NEXUS_UiPathAgentHack

• 

• 

  workflow from studio

Inspiration

Production AI incidents are currently managed in an ad-hoc, manual fashion: a model regresses or a jailbreak lands, and engineers guess at the correct rollback version. This process is slow, irreproducible, and completely unauditable. The hardest problem in production AI is not whether the model can do the task, but whether we can deterministically restrict the model when it fails, prove we did so, and recover safely.

What it does

NEXUS Sentinel is a deterministic, audit-ready policy gate for AI release recovery, orchestrated as a closed loop in UiPath Maestro BPMN. A remediation action enters the process, is evaluated against four strict rule gates (model-identity, policy-tests, service-health, evidence-attached), routed by verdict (ALLOW to execute, HOLD to request human approval, DENY to escalate), and verified back through the same gate with strict audit-id binding. Every single step emits a SHA-256 fingerprint, creating a completely verifiable and replayable audit chain. https://www.youtube.com/watch?v=gEJQoGezs_E

How we built it

We designed a 5-stage loop grounded in five specific computer science papers:

1. Evaluate (BIPIA, Microsoft): Separates user prompt data from instructions at the I/O edge to prevent indirect injections.
2. Route (BPMN Governance): A 16-node process with 4 conditional flows, a human approval task, and a gated agentic node.
3. Approve (Fudan human-in-the-loop): Establishes scalable human steering and role-based access before action space expansion.
4. Verify (Huang V&V, NASA): Runtime verification bound to the prior evaluation via evaluationAuditId.
5. Re-evaluate (Progent, UC Berkeley): Enforces monotonic confinement, ensuring the agent's action space can only shrink without explicit human sign-off. ## Challenges we ran into
6. Cloud Studio Publishing Gaps: Publishing from the CLI was gated by interactive browser OAuth and upgrade dialogs, which required custom UI handling to bypass. We documented this as product feedback for the UiPath team.
7. Strict Schema Discipline: Enforcing extra=forbid in Pydantic meant that any undocumented fields triggered immediate failures, forcing us to maintain clean, typed API boundaries.
8. Free-Tier Cold Starts: Deployed a keep-warm pinger to prevent Render container dormancy during live evaluations. ## Accomplishments that we're proud of
9. 30 passing tests verifying the policy contract and adversarial inputs.
10. Zero merge conflicts across 3 parallel agent lanes (Sai, Codex, Antigravity) with over 30 commits.
11. A fully automated 64-second video with synthesized neural voiceover and high-contrast dark mode slides.
12. 100% audit-chain integrity verified through cryptographic signatures at every stage of the loop. ## What we learned
13. I/O Boundaries Matter: Prompt injection cannot be solved by prompts alone; it must be handled at the deterministic boundaries.
14. Algebraic Recovery: Recovery must be treated as part of the typed execution system, not as an out-of-band patch.
15. Provenance > Metrics: A SHA-256 fingerprint per step is far more valuable for compliance than a simple accuracy score. ## What's next for NEXUS_UiPathAgentHack
16. Cross-Platform SDK: Packaging the policy adapter for other BPMN engines.
17. Classifier as a Service: Offloading the BIPIA boundary classifier to a dedicated high-throughput microservice.
18. Durable Audits: Integrating SQLite/PostgreSQL to persist audit chains across container restarts.

Track: 1 — Maestro Case (built on UiPath Cloud Maestro, Track-2-adjacent) Live demo: https://nexus-sentinel-policy-adapter.onrender.com/health Source: https://github.com/specimba/NEXUS_UiPathAgentHack Team: NEXUS (Sai lane, Codex lane, Antigravity lane)

One-paragraph summary

NEXUS Sentinel is a deterministic, audit-ready policy gate for AI release recovery, implemented as a typed closed loop. A remediation action enters a UiPath Maestro BPMN canvas, is evaluated against four rule gates (model-identity, policy-tests, service-health, evidence-attached), routed by verdict (ALLOW → execute, HOLD → human approval, DENY → escalate), executed, and verified back through the same gate with audit-id binding. Every step emits a SHA-256 fingerprint; the chain is replayable end-to-end via /api/v1/audit/{id}. The architecture is grounded in five specific papers (Progent, BIPIA, INJECAGENT, Huang V&V, Fudan oversight) — see docs/RESEARCH-GROUNDING.md.

What judges will see

• Live adapter responding 200 to all 4 sample cases (samples/01..04.json).
• Maestro BPMN (uipath/NEXUSSentinelBPMN/Process.bpmn) with typed conditional flows, a human-approval user task with role assignment, and one gated agentic node.
• 30 passing tests for the adapter's contract + policy logic.
• A 3-min narrated demo (assets/video/) showing the live adapter + the BPMN + the audit chain.
• Research Grounding (docs/RESEARCH-GROUNDING.md) — 5 papers mapped to 5 design decisions.
• Product Feedback (docs/PRODUCT-FEEDBACK.md) — 6 concrete friction points for the UiPath team, including the P0 publish-API gap.

How it satisfies the Maestro Case requirements

Submission artifacts

• nexus_uipath_bridge/ — the deterministic policy adapter (FastAPI + Pydantic).
• uipath/Main.xaml — UiPath Studio workflow that drives the same flow locally.
• uipath/NEXUSSentinelBPMN/Process.bpmn — the Maestro BPMN canvas export.
• samples/01..04.json — the four sample request bodies.
• docs/CANVAS-BINDING-SPEC.md — paste-ready HTTP bindings for the live Studio canvas.
• docs/RESEARCH-GROUNDING.md — the 5-paper design rationale.
• docs/PRODUCT-FEEDBACK.md — the product feedback survey (separate award track).
• docs/handoff-codex-antigravity.md — multi-lane handoff log.
• evidence/live-test/ — live adapter evidence + Studio canvas screenshots.
• artifacts/instance-timeline/ — the recorded end-to-end instance (Lane A in flight).
• assets/video/agenthack-demo-evidence-narrated.mp4 — the 3-min narrated demo.

What we are NOT claiming

• We do not claim the Maestro Studio canvas auto-published to Orchestrator end-to-end on the trial tier. The BPMN export, the binding spec, and the local Studio workflow (Main.xaml) are all shipping; the Cloud publish path is the single known gap (see P0 in docs/PRODUCT-FEEDBACK.md).
• We do not claim a learned policy. The gate is deterministic on purpose — see docs/RESEARCH-GROUNDING.md §4 for the rationale.
• We do not claim zero prompt-injection. We claim a defensible boundary that demonstrably does not pass the model prompt into the trust decision.

What we ARE claiming

• A working, testable, publicly deployable policy gate that solves a real problem (AI release recovery).
• A design that is grounded in published research, not invented from intuition.
• An implementation that runs against a live endpoint, not a mock.
• A code base that is clean, fully tested, and ready for review.

Built With

• 2-xfailed-documented
• 30-passing-tests
• audit-chain
• audit-correlation
• bounded-verification
• bpmn
• cloudflared
• deterministic-policy-gate
• dual-evaluate-verify-workflow
• fastapi
• gemini
• github-actions
• googlellm
• governance
• governed-recovery
• maestro
• nexus
• nexusos
• notebookllm
• orchestration
• pydantic
• python-3.11
• render
• runtime-verdict-routing
• security
• sha-256-fingerprint
• solution
• timeout-escalation
• typed-contract
• uipath
• uipath-maestro-bpmn
• uipath-studio-main.xaml
• v1.0.2