CITADEL

Inspiration

Most security tools stop at finding problems. They hand you a long list of vulnerabilities and leave the fixing, re-testing, and proving to humans. We wanted to close that loop. What if a system could audit your code, patch it, verify the patch, and leave behind proof nobody could quietly edit afterwards? That idea became Citadel, a closed-loop defensive cyber range.

What it does

Analysis swarms audit your code and surface weaknesses.
Defense swarms generate patches and verify that they actually fix the issue without breaking anything.
A tamper-evident audit chain seals every action, so the full history of what was found, changed, and verified can be trusted.

How we built it

Citadel is a web platform deployed on Vercel. [Add your frontend stack, e.g. React / Next.js.] [Add how the swarms work: models, agents, orchestration.] [Add how code is sandboxed and tested.]

The audit chain links each action to the one before it using a cryptographic hash:

$$H_i = \operatorname{SHA\text{-}256}\left(H_{i-1} \,|\, a_i\right)$$

where $a_i$ is the $i$-th recorded action. Changing any past action changes its hash, which breaks every hash after it, so tampering is detectable.

What we learned

Designing multi-agent workflows where one swarm's output is another's input.
Why verification matters as much as generation: a patch is only useful if it is proven to work.
How hash chains give simple, strong integrity guarantees.
[Add your own lessons.]

Challenges we faced

Trusting AI patches: generated fixes can look right and still be wrong, so we built verification into the loop.
Coordinating swarms: keeping analysis and defense agents in sync without conflicts.
Making the audit trail meaningful: recording enough detail to be useful without drowning users in logs.
[Add real challenges, such as time limits, bugs, or deployment issues.]