Airgap Operations (DOCS-AIRGAP-57-004)

Audience: operators running Stella Ops in sealed or constrained air-gap modes.

Day-two runbooks for bundle imports, failure recovery, and auditing. For mode definitions and the end-to-end lifecycle, start with the Airgap Overview.

Imports

1. Verify bundle hash/DSSE (see Mirror Bundles).
2. stella airgap import --bundle ... --generation N --dry-run (optional).
3. Apply network policy: ensure sealed/constrained mode set correctly.
4. Import with stella airgap import ... and watch logs.
5. Confirm timeline event emitted (bundleId, mirrorGeneration, actor).

Failure recovery

• Hash/signature mismatch: reject bundle; re-request export; log incident.
• Partial import: rerun with --force after cleaning registry/cache; keep previous generation for rollback.
• Staleness breach: if imports unavailable, raise amber alert; if >72h, go red and halt new ingest until refreshed.
• Time anchor expired: apply new anchor from trusted media before continuing operations.

Auditing

• Record every import in audit log: {tenant, mirrorGeneration, manifestHash, actor, sealed}.
• Preserve manifests and hashes for at least two generations.
• Periodically (daily) run stella airgap list --format json and archive output.
• Ensure logs are immutable (append-only) in sealed environments.

Observability

• Monitor counters for denied egress, import success/failure, and staleness alerts.
• Expose /obs/airgap/status (if available) to scrape bundle freshness.

Checklist (per import)

• [ ] Hash/DSSE verified
• [ ] Sealed/constrained mode configured
• [ ] Registry/cache reachable
• [ ] Import succeeded
• [ ] Timeline/audit recorded
• [ ] Staleness dashboard updated

Related docs

• Airgap Overview — modes, lifecycle, and responsibilities.
• Mirror Bundles — bundle hashing and DSSE verification.
• Staleness and Time — time anchors and staleness thresholds.
• Sealing and Egress — deny-all egress posture.