Heartbeat Sentinel

The Heartbeat Sentinel protects against Shadow AI scenarios where an autonomous agent goes "rogue" or "silent" — continuing to operate without reporting back, or crashing and leaving processes in an unknown state.

Mechanism

The Sentinel functions as a Dead Man's Switch. It expects a periodic "pulse" from the agent.

States

• ACTIVE : The agent is healthy and reporting regularly.
• SILENT : The agent missed 1 heartbeat window (5 minutes). Warning issued.
• ZOMBIE : The agent missed 3 heartbeat windows (15 minutes). Critical alert issued.

Escalation Protocol

1. Monitoring: The agent sends a heartbeat POST /heartbeat?agentId=xyz every N minutes.
2. Alarm: If the deadline passes without a heartbeat, a Durable Object Alarm fires.
3. Alerting:
   • SILENT: Logs a warning and delivers a webhook notification (see below).
   • ZOMBIE: Escalates to a Critical Alert (PagerDuty/Slack/Email).
4. Recovery: If a ZOMBIE agent sends a heartbeat, the system marks it as RECOVERED, logging the outage duration.

Webhook Notifications

When a state change occurs, ABS Core sends a POST request to your configured webhook URL:

{
  "event": "heartbeat.state_change",
  "agentId": "my-agent-01",
  "previousState": "ACTIVE",
  "newState": "SILENT",
  "missedBeats": 5,
  "lastSeenAt": "2026-02-18T12:30:00Z",
  "lastHeartbeatAt": "2026-02-18T12:25:00Z",
  "timestamp": "2026-02-18T12:35:00Z"
}

Configure your webhook endpoint in the Dashboard under Settings → Webhooks. All webhook payloads are signed with HMAC-SHA256 using your workspace secret. Verify the X-ABS-Signature header before processing.

Integration

Use the ABS SDK to manually manage heartbeats:

import { ABSClient } from "@oconnector/sdk";

const abs = new ABSClient({
  endpoint: "https://api.abscore.app",
  apiKey: process.env.ABS_PAT!,
  tenantId: "my-tenant",
});

// Sends a liveness pulse
await abs.process({
  event_id: crypto.randomUUID(),
  tenant_id: "my-tenant",
  event_type: "agent.heartbeat",
  source: "my-agent-01",
  payload: { status: "healthy" }
});

Or call the API directly:

curl -X POST "https://api.abscore.app/v1/heartbeat?agentId=my-agent-01" \
     -H "Authorization: Bearer $ABS_TOKEN"

Response (200 OK):

{
  "status": "ACTIVE",
  "agentId": "my-agent-01",
  "nextDeadline": "2026-02-18T12:36:00Z"
}