OfflineOperations defines the rules and procedures for running EMEP in an air-gapped environment. This page specifies the no-egress policy, signed bundle ingestion, dataset transfer, monitoring constraints, and the list of forbidden operations.
No Egress Policy
Air-gapped environments permit no outbound network connections. All data entering the environment must pass through a controlled one-way transfer mechanism. Model weights, inference outputs, training checkpoints, and experiment metadata must never leave the air-gap.
Signed Bundle Ingestion
All incoming bundles are verified before import.
- Signature validation against the pre-installed public key
- Manifest hash verification for every file
- Dependency bundle completeness check
- SBOM audit against the approved dependency list
Bundles that fail any check are quarantined and flagged for security review.
Dataset Transfer
Datasets enter the air-gap as signed, read-only bundles. The bundle contains:
- Dataset files with per-file hashes
- License and provenance metadata
- Processing script references from DatasetRegistry
- Usage restrictions if applicable
Datasets are imported into DatasetRegistry and tagged as OFFLINE. They cannot be modified after import.
Log Egress via One-Way Transfer
System logs and aggregated metrics may exit the air-gap through a one-way transfer mechanism. The transfer is unidirectional and physically enforced. Logs are sanitized to remove model weights, inference content, and user prompts before transfer.
Monitoring in Air-Gap
Monitoring runs entirely inside the air-gap. Observability collects metrics from InferenceBackend, GPU Health, and Monitoring. Alerting is internal only. External paging integration is not available in air-gapped mode.
Runbook Flowchart
The flowchart below shows the standard operational runbook for an air-gapped deployment.
Forbidden Operations
The following operations are prohibited in all air-gapped environments:
- Outbound network connections from any host
- USB or removable media write operations except by authorized transfer station
- Unverified code execution outside the signed bundle manifest
- Model weight export in any format
- Inference output storage on transferable media
- Remote shell or tunneling tools
- Automatic update checks to external repositories
Violation of any forbidden operation triggers an immediate security lockdown and incident response. The lockdown isolates the affected host and preserves forensic state.
Integration
OfflineOperations is enforced by Security Requirements and Offline Security. Model updates follow Model Update Protocol. Rollbacks follow Model Rollback.