Console builds a signed bundle: release artifacts, vuln DB, config plans, queued notifications. Contents manifest approved before it leaves.
Media or data diode — the transport is untrusted by design. Nothing about the bundle depends on how it travels.
Site verifies the signature offline against its trust root, checks the sequence number, then applies through the same plan-and-approve gates.
Site builds its own signed state bundle: inventory, health snapshots, operation journals, queued notifications.
Signature + sequence verified; fleet views update with the site's as-of timestamp. Stale is visible, never silent.
#47 signature ✓ sequence ✓exp-0.1.88-patch4 · import receipt confirmed in bundle #47#48 — an older or replayed bundle is refused, loudly#52 signature ✓ sequence ✓exp-vulndb-0805 · receipt pending next import| When | Direction | Site | Bundle | Verification |
|---|---|---|---|---|
| 1d ago | import | atlas | #52 · sha256:91ce…4b02 | sig ✓ seq ✓ |
| 1d ago | export | atlas | exp-vulndb-0805 | manifest approved · sofia.k |
| 3d ago | import | cobalt | #47 · sha256:7ba1…e990 | sig ✓ seq ✓ |
| 8d ago | import refused | cobalt | #45 (replay) | sequence 45 < 46 — rejected, audited #498 |
| 9d ago | export | cobalt | exp-0.1.88-patch4 | receipt in #47 |
Select the bundle file from media. Verification runs before anything merges:
1 SIGNATURE cosign verify against site key (offline trust root) 2 SEQUENCE must be exactly current + 1 — replay and gaps refused 3 MANIFEST contents listed and digest-checked before merge 4 MERGE inventory · health · journals · notifications 5 AUDIT import recorded with digests; fleet as-of updated