credkellar/llm-x-netlab repository overview

⁠🧠🌐 LLM-X-NetLab

⁠🐳 Run it

docker pull credkellar/llm-x-netlab:latest
docker run --rm credkellar/llm-x-netlab:latest
# the container entrypoint runs the self-checks: CHECKS 21/21, VERDICT: PROCEED

From source: python3 main.py demo · python3 main.py ask "What does a router do?" · python3 main.py track 192.168.1.1,10.0.0.1,203.0.113.10 · python3 main.py checks

⁠🧰 Tech Stack Badges & Full Architecture Tech Stack

⁠💻 Core Programming Languages & Core Systems

🐍 Python stdlib only. One CLI (main.py), one package (llmx_netlab/), JSON-friendly output everywhere.

⁠⛓️ Web3 & Infrastructure

⁠⚙️ Platform Support & Hardware Architecture

🐧 Runs anywhere Python 3.11+ runs; ships a python:3.12-slim Docker image whose entrypoint runs the self-checks.

⁠⚡ Low-Level Infrastructure & Performance

⚙️ Hand-rolled TF-IDF embeddings + cosine search, a bigram SLM trained on the notes corpus, ipaddress-based subnet math, graph BFS for topology paths and failure analysis.

⁠🛠️ DevOps & Build Tools

⁠☁️ Cloud Providers

☁️ No cloud is required. Seats are names-only: Gemini Carbon 4 Extended Thinking decides (key GEMINI_API_KEY, free tier exists), Muse advises (MODEL_API_KEY, pay-as-you-go, not free, authority: none), Google Earth receives a KML file export (never called live, never fed invented coordinates), Google Flow receives a video plan (rendering is HOLD — it needs Darion's own Flow access).

⁠❓ What is this about?

📐 The LLM-x poster describes a complete modern LLM system in three layers: clients on top; a core of orchestrator, multi-modal gateway, LLM backbone, RAG, memory and domain modules in the middle; MLOps and guardrails underneath.

📓 The networking notes are a full beginner course in 28 topics: what a network is, PAN/LAN/MAN/WAN, devices, topologies, IP addressing and classes, protocols, the OSI and TCP/IP models, routing vs switching, cables, firewalls, security, bandwidth and the troubleshooting commands.

🧩 LLM-X-NetLab is those two things merged into one running system: every poster block is a real module, and the notes are its knowledge — the RAG corpus, the tutor's textbook, the SLM's training text, and the source of four working engines (subnet, topology, layers, devices) plus the IP path tracker Darion added.

⁠🎯 What this does

Step by step, python main.py ask "What does a router do?":

1. 🛡️ Safety filter — the guardrail scans the request; wrongdoing patterns stop here.
2. 🧭 Routing — the orchestrator decomposes the request and picks a sub-agent: retriever, subnet, topology, layer, device or tracker.
3. 🔢 Tool work — a subnet question gets real subnet math; a topology question gets a simulated graph with failure analysis; a track request gets the hop-by-hop start/middle/end report.
4. 📚 Retrieval — the RAG system searches the notes KB (TF-IDF vectors + knowledge graph) for grounding evidence.
5. 🧠 Council review — Carbon 4 runs MAP → MODEL → STRESS → DECIDE; Muse advises; the strictest verdict wins. A live-network reading of the request = HOLD.
6. ✍️ Grounded answer — composed from the tool output + the top notes entry, with source ids named.
7. 🧠 Memory — the turn lands in session memory for follow-ups.

Other faces of the same system: subnet (calculator), topology (simulator), layer (mapper), device (advisor), track / track-topo (IP hopper-tracker-mapper), earth (Google Earth KML export), flow (Google Flow video plan), quiz (tutor cards), bench (MLOps benchmark), checks, hold-demo.

⁠⚙️ How this works

⁠Master architecture

flowchart TD
    U[User via main.py] --> O[Orchestrator & Planner]
    O --> SF[Guardrails: safety filter]
    O --> RT{Route}
    RT --> RAG[RAG: TF-IDF vectors + knowledge graph over the notes KB]
    RT --> NL[NetLab engines: subnet / topology / layer / device]
    RT --> TR[Tracker: IP hopper - start / middle / end]
    O --> DM[Domain X: code interpreter / data analysis / math solver]
    RAG --> C[Council: Carbon 4 DECIDER + Muse advisor]
    NL --> C
    TR --> C
    C -->|PROCEED| A[Grounded answer with sources]
    C -->|HOLD| H[Refused: live-network action]
    A --> MEM[Session + episodic memory]
    O -.-> EARTH[Google Earth seat: KML export]
    O -.-> FLOW[Google Flow seat: video plan, render HOLD]

⁠main.py — the one interface

flowchart LR
    M[main.py] --> D[demo] & A[ask] & S[subnet] & T[topology] & L[layer] & DV[device]
    M --> Q[quiz] & TR[track / track-topo] & E[earth] & F[flow] & B[bench] & C[checks / hold-demo]

⁠llmx_netlab/orchestrator.py — agentic orchestrator & planner

flowchart TD
    Q[Question] --> SF[Safety filter]
    SF -->|blocked| HOLD[HOLD]
    SF -->|ok| R[Decompose + route]
    R --> AG[Sub-agent: retriever / subnet / topology / layer / device / tracker]
    AG --> EV[Evidence + tool output]
    EV --> CO[Council review]
    CO -->|PROCEED| ANS[Answer + sources]
    CO -->|HOLD| HOLD

⁠llmx_netlab/rag.py — retrieval-augmented generation

flowchart LR
    KB[(Networking KB: 21 entries)] --> EMB[TF-IDF embedder]
    EMB --> VS[(Vector store)]
    Q[Query] --> QE[Query vector]
    QE --> VS --> TOP[Top-3 chunks]
    KB --> KG[Knowledge graph edges]
    TOP --> OUT[Evidence]
    KG --> OUT

⁠llmx_netlab/netlab.py — networking engines

flowchart TD
    IN[CIDR / topology / thing / need] --> SC[subnet_info: network, broadcast, hosts, class, private?]
    IN --> TS[analyse_topology: links, worst hops, single points of failure]
    IN --> LM[layer_of: OSI + TCP/IP layer]
    IN --> DA[advise_device: from the notes]
    IN --> PS[simulate_ping: path over the simulated graph]

⁠llmx_netlab/iphop.py — IP hopper / tracker / mapper

flowchart LR
    P[Supplied IP path OR simulated topology path] --> HOP[Hopper: analyse each hop]
    HOP --> TRK[Tracker: START point / MIDDLE points / ENDING point]
    TRK --> MAP[Mapper: text path map + per-hop table]
    TRK --> KML[Google Earth KML export]

⁠llmx_netlab/brains/ — the council

flowchart TD
    REQ[Action + question + evidence] --> C4[Carbon 4: MAP - MODEL - STRESS - DECIDE]
    REQ --> MU[Muse: advice, authority none]
    C4 --> V{Strictest wins}
    MU --> V
    V -->|any HOLD| HOLD[HOLD - never overridable]
    V -->|clear| PRO[PROCEED]

⁠llmx_netlab/backbone.py — LLM core, honestly staged

flowchart LR
    PT[Pre-training: bigram counts over KB] --> SFT[SFT: KB entries are the curated set]
    SFT --> RLHF[RLHF: feedback log - votes recorded, no offline weight update]
    PT --> SLM[Tiny bigram SLM: generates from KB words]

⁠llmx_netlab/kb.py — the knowledge base

flowchart LR
    N[7 handwritten notes pages] --> KB[21 structured entries: title / body / tags]
    KB --> RAG[Feeds the RAG corpus]
    KB --> SLM[Trains the bigram SLM]
    KB --> TUT[Tutor study cards]

⁠llmx_netlab/gateway.py — multi-modal gateway & input processing

flowchart LR
    IN[Text input] --> TOK[Tokenizer]
    TOK --> VOC[Vocabulary over the KB corpus]
    IN2[Image / audio bytes] --> FP[Fingerprint only: sha256 + size, never decoded]

⁠llmx_netlab/embeddings.py — embedding models

flowchart LR
    DOC[Documents] --> TF[Term frequency]
    TF --> IDF[Inverse document frequency]
    IDF --> VEC[TF-IDF vectors]
    Q[Query vector] --> COS[Cosine similarity]
    VEC --> COS

⁠llmx_netlab/memory.py — memory systems

flowchart LR
    TURN[Conversation turn] --> SES[Session memory: short-term, in RAM, last 20]
    TURN --> EPI[Episodic memory: long-term JSON, only at an explicit path]

⁠llmx_netlab/domain.py — domain-specific 'X' modules

flowchart TD
    X[Domain X] --> CI[Code interpreter: safe AST arithmetic, no eval]
    X --> DA[Data analysis: transfer-time over a link]
    X --> MS[Math solver: bandwidth unit conversion]
    X --> API[External API integrations: contracts by name, never called]

⁠llmx_netlab/earth.py — Google Earth seat

flowchart LR
    TRK[Tracked path] --> C{Caller supplied coordinates?}
    C -->|yes, their own points| KML[KML: START / MIDDLE / END placemarks + path line]
    C -->|no| NOTE[KML with a no-coordinates note - nothing invented]

⁠llmx_netlab/flowvideo.py — Google Flow seat

flowchart LR
    TOPIC[Notes topic] --> G[Ground in the KB entry]
    G --> SB[Storyboard: setup / explain / diagram / recap]
    SB --> HOLD[Render: HOLD - needs Darions own Flow access]

⁠llmx_netlab/guardrails.py — guardrails & monitoring

flowchart LR
    REQ[Request / answer] --> SF[Content safety filter]
    REQ --> PII[PII redaction for logs]
    CALL[Any timed call] --> LAT[Latency monitor: samples + summary]

⁠llmx_netlab/mlops.py — MLOps & continuous learning

flowchart LR
    BENCH[Fixed 10-question benchmark] --> GRADE[Grade retriever top-1 vs expected entry]
    GRADE --> ACC[Accuracy report]
    VOTE[Helpful? votes] --> LOG[Feedback log - human promotes to KB, never automatic]

⁠⛔ HOLD gates

Permanently refused: live_network_scan, real_ping_sweep, live_packet_capture, execute_shell_command, fetch_live_url, modify_real_network_config, connect_live_device, geolocate_real_ip, track_person_device, identify_ip_owner. Run python main.py hold-demo — it exits 2. (A scoped live-socket mode is in progress at Darion's direction: TCP/DNS/HTTP to named targets; person-tracking and geolocation stay refused permanently.)

⁠⚠️ Honest stubs

• The LLM core is a staged contract + a tiny bigram SLM trained on the notes — not a general language model.
• Embeddings are TF-IDF, not a neural model — every number inspectable.
• Google Earth / Google Flow are seats: a KML file export and a video plan. Nothing uploaded, called or rendered; KML coordinates are never invented.
• Source: https://github.com/credkellar/LLM-X-NetLab⁠ — MIT © 2026 Darion Kellar.