NetOps Copilot

NetOps Copilot validates BGP/OSPF configuration changes in a Batfish-based digital twin before they are applied to a production ISP backbone. A proposed change is simulated against the current network snapshot; the verdict — ALLOW, REVIEW, or BLOCK — is decided by fixed rules over Batfish evidence only (lost routes, broken flows, new announcements). The Meta Model API (Muse Spark 1.3) never decides the verdict: it only explains the evidence in plain language and proposes a next step, which must be re-simulated before it can be trusted. The demo covers 11 scenarios: 3 on a 5-node simple lab (OSPF cost shift, peer prefix block, new customer prefix) and 8 on a 13-node, two-region advanced lab (link failure, BGP session down, LOCAL_PREF exit shift, prefix hijack, route-reflector failure, DDoS blackhole /32, RPKI invalid origin, AS_PATH prepend). Every scenario gives identical verdicts on Cisco IOS, Arista EOS, and Juniper Junos lab variants. It runs live in GitHub Codespaces — open the repo, create a codespace, and use the web UI on port 8000 with Batfish started automatically — with a recorded-replay mode as fallback, plus an MCP server (list_scenarios, validate_change, get_policy). 47 automated tests pass. All topologies, prefixes, and AS numbers are fictional (RFC 5737 documentation ranges). Built by a network engineer who operates a large ISP backbone (AS9848 / AS4670) and reviews risky changes daily: a wrong BGP policy propagates in seconds, while today's pre-checks are still manual and slow.