AWS Cloud-Ops Sentinel

Sentinel correlates CloudWatch alarms, AWS Backup posture, and IAM drift signals on the ACP fabric and surfaces them on the ACP ALERT dashboard. v1 is read-only: the wired aws adapter is CloudTrail / Cost Explorer / Config inventory only. Mutation verbs (instance restart, key rotation, snapshot volume) are gated by explicit per-tenant scope grants and land in a follow-up wave.

⚠ v1 install caveat: the aws connector kind is in FUTURE_CONNECTORS on main (not yet in the live ConnectorKind union). The picker checkbox for aws will NOT be visible in the admin form today, and pasting aws into the form will be silently dropped by sanitizeConnectorList. Land the catalog promotion first (see appendix gap row) — then save this AgentSpec.