core: provisioner sentinel should check machine ID