// Network & AI Systems Consulting — Abu Dhabi · EN/ES/PT
Networks that
verify themselves.
AI you can run on your own GPUs. Plain-language intent in — verified-on-device fabric changes out. Independent consulting by Marlon Paz across network automation, agentic NetOps and sovereign AI.
01 // proof
It ships, and it verifies.
Every claim on this site links to public evidence — a repo, a paper or a demo. The receipts are the homepage.
agentic-netops
Intent in plain language; AGNTCY + LangGraph agents, Kubernetes controllers, a live SONiC EVPN/VXLAN fabric, gNMI closed loop. Nothing reported deployed until verified on the device.
4/4 constructs converge · 0 unverified success reports · repo, 2026-10agent-observability-stack
Token/cost/trace telemetry for agent fleets — LiteLLM + OpenTelemetry into Prometheus, Loki, Tempo, Grafana and Arize Phoenix; GPU-aware, with budget alerts.
every LLM call traced · cost per agent, model, task · repo + video walkthroughagentic-ops-bench
Model × harness benchmark on real operations tasks — AIOps, NetDevOps, HPC, inference, RAG, tool loops. The honest local-or-frontier answer, per workload.
30B-class on 1× RTX 3090 vs hosted frontier · repo, dated runsqmd-memory-stack
Local, GPU-accelerated 3-tier RAG memory over GGUF embeddings plus a shared MCP gateway — agent memory that never leaves your hardware.
~19× query speedup (Intel Arc iGPU, Vulkan) · repo READMEMore receipts: all public repos · the open-source ledger below.
02 // services
What the practice builds.
Six service lines, one thesis: automation you can audit. Each carries its outcome, duration and the public evidence behind it.
Agentic Network Operations — Intent-to-Fabric
Plain-language network intent becomes verified, on-device configuration changes with a closed telemetry loop — and zero unverified success reports.
Agentic CloudOps & AIOps — Signal to Action
Your telemetry stops being a wall of alerts and starts closing loops — events correlated, remediated under guardrails, and verified resolved.
Sovereign Inference & GPU Economics
Production-grade LLM serving on your own NVIDIA GPUs, with a dated, benchmarked answer to "local or frontier?" per workload.
Agent-Fleet Platform — Memory, Routing, Observability
A governed multi-agent platform with shared memory, model routing, and full token/cost/trace telemetry — so fleets are operable, not just demoed.
Critical-Network Security & Telemetry Assessment
Your utility, railway, ISP or data-center fabric gets a quantum-safe segmentation and streaming-telemetry readiness review — hands-on, not a checklist.
Applied Agent Delivery
One named workflow — analysis, triage, content, assurance — delivered as a working agentic application with provenance-bound, unattended operation.
Fractional Architecture & Team Enablement
Ongoing senior network/AI-infrastructure architecture judgment — plus your engineers trained on automation, Kubernetes and agent operations — without a full-time hire.
engagement shapes
Architecture & Strategy Advisory
2–3 weeks
Opportunity/decision memo — where agentic NetOps, local inference or automation pays back, sequenced, with a build-or-buy recommendation and risk notes.
Automation / Inference Readiness Assessment
3–4 weeks
Technical assessment report with dated, evidence-backed findings, severity-ranked gaps, and a two-quarter remediation roadmap.
Fabric Convergence Proof-of-Value
4–8 weeks
A containerlab replica of your fabric with the intent-to-CR pipeline, gNMI closed loop, and an on-device verification report — video-recorded for internal sell-through.
Implementation & Delivery
3–6 months
Shipped automation or platform, runbooks, verified-on-device evidence, and a knowledge-transfer handover to your team.
AIOps & Agent-Platform Build
6–12 weeks
Working event-driven operations pipeline (alert → diagnosis → guarded remediation → verified resolution) on a multi-agent platform with observability, dashboards, cost telemetry, and operating guidance.
Fractional Architect & Enablement
1–2 weeks per cohort / 3–12 month retainers
Tailored EN/ES/PT curriculum and labs, plus a trained internal team; or a retained architecture allocation.
03 // method
The Verified Fabric: intent in, evidence out.
The method is the same loop the reference system runs — and it is how engagements are governed: nothing advances without evidence.
↺ gNMI → Prometheus → Grafana · converged services re-verified every 5 min — drift is repaired, and said so
The same loop runs the inference practice: prompt → routed model → verified cost and latency, per workload, on dated numbers.
04 // zero-friction
Ask the lab twin.
A Turnstile-gated digital twin of Marlon's public work — it answers how intent-to-fabric verification, gNMI closed loops or local GPU serving actually work, and points back to the repo or paper it came from.
It is itself a served inference app with telemetry: a live demo of the grounding, routing and observability the practice sells. Not a live person; may be imperfect.
try asking
- "What stops the agents from reporting success before it's real?"
- "How do you benchmark local models against frontier APIs?"
- "What does quantum-safe ANYsec change in my fabric?"
05 // depth
Work & publications.
Curated depth on demand — the demo, the peer-reviewed papers, the security labs, the delivery method.
The intent-tier demo — 6½ minutes, end to end
VLAN, ip-vrf and a stretched mac-vrf provisioned from plain language, then proven with kubectl and on the SONiC leaves. Nokia SR Linux variant: agentic-netops-srl.
Peer-reviewed publications — IEEE & Springer
Decentralized & Dynamic Zero-Touch Provisioning of Leaf-Spine EVPN Data Centers IEEE
Autonomous agents on each router provision the leaf-spine EVPN underlay and overlay with no manual intervention — inferring router roles from link-state topology and self-healing on failures.
Kubernetes-Aware Load Balancing for Leaf-Spine EVPN Data Centers Springer · Journal of Cloud Computing
Distributed agents at leaf routers feed live Kubernetes pod data into the fabric, dynamically tuning ECMP weights via EVPN/BGP extended communities so routing aligns with pod placement.
Co-authored as mentor to the master's students who carried out the research.
Quantum-safe fabric labs — Nokia SR OS FP5
Working containerlab labs: ANYsec · ANYsec + MACsec · streaming telemetry (SR Linux + SR OS) — the same labs the Critical-Network Assessment runs on.
Spec-driven delivery — specstride.ai
The delivery methodology is public and self-improving: specstride.ai drives coding agents phase by phase behind an LLM-critic gate and learns from its own telemetry. mixture-of-loops compiles Spec Kit features into provenance-bound, unattended pipelines.
06 // ledger
The open-source ledger.
The practice's public work, auto-synced daily from GitHub and grouped by service line — the standing evidence behind every offer.
Network & fabric
agentic-netops
AGNTCY + LangGraph agents turn intent into CRs; Kubernetes controllers reconcile them onto a live SONiC EVPN/VXLAN fabric; gNMI telemetry closes the loop. Runs in containerlab + kind.
Python★ 3
agentic-netops-srl
Agentic NetOps on Nokia SR Linux — declarative EVPN/VXLAN fabric control plane with a guarded multi-agent intent tier.
Shell★ 3
srl-sros-telemetry-lab
Interactive streaming telemetry lab — Nokia SR Linux + SR OS.
Shell★ 1⑂ fork
sros-anysec-lab
Quantum-safe ANYsec encryption demo on containerlab with Nokia SROS FP5 vSIMs.
PHP★ 2⑂ fork
sros-anysec-macsec-lab
Quantum-safe ANYsec + MACsec lab environment.
Python⑂ fork
vrnetlab
Contributed ISA-MS card support for vr-sros.
Python★ 1⑂ fork
certforge
certforge — a small OpenSSL CLI to generate CSRs (for signing by an internal CA) or self-signed certificates from a .cnf, with or without an existing key.
Shell★ 1
Agents & platforms
agent-observability-stack
Self-hostable observability for LLM agents + a Linux host (Intel iGPU/NPU + NVIDIA RTX 3090 eGPU aware): Prometheus + Grafana + Loki + Tempo + Arize Phoenix + OTel, OpenClaw/LiteLLM/Claude Code/RAG metrics and traces, dynamic onboarding, Telegram alerts.
Python★ 1
qmd-memory-stack
Local, GPU-accelerated RAG memory for coding agents (Claude Code + OpenClaw) — hierarchical 3-tier memory over local GGUF embeddings + an MCP server; ~19× query speedup on an Intel Arc iGPU via Vulkan. Idempotent bash installer, fail-open recall.
Shell★ 1
qmd-gateway
Shared, warm, writable qmd MCP memory gateway for a multi-agent coding fleet.
Shell★ 1
kind-cilium-hubble-cluster
Bootstraps an observable K8s cluster from scratch with kind + Cilium + Hubble.
Shell★ 1
Local inference
agentic-ops-bench
Model x harness benchmark on real agentic ops tasks (AIOps, NetDevOps, HPC, inference, RAG, tool loops). Local 30B-class models on one RTX 3090 vs hosted frontier models.
Python★ 1
antares-scan
Fast, free first-pass security triage of a code folder with a local antares-1b (Granite-4.0) model.
Shell★ 2
gpu_rtx_3090
Safe power-cycle scripts for an RTX 3090 Thunderbolt-4 eGPU (drain/detach/rescan + systemd shutdown guard).
Shell★ 1
Method & delivery
specstride
Spec-driven autonomous coding orchestrator: drives your agent through GitHub Spec Kit phases behind an LLM critic gate and diagnoses stuck phases. It also improves itself: it learns per-phase settings from its own run telemetry, tests each change against a baseline, and reverts any that make things worse.
Python★ 4
mixture-of-loops
Generate provenance-bound, unattended Specstride pipelines from Spec Kit artifacts.
Python★ 1
specstride.ai
Website for Specstride: spec-driven, gated, unattended coding. Built as a reusable template.
Astro★ 1
claude-plugins
Marlon De Paz's Claude Code plugin marketplace.
Shell★ 1
Applied agents
video-to-deck
Turn videos into Marp slide decks (PPTX/PDF/HTML). Local whisper + OCR + optional VLM captions build an evidence bundle; a fresh agent per video writes the deck. Structural content becomes Mermaid diagrams. Pluggable agent, CUDA-accelerated, CPU-portable.
Python★ 2
kedin
An AI agent (managed via Telegram, orchestrated by OpenClaw) that ghost-writes LinkedIn posts in your voice with UML/architecture diagrams. Public, dummy-data demo of the digital-twin career-agent pattern.
JavaScript★ 1
havan
Havan - an autonomous flight-deal hunting AI agent. Managed from Telegram, orchestrated by OpenClaw: searches Google Flights / Skyscanner / OTAs for the cheapest fare with good timing and returns a ranked shortlist with booking links. Public, dummy-data demo.
★ 1
nb-robotic-ai-hk
Shell
agent-skills
Agent skills I use every day: GPU and fleet ops, Proxmox ops/triage, local-model routing, fleet memory, spec reconciliation, spec-corpus curation.
Python
kanban
Persistent kanban board — Hono API + Next.js + SQLite + Claude AI + Telegram bot integration.
Shell★ 1
duby
AI investment-analysis agent — monitors Telegram channels for trading signals, enriches them with live market data, and delivers position-sized analysis via a dashboard and Telegram bot.
Python★ 1
Synced daily by an unattended pipeline — identical GitHub state, byte-identical output. All repos ↗
07 // lineage
Where the fabric experience comes from.
Trust via lineage, not biography — each stop de-risks a service line.
Full story and the consultant profile (PDF): about.
08 // depth
Certified across the stack.
NVIDIA-Certified Professional: Agentic AI
NVIDIA-Certified Associate: AI Infrastructure and Operations
CCIE Service Provider
CCNP Automation
Certified Kubernetes Administrator
CCNP Data Center
Specialist: Data Center Networking Automation
Lab Champion: 20 labs
Lab Champion: 10 labs
CCNP Enterprise
Specialist: Automation Core
Data Center Fabric Professional
Every badge links to its public verification page. Full list on Credly.
certifications
- CCIE
- Certified Kubernetes Administrator (CKA)
- CCNP Automation
- CCNP Data Center
- NVIDIA-Certified Professional: Agentic AI
- NVIDIA AI Infrastructure and Operations
- Nokia DCFP
- Isovalent Lab Champion
Verified on Credly.
vendor fluency
- Cisco (IOS-XR, NX-OS)
- Nokia (SR Linux, SR OS)
- Juniper
- SONiC
- loadbalancer.org (application delivery)
- NVIDIA (GPU / AI infrastructure)
- Red Hat (Ansible, RHEL)
Multivendor is the offer, not an add-on — deliberately vendor-independent.
quantum-safe networking
Nokia ANYsec — post-quantum-resistant, line-rate encryption for data-center fabrics — plus MACsec and Nokia NGE, exercised in public labs on Nokia SR OS FP5 and presented at MPLS SD & AI Net World 2024 (demo video). PQC keying, line-rate encryption inside EVPN/VXLAN, latency trade-offs, staged multi-vendor migration.
09 // questions
Asked, answered.
Do you actually build, or only advise?
Both, but the bias is building. The reference evidence is shipped and runnable — working multi-agent intent-to-fabric code with verified convergence on a live containerlab fabric (agentic-netops), deployed observability stacks, published research. Advisory engagements exist, but every recommendation is anchored to something built and demonstrable.
Can you work with our vendor X?
Yes — multivendor is the core of the practice, not an add-on. Public work spans Cisco IOS-XR/NX-OS, Nokia SR Linux and SR OS, and SONiC, with hands-on labs for Nokia ANYsec/MACsec security and streaming telemetry (sros-anysec-lab). Certifications across Cisco, Nokia, Kubernetes and NVIDIA back that range; Juniper and Red Hat estates are equally in scope.
How do you handle confidentiality?
Your environments, topology and business context stay yours. Public repo names and anonymized capability categories are the only evidence ever referenced — no client names, architectures, screenshots or details are published or cited. Confidentiality terms are set in the engagement contract before work starts.
What does an engagement look like?
A short scoping conversation, then a bounded discovery phase mapping your fabric, tooling and constraints; then delivery with defined constructs and a verification bar — every change proven on the device before it is reported done; then handover with runbooks, code, and optionally training for your team.
Local models vs. cloud — what fits us?
It depends on your data sensitivity, latency and cost profile — and it is measurable, not philosophical. Structured benchmarks of local 30B-class models against hosted frontier models on real ops tasks (agentic-ops-bench) mean the decision is made on your workloads with real numbers, plus routing and policy so both can coexist.
How do you price?
Fixed-scope phases with a defined deliverable and verification bar per phase, priced up front; ongoing advisory or platform work on retainer. You always know what a phase costs and what "done" means before it starts — and "done" is on-device verified, not a status report.
Who controls the automation if agents are in the loop?
The same way the public reference build does — agents propose, controllers reconcile, telemetry verifies, and drift is repaired automatically, with guarded control planes so agent actions are bounded and auditable. Nothing is reported deployed until verified on the device; that rule is the product (agentic-netops).
Can you train our team, not just deliver?
Yes. Training and enablement are a standing line of the practice, grounded in university mentoring that produced two peer-reviewed publications and in authored course material. Handover includes working sessions so your engineers can operate and extend what is built.
Do you actually work on quantum?
Applied quantum-safe networking — hands-on, public and verifiable: Nokia ANYsec (post-quantum-resistant, line-rate encryption for data-center fabrics), MACsec and Nokia NGE, exercised in public containerlab labs on Nokia SR OS FP5 vSIMs (sros-anysec-lab, sros-anysec-macsec-lab, building on the srl-labs originals) and presented as a quantum-safe ANYsec demonstration at MPLS SD & AI Net World 2024 — demo video. In depth: how post-quantum cryptography and keying change network design and operations, line-rate encryption inside EVPN/VXLAN fabrics, performance/latency trade-offs, and staged multi-vendor migration. Quantum-computing research itself (qubits, algorithms, hardware) is not the practice — making your fabric resistant to it is.
10 // talk
One email starts it.
Scope a Fabric Convergence Proof-of-Value, an assessment, or a fractional engagement — or just ask a hard question.
Response within two working days. Abu Dhabi, UAE · working languages EN / ES / PT.
the ladder
- Ask the twin — zero friction
- Watch the 6½-min demo
- Read the repos and papers
- Print this page as a one-page brief (Ctrl/Cmd-P)
- Send the scoping email