AEGIS

📖 Live documentation

🌐 Live: https://gesh75.github.io/aegis/ — an animated single-page guide: architecture diagrams, data flow, tech stack, and quickstart.

🗂️ Part of the gesh75 documentation hub — all my network & AI engineering project docs in one place.

Air-gapped Evidence-Grade Inspection System — preflight network changes against a digital twin (containerlab live tier / simulator community tier), entirely inside your perimeter. Air-gapped by default: no cloud backend and no non-loopback model URL unless an operator sets AEGIS_AIRGAP=0.

The open-source evidence and governance layer for network change, including changes proposed by AI agents.

AEGIS runs a change → twin → validate → evidence loop inside your perimeter, on a self-hosted LLM. The twin is a real containerlab topology in the live tier; the open community tier runs a deterministic simulator. Air-gap is the default: the LLM layer refuses cloud backends and non-loopback model URLs unless an operator explicitly sets AEGIS_AIRGAP=0.

It emits a bundle an auditor can verify offline with a public key: an Ed25519 seal over the evidence, the proposing model's identity and the autonomy bound. Promotion is gated by separation of duties and single-use approvals. A hash-chained ledger records:

• every preflight decision, including guard rejections;
• every approval mint and mint denial;
• every promotion and promotion denial.

Commercial platforms (Forward, IP Fabric, NetBrain) go deeper on network modelling. Forward Enterprise documents on-prem deployment, and NetPilot says it offers an air-gapped option (an unverified vendor claim). AEGIS complements them; it does not replace them. See docs/STRATEGY_2026-10.md §3.

Demo

▶ Watch the 3-minute feature tour (narrated) — every stage on the live PreFlight UI: intent → digital twin → grounded config → PCI/SOC 2/NIST → sealed evidence → offline Ed25519 verify → the BLOCKED guardrail → config-import → live mode.

Shorter cuts: 64-second overview (silent, captioned) · narrated overview · real-product demo

How it works

intent | paste-config ─▶ guard ─▶ generate (LLM) ─▶ batfish ─▶ spawn twin ─▶ apply+converge
                     ─▶ diff ─▶ compliance ─▶ risk tier ─▶ rollback ─▶ verdict ─▶ evidence bundle

Only generate touches an LLM — and the config-import path skips even that. Every step after the proposal is deterministic verification (the "guarded agentic" pattern). That is what makes the evidence auditable: the LLM proposes, the pipeline verifies, a human authorizes, and the sealed bundle proves nothing left the perimeter.

Why it's different

Vendor facts are as published on 2026-10-23. "?" means not found in the vendor's public material, which is not proof of absence. Sources are in docs/STRATEGY_2026-10.md §3.8.

	Forward Enterprise + Predict	NetPilot	AEGIS
Twin	mathematical model (Predict GA 2026-09-29)	real NOS containers	containerlab emulation (live tier) / simulator (community)
Hosting	Enterprise: on-prem or SaaS (documented); Predict on-prem parity: ?	cloud; on-prem / air-gapped via sales (vendor claim; its pricing page conflicts)	on-prem / air-gapped by default, open source
LLM	Forward AI (hosting model: ?)	local LLM on-prem (vendor claim)	self-hosted, loopback-enforced by default (AEGIS_AIRGAP=0 opts out)
Reachability / ACL analysis	yes	in-lab	yes, via in-perimeter Batfish intents (reachability, ACL, SRX/PAN-OS zone policy and NAT; before/after differential, docs/INTENTS.md)
ITSM / source of truth	ServiceNow, NetBox	?	ServiceNow CHG attach + hold, NetBox roles + sealed inventory rev, post-change verify (docs/INTEGRATIONS.md; contract-tested, not yet live)
Evidence an auditor verifies offline	?	?	Ed25519-sealed bundle + aegis.verify
Approval: SoD + single-use, bound to config	?	?	yes, plus hash-chained ledger
Output	reports / API	pre/post diff	sealed, 11-framework evidence + PDF / CAB / AEGIS-shaped OSCAL AR (not schema-validated)

🏛️ Architecture

Everything runs inside an air-gapped perimeter: the operator submits a change, a self-hosted Qwen3 LLM proposes config, a throwaway containerlab twin verifies it, and an auditor consumes the sealed PDF — no actor or line ever reaches outside the wall.

This is the beginning of the README. Read the rest at the original. Read the full README ↗