CLI Air-Gap Guide

Audience: operators running the Stella Ops CLI in offline or air-gapped (sealed-mode) environments.

This guide covers the offline usage patterns for the Stella Ops CLI: importing and verifying offline kits and mirror bundles, checking sealed-mode status, and the determinism rules every command must obey when no network egress is permitted. For the platform-level policy behind these commands, see the air-gap overview and sealing and egress.

Offline kit commands

Import an offline kit (local verification + activation)

stella offline import \
  --bundle ./bundle-2025-12-14.tar.zst \
  --verify-dsse \
  --verify-rekor \
  --trust-root /evidence/keys/roots/stella-root.pub

Check current offline kit status
```
stella offline status --output table
```

Prerequisites

CLI installed from offline bundle; local-nugets/ and cached plugins available.
Mirror/Bootstrap bundles staged locally; no external network required.
Set STELLA_OFFLINE=true to prevent outbound fetches.

Common commands

Validate mirror bundle

stella airgap verify-bundle /mnt/media/mirror.tar \
  --manifest /mnt/media/manifest.json \
  --trust-root /opt/stella/trust/mirror-root.pem

Import bundle into local registry
```
stella airgap import --bundle /mnt/media/mirror.tar --generation 12
```
Imported mirror-bundle metadata is written durably under %LocalApplicationData%/stellaops/offline-kit/state/mirror-bundles, so the import history survives fresh CLI processes instead of relying on process-local memory.
Check sealed mode status
```
stella airgap status
```
List bundles and staleness
```
stella airgap list --format table
```

Determinism & offline rules

Commands must succeed without egress; any outbound attempt is a bug — report it with logs.
Hashes and signatures are verified locally using bundled trust roots; no OCSP/CRL.
Outputs are stable JSON/NDJSON; timestamps use UTC.
Mirror-bundle import metadata is persisted locally with deterministic ordinal ordering for content paths and bundle items.

Exit codes

0 success
2 validation failed (hash/signature mismatch)
3 sealed-mode violation (unexpected egress attempted)
4 input/argument error
>4 unexpected error (inspect logs)

Logs

Default stderr structured JSON: includes tenant, bundleId, mirrorGeneration, sealed flag.
For audits, use --log-file /var/log/stella/airgap.log --log-format json.

Tips

Keep bundles on read-only media to avoid hash drift.
Use --dry-run to validate without writing to registries.