> ## Documentation Index
> Fetch the complete documentation index at: https://doc.blueapi.ir/llms.txt
> Use this file to discover all available pages before exploring further.

# Air-Gapped and Offline Security Posture

> Air-gap guarantees, physical media handling, incident containment, one-way log egress, offline HSM custody, and offline signing ceremonies for enterprise deployments.

Enterprise EMEP deployments may run in environments with no network egress. This page defines the air-gap posture, physical media protocols, containment procedures, and the offline signing ceremony that replaces automated flows.

## Air-Gap Boundary

```mermaid theme={null}
flowchart TB
    subgraph FORBIDDEN["FORBIDDEN"]
        INTERNET[Internet]
        EGRESS[Egress Traffic]
        REMOTE[Remote Admin]
    end

    subgraph ALLOWED["ALLOWED"]
        INGRESS[Ingress: Signed Media Only]
        LOGS[Log Egress: One-Way Transfer]
        PHYSICAL[Physical Admin Console]
    end

    subgraph AIRGAP["Air-Gapped Zone"]
        REG[ModelRegistry]
        MERGE[MergeEngine]
        EVAL[EvaluationEngine]
        DEP[DeploymentManager]
        HSM[Offline HSM]
    end

    INGRESS -->|Sealed Media| REG
    PHYSICAL -->|Local Console| AIRGAP
    AIRGAP -->|Data Diode / Sneakernet| LOGS
    INTERNET -.->|Blocked| AIRGAP
    EGRESS -.->|Blocked| AIRGAP
    REMOTE -.->|Blocked| AIRGAP
```

No packet from the air-gapped zone reaches the internet. All inbound data arrives on signed, sealed physical media.

## No-Egress Guarantee

Three layers enforce the no-egress guarantee:

1. Network policies: deny all egress except loopback
2. Egress firewall: physical or hypervisor-level drop rule
3. Monitoring: packet capture on the single physical interface; alert on any outbound SYN

An outbound packet triggers a P1 alert and initiates incident containment.

## Physical Media Handling

| Step    | Action                                    | Record                       |
| ------- | ----------------------------------------- | ---------------------------- |
| Receive | Verify seal integrity against custody log | Seal ID, timestamp, receiver |
| Scan    | Malware scan on isolated station          | Scan result, station ID      |
| Hash    | Compute SHA-256; compare to manifest      | Hash value, verifier         |
| Import  | Load into registry with provenance record | Registry ID, timestamp       |
| Archive | Store media in locked container           | Container ID, location       |

Chain of custody is maintained in a paper log and an append-only digital record signed by the HSM.

## Incident Containment

If a security event occurs inside the air gap:

1. Isolate affected systems by physical network disconnect
2. Preserve volatile state to offline storage
3. Review one-way log transfer for indicators
4. Conduct forensic analysis on isolated station
5. Remediate via new signed media import
6. Document incident in tamper-evident log

Remote assistance is impossible. All response is physical.

## Log Egress

Logs exit via one-way transfer only. Two supported methods:

* Data diode: unidirectional optical or electrical link
* Scheduled sneakernet: encrypted logs to write-once media, transferred on a fixed schedule

Log files are encrypted with a key held by the enterprise security operations center. The air-gapped zone never receives the decryption key.

## Offline HSM Secret Custody

Signing keys and encryption keys live in an HSM with no network interface. Key ceremonies require two operators and dual control. Key backup uses Shamir secret sharing across physical locations.

## Offline Signing Ceremony

1. Prepare artifact manifest on isolated build station
2. Export manifest to tamper-evident media
3. Transfer to signing room with dual-operator escort
4. Sign with offline HSM; HSM logs the operation
5. Transfer signature back to build station on separate media
6. Verify signature against manifest before release
7. Archive all media and logs

## Cross-Links

* [Artifact Signing](/security/artifact-signing)
* [Security Requirements](/security/security-requirements)
* [Dependency Safety](/security/dependency-safety)