Plan AI for a disconnected environment.

What air-gapped means for an AI stack

Ordinary AI products assume the network: they download models on demand, refresh licences, check for updates, resolve identity against a hosted provider, and send telemetry. Each of those is a dependency that either has an internal equivalent or must be removed. The work of an air-gapped deployment is enumerating those dependencies honestly and deciding, one by one, which is which.

Bring dependencies in deliberately

Everything crosses the boundary through your organisation’s approved transfer process, and everything is verified after it crosses. The list below is the minimum supply chain for Glyph Private plus enrolled desktops.

• Desktop installers with SHA-256 checksums from the download page; verify inside the boundary, not on the transfer workstation.
• Server container images with their digests, and the exact database version you will run.
• Model artifacts (GGUF, MLX, or the backend’s native format) with checksums, plus vision projector files where used, and a record of the source repository and licence.
• The offline Ed25519-signed licence file and the deployment identifier it is bound to.
• Certificates and trust roots for your internal PKI, and the identity provider metadata.
• Documentation and runbooks, because the online docs will not be reachable.
• Rollback copies of the previous versions of all of the above.

What the air-gap flag does and does not do

Setting GLYPH_PRIVATE_AIR_GAPPED on the server blocks vendor and cloud model egress, Hugging Face search and downloads, queued external downloads, and the Fortaify heartbeat; those paths are covered by forced-failure tests. The flag deliberately does not override operator configuration: an OIDC issuer, a Splunk HEC endpoint, or a cloud model base URL you have set remain reachable if the network allows it. For strict zero egress, leave those unset and confirm at the firewall that no path exists. The Trust Center states this behaviour so reviews are not working from an assumption.

Replace the online assumptions

Each of these normally comes from the internet. In an air-gapped environment, each needs an internal service or an explicit decision to do without.

Prove the recovery path

Qualification is a set of drills run inside the boundary, with results recorded: fresh installation from transferred media; sign-in against the internal identity provider; inference through the gateway; policy delivery to an enrolled desktop; backup and restore of the database and licence; an expired certificate; a failed upgrade and its rollback; and a licence expiry, to confirm the deployment degrades to read-only administration rather than failing outright. If a drill has not been run in this environment, the capability is not yet qualified.

Operating rhythm after go-live

Plan the cadence for model refreshes, server and desktop updates, certificate renewals, and licence renewal, each with an owner and a transfer window. Keep the previous version of every artifact until the new one has survived a full cycle. Most air-gapped failures are calendar failures — an expired certificate or licence on a system nobody had to touch for a year — and the fix is a calendar, not a feature.