SBC-AutoOps — Fleet Validation

Vendor

Verdict

Data source sample

⤓ Load dashboard_data.json

Drop an SBC config to validateAudioCodes .ini · Cisco CUBE · Ribbon · Oracle Acme · Metaswitch — read in memory, never written to disk, never leaves this machine.

Browse…

SBC Pre-Deploy Validation

🔗⤓⟳⊕

—

SBCs blocked from deploy

—fleet

—review

—pass

Open Findings by Domain

A-G validation domains

Open Findings Trend by Severity

Trend: dayGroup: Severity

Avg Risk Score by Vendor

Trend: dayGroup: Vendor

SBC Fleet — Latest Validation

SBC	Vendor	Site	Risk	Verdict	Top finding

— SBCs shownRuleset —

Deploy Verdict Mix

Block Review Pass

Group: Verdict

Findings — Severity × Domain

Darker = more findings

Outside-In Readiness Scanner

Enter an SBC's public hostname. A live TLS handshake is run against it and the edge is graded against Microsoft's 2026 Direct Routing requirements. No config upload; only the public endpoint is touched.

Same engine as the public scanner. SSRF-guarded, rate-limited. Outside-in only.

Walkthrough — One Broken SBC, One Fixed SBC

Real engine output, live. Run the broken config and the validator blocks it and predicts where in the handshake the call dies. Run the fix and the same SBC passes with two-way audio. That closed loop is the product.

// choose Broken or Fixed, then press Run validation

Live sbc-validator walk output. The engine runs locally; nothing leaves your machine.

Setup Guide — wire the validator into your estate

This console is already running on your machine; everything below runs the same engine against your own configs. It reads exports, never touches an SBC, and needs zero outbound network.

Python 3.10+ or Docker / Podman 1 runtime dependency (cryptography) 0 outbound connections required

Validate a real config

sbc-validator validate your-export.ini \
--ruleset rulesets/ms_direct_routing_2026-06.json --out results --html report.html
# any of the five vendors, auto-detected

Predict the call, diagnose a capture, diff an HA pair

sbc-validator simulate your-export.ini # TLS → SIP → SDP → media, where it dies
sbc-validator explain capture.pcap # post-mortem, plain English
sbc-validator diff active.ini standby.ini --fail-on review

Roll up the fleet

sbc-validator fleet sbc-configs/ \
--ruleset rulesets/ms_direct_routing_2026-06.json
# "X of N SBCs ready for the 2026 CA migration" + this console: serve --results results

Gate your pipeline

Drop-in example at examples/ci/sbc-pre-deploy-gate.yml. Non-zero exit blocks the PR before a non-compliant config reaches the change window.

sbc-validator validate config.ini --fail-on review \
--ruleset rulesets/ms_direct_routing_2026-06.json

Air-gapped and offline installs

docker run --rm --network none sbc-validator demo # or rootless podman, identical
# offline pip: pip download . -d wheels/ on a connected box, then
pip install --no-index --find-links wheels/ sbc-autoops-validator

Refresh signed rules (stays offline at validate time)

python -m sbc_validator.tools.fetch_ruleset <api_base> ms_direct_routing -o local.json
# Ed25519 signature verified against the pinned key BEFORE writing a byte

Data-flow contract: docs/SECURITY.md in your source tree · sbcvalidator.metaventionsai.com/#security

Findings — every open check across the fleet

SBC	Check	Title	Domain	Severity

Live from the loaded payload. Click a row to jump to that SBC in Fleet Overview; open its full report (Reports tab) for remediation text.

Rule Bundles — what produced these verdicts

loading bundle provenance…

Bundles are Ed25519-signed and verified against a key pinned in source before use; a compiled-in freshness floor refuses rollback. Configs never travel this channel.

Reports — the post-run deliverables

Single source of truth: every run writes results/<sbc>/<timestamp>.json (history-preserving, identical schema from every run path: pip, offline, container, CI). Everything below is a rendering of those audit-trail files.

Open executive report Download Markdown

Per-SBC reports (latest run)

CLI equivalents: validate --html report.html · sbc-validator report --results results/ · fleet --out fleet.md · report --compliance mifid2

The version-stamped verdict JSON is the audit artifact for your change record.

Dashboards