Skip to main content
Eudai Gestalt IntegrationsWorkflowtech.ai / EGI

Portfolio

Systems that run, shown with their evidence.

Each case study here is a system David G. Braun built himself. Each one comes with the record of what it did in production and a way to check the claims yourself.

David is the founder of Eudai Gestalt Integrations, which operates at Workflowtech.ai, and has spent 17 years in client-facing IT. Read his CV (opens in a new tab)

Case study 01

ConfigLeaf

One setting can show up in eight places. ConfigLeaf reads all eight as one and decides every finding under the MSP's own policy.

Built solo by David G. Braun in six days.

Entered in

  • GenAI Works Open Agent Hackathon 2026
  • Track 1 · Solving Fragmented Intelligence
Watch the demo (3:43) (opens in a new tab)Open the live console (opens in a new tab)Repository on GitHub (opens in a new tab)Slide deck (opens in a new tab)

The demo is recorded from the real system. The console opens the technician's work queue in sample mode, with no login.

91 s

Production DNS rollback on 25 October, ticket #6 opened and closed

20 of 20

Held-out items where the SQL checks agreed with the labels, 0 false alarms

375

Held-out receipts, all verified offline with Ed25519

6 of 6

Checks passed by npm run judge on 26 October, in 18.7 s

The problem

One setting lives in eight places.

When the setting changes in one place, nothing notices. A technician opens eight tools to find out which copy is right.

  1. The live server
  2. The nightly backup
  3. The documentation of record, where approvals live
  4. The DNS provider
  5. The audit logs
  6. The inventory
  7. The outside probes
  8. The PSA tickets

A file monitor misses one case entirely: the file stays byte-identical while what it points at changes. ConfigLeaf reports that case as found-but-different.

ConfigLeaf is for MSP operations leads and the technicians on call.

What it does

All eight sources, read as one.

One read path through Zetaris

ConfigLeaf reads all eight sources through the Zetaris semantic layer, and every live read runs on Zetaris Lightning SQL.

Zetaris data-quality rules decide whether a collection run is complete enough to judge at all. A run that read fewer objects than it said it would never reaches the detectors.

Policy is data

Every finding is decided under the MSP's own policy, which is data: ROLLBACK, FIX, ESCALATE, HOLD with an expiry, or ADOPT.

Who changed it, from evidence

ConfigLeaf explains who changed a setting and how with no model involved. It reads the vault diff, the host journal with its sudo and ssh logins, the provider's audit log and the agent's own ledger.

Tickets that carry the evidence

It opens, comments on and closes PSA tickets with the evidence. GitHub Issues today. HaloPSA, ConnectWise and Autotask are written as field maps.

Nemotron as the falsifier

Through Nightshift, Nemotron Lightning picks checks from a tested catalogue and Nemotron Ultra writes one SELECT that tries to prove each finding false. A verdict counts only when its signed receipt verifies.

A console for the person on call

The work queue puts what needs a person on top: live value against approved value, why the agent stopped and the rule it applied, and how long it has been open.

Approve, Unlock and Lock sit on every row. Unlock opens a change window, so a planned change is held instead of rolled back.

Screenshot of the ConfigLeaf work queue in sample mode. Counters across the top show how many findings need a person, are held, adopted or locked. The Needs you and Held tables list each object with its live value, its approved value, why the agent stopped and under which rule, its age or expiry, and Approve, Unlock, Lock and Open buttons on every row.
The ConfigLeaf work queue in sample mode. What needs a person comes first, then what is held. Open the full-size image

Production proof

25 October 2026, in production.

ConfigLeaf ran against David's own estate: 2 production hosts and 6 DNS zones. Three acts ran in production that day, and a fourth ran in the lab.

Act two · 16:50 UTC

The record changed. The file did not.

A hand edit in the provider's dashboard changed a DNS record. The nginx file stayed byte-identical, so a file monitor sees nothing.

ConfigLeaf saw that the record no longer matched its approved value and that the name now resolved to an address outside the inventory. It rolled the record back from a validated copy through the provider's API and read it back field by field. It opened ticket #6 and closed it in the same cycle.

91 s

The whole cycle, 16:49 to 16:51 UTC

#6

Ticket opened and closed with the evidence

Screenshot of the ConfigLeaf trace page in sample mode, showing the stored trace of act two on 25 October 2026, 16:49 to 16:51 UTC. Four rows show the detector reporting found_but_different on a byte-identical nginx file whose name now resolves to an address outside the inventory, the decider choosing ROLLBACK to the approved vault copy, the actor reverting the record and reading it back field by field, and the PSA step creating and closing ticket #6.
The production trace of act two, as the console shows it in sample mode. Detector, decider, actor and PSA step, each with its timestamp. Open the full-size image

Act one · 15:55 UTC

A vhost edited by hand

Policy had the setting locked, so the decision was ROLLBACK. ConfigLeaf wrote the vault copy, nginx -t passed and nginx reloaded.

The next pass confirmed the approved value and closed the ticket.

Act three · 18:10 to 18:16 UTC

No valid copy, so it stopped

A change with no valid copy broke production. The pass decided FIX. Nemotron Lightning picked 4 checks and Ultra's refuting SELECT returned 0 rows, both on verified receipts.

ConfigLeaf refused the fix because no valid copy existed and opened incident #7 as P1 for a technician.

Lab · 20:22 UTC

An edit over ssh, named and restored

A user changed a file over ssh with sudo tee. The agent named the cause as operator_edit, with 20 evidence rows and an 11-line diff.

It restored the approved copy 4 minutes later. Then nginx -t passed and the site answered from outside.

Evaluation

Labels written before any model ran.

The evaluation was pre-registered: the protocol was written and every item labelled before any model ran. It compares ConfigLeaf's SQL checks, with Nemotron Ultra trying to prove each finding false, against Ultra reading the data alone.

20 of 20

Held-out items where the SQL checks agreed with the labels

0

False alarms from the SQL checks on the held-out set

7, 7 and 9

False alarms from Ultra reading the same held-out data alone

Development set

15 items, 3 runs each

Ultra reading the data alone
Agreed with the labels on 3 or 4 of 9. False alarms on 6, 5 and 6 of 9 healthy items.
SQL checks with Ultra as the falsifier
0 false alarms. Ultra struck 9, 8 and 8 of 10 deliberately false claims.

Held-out set

23 items, run once on the frozen code on 26 October

SQL checks
Agreed on 20 of 20, with 0 false alarms.
Ultra reading the data alone
Agreed on 13, 13 and 11 of 20, with 7, 7 and 9 false alarms.
Ultra as the falsifier
Struck 8, 9 and 9 of 10.

Receipts. Development: 390 calls, 384 on a verified receipt, the other 6 refused by the gate, 0 model substitutions. Held-out: 375 receipts, all verified. Every receipt verifies offline (Ed25519).

Anyone can check it

One line, on your own machine.

Clone the repository and run six checks of the main claims in about 20 seconds. They run offline, with no credentials and no model.

npm ci && npm run judge

6 of 6 checks passed in 18.7 s

Printed on 26 October 2026.

Stack and sponsor technology

TypeScript on Node 22, four runtime dependencies.

The console is server-rendered under a strict CSP, and every action works without JavaScript.

Semantic layer · Lightning SQL · DQ rules

Zetaris

  • 25 entities in the drift_usl semantic layer over 4 datasources.
  • 6 DQ rules, each a gate on its entity.
  • 107 parity cases equal on Zetaris and sql.js.
  • 235 queries through Zetaris in one live pass: 47.6 s, 0 failed.

World Model · H-MEM · Nightshift runtime

Meterless

  • World Model conformance: 8 of 8.
  • H-MEM conformance: 13 of 13. The technician's 23 accepted exceptions, each with an expiry, are recalled before each decision.
  • Scout blocked 7 of 7 injected instructions and 0 of 25 benign texts.

Served through Nightshift

NVIDIA Nemotron

  • nemotron-3.5-lightning picks checks from a tested catalogue.
  • nemotron-3-ultra-550b-a55b writes one SELECT that tries to prove each finding false.
  • A verdict counts only when its signed receipt verifies.

What is next

A new source is a collector, not a new agent.

Every adapter keeps one contract. It reads one system and asserts how many objects it should find, then hands back the same six tables.

Live today

  • linux.nginx
  • cloudflare.dns
  • m365.dns: Microsoft 365 mail records held to DNS
  • zetaris.control: Zetaris's own control plane, added with the pipeline unchanged

Next

  • Liongard: inspections as observations, change detections as audit events
  • StackJack.io as an MCP broker: one adapter to every tool it brokers
  • IT Glue and Hudu: approved settings
  • NinjaOne and Datto: inventory
  • HaloPSA, ConnectWise and Autotask: PSA, written today as field maps

See it yourself

ConfigLeaf: the evidence

Contact

Start a conversation.

If a problem on this page looks like one in your own operation, tell us where things stand.

Open contact form