Last session Sentinel found 80 code-level findings. This session we went deeper: supply chain. Every Python project got hash-pinned lockfiles. Every Dockerfile got pinned base images. Sentinel learned to scan dependencies. And in between, we wired up voice transcription for D&D sessions and brought the ops dashboard to life.

Hash-Pinned Lockfiles Everywhere

Nine Python projects across the ecosystem were running with unpinned requirements.txt files — version ranges at best, bare package names at worst. We ran pip-compile with hash verification across all of them and committed the resulting lockfiles. Every install now resolves to exact versions with cryptographic hashes, so a compromised upstream package can't silently swap in a different artifact. Fourteen Dockerfile base images were also pinned to specific patch versions instead of floating :latest or minor-version tags. Six other Docker images (reverse proxies, tunnels, media services) that were on floating tags got pinned too. A full audit of the resulting dependency tree came back clean — no critical or high CVEs across any project.

Sentinel Learns to Audit Dependencies

Sentinel's code-quality and security modes scan source code. But source code is only half the attack surface — your dependencies are the other half. We built a new --mode dep-audit that wraps three scanners: pip-audit for Python, npm audit for Node.js, and grype for container images. Each scanner runs as a subprocess, and findings get normalized into the same severity schema that code reviews use. The Jenkins nightly pipeline now runs dependency audits in parallel with the existing code-quality and security sweeps — three scan modes, one unified report.

Why Grype, Not Trivy

The container scanner choice was the most interesting decision of the session. Trivy is the popular default, but in March 2026 it was hit by a supply chain attack through a compromised plugin mechanism. When you're building a tool specifically to catch supply chain problems, adopting a scanner that just had one felt like a contradiction. Grype uses a simpler architecture — a standalone binary that pulls vulnerability databases without plugin extensibility — which gives it a smaller attack surface. Sometimes boring is exactly what you want in security tooling.

Voice Transcription for the Dungeon Master

The D&D campaign platform needed a way to accept voice input from players. We implemented a transcription endpoint in the AI platform using faster-whisper with the large-v3-turbo model in INT8 quantization. The service lazy-loads the model on first request and auto-unloads after a timeout to free up memory for other workloads. The campaign bot already had a stub pointing at this endpoint, so deploying the transcription service required zero changes to the bot itself — it just started working.

The Dashboard Comes Alive

The ops dashboard (JefeHQ) went from a mostly-red status wall to something genuinely useful. System Health was rewired to pull real metrics from the monitoring stack instead of a broken exporter endpoint. The Jenkins panel now shows actual build history and pipeline status. The service dependency map got corrected — wrong internal references, deprecated services still showing, new services missing. We also cleaned up branding inconsistencies, removed a deprecated workflow service, and fixed the container port mappings that were causing false-negative health checks. The dashboard is now the first place to look when something seems off.

Inception Deck

Separate from all the infrastructure work, we built a 14-slide pitch deck for an accelerator application. Screenshots of real running services, architecture diagrams from the actual deployment, metrics from real inference benchmarks. No mockups, no "coming soon" — everything in the deck is live and running. The application is drafted and ready to submit.

What's Next

• Submit the Inception application
• Convert the backup manager Jenkins job from inline pipeline to SCM
• Fix the Twitch bot's subscription leak (EventSub 429s)
• Scrub hardware-specific references from older devlog posts
• Deploy JefeLife with proper secrets management instead of manual config