Integrate dockerized sentinel

[sahilx13]

Summary

Adds Sentinel as a first-class Coop integration and wires up a new built-in signal, SENTINEL_RARE_CLASS_AFFINITY, that scores string content for rare harmful text patterns (e.g. grooming) using Sentinel's contrastive example banks.

Sentinel is treated as a local HTTP service (no org credentials). The signal is disabled gracefully when Sentinel is unreachable or banks are not loaded. When thread context is available, scoring includes prior messages in the thread so patterns spanning multiple messages can be detected.

Also includes a small GraphQL fix for item type create/update mutations returning null data on success, and updates local dev env docs for HMA port mapping.

What changed

Sentinel integration & signal

• Adds SENTINEL to GraphQL Integration enum and client/server generated types
• Adds SENTINEL_RARE_CLASS_AFFINITY signal type across GraphQL, server signal registry, and client signal→integration mapping
• Introduces SentinelService HTTP client (/health, /banks/status, /score, etc.) with unit tests
• Implements SentinelRareClassAffinitySignal:
  • Scores submitted text via Sentinel's /score endpoint
  • Fetches up to 10 prior thread messages from ItemInvestigationService when a threadId is present
  • Reports disabled state when Sentinel is unhealthy or banks are unloaded
  • Marks signal as free / eligible for automated rules

Thread-aware rule evaluation

• Pre-writes content to Scylla in submitContent before rule evaluation (best-effort, retried once) so thread history is available when Sentinel runs
• Passes runtime args from leafCondition for Sentinel signals:
  • threadIdentifier — from content schema threadId role
  • contentTextFieldName — from the condition's evaluated field
• Coerces plain-string threadId values in content submissions to { id, typeId } for validation

UI

• Adds a non-configurable Sentinel tile on the integrations dashboard (requiresInfo: false)

Config & docs

• Adds SENTINEL_API_URL to server/.env.example and server/decs.d.ts
• Updates HMA local dev URL in .env.example and DEVELOPMENT.md to http://localhost:5001

Bug fix

• Fixes item type create/update GraphQL mutations (content, thread, user) to return { data: ... } inside success responses instead of the raw object, which caused null data on success

Architecture

sequenceDiagram
    participant Client
    participant SubmitContent
    participant Scylla as ItemInvestigation (Scylla)
    participant RuleEngine
    participant SentinelSignal
    participant SentinelAPI

    Client->>SubmitContent: POST content
    SubmitContent->>Scylla: insertItem (best-effort, pre-rules)
    SubmitContent->>RuleEngine: runEnabledRules
    RuleEngine->>SentinelSignal: evaluate with thread runtime args
    SentinelSignal->>Scylla: getThreadSubmissionsByTime
    SentinelSignal->>SentinelAPI: POST /score (primary + thread texts)
    SentinelSignal-->>RuleEngine: rare_class_affinity_score

Loading

Local development

1. Set SENTINEL_API_URL=http://localhost:8000 in server/.env

2. Run Sentinel locally (local overlay compose file):

   docker compose -f docker-compose.yaml -f docker-compose.sentinel.yaml up -d sentinel

3. Start Coop as usual (npm run up, migrations, npm start)

4. Create a rule using Sentinel Rare Class Affinity on a string content field; submit threaded content to exercise context scoring

Test plan

Automated tests

• Run Sentinel unit tests:

  cd server && npm test -- sentinelService SentinelRareClassAffinitySignal

• Confirm all existing server tests still pass:

  cd server && npm test

Signal availability

• Sentinel running + banks loaded: open the integrations dashboard and confirm the Sentinel tile appears
• Sentinel running + banks loaded: create or edit a rule and confirm Sentinel Rare Class Affinity is available and not disabled
• Sentinel stopped: confirm the signal shows as disabled with a helpful error message
• Sentinel running, banks unloaded: confirm the signal shows as disabled with a banks-not-loaded message

Scoring behavior

• Submit content without a thread ID and confirm the signal returns a numeric score for the primary text only
• Submit multiple messages in the same thread and confirm later submissions produce different (typically higher) scores when thread context is included
• Submit content with an invalid or missing text field and confirm the signal handles it gracefully (no server crash)

Thread store integration

• Submit content with a string threadId and confirm it is coerced to { id, typeId } without validation errors
• Confirm content is written to Scylla before rule evaluation (thread-aware scoring works on first submission in a new thread when prior messages exist)

GraphQL regression

• Create a content item type via GraphQL and confirm the mutation response includes populated data
• Update a thread item type via GraphQL and confirm the mutation response includes populated data
• Update a user item type via GraphQL and confirm the mutation response includes populated data

Client build

• Confirm the client builds successfully:

  cd client && npm run build

• Verify client/src/images/RobloxLogo.png is present (required by the integrations dashboard import)

[sahilx13]

SENTINEL_REDDIT_TEST_DATA.md

Testing doc for manual testing the feature