Tutorial: grade sentrypeer with UHBS¶

Upstream: https://github.com/SentryPeer/SentryPeer · last push 2026-07-27

# Lab container (example — see docs/conformance/labs/sentrypeer/)
docker network create uhbs-lab 2>/dev/null || true

UHBS_QUICK=1 UHBS_AIRGAP_ATTESTED=1 uhbs-lab \
  --inventory .local/sentrypeer-inventory.yaml --target <site> \
  --tps docs/conformance/labs/sentrypeer/*_quick.yaml --protocol sip \
  --quick --skip-sast-tools --out docs/conformance/reports/sentrypeer/sip/quick

UHBS_AIRGAP_ATTESTED=1 uhbs-lab \
  --inventory .local/sentrypeer-inventory.yaml --target <site> \
  --tps docs/conformance/labs/sentrypeer/*_full.yaml --protocol sip \
  --skip-sast-tools --out docs/conformance/reports/sentrypeer/sip/full

Published: quick 43.38 / F, full 43.38 / F.

What you get from this lab¶

This tutorial reproduces the published UHBS evaluation proof for analysts who need to verify numbers, not trust a screenshot. After a successful run you should have:

SCORECARD.txt — verbatim module table, UHQS, letter grade, and δ_C Safety Gate
report.json — machine-readable scores for automation / diffing
Optional harness logs under the lab telemetry directory

How CTI / blue team should use the artifacts¶

Open the full SCORECARD first (authoritative). Treat quick as a smoke check unless the methodology says otherwise.
Read modules A–F with READING-UHQS.md: low B is often “credential sink by design,” not a broken decoy.
Confirm δ_C = 1.0 (or understand why containment failed) before citing UHQS externally.
Wire your own log shipping; UHBS Module C is harness visibility, not SIEM coverage.

Trust limits¶

UHBS 4.2.2 evaluation proof is informative — not a certification, endorsement, or ranking.
Product names appear only under docs/conformance/ as evaluation evidence.
Re-run after upstream or TPS changes; do not invent scores without regenerating artifacts.