Findings

Trained on real fault injections, Katyayani names the root cause first on a system it never saw this often. The same design trained on synthetic incidents falls below a no-learning baseline on real ones: the simulator taught it to trust topology, and real faults make the culprit the loudest.

Tuned honestly, Mahagauri now stays inside its 5% safety budget on servers it never saw: it rarely calls an incident over too early. But it confirms few recoveries, so most incidents still go back to a person — the model needs sharper signals, not a different threshold. Fusing three detectors bought recall with far more false alarms. Both are published, with what would fix them.

The public Kaggle notebooks found it first, so the baseline was added to the training runs and the result reported. A model is only worth serving where it beats the strongest simple baseline. Brahmacharini still earns its place: it retrieves the passages behind every answer, which a classifier cannot, and fused with the classifier it beats both.

Both larger models were trained on Kaggle's GPUs with the epoch or step chosen on validation data. The larger encoder had too little data to learn from scratch. The larger language model copies identifiers better but declines less often when no passage holds the answer, and declining is what Sati depends on. The smaller models stay served.

To find a weight for new attacks without peeking at the test days, each attack family in the training days was hidden from the classifier in turn. Those families are mostly denial-of-service variants the classifier generalises across, so the rehearsal saw no need for the second detector. The real unseen attacks (botnets, infiltration, port scans, web attacks) needed it. The served model is unchanged.