SBC-AutoOps — Fleet Validation

Vendor

Verdict

Data source sample

⤓ Load dashboard_data.json

SBC Pre-Deploy Validation

🔗⤓⟳⊕

—

SBCs blocked from deploy

—fleet

—review

—pass

Open Findings by Domain

A-G validation domains

Open Findings Trend by Severity

Trend: dayGroup: Severity

Avg Risk Score by Vendor

Trend: dayGroup: Vendor

SBC Fleet — Latest Validation

SBC	Vendor	Site	Risk	Verdict	Top finding

— SBCs shownRuleset —

Deploy Verdict Mix

Block Review Pass

Group: Verdict

Findings — Severity × Domain

Darker = more findings

Outside-In Readiness Scanner

Enter an SBC's public hostname. A live TLS handshake is run against it and the edge is graded against Microsoft's 2026 Direct Routing requirements. No config upload; only the public endpoint is touched.

Same engine as the public scanner. SSRF-guarded, rate-limited. Outside-in only.

Walkthrough — One Broken SBC, One Fixed SBC

Real engine output, live. Run the broken config and the validator blocks it and predicts where in the handshake the call dies. Run the fix and the same SBC passes with two-way audio. That closed loop is the product.

// choose Broken or Fixed, then press Run validation

Live sbc-validator walk output. The engine runs locally; nothing leaves your machine.

Setup Guide — run the real engine in your environment

This dashboard is a demo of the local console. The validator itself runs entirely on your side: it reads config exports, never touches an SBC, and needs zero outbound network. Four ways to run it, all starting from the source tree (design-partner tarball or repository checkout).

Python 3.10+ or Docker / Podman 1 runtime dependency (cryptography) 0 outbound connections required non-root container · uid 10001

Step 0 · verify what you received (every path)

The source ships with a SHA-256 manifest covering every file. Verify before you build.

tar -xzf sbc-validator-0.16.4-src.tar.gz && cd sbc-validator-0.16.4
shasum -a 256 -c SHA256SUMS # every file, against the manifest

Path 1 · plain pip — any Python 3.10+ host

python3 -m venv .venv && .venv/bin/pip install .
.venv/bin/sbc-validator demo # the full mixed-vendor showcase, locally

Path 2 · fully offline — isolated environments

# on a connected machine:
pip download . -d wheels/
# carry wheels/ across the air gap, then:
pip install --no-index --find-links wheels/ sbc-autoops-validator

Path 3 · container — Docker or rootless Podman, same image

docker build -t sbc-validator . # or podman build, identical
docker run --rm --network none sbc-validator demo # the air-gap claim, proven on your hardware

The audit artifact — identical from every path

Every run path writes the same single source of truth: results/<sbc>/<timestamp>.json, history-preserving. In containers, mount it out or it dies with the container:

docker run --rm --network none -v "$PWD:/work" sbc-validator \
validate /work/configs/teams.ini --out /work/results --html /work/report.html
# in CI: upload results/ as a pipeline artifact (see examples/ci/)

Path 4 · your CI/CD — the pre-deploy gate

A drop-in pipeline example ships at examples/ci/sbc-pre-deploy-gate.yml. The non-zero exit blocks a PR before a non-compliant config reaches the change window.

sbc-validator validate config.ini \
--ruleset rulesets/ms_direct_routing_2026-06.json --fail-on review

Then explore

sbc-validator validate · walk · simulate · explain · diff · fleet
sbc-validator serve --results results # this console, live on your own results

Data-flow contract: sbcvalidator.metaventionsai.com/#security · full details in docs/SECURITY.md · source: github.com/Dicoangelo/sbc-validator

Findings — every open check across the fleet

SBC	Check	Domain	Severity

Demo data. In your environment this view runs over your live results directory.

Rule Bundles — what produces the verdicts

Ruleset	ms_direct_routing · 2026-06-07 (authority-sourced)
Carries	7 required 2026 roots (incl. the DigiCert G5 pair) · TLS ≥1.2 · SIP cipher allowlist · SRTP suite · serverAuth-EKU enforcement
Integrity	Ed25519-signed · verified against a source-pinned key before use · compiled-in freshness floor refuses rollback
Channel	rules in, never configs out · 8 MB inbound cap

Live provenance (issued/verified dates, key fingerprint, domains carried) is served by sbc-validator serve at /bundle in your environment.

Sourcing and the re-sign workflow are documented in docs/RULE_AUTHORITY.md.

Reports — the post-run deliverables

Single source of truth: every run writes results/<sbc>/<timestamp>.json — history-preserving, identical schema from every run path (pip, offline wheels, Docker/Podman, CI). Every report below is a rendering of those audit-trail files.

In your environment, sbc-validator serve also renders the executive report as HTML at /report and a per-SBC report from each box's latest run at /report/sbc. CLI equivalents: validate --html · report --results results/ · fleet --out · report --compliance mifid2.

The version-stamped verdict JSON is the audit artifact for your change record.