AirGap (sealed and offline operation)
Verified against commit
942a18727c(2026-09-26). Re-verify with:find src -type d -name 'StellaOps.AirGap*' -not -path '*__Obsoleted*' -not -path '*/bin/*' -not -path '*/obj/*'andgrep -rn 'MapGroup("/system/airgap' src --include=*.cs | grep -v __Obsoleted.src/is the source of truth; where this page and the code disagree, the code wins.
AirGap is no longer a service. There is no src/AirGap/ tree and no AirGap host: the airgap-controller and airgap-time deployables were withdrawn (source frozen at src/__Obsoleted/AirGap/), and the exchange libraries moved into the OfflineKit family. This directory is the dossier for the concepts of sealed and offline operation that the code still implements, and it names the service or library that implements each one.
Who owns what
| Concern | Owner | Where |
|---|---|---|
| Sealed posture and time-anchor custody | Platform | platform.environment_state, state classes airgap-seal and time-anchor; PUT/GET /api/v1/platform/environment-state/{stateClass}/{scope} (src/Platform/StellaOps.Platform.WebService/Endpoints/EnvironmentStateEndpoints.cs) |
| Posture interpretation and egress policy | shared library, domain-neutral | src/__Libraries/StellaOps.AirGap.Policy (IEgressPolicy, Posture/, Time/), …AirGap.Policy.Replication (local posture replica), …AirGap.Policy.Analyzers |
| Carrier envelope, trust profiles, trust-snapshot import | OfflineKit | src/OfflineKit/__Libraries/StellaOps.AirGap.Bundle |
| Client-side pre-import verification, quarantine, evidence reconciliation | OfflineKit (consumed by the CLI) | src/OfflineKit/__Libraries/StellaOps.AirGap.Importer |
| RFC3161 time-token verification | OfflineKit | src/OfflineKit/__Libraries/StellaOps.AirGap.Time.Verification |
| Verified carrier import (the sanctioned ingress of a sealed estate) | OfflineKit | POST /api/offlinekit/v1/import on offlinekit-web; see OfflineKit |
Sealed-mode enforcement face (/system/airgap/*) | Policy Engine | src/Policy/StellaOps.Policy.Engine/Endpoints/{SealedModeEndpoints,StalenessEndpoints,AirGapNotificationEndpoints}.cs |
Platform validates who may declare a document; it never interprets one. Consumers replicate the environment_state catalog into their own database and read posture locally, so a down Platform never blocks a posture read. Hosts that compose the replica at this commit: Platform, Policy Engine, Notify worker, OfflineKit web, Authority, Signals and the Vulnerabilities worker (grep AddAirGapPostureReplica / PostureReplication).
Operating a sealed estate
| Step | Command or surface |
|---|---|
| Declare sealed / unsealed | stella airgap seal / stella airgap unseal (write the airgap-seal document; scope defaults to installation) |
| Read posture | stella airgap status; GET /api/v1/platform/environment-state/airgap-seal/{scope} |
| Declare trusted time | stella airgap time-anchor declare --token <rfc3161> --trust-roots <pem>: verifies the token locally, then declares the time-anchor document |
| Inspect trusted time | stella airgap time-anchor status [--trust-roots <pem>] |
| Bring content in | stella airgap pull --run <id> on the producing estate, then stella airgap import on the sealed one; runbook ../../runbooks/airgap/offlinekit-import.md |
| Compare two envelopes | stella airgap diff |
| Verify egress is blocked | guides/sealing-and-egress.md |
Scopes (src/Authority/StellaOps.Authority/StellaOps.Auth.Abstractions/StellaOpsScopes.cs): envstate:read, envstate:airgap-seal:write, envstate:time-anchor:write; the legacy airgap:status:read and airgap:seal grants are accepted as aliases for the read and seal-write policies. airgap:import gates the OfflineKit import.
Documents in this directory
architecture.md: the posture model, the time anchor, staleness, the import posture gate and the surviving libraries.guides/airgap-mode.md: supported scope and activation order.guides/staleness-and-time.md: time anchors and staleness budgets.guides/sealing-and-egress.md: egress verification tooling.guides/importer.md: where offline content enters.guides/degradation-matrix.md: planning guidance per connectivity mode.guides/risk-bundles.md,guides/symbol-bundles.md,guides/proof-chain-verification.md,guides/promotion-rekor-tile-verification.md: domain workflows in sealed mode (paths re-checked, procedures not re-verified).evidence-reconciliation.md: the Importer’s reconciliation algorithm.runbooks/: offline-kit verification scripts, AV scanning, CLI quarantine.schemas/andsamples/: the offline-kit manifest, AV report and receipt formats consumed bysrc/OfflineKit/scripts/verify-kit.sh.
Withdrawn material (the controller and time host contracts, the knowledge-snapshot dialect, the HLC job-sync bundles, planning records and guides built on commands that do not exist) is frozen under docs-archive/modules/airgap/ and docs-archive/modules/airgap-controller/.
Related
- OfflineKit (the offline-exchange service) and
../../OFFLINE_KIT.md(operator guide). - Platform (environment-state custodian).
- Mirror (mirror-seed and bundle formats).
- Standalone evidence verifier:
src/Tools/StellaOps.Verifier(binarystella-verifier).