Airgap Overview
Audience: teams planning or operating a sealed Stella Ops deployment.
This page orients you before you dive into the per-component runbooks. It summarises the air-gap modes, the bundle lifecycle, and the governance responsibilities for sealed deployments.
Modes
- Sealed: deny-all egress; only preloaded bundles (mirror + bootstrap) allowed. Requires exported time anchors and offline trust roots.
- Constrained: limited egress to allowlisted registries and NTP; mirror bundles still preferred.
- Connected: full egress for staging; must remain policy-compatible with sealed mode.
Lifecycle
- Prepare bundles: export mirror + bootstrap packs (images/charts, SBOMs, DSSE metadata) signed and hashed.
- Stage & verify: load bundles into the offline store, verify hashes/DSSE, record mirrorGeneration.
- Activate: flip sealed toggle; enforce deny-all egress and policy banners; register bundles with Excititor/Export Center.
- Operate: run periodic staleness checks, apply time anchors, and audit imports via timeline events.
- Refresh/rollback: import next mirrorGeneration or roll back using previous manifest + hashes.
Responsibilities
- AirGap Controller Guild: owns network posture (deny-all, allowlists), sealed-mode policy banners, and change control.
- Export Center / Evidence Locker Guilds: produce and verify bundle manifests, DSSE envelopes, and Merkle roots.
- Module owners (Excititor, Concelier, etc.): honor sealed-mode toggles, emit staleness headers, and refuse unsigned/unknown bundles.
- Ops/Signals Guild: maintain time anchors and observability sinks compatible with sealed deployments.
Rule banner (sealed mode)
Display a top-of-console banner when sealed=true:
- “Sealed mode: no external egress. Only registered bundles permitted. Imports logged; violations trigger audit.”
- Include the current
mirrorGeneration, bundle manifest hash, and time-anchor status.
Related docs
- Airgap Mode — deeper policy shapes per mode.
- Bundle Repositories — mirror/bootstrap bundle structure.
- Staleness and Time — time anchors and staleness checks.
- Controller / Importer — controller + importer references.
- Airgap Operations — day-two import, recovery, and audit runbooks.