Air-Gapped Audit Bundle Exchange
Designed to carry portable, self-contained evidence bundles into environments where network connectivity is unavailable, restricted, or untrusted. Cryptographic verification runs entirely locally, with no external dependencies.
A design blueprint, not a shipped product. Offline bundle verification ships (aga-verify, and verify.mjs in the sample bundle); the transfer workflow, the manifest and the ZIP export on this page are not implemented in the published packages. Design record dated 2026-01-05.
Target System
Disconnected, Denied, Intermittent, or Limited (DDIL) environments including classified networks, forward-deployed military systems, critical infrastructure with network isolation, and regulated environments requiring air-gapped audit trails.
Threat Model
- Tampered evidence during network transit
- Unauthorized modification of audit records
- Receipts replayed from another chain (they fail; an earlier genuine export presented as the current one still verifies, because the verifier has no freshness input)
- Verifier substitution attacks
- Chain discontinuity exploitation
Integration Points
- Bundle Export
- Designed to export evidence bundles as deterministic ZIP archives
- Offline Verifier
- aga-verify on the extracted evidence-bundle.json → VERIFIED or FAILED
- Manifest Validation
- Designed to carry SHA-256 checksums for all artifacts
- Signature Verification
- Ed25519 over canonical bytes
Artifacts Produced
Offline Verification Workflow
- 1
Transfer bundle to air-gapped system
USB, optical media, or secure file transfer
- 2
Verify bundle checksums
SHA-256 manifest validation
- 3
Run offline verifier
aga-verify evidence-bundle.json --pubkey <key>
- 4
Record deterministic verdict
VERIFIED or FAILED, with provenance when the key is pinned
Outcomes
- Designed to enable incident reconstruction from a hash-chained, tamper-evident decision record
- Designed to enable third-party audit without network access
- Designed to provide cryptographic proof of integrity for audits
- Designed to detect transit tampering when verified against a public key obtained out of band
Sample bundle
The same representative sample bundle offered site-wide: four Ed25519-signed receipts, Merkle proofs, a signed checkpoint, and an offline verifier. There is no air-gapped-specific variant; verification itself runs fully offline.