How to try Centinela

There are two experiences with different scopes. A person must validate the evidence and approve the plan before acting.

Public preview

The interactive demo lets you explore three historical cases without signing in or connecting resources. All assets, figures, dates, scores and states are synthetic: they are not current measurements or recommendations for a real system.

1. Choose a scenario and inspect its result and example assets.
2. Follow the exposure path to the package and repository. You can adjust the graph view.
3. Examine the risk factors and proposed change.
4. Use “Next step” to explore the case explanations. “Reset” returns to the first step; choosing another scenario also resets the walkthrough. None of these controls changes a plan.

Preview buttons do not record approvals, open Pull Requests or execute changes. The illustrative sequence ends at the proposal; no approval or execution milestones are generated.

Private guided functional demo

A private session is prepared in a separate environment, with an exclusive tenant, invited users, roles and expiry. The operator must confirm the session scope and providers before inviting participants. Hosted demo configuration and operational validation remain pending.

In the local test profile, the API, database with tenant isolation, workflows, workers, authorization policy and executor run as real processes. The identity provider, GitHub, AWS services and model are explicitly emulated or replayed. A PR in that profile belongs to the emulator: it does not exist on github.com.

To participate, use Request a private demo. Intake is confirmed only when the register returns a persisted reference. If intake is not enabled, it is stated without pretending a submission occurred. A person must review the request before preparing an invitation. Console access requires their invitation; access to the private repository is granted separately. In local test mode, the form accepts fictional addresses at example.com, .test or .invalid only and contacts nobody. Real intake remains disabled if a validated controller and privacy contact are missing.

What to review during the session

• Confirm the environment, tenant, your role and expiry. Use only authorized sandbox data and repositories.
• Review the evidence, coverage and analysis limits; do not turn missing data into a security conclusion.
• As an authorized reviewer, examine the signed plan and exact diff before registering your own WebAuthn key and approving. The operator does not replace the approver.
• Check the result at the specified destination and retain review evidence. An automated test does not establish human approval.

Deployment, privacy and operational controls must be reviewed by the responsible people. This demo does not establish ISO 27001 certification or a SOC 2 report.