Grid Copilot
An anomaly detector tells you something broke. This one tells you why, and cites its evidence.
Problem
Detection on grid telemetry stops at the alert. An operator still has to reconstruct what happened from raw signals, equipment manuals, and whatever they remember about that asset.
Approach
A streaming detector flags the anomaly. An agent then investigates it, pulling evidence from the telemetry window, from equipment and protocol documentation, and from memory of prior incidents on the same asset, and writes a root-cause report where every claim is cited. It runs entirely on public data (the HAI ICS dataset), and reuses Cortex for orchestration and mnemos for per-asset memory.
Result
A multivariate autoencoder, trained on HAI's dedicated attack-free file rather than a prefix of the test file, takes point-adjusted F1 from 0.57 to 0.70 at full recall. The harness also reports the stricter per-timestep score, where the same change matters more (0.26 to 0.58), and the precision-recall curve behind that single operating point, because which point is right is a product decision about how many false alarms a maintenance lead will tolerate per caught attack. Recall holds at 87% across all 118 labelled attack intervals in HAI's five test files, not just the friendlier one.
