AirGap Controller

Pointer stub. The canonical AirGap module dossier lives in ../airgap/. This directory holds only the controller’s HTTP contract; read it alongside the dossier for sealed-mode architecture.

docs/modules/airgap-controller/ contains the openapi/ source spec (v1.json) and the api-reference.mdthat is auto-generated from it. The reference covers all six declared operations of the controller’s HTTP surface:

• POST /system/airgap/seal — seal the tenant (records policy hash, time anchor, staleness budget; requires airgap:seal).
• POST /system/airgap/unseal — unseal the tenant (requires airgap:seal).
• GET /system/airgap/status — current seal state, staleness, and content-budget freshness (requires airgap:status:read).
• POST /system/airgap/verify — verify state against a supplied policy hash and replay evidence (requires airgap:status:read — see note below).
• GET /buildinfo.json and its alias GET /api/v1/buildinfo — image build provenance for drift detection.

The controller source lives under src/AirGap/StellaOps.AirGap.Controller/. It is one of four service components of the AirGap module — alongside StellaOps.AirGap.Importer, StellaOps.AirGap.Policy, and StellaOps.AirGap.Time — which build on the module’s shared libraries under src/AirGap/__Libraries/ (StellaOps.AirGap.Persistence, StellaOps.AirGap.Bundle, StellaOps.AirGap.Sync).

Scope note: POST /system/airgap/verify requires airgap:status:read, not a distinct verify scope. The AirGap.Verify policy is registered against StellaOpsScopes.AirgapStatusRead (StellaOps.AirGap.Controller/Program.cs:59-69) because verification is a read-only integrity check — it mirrors how the Attestor verify surface collapses to attest:read. The canonical catalog StellaOps.Auth.Abstractions/StellaOpsScopes.cs defines exactly three AirGap scopes (airgap:seal, airgap:import, airgap:status:read); the historical airgap:verify literal was never catalogued, was granted to no client, and no longer exists in the code.

Generator source reconciled (2026-07-12): the operation description strings in openapi/v1.json and the generated api-reference.mdare sourced from src/AirGap/StellaOps.AirGap.Controller/Translations/en-US.airgap.json. Its airgap.verify.description value previously ended “Requires airgap:verify scope”; it has now been corrected in source to airgap:status:read, so regenerating the OpenAPI/reference no longer regresses the scope string. (SPRINT_20260712_009 CLO-7.)

For sealed-mode architecture, the staleness state machine, bundle import, and time anchors, see the AirGap module dossier.