AI × Network Systems Engineer

I build AI systems for networks
that are verified rather than trusted.

LLMs propose. Formal tools verify. Humans approve. And the system proves that what it claimed would happen actually happened — every claim below is generated from a reproducible run, gated by a human, or enforced by CI.

Chandana NandiChandana Nandi AI Engineer @ Solix · MS Data Science · ex-Aircraft Maintenance Engineering
See the flagship → GitHub
0/52
gray faults caught by classical detection — even under traffic load
0.50 → 0.91
localization AUROC, chance → temporal learned models
312
incident corpus, content-hashed & leakage-proofed
1
shared approval↔digest gate for UI and executor — no side door, proven by test
01 · Flagship

ClosCall — evidence-grounded incident command for AI datacenter fabrics

The faults that ruin datacenters aren't the links that die — they're the "gray" ones that stay up while silently dropping traffic. I measured exactly what classical monitoring misses, showed learning recovers it, and wrapped the result in a human-approved remediation loop whose honesty is enforced by code.

ClosCall results dashboard: AUROC by fault class, rule vs MLP vs GNN with confidence intervals

The finding, on a live fabric

PyTorchscikit-learn FastAPIPostgreSQL containerlab · SR LinuxgNMI
312
incidents under live traffic, every file content-hashed
4,992
telemetry windows, fabric-wide
0.500
rule AUROC on gray faults — exactly chance
0.91
learned AUROC, temporal features
Problem
Classical monitoring watches each interface's own counters. What does it structurally miss, and can learning recover it — with evidence, not vibes?
Approach
A real containerized SR Linux Clos fabric: streaming gNMI telemetry, a fault-injection framework (5 classes + healthy controls), a 312-incident corpus under load, then a controlled, pre-registered ablation — oper-state rule vs MLP vs GNN on frozen features, splits leakage-proofed.
Verified ✓
Classical detection is structurally blind to gray faults even under load (0/52; AUROC exactly 0.500). Temporal learned models recover them: 0.50 → 0.91 AUROC — and the ablation localizes the signal in throughput instability over time. Every published number is generated from one immutable, content-hashed run.
Honest limits
One lab fabric with synthetic traffic; the full fail-closed precheck suite is unit-proven but not yet wired into live execution — documented as an ADR-backed waiver, and the approval screen says so, right above the approve button.
ClosCall approval screen: safety-scope banner directly above the Approve button, digest-bound plan
The decision point: a persistent banner states exactly which safety checks the live executor enforces — the UI cannot claim more safety than the code provides. A test tries to execute a tampered plan digest and is refused with the device untouched.
ClosCall journey page: the build pipeline and 15-gate timeline
Built in 15 gates, each with hard exit criteria and checkable evidence — the app's own Journey page documents the whole pipeline, including what is deliberately not claimed.

repo →  ·  generated results  ·  limitations ledger

Featured, then the body of work

The thesis, made into a benchmark — plus three more angles

The verification sandwich, safety by construction, and the networking bedrock it all stands on.

⊨

verifiednet-arena · live dashboard ↗

A safety benchmark for AI network-operations agents — the thesis, made measurable.

An agent proposes a fix; a deterministic scorer checks seven safety properties; approval binds to a sha256 of the exact plan; and a gated harness executes that plan in a Docker (FRR) lab so the lab's own validator proves recovery. Agents answer clean-room, seeing only a redacted prompt.

13 implemented tasks span EVPN/VXLAN, BGP route-policy, SONiC ACL/SAI, and a cross-domain ambiguity task. On the live-backed EVPN tasks, 18/18 combined remediations were live-verified in Docker FRR labs (suite_v2 + task-006); the first BGP task adds a separate 3/6 clean-room live result. On hard-mode tasks where the safe move is to refuse, both evaluated models abstained 24/24 with 0 unsafe-action attempts. 20 sha256 artifact locks; a Docker-free CI re-verifies everything.

LIMITS — local Docker (FRR) labs only, not physical hardware and not production networks; SONiC ACL/SAI tasks are fixture-replay only; Claude-family models, three repeats (consistency, not statistics).

PythonFRR · Docker BGP-EVPN/VXLANsha256 locks
repo → · dashboard →
⇄

sonic-intent-agent

Natural language → formally verified network configuration on SONiC.

+---------------+     +----------------+
| User terminal |     | qwen2.5:7b     |
+-------+-------+     | (Ollama,local) |
        |             +--------+-------+
        | question + tools     | tool calls
        v                      |
+---------------+  <--tools--> |
|   agent.py    +--------------+
+-------+-------+
        | read or write
   +----+-----+------------+
   v          v            v
+-------+ +----------+ +-----------+
| SONiC | | Batfish  | | snapshot  |
| VS    | | (parser) | | builder   |
+-------+ +----------+ +-----------+

A local LLM parses intent against a real SONiC virtual switch. Before anything applies, Batfish verifies a candidate snapshot — new critical issues surface in the diff a human reviews. After apply, the agent re-reads CONFIG_DB and checks each predicted change actually materialized, with per-prediction verdicts.

The full propose → formally verify → human-approve → apply → prove-it-happened loop runs against real switch software. Built in 7 phases, each gated by a working demo.

LIMITS — Batfish verification is parser-level, not full dataplane analysis; one virtual switch.

PythonOllama · qwen2.5 BatfishSONiC VS
repo →
⊘

neuronoc

A NetOps console where no execution path exists — and CI proves it.

collectors (show-only · allow-listed)
        │ evidence
        v
8 deterministic rules ───> incident
        │
        v
LangGraph workflow (6 nodes) ──> analysis
        │
        v
local-LLM RCA + RAG citations
        │
        v
remediation PLANNER — plans only
        │  requires_approval=True (DB level)
        v
[ authenticated admin approval gate ]

 ✗ no execution path exists in code
 ═ CI AST scan fails the build on any
   remote-exec import in protected pkgs

Read-only collectors, 8 deterministic anomaly rules, a LangGraph incident workflow, local-LLM RCA with RAG citations — and a planner that only ever drafts. Every plan is requires_approval=True at the database level; an AST scan in CI fails the build if any protected module imports a remote-execution library.

4 of 8 rules fire from real FRR lab data (the rest are labeled simulator-only — provenance always tagged). The no-execution guarantee is enforced by the build, not the README.

LIMITS — portfolio-scale demonstration; half the rule library fires only on simulated signals.

FastAPILangGraph FAISS RAGReact + TS
repo →
⬡

evpn-vxlan-frr-lab

A leaf-spine EVPN/VXLAN fabric on a laptop, with a validator that proves it's healthy.

 192.168.10.10            192.168.10.20
   hostA ── leaf1            leaf2 ── hostB
        (AS 65001)        (AS 65002)
        lo 10.0.0.1       lo 10.0.0.2
             \                /
       10.0.12.0/24    10.0.23.0/24
               \            /
               spine1 (AS 65000)
                 lo 10.0.0.3

 underlay: eBGP · overlay: EVPN type-3
 IMET ──> VXLAN head-end replication

eBGP underlay, BGP-EVPN type-3 IMET control plane driving VXLAN head-end replication, two tenant hosts stretched across one L2 segment — and a Python validator that asserts the overlay end-to-end at every layer. No AI, deliberately: this is the networking bedrock the AI projects stand on.

Host-to-host traffic crosses the VXLAN overlay, and the validator proves why it works: EVPN AF up, IMET routes exchanged, HER FDB programmed.

LIMITS — type-2 MAC/IP learning intentionally disabled: the Docker Desktop kernel breaks BUM split-horizon (documented, with the exact mechanism).

FRRBGP-EVPN VXLANDocker Compose
repo →
⌕sonic-troubleshooting-agent — blackboard-architecture diagnosis over live switch evidence ▦sonic-acl-validation-harness — CONFIG_DB → ASIC_DB SAI translation validation →everything else on github.com/ChandanaNandi
Toolbox

Skills

AI / ML

PyTorchGNNs scikit-learnLangGraph RAG / FAISSLLM fine-tuning local LLMs (Ollama)eval design

Networking

BGP / eBGPEVPN · VXLAN SONiCSR LinuxFRR gNMI telemetryBatfish containerlab

Backend

PythonFastAPI PostgreSQLSQLAlchemy PydanticReact + TypeScript HTMX

Rigor

pre-registration content-hashed runsleakage-proof splits adversarial testsCI safety scans threat modelingADRs
The road here

Journey

I came to AI from a field where systems fail loudly and safety is not optional. That is why my projects are honest about their limits and built to be verified rather than trusted.

FOUNDATION

Aircraft Maintenance Engineering

Where "it probably works" is not a sentence anyone says. Checklists, sign-offs, audit trails — the instincts my software still runs on.

GRADUATE SCHOOL

MS Data Science — University of the Pacific

The pivot: from maintaining physical systems to modeling them.

NOW · INDUSTRY

AI Engineer @ Solix Technologies

Production AI systems: multi-agent orchestration, RAG pipelines, LLM fine-tuning, and the backend that holds it together. (Company infrastructure — not on GitHub.)

NOW · INDEPENDENT RESEARCH

Safe AI for network operations

The project series on this page — culminating in ClosCall: a 15-gate build, a real scientific finding, and a UI whose honesty is enforced by a shared gate and proven by a test that tries to cheat and fails.

Get in touch

Let's talk about safe agentic systems,
network automation, or ML infrastructure.

Open to conversations — and always happy to walk through any claim on this page, because every one of them links to code.

Email me GitHub LinkedIn