AirGap Controller

Pointer stub for a RETIRED host. The canonical AirGap module dossier lives in ../airgap/. This directory holds only the controller’s HTTP contract; read it alongside the dossier for sealed-mode architecture.

The airgap-controller deployable retired 2026-09-11 (SPRINT_20260722_025 OK-5, ADR-039 Rev-8/EVL-3) and is frozen at src/__Obsoleted/AirGap/StellaOps.AirGap.Controller/. The contract below is kept because the paths still resolve: a live probe on 2026-09-14 of GET /system/airgap/status returns 401 with an error body naming "service":"policy-engine". Read the operations as the contract, not as a statement about which container answers them — and note that sealed-posture CUSTODY moved to Platform’s platform.environment_state (/api/v1/platform/environment-state/{stateClass}/{scope}), so the seal/unseal semantics below describe the enforcement face only.

docs/modules/airgap-controller/ contains the openapi/ source spec (v1.json) and the api-reference.mdthat is auto-generated from it. The reference covers all six declared operations of the controller’s HTTP surface:

• POST /system/airgap/seal — seal the tenant (records policy hash, time anchor, staleness budget; requires airgap:seal).
• POST /system/airgap/unseal — unseal the tenant (requires airgap:seal).
• GET /system/airgap/status — current seal state, staleness, and content-budget freshness (requires airgap:status:read).
• POST /system/airgap/verify — verify state against a supplied policy hash and replay evidence (requires airgap:status:read — see note below).
• GET /buildinfo.json and its alias GET /api/v1/buildinfo — image build provenance for drift detection.

Where the source is now (measured at HEAD, 2026-09-14). The controller is frozen at src/__Obsoleted/AirGap/StellaOps.AirGap.Controller/, and so are StellaOps.AirGap.Time and the module’s StellaOps.AirGap.Persistence library. What survives under src/AirGap/ is StellaOps.AirGap.Importer, StellaOps.AirGap.Policy (a domain-neutral posture SDK consumed estate-wide) and __Libraries/{StellaOps.AirGap.Bundle, StellaOps.AirGap.Sync} (the AirGap root itself retired at 025 OK-14 into src/OfflineKit/, and StellaOps.AirGap.Sync was withdrawn 2026-09-14 (SPRINT_20260914_002 EA-8 on D-EA4-1) to src/__Obsoleted/OfflineKit/__Libraries/); StellaOps.AirGap.Time.Verification relocated to src/OfflineKit/__Libraries/. None of the surviving src/AirGap/ projects is currently in any deployable’s build closure — airgap-controller appears zero times in docs/architecture/build-boundary/build-boundary-report.json, which is the measurement behind SPRINT_20260722_025’s open note that the DC-18 bundle contract is un-owned since the OK-10 window landed without relocating AirGap.Bundle.

Scope note: POST /system/airgap/verify requires airgap:status:read, not a distinct verify scope. The AirGap.Verify policy is registered against StellaOpsScopes.AirgapStatusRead (StellaOps.AirGap.Controller/Program.cs:59-69) because verification is a read-only integrity check — it mirrors how the Attestor verify surface collapses to attest:read. The canonical catalog StellaOps.Auth.Abstractions/StellaOpsScopes.cs defines exactly three AirGap scopes (airgap:seal, airgap:import, airgap:status:read); the historical airgap:verify literal was never catalogued, was granted to no client, and no longer exists in the code.

Generator source reconciled (2026-07-12): the operation description strings in openapi/v1.json and the generated api-reference.mdare sourced from src/AirGap/StellaOps.AirGap.Controller/Translations/en-US.airgap.json. Its airgap.verify.description value previously ended “Requires airgap:verify scope”; it has now been corrected in source to airgap:status:read, so regenerating the OpenAPI/reference no longer regresses the scope string. (SPRINT_20260712_009 CLO-7.)

For sealed-mode architecture, the staleness state machine, bundle import, and time anchors, see the AirGap module dossier.