HomeNetWatch · production home network platform
A live network platform, built by AI that started from the operating rules.
Sensors on the home network, isolated measurement tunnels, path and speed, wireless security, and a dashboard you can open. Coding agents wrote most of it. They worked from institutional knowledge written down first: how a network actually fails, what has to stay private, and which checks must pass before a change ships.
SELECT A SYSTEM LAYER TO INSPECT
01 / Edge Hardware
Raspberry Pi & Android TV Sensors on a Real Home Network
A Raspberry Pi measures both Wired Ethernet and Wi-Fi simultaneously—running HTTP and ICMP path checks, LibreSpeed throughput tests, Kismet wireless intrusion detection, on-demand LAN scans, and a custom Rust real-time UDP stream generator (Voice G.711 A-law/µ-law & Video)—while an NVIDIA Shield Android TV agent adds QR-onboarded Wi-Fi voice and throughput telemetry from the living room.
Architectural Trade-off
Spaced heavy tests in a serialized queue rather than firing parallel streams that would peg the Pi's
CPU, saturate residential uplink, and create the very lag we measure.
02 / Security & Networking
Access Plane vs. Measurement Tunnel Split
Devices enroll with Ed25519 signatures and pin the server's TLS certificate. Wired (wg0)
and Wi-Fi (wg1) each maintain an isolated WireGuard tunnel. When an ISP blip leaves a stale
route pin, the agent detects that public web works while the tunnel peer is unreachable and self-heals
within 60 seconds.
Why It Matters
Separating public web checks from WireGuard tunnel checks prevents false "Wi-Fi Down" alarms when only
a measurement tunnel dropped—and HSTS, strict CSP, and server-side RBAC protect the public guest demo.
03 / Portable Cloud Stack
FastAPI, PostgreSQL & Hierarchical Correlation
Deployed via clean Docker Compose and Caddy on Oracle Cloud with zero proprietary lock-in. The alert engine evaluates a strict hierarchy—Pi offline → shared WAN outage → upstream bandwidth collapse → single link → tunnel—suppressing downstream alert noise automatically, while Server Health monitors disk forecasts, encrypted off-host backups, and weekly CVEs.
Architectural Trade-off
Gave up familiar AWS and GCP managed services to prove the entire stack can migrate to any Linux host
or bare metal without rewriting code.
04 / How it was built
Coding agents, working inside written knowledge
The platform was not one open prompt. Architecture, security, and delivery rules were written first in
SPEC.md and CLAUDE.md: remote agents push, browsers only read, roles are
enforced on the server, secrets never enter a public repo, and an alert names the cause rather than
every symptom under it. Several coding agents then implemented on isolated branches. Each change went
through pull-request review, server tests in a throwaway database, and a TypeScript build before it
reached the live system.
What the rules refused
No always-on language model reading logs. Deterministic correlation runs first. Gemini is on demand,
for a root-cause note or a fault walkthrough, and a guest session is read-only with the home address
removed on the server.
