Modern Anti-Cheat Architecture (Sentinel)

GMod agent (sv_events.lua)
        ↓ authenticated batch
Modern Agent HTTP (HMAC + license + pairing secret)
        ↓
Ingest (rate limit · schema · size · idempotency)
        ↓
Normalization + quality / exemptions
        ↓
Feature extraction (session-state, movement expect, weapon profiles)
        ↓
Detection modules (movement · combat · behavior)
        ↓
Evidence aggregation + correlation
        ↓
Confidence (signal) + Severity (module) + Risk (investigation priority)
        ↓
Investigation case  →  Replay capture  →  Human decision
        ↓
Optional staff punishment (separate RBAC surface)

Trust model

• Server-authenticated agent is the producer of telemetry
• Agent-provided conclusions (anticheat.signal) are evidence inputs, not automatic detections
• Dashboard detectors are authoritative for Detection rows
• Staff dispositions and punishments are human actions only

Scoring vocabulary

| Term | Meaning |

|------|---------|

| Severity | Detector-assigned seriousness band for the observation |

| Confidence | Heuristic agreement 0–1 for that signal |

| Risk | Staff investigation priority (session + historical), not cheat probability |

False-positive control

Context reasons (recent_spawn, vehicle, teleport, noclip, spectator, degraded tick, sample gaps, etc.) can suppress or degrade. Exclusion reasons are retained in evidence/metadata when applied.