self |
PointerConfig
_No module-level documentation is present in the source._
| Item |
|---|
pub struct PointerConfig |
PointerConfig :: fn default() -> Self |
SampleRate
_No module-level documentation is present in the source._
| Item |
|---|
pub enum SampleRate |
TouchConfig
_No module-level documentation is present in the source._
| Item |
|---|
pub struct TouchConfig |
TouchConfig :: fn default() -> Self |
SentinelConfig
_No module-level documentation is present in the source._
| Item |
|---|
pub struct SentinelConfig |
FingerprintComponentConfig
_No module-level documentation is present in the source._
| Item |
|---|
pub struct FingerprintComponentConfig |
FingerprintComponentConfig :: fn all() -> Self |
FingerprintComponentConfig :: fn default() -> Self |
FingerprintConfig
_No module-level documentation is present in the source._
| Item |
|---|
pub struct FingerprintConfig |
FingerprintConfig :: fn default() -> Self |
ComponentSpec
The browser-fingerprint component map and its entropy weighting.
| Item |
|---|
pub struct ComponentSpec |
pub const COMPONENT_SPECS: & ComponentSpec |
FingerprintComponents
The browser-fingerprint component map and its entropy weighting.
| Item |
|---|
pub struct FingerprintComponents |
FingerprintComponents :: fn value(& self, name : & str) -> Option <& str> |
FingerprintComponents :: fn is_empty(& self) -> bool |
FingerprintComponents :: fn high_entropy_weight(& self) -> f64 |
FingerprintComponents :: fn stable_hash(& self) -> String |
fingerprint::matcher (other)
Component-weighted fuzzy fingerprint matching (Sprint 23).
| Item |
|---|
pub const MATCHER_VERSION: & str |
fn match_fingerprint(query : & FingerprintComponents, candidates : & FingerprintCandidate, cfg : & MatchConfig,) -> MatchOutcome |
AmbiguityReason
Component-weighted fuzzy fingerprint matching (Sprint 23).
| Item |
|---|
pub enum AmbiguityReason |
FingerprintCandidate
Component-weighted fuzzy fingerprint matching (Sprint 23).
| Item |
|---|
pub struct FingerprintCandidate |
MatchConfig
Component-weighted fuzzy fingerprint matching (Sprint 23).
| Item |
|---|
pub struct MatchConfig |
MatchConfig :: fn default() -> Self |
MatchOutcome
Component-weighted fuzzy fingerprint matching (Sprint 23).
| Item |
|---|
pub enum MatchOutcome |
MatchFlag
_No module-level documentation is present in the source._
| Item |
|---|
pub enum MatchFlag |
MatchResult
_No module-level documentation is present in the source._
| Item |
|---|
pub struct MatchResult |
MatchType
_No module-level documentation is present in the source._
| Item |
|---|
pub enum MatchType |
MatchType :: fn confidence_threshold(& self) -> f32 |
ReplayConfig
_No module-level documentation is present in the source._
| Item |
|---|
pub struct ReplayConfig |
ReplayConfig :: fn default() -> Self |
RiskConfig
_No module-level documentation is present in the source._
| Item |
|---|
pub struct RiskConfig |
RiskConfig :: fn default() -> Self |
RiskLevel
_No module-level documentation is present in the source._
| Item |
|---|
pub enum RiskLevel |
RiskLevel :: fn threshold(& self) -> f32 |
RiskThresholds
_No module-level documentation is present in the source._
| Item |
|---|
pub struct RiskThresholds |
RiskThresholds :: fn default() -> Self |
RiskWeights
_No module-level documentation is present in the source._
| Item |
|---|
pub struct RiskWeights |
RiskWeights :: fn balanced() -> Self |
RiskWeights :: fn default() -> Self |
SignalType
_No module-level documentation is present in the source._
| Item |
|---|
pub enum SignalType |
SignalType :: fn is_positive(& self) -> bool |
How to use it
No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.
Module structure
observability_sentinel
biometricsbiometrics::collectorbiometrics::keystrokebiometrics::pointerbiometrics::profilebiometrics::touchconfigfingerprintfingerprint::collectorfingerprint::componentsfingerprint::environmentfingerprint::matcherfingerprint::networkidentityidentity::deviceidentity::resolutionreplayreplay::capturereplay::playerreplay::storageriskrisk::assessmentrisk::scoringrisk::signalsstoragestorage::postgrestransporttransport::protocol
_28 modules: past 25 the diagram stops being readable, so the tree above is the complete picture._
Public surface
`biometrics`
| Item | What it is |
|---|---|
pub struct BiometricsConfig | — |
BiometricsConfig :: fn default() -> Self | — |
pub struct KeystrokeConfig | — |
KeystrokeConfig :: fn default() -> Self | — |
pub struct PointerConfig | — |
PointerConfig :: fn default() -> Self | — |
pub struct TouchConfig | — |
TouchConfig :: fn default() -> Self | — |
pub enum SampleRate | — |
`config`
| Item | What it is |
|---|---|
pub struct SentinelConfig | — |
`fingerprint`
| Item | What it is |
|---|---|
pub struct FingerprintConfig | — |
FingerprintConfig :: fn default() -> Self | — |
pub struct FingerprintComponentConfig | — |
FingerprintComponentConfig :: fn all() -> Self | — |
FingerprintComponentConfig :: fn default() -> Self | — |
`fingerprint::components`
| Item | What it is |
|---|---|
pub struct ComponentSpec | The fixed weighting and entropy class of one fingerprint component. |
pub const COMPONENT_SPECS: & ComponentSpec | Every fingerprint component, with its weight and entropy class |
pub struct FingerprintComponents | The browser-fingerprint component map |
FingerprintComponents :: fn value(& self, name : & str) -> Option <& str> | The value of a component by its ComponentSpec name. |
FingerprintComponents :: fn is_empty(& self) -> bool | Whether no component was collected at all. |
FingerprintComponents :: fn high_entropy_weight(& self) -> f64 | The total high-entropy weight actually present — how much strong identifying signal this fingerprint carries. |
FingerprintComponents :: fn stable_hash(& self) -> String | A stable hex hash over every component — the exact-match fast path |
`fingerprint::matcher`
| Item | What it is |
|---|---|
pub const MATCHER_VERSION: & str | The matcher version — bump on any scoring or threshold change, so a stored fuzzy decision stays attributable to the logic that made it. |
pub struct FingerprintCandidate | A known visitor's fingerprint, supplied by the caller as a match candidate |
pub enum AmbiguityReason | Why the matcher refused to commit to an identity. |
pub enum MatchOutcome | The outcome of a match attempt. |
pub struct MatchConfig | Tunable thresholds for match_fingerprint. |
MatchConfig :: fn default() -> Self | — |
fn match_fingerprint(query : & FingerprintComponents, candidates : & FingerprintCandidate, cfg : & MatchConfig,) -> MatchOutcome | Match a query fingerprint against the fingerprints of known visitors |
`identity`
| Item | What it is |
|---|---|
pub enum MatchType | — |
MatchType :: fn confidence_threshold(& self) -> f32 | — |
pub struct MatchResult | — |
pub enum MatchFlag | — |
`replay`
| Item | What it is |
|---|---|
pub struct ReplayConfig | — |
ReplayConfig :: fn default() -> Self | — |
`risk`
| Item | What it is |
|---|---|
pub struct RiskConfig | — |
RiskConfig :: fn default() -> Self | — |
pub struct RiskThresholds | — |
RiskThresholds :: fn default() -> Self | — |
pub struct RiskWeights | — |
RiskWeights :: fn balanced() -> Self | — |
RiskWeights :: fn default() -> Self | — |
pub enum RiskLevel | — |
RiskLevel :: fn threshold(& self) -> f32 | — |
pub enum SignalType | — |
SignalType :: fn is_positive(& self) -> bool | — |
Re-exports. Exported here, defined elsewhere.
| Export | Defined in |
|---|---|
{ComponentSpec,FingerprintComponents,COMPONENT_SPECS} | components::{ComponentSpec,FingerprintComponents,COMPONENT_SPECS} |
{match_fingerprint,AmbiguityReason,FingerprintCandidate,MatchConfig,MatchOutcome,MATCHER_VERSION,} | matcher::{match_fingerprint,AmbiguityReason,FingerprintCandidate,MatchConfig,MatchOutcome,MATCHER_VERSION,} |
Boundary
Reaches into foundation.
Shares tier observability with 1 other crate: observability-analytics.
_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._
Where it sits
| Tier (ontology) | observability |
| Architectural role (taxonomy) | unclassified (baselined) |
| Location | crates/observability/sentinel |
| Vocabulary in force (lexicon) | current |
Tier flow. Which tiers this crate's own edges cross.
flowchart LR n_observability["observability"] --> n_foundation["foundation"]
Dependencies
Runtime, in this workspace.
| Crate | Tier | Optional | Only on |
|---|---|---|---|
| `foundation-telemetry` | foundation | no | always |
Runtime, from outside the workspace.
| Crate | Requirement | Features | Optional | Only on |
|---|---|---|---|---|
async-trait | ^0.1 | — | no | always |
chrono | ^0.4 | serde | no | always |
serde | ^1 | derive | no | always |
serde_json | ^1 | — | no | always |
sha2 | ^0.10 | — | no | always |
thiserror | ^2 | — | no | always |
tokio | ^1 | full | no | always |
uuid | ^1 | v4, v7, serde, js | no | always |
Development, from outside the workspace.
| Crate | Requirement | Features | Optional | Only on |
|---|---|---|---|---|
tokio | ^1 | full, rt-multi-thread, macros | no | always |
Build. None.
Depended on by. 1 workspace crate.
Signal flow — what reaches this crate, and what it reaches.
flowchart LR n_application_sentinel["application-sentinel"] -->|uses| SELF SELF["observability-sentinel"] SELF -->|runtime| n_foundation_telemetry["foundation-telemetry"] classDef self fill:#1f883d,stroke:#1f883d,color:#fff; class SELF self;
Feature flags
No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.
Targets
| Kind | Name | Source |
|---|---|---|
| lib | observability_sentinel | `src/lib.rs` |
Error model
No public error type was detected: no public item declares a type named *Error, and no public signature returns one.
Operational characteristics
| Property | Evidence |
|---|---|
| async public surface | none detected |
| async runtime | yes |
| database access | none detected |
| network I/O | none detected |
| unsafe code | none detected |
| environment variables | none detected |
No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.
Configuration
No environment variable is read with a literal name anywhere in this crate. A variable whose key is computed at run time cannot be listed here, and is not claimed to be absent.
Related capabilities
1 workspace crate depends on this one: application-sentinel.
Verification
| Kind | Count |
|---|---|
| Unit tests | 21 |
| Integration tests | 0 |
| Examples | 0 |
| Doctests | 0 |
Evidence by module. How often each public module is named by something executable.
| Module | Tests | Examples | Consumers |
|---|---|---|---|
biometrics | 5 | 0 | 0 |
config | 1 | 0 | 0 |
fingerprint | 2 | 0 | 0 |
fingerprint::components | 3 | 0 | 0 |
fingerprint::matcher | 6 | 0 | 0 |
identity | 3 | 0 | 0 |
replay | 1 | 0 | 0 |
risk | 5 | 0 | 0 |
What the tests establish, by name:
empty_detects_absence—src/fingerprint/components.rshigh_entropy_weight_counts_only_strong_present_signals—src/fingerprint/components.rsstable_hash_is_deterministic_and_distinct—src/fingerprint/components.rscollision_guard_ignores_non_matching_candidates—src/fingerprint/matcher.rsdifferent_browser_does_not_match—src/fingerprint/matcher.rsempty_query_never_matches—src/fingerprint/matcher.rsexact_fingerprint_matches—src/fingerprint/matcher.rspicks_the_clear_winner_over_a_weak_candidate—src/fingerprint/matcher.rsrejects_high_collision_fingerprint—src/fingerprint/matcher.rsrejects_low_entropy_only_agreement—src/fingerprint/matcher.rsrejects_when_no_clear_winner—src/fingerprint/matcher.rstolerates_one_drifted_component—src/fingerprint/matcher.rstest_biometrics_config_default_disabled—src/lib.rstest_fingerprint_config_default_disabled—src/lib.rstest_match_type_variants—src/lib.rstest_replay_config_default_disabled—src/lib.rstest_risk_config_default_disabled—src/lib.rstest_risk_level_thresholds—src/lib.rstest_sentinel_config_defaults_all_disabled—src/lib.rstest_sentinel_depends_on_telemetry—src/lib.rstest_signal_type_positive_negative—src/lib.rs
Documentation coverage
| Measure | Documented | Total |
|---|---|---|
| Public items with rustdoc | 13 | 46 |
Public modules with a //! block | 2 | 28 |
pie showData
title Public items with rustdoc
"Documented" : 13
"No rustdoc detected" : 33
Metrics
| Metric | Value |
|---|---|
| Rust source files | 29 |
| Source lines | 1120 |
| Code lines | 890 |
| Public API items | 46 |
| Public modules | 28 |
| Tests | 21 |
| Examples | 0 |
| Cargo features | 0 |
| Direct runtime dependencies | 9 |
| Workspace reverse dependencies | 1 |
pie showData
title Public API by kind
"constant" : 2
"enum" : 7
"function" : 1
"method" : 20
"struct" : 16
pie showData
title Rust source composition
"Code" : 890
"Blank or comment" : 230
Generation
Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.