Live walkthroughs
Real devices. Real frames. Nothing simulated.
Four recordings from the lab, in the order they build on each other: a root cause proved on the wire, a fault injected and caught blind, the training cell that seals a model offline, and the copilot that has to ask before it acts. Every timestamp below jumps straight to that moment.
The base Distinguished Name moved. Here's the frame that proves it.
A supplicant fails to authenticate and the switch logs say almost nothing useful. TestPulse ingests the run, renders the AAA path as an OpenTelemetry trace, and marks exactly one span red — the LDAP bind — with the log line that proves it and the fix direction attached. The base DN is the point in the directory tree where a search begins; when it drifts from the recorded source of truth, every bind beneath it fails.
Jump to a moment
What to watch for
- Only one span is red. The trace doesn't highlight everything that looks slow — it commits to a single root-cause hop.
- The verdict cites a frame number. If that frame weren't in the capture, the engine would decline to diagnose rather than infer.
- The fix names the source of truth. Not "check your LDAP config" — restore the bind DN recorded in NetBox.
what this does not showRecorded in the BMI2 lab against our own FreeRADIUS and directory. Your run will name different hosts and timings; the cause family and the evidence gate are the parts that transfer.
A fault it was never told the answer to.
This is the one that matters for trust. A labelled transport fault is injected on live hardware, the label is held out, and the engine diagnoses from packets alone. Afterwards the answer key scores it. If the engine could see the label, the whole learning loop would be theatre.
Jump to a moment
What to watch for
- The order of operations. The label is sealed before the run starts and opened only after the verdict is fixed.
- Evidence-gated grading. A correct guess without supporting evidence is scored as a miss, not a win.
- The lab self-reverts. Every cycle returns the hardware to a clean state, so runs don't contaminate each other.
why this is the honest testAnyone can show an AI explaining a failure it was handed the answer to. The interesting question is what it does when nobody tells it.
From 116 experiments to a 7 MB adapter running offline.
The longest of the four, and the one to send to anyone asking how the system improves. Trainer, trainee and teacher roles produce a curriculum; a human signs each chain; the sealed corpus trains a DeepSeek-R1 Distill adapter that then runs on an Acer GN100 with no cloud call at all.
Jump to a moment
What to watch for
- Only sealed runs train. The engine cannot promote its own work — a human signature is the gate on training credit.
- The adapter is 7 MB. Small enough to ship, sign and diff, which is what makes it auditable.
- The network is genuinely unplugged. This is the proof that matters for air-gapped and classified environments.
send this one to security reviewIf a prospect's blocker is "we can't send our packet captures anywhere," this is the demo that answers it. The other three can wait.
The AI proposes. A human approves. Every time.
A copilot grounded on real run evidence rather than free-forming over a prompt. Every claim links to the forensic exhibit behind it, and every agentic action stops at a human approval gate — the same pattern that Fiduciary and A&R are built on.
Jump to a moment
What to watch for
- It cites, then answers. If the evidence doesn't support a claim, the copilot says so instead of filling the gap.
- The block is not a setting. The approval gate is structural — the action plane is authorised separately from the reasoning plane.
- The receipt is written after the fact. What happened, who approved it, and what changed, in a hash-linked record.
this is the Fiduciary patternSame machinery, different domain. If you're evaluating Fiduciary or A&R, this demo is the closest look at how the governance actually behaves.
Run it against your own lab.
TestPulse installs as a Python package and runs on your machine. Point it at your own FreeRADIUS or tac_plus server — we host no lab and ship no lab.