Air-Gap Degradation Matrix
Audience: operators and architects planning Stella Ops deployments that move between connected, constrained, and sealed (air-gapped) network postures.
This matrix is planning guidance: which capabilities work, degrade, or are unavailable across the three connectivity modes, and how to substitute offline equivalents. It is not a capability measurement against src/; verify any row you depend on. For the activation flow and supported scope of sealed mode, see the Air-Gap Mode Guide; for the posture model, see ../architecture.md.
Legend: yes = available, no = unavailable, a qualifier in parentheses = available with conditions.
| Capability | Connected | Constrained | Sealed | Notes |
|---|---|---|---|---|
Carrier imports (stella airgap import) | yes | yes | yes | Sealed imports require a declared, in-budget time anchor. |
| Time anchors (external NTP) | yes | yes (allowlisted) | no | Sealed relies on a declared RFC3161 time anchor. |
| Transparency log lookups | yes | yes (if allowlisted) | no | Sealed skips; rely on bundled checkpoints. |
| Rekor witness | yes | optional | no | Disabled in sealed; log locally. |
| SBOM feed refresh | yes | yes (limited mirrors) | yes (offline only) | Use mirror bundles. |
| CLI plugin downloads | yes | yes (allowlisted) | no | Must ship with the release or Offline Kit. |
| Telemetry export | yes | optional | optional (log-only) | Sealed may use the console exporter only. |
| Webhook callbacks | yes | yes (allowlisted, internal only) | no | Use the internal queue instead. |
| OTA updates | yes | partial | no | Refresh through a new release bundle and carriers. |
Remediation guidance
- If a capability is degraded in sealed mode, provide an offline substitute: OfflineKit carriers (Importer), a declared time anchor (Staleness and Time), or a local telemetry sink.
- When moving from sealed toward constrained or connected, re-enable trust roots and transparency checks gradually, and verify hashes before trusting any newly reachable source.
See also
- Air-Gap Mode Guide: supported scope and activation order.
- Importer: offline content through OfflineKit carriers.
- Staleness and Time: time anchors and staleness budgets.