ConduitAI

Live demo, no sign-in: https://conduit-ai-cyan.vercel.app Water plants and substations are still connected to their office networks through firewalls that let traffic go both ways, so one hacked laptop can reach a chlorine pump. A hardware data diode fixes this: data flows out and nothing can come back in. But fit one wrong and the plant stops running, because equipment and servers talk in both directions. Planning that cutover takes a senior plant network architect weeks. ConduitAI reads the files a plant can safely share: packet captures, firewall logs, a switch dump, an asset list, cabinet photos, a network drawing and a voice note. It decides what to cut, what to keep and how, and which diode hardware fits. An AI agent drafts the plan. A rule checker written as plain code tests every draft and sends failures back with the broken rules listed, so only a plan that passes is shown. An engineer can change any decision, the same checker reviews the change, and sign-off is tied to the exact plan by its fingerprint. The PDF report lists every input file by SHA-256 and which model produced what. Then it proves the plan by replaying attacks down the plant's own network paths. Water plant: 11 of 11 reach the equipment today, 0 of 11 with the plan (8 of the 11 are real packets from public captures). Substation: 39 of 39, then 0 of 39. Real IEC-104 testbed: 56 of 56, then 0 of 56. The test can fail: leave the plant's hidden 5G modem in place and its commands get through. Built during the hackathon: all application code, from Oct 26 after kickoff. That is the seven-stage agent pipeline, rule checker, attack replay, maps, engineer review, evidence manifest, reports and web interface. Prepared before kickoff and disclosed in the README: the test data (synthetic plant files, AI-generated cabinet photos and drawings, walkthrough videos, catalogs, the first public captures) and the prompt files in data/prompts/. Some of that data was revised during the event, and git log shows every change. No real customer data was used. Limits: two of the three demo plants are synthetic. On real photos SAM 3.1 is cautious, measuring 2 of 11 enclosures with 0 false free-space claims. The hosted demo holds no API keys, so it replays output recorded from live model runs; every rule check, packet analysis, attack replay and map still runs live.