How Model Updates Reach an Air-Gapped Network

The integrator on the state-police-adjacent project — civilian records, not a classified mission — had sold an air-gap and then discovered the model needed a tokenizer fix. There was no promotion path. An engineer carried a laptop into the hall, dual-homed it for twenty minutes, and left. The hall was no longer air-gapped. The change ticket said emergency hygiene.

Air-gaps fail in two opposite ways. They fossilise, so people cheat. Or they grow a convenient live path, so they were never gaps. The adult design is a boring pipeline: build and scan on a connected estate, sign, carry, verify, evaluate, promote, record.

This guide is for the SI who has to make that pipeline real inside an Indian SDC or a PSU hall, and for the departmental owner who has to refuse the dual-homed laptop.

The promotion path

1. Connected build estate: pull the checkpoint or container from a known registry onto a machine that never sees production data.
2. Scan: malware, unexpected outbound calls in the image, licence check, SBOM if you produce one.
3. Sign: department or SI key, not a random engineer GPG setup from 2019. Record the hash.
4. Pack: a bundle that includes model, tokenizer, small config, and a manifest. No extra utilities.
5. Carry: new or verified media through a guard process. Some estates use a diode; some use a transfer room.
6. Verify on the dark side: signature and hash before the bundle is allowed near the serving VLAN.
7. Evaluate: run the frozen eval set. Do not promote on a vibe or a vendor release note.
8. Promote or reject: canary a single node if you can; keep the previous artefact bootable.
9. Record: who carried, who verified, who approved, which hash is now live.

Nine steps look heavy. They are lighter than an incident and lighter than a six-month freeze that ends in a laptop.

If outward content exists, you built a leak and called it telemetry.

Hop	What may travel	What may never travel
Inward (connected to dark)	Signed artefacts, configs without secrets, eval questions that are not live personal data	Engineer laptops as the media; unsigned wheels from the internet
Outward (dark to connected)	Aggregated metrics without content; hashed incident notes if the file allows	Prompts, traces, datasets, crash dumps with request bodies

Keys, media and people

The signature is the control. If anyone can sign, the pipeline is a ritual. Keep the promotion key in an HSM or at least in a two-person procedure. Rotate it. Do not store it on the laptop that builds the bundle.

Media is the other control. Use known sticks or approved transfer appliances. Scan them on the way in and treat them as dirty on the way out. Do not reuse an officer’s personal drive because the approved stick is in a drawer.

People are the third. The person who builds should not be the only person who promotes. The person who carries should sign a register. This will feel like a 1990s tape library. That is a compliment.

What a bundle is allowed to contain

SIs pad bundles. A helpful script, a diagnostic binary, a second tokenizer just in case, a copy of last month’s eval that still has live names. The dark-side verify step should fail a bundle that is not on the manifest allow-list. If the manifest says four files, a fifth file is an incident, not a convenience.

Configs that travel inward must not carry secrets from the connected estate and must not reset the dark estate’s deny-by-default flags. Review the diff. A values.yaml that re-enables an exporter is how last quarter’s air-gap becomes this quarter’s collector.

Outward artefacts, if any, should be numbers. Queue depth, error counts, eval scores. If a person wants a crash dump to leave, they file a ticket, scrub it, and carry it as an exception with two signatures. Standing outward sync of logs is a WAN with extra steps.

Objections

This is too slow for security patches. Keep an emergency lane with the same signatures and a shorter eval, plus a mandatory retrospective. Skipping signatures because CVE is not speed. It is how the CVE becomes the cover story for a bad file.

The vendor must be able to hot-patch. Then the vendor is on the wrong side of the gap. They can deliver a bundle to staging the same day. Your people still promote.

We will use a connected jump box only for updates. A jump box that can see both worlds is a path. Call it what it is and decide whether you still have an air-gap.

Rollback is part of the update

A promotion that cannot be undone is not a promotion. It is a one-way bet. Keep the previous signed artefact on the dark registry. Practise booting it. Time the rollback. If rollback needs the vendor, you built a dependency that the air-gap was supposed to remove.

Eval failures should default to reject, not to a meeting. Meetings are how a slightly worse model that fixes a demo bug gets forced through. The owner may override, in writing, with a reason. The file should show more rejects than overrides. If it does not, the gate is decorative.

Document what happens when a bundle is half-applied — one node on the new hash, one on the old. Either you can live with mixed versions for an hour, or you drain the node first. Guessing during an exam window is how SIs become famous for the wrong reasons.

A 60-day pipeline build

• Days 1–15: draw the two estates. Ban dual-homed devices in the drawing.
• Days 16–35: implement sign, carry, verify with a dummy artefact.
• Days 36–50: add the eval gate and the rollback boot.
• Days 51–60: run one real promotion and one rejected promotion. File both.

What goes in the file

The path diagram, the key procedure, the media register, the live hash, the last eval report, and the names of the two people who must agree to promote. If an emergency lane exists, its retrospective template lives in the same file.

If Prcept AI delivers an artefact to an air-gapped estate, it should arrive as a signed bundle you promote. We should not need a laptop in the hall.

How to prove this on a rack, not on a slide

“How Model Updates Reach an Air-Gapped Network” only matters if a CISO can fail it. A P4 System Integrator should be able to point at a cable, a registry, a licence file, a PDU reading or a SIEM index and say: this is the control. If the only evidence is a brochure that mentions “air-gapped model updates”, you do not have the control.

An air-gap without an update path is a museum. Build a signed, one-way promotion of artefacts, or the gap will be broken by a helpful engineer. Air-gap and on-prem programmes die in the second month, when the first update, the first crash, or the first GPU lead-time slip arrives. Budget the boring path — media, offline licence, local registry, local traces — in the same note as the model name.

On-prem is not air-gapped. An India region is not either. Write the forbidden path (outbound HTTPS, licence phone-home, crash reporter, hidden model API) as a numbered list and test it with the internet off. Whatever still dies was a dependency you did not draw.

1. Draw the data path for one user-visible answer under “air-gapped model updates”.
2. Disable outbound internet on staging and run the demo script.
3. List every remaining hop: update, licence, registry, NTP, DNS, SIEM.
4. Give each hop an owner inside the department, not only the SI.
5. Minute the restore or the media-transfer once before go-live.

Close this loop before the next CAB

Put “How Model Updates Reach an Air-Gapped Network” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P4 System Integrator, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “air-gapped model updates” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What the next noting must contain

“How Model Updates Reach an Air-Gapped Network” belongs in a file, not only in a search result. A P4 System Integrator should be able to point at one artefact that proves “air-gapped model updates”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

An air-gap without an update path is a museum. Build a signed, one-way promotion of artefacts, or the gap will be broken by a helpful engineer. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C2 Air-Gapped & On-Prem: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “air-gapped model updates”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.