Air-Gap Importer Guide

Audience: operators bringing offline content into a sealed Stella Ops installation.

Verified against commit 942a18727c (2026-09-26).

There is no separate importer service. Offline content enters a Stella Ops estate through one path: a signed OfflineKit carrier submitted to offlinekit-web (POST /api/offlinekit/v1/import, scope airgap:import). The service verifies both DSSE envelopes against the operator-mounted trust key, applies the sealed-freshness posture gate, takes custody in its content-addressed store and hands each declared part to the service that owns it (Scanner, Vulnerabilities). A part no owner claims is recorded but not activated.

Import flow

  1. On the producing estate, download a completed export run’s carrier: stella airgap pull --run <runId> [--output <dir>].
  2. Move the carrier across the air gap on approved media.
  3. Optionally pre-check it on the client: stella offline import --verify-dsse / --verify-rekor (client-side checks that admit nothing).
  4. Import: stella airgap import --bundle <offline-kit.tar.gz> [--manifest ...] [--bundle-signature ...] [--manifest-signature ...].
  5. Read the result: GET /api/offlinekit/v1/status (scope airgap:status:read) reports the carrier and each part’s activation state.

Operator runbook, exit codes and the posture gate: ../../../runbooks/airgap/offlinekit-import.md. Service internals: ../../offlinekit/architecture.md§5.

Client-side library

src/OfflineKit/__Libraries/StellaOps.AirGap.Importer holds the verifiers the CLI runs before an import (DsseVerifier, RekorOfflineReceiptVerifier), the file-based version monotonicity checker, the CLI quarantine (../runbooks/quarantine-investigation.md) and evidence reconciliation (../evidence-reconciliation.md).

Unsupported legacy paths

Kubernetes init-container, sidecar and volume instructions are retired. The knowledge-snapshot bundle importer and the export-archive validators were withdrawn on 2026-09-14 and are frozen under src/__Obsoleted/OfflineKit/__Libraries/.