{
  "format": "agent-article-v0",
  "article_id": "EA-090",
  "canonical_url": "/tools/ea-090-air-gapped-ai",
  "page_type": "reference",
  "claim_ids": [],
  "evidence_ids": [
    "EVD-EA-090-URL-57C3247CCB94",
    "EVD-EA-090-URL-272149FACE44",
    "EVD-EA-090-URL-A18F0A72C8B7",
    "EVD-EA-090-URL-7591E2070CAB",
    "EVD-EA-090-URL-6B878F018210",
    "EVD-EA-090-URL-98C9ED2E4EC6",
    "EA-090-R11-RESEARCH",
    "EA-090-R11-WEB-READBACK"
  ],
  "unknown_ids": [
    "EA-090-UNKNOWN-01",
    "EA-090-UNKNOWN-CURRENTNESS"
  ],
  "operational_object_ids": [],
  "provider": [],
  "models": [],
  "plans": [],
  "surfaces": [],
  "regions": [],
  "current_status": "UNKNOWN",
  "observation_status": "SPEC_ONLY",
  "freshness": "UNKNOWN",
  "last_verified": null,
  "supersedes": [],
  "superseded_by": [],
  "provenance": [
    "COMM-081-EA0090",
    "SRC-EA-090-URL-57C3247CCB94",
    "SRC-EA-090-URL-272149FACE44",
    "SRC-EA-090-URL-A18F0A72C8B7",
    "SRC-EA-090-URL-7591E2070CAB",
    "SRC-EA-090-URL-6B878F018210",
    "SRC-EA-090-URL-98C9ED2E4EC6",
    "WEBBODY-EA0090-R8-15357FAD"
  ],
  "article_sources": [
    {
      "id": "EVD-EA-090-URL-57C3247CCB94",
      "evidence_class": "RESEARCH",
      "title": "author/org: Red Hat",
      "href": "https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/observability/disconnected_environments/index",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-090-URL-57C3247CCB94"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URL: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/observability/disconnected_environments/index"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-090-URL-272149FACE44",
      "evidence_class": "RESEARCH",
      "title": "author/org: Hugging Face",
      "href": "https://huggingface.co/docs/transformers/main/installation",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-090-URL-272149FACE44"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URL: https://huggingface.co/docs/transformers/main/installation"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-090-URL-A18F0A72C8B7",
      "evidence_class": "RESEARCH",
      "title": "author/org: NIST",
      "href": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/800-171r3/NIST.SP.800-171r3.html",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-090-URL-A18F0A72C8B7"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URL: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/800-171r3/NIST.SP.800-171r3.html"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-090-URL-7591E2070CAB",
      "evidence_class": "RESEARCH",
      "title": "author/org: NIST NCCoE",
      "href": "https://csrc.nist.gov/pubs/sp/1334/final",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-090-URL-7591E2070CAB"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URL: https://csrc.nist.gov/pubs/sp/1334/final"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-090-URL-6B878F018210",
      "evidence_class": "RESEARCH",
      "title": "author/org: NIST",
      "href": "https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-090-URL-6B878F018210"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URL: https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EVD-EA-090-URL-98C9ED2E4EC6",
      "evidence_class": "RESEARCH",
      "title": "author/org: NIST",
      "href": "https://csrc.nist.gov/pubs/sp/1326/final",
      "supports": [],
      "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。",
      "origin_class": "SOURCE_PACKET_REFERENCE",
      "source_or_experiment_ids": [
        "SRC-EA-090-URL-98C9ED2E4EC6"
      ],
      "supporting_locators": [
        "EVIDENCE TABLE",
        "canonical URL: https://csrc.nist.gov/pubs/sp/1326/final"
      ],
      "scope": "EVIDENCE TABLE",
      "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED"
    },
    {
      "id": "EA-090-R11-RESEARCH",
      "evidence_class": "RESEARCH",
      "title": "EA-090 監査済みresearch / canonical revision binding",
      "supports": [
        "- Air-gapped AIの本体はoffline inferenceではなく `controlled import → verify → quarantine/stage → approve → internal registry/repository → deploy → audit → rollback` の更新supply chain。\n- Red Hat OpenShift 4.20はfully disconnected環境でmirror-to-disk、physical transfer、disk-to-mirrorという更新経路を公式に実装している。AI専用機能ではないが、container/runtime/operator供給線の実装根拠になる。\n- Hugging Face Transformersはpre-downloaded artifact、HF_HUB_OFFLINE、local_files_onlyでoffline executionを明示的にsupportする。これは「モデルをofflineでloadできる」証拠であり、安全なair-gap更新手順の証明ではない。\n- physical mediaはair gapを越える更新channelになるため、air gapは攻撃面をゼロにしない。NISTはremovable mediaのowner、use restriction、procedural/physical/technical controlsを要求・推奨している。\n- model weightsだけでなく tokenizer, config, code, Python wheels, container images, CUDA/driver/runtime, vector DB, embedding/reranker, RAG corpus, vulnerability/advisory metadata, license/SBOMを同じartifact governanceへ入れる必要がある。"
      ],
      "limit": "canonical監査・revision bindingの存在を示す。外部ソースcurrentnessが本文またはcontrol-planeで確定していない場合は、currentnessをUNKNOWNのまま保持する。",
      "origin_class": "AUDITED_CANONICAL_RESEARCH_PACKET",
      "source_or_experiment_ids": [
        "COMM-081-EA0090"
      ],
      "supporting_locators": [
        "COMM-081-EA0090",
        "EA-090-R5-LEGACY-MIGRATION-20261008-R1",
        "content/staging/EA-090.md"
      ],
      "scope": "監査済みEA本文・canonical revision・既存Source Graph relationの範囲。欠損currentnessは推測で閉じない。",
      "provenance_status": "AUDIT_PASS_CANONICAL_BINDING"
    },
    {
      "id": "EA-090-R11-WEB-READBACK",
      "evidence_class": "IMPL",
      "title": "EA-090 Web body identity / canonical readback",
      "supports": [
        "canonical staging bodyのSHA-256一致とR9 canonical ledger readbackをProduction projectionの入力として検証する。"
      ],
      "limit": "body identity/readbackは本文claim自体の真偽や外部ソースの最新性を追加保証しない。",
      "checked_at": null,
      "origin_class": "IMPLEMENTATION_READBACK",
      "source_or_experiment_ids": [
        "WEBBODY-EA0090-R8-15357FAD"
      ],
      "supporting_locators": [
        "WEBBODY-EA0090-R8-15357FAD",
        "content/staging/EA-090.md",
        "EA-090-R5-LEGACY-MIGRATION-20261008-R1"
      ],
      "scope": "R9/R10 canonical readback後のProduction生成時body identity。",
      "provenance_status": "CANONICAL_READBACK_BODY_HASH_MATCH"
    }
  ],
  "research_sections": [
    {
      "heading": "WHY_THIS_MATTERS_TO_UPDATE",
      "text": "高機密・OT・規制環境では外部APIへ送れないことがある。しかし「ネットを抜く」だけではAI運用は成立しない。model/container/package/vulnerability intelligenceの持込、RAG corpus更新、監査log、時刻、license、patch、rollbackを閉域内で継続する供給線が必要。"
    },
    {
      "heading": "SCOPE_ROUTING",
      "text": "Enterprise AI Core / infrastructure / governance / security / privacy / audit / implementation / non-LLM component / organization overlay"
    },
    {
      "heading": "CLAIM_OR_RESEARCH_QUESTION",
      "text": "Air gap下でAI inference/RAGを動かすだけでなく、更新・provenance・security review・rollback・監査を持続可能にする最小control planeは何か。offline capabilityとsecure air-gapped operationをどう分離するか。"
    },
    {
      "heading": "EVIDENCE TABLE",
      "text": "1. source class: official platform documentation\nexact title: Disconnected environments — OpenShift Container Platform 4.20\nauthor/org: Red Hat\ncanonical URL: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/observability/disconnected_environments/index\npublication/update/access: accessed 2026-09-16\nversion/release/tag/commit: OpenShift Container Platform 4.20; oc-mirror v2 preferred\nsupporting locator: disconnected mirroring; mirror-to-disk → disk transfer → disk-to-mirror; internal mirror registry; update workflow\nevidence label: VERIFIED_SPEC\nrelation: support/context\n\n\n2. source class: official library documentation\nexact title: Transformers Installation — Offline mode\nauthor/org: Hugging Face\ncanonical URL: https://huggingface.co/docs/transformers/main/installation\npublication/update/access: accessed 2026-09-16\nversion/release/tag/commit: main docs state latest stable v5.17.0 at access time\nsupporting locator: Offline mode; pre-download snapshot, HF_HUB_OFFLINE=1, local_files_only=True\nevidence label: VERIFIED_SPEC / PRODUCT_VOLATILE\nrelation: support\n\n\n3. source class: standard/guidance\nexact title: NIST SP 800-171 Rev. 3 — Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations\nauthor/org: NIST\ncanonical URL: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/800-171r3/NIST.SP.800-171r3.html\npublication/update/access: published 2024; accessed 2026-09-16\nversion/release/tag/commit: Rev.3\nsupporting locator: 03.08.07 Media Use; restrict/prohibit media and prohibit removable media without identifiable owner\nevidence label: VERIFIED_SPEC\nrelation: context/limit\n\n\n4. source class: standard/guidance\nexact title: NIST SP 1334 — Reducing the Cybersecurity Risks of Portable Storage Media in OT Environments\nauthor/org: NIST NCCoE\ncanonical URL: https://csrc.nist.gov/pubs/sp/1334/final\npublication/update/access: September 2025; accessed 2026-09-16\nversion/release/tag/commit: final\nsupporting locator: portable storage transfers data physically; procedural, physical, technical controls required\nevidence label: VERIFIED_SPEC\nrelation: counter/limit/context\n\n\n5. source class: standard/guidance\nexact title: NIST SP 800-161 Rev.1 — Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations\nauthor/org: NIST\ncanonical URL: https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final\npublication/update/access: May 2022, updates through 2024-11-01; accessed 2026-09-16\nversion/release/tag/commit: Rev.1 update\nsupporting locator: supply-chain visibility, integrity, resilience, malicious/counterfeit/vulnerable component risk\nevidence label: VERIFIED_SPEC\nrelation: context/limit\n\n\n6. source class: standard/guidance\nexact title: NIST SP 1326 — Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide\nauthor/org: NIST\ncanonical URL: https://csrc.nist.gov/pubs/sp/1326/final\npublication/update/access: 2026-07-08; accessed 2026-09-16\nversion/release/tag/commit: final\nsupporting locator: supplier/product due diligence including provenance, resilience, cyber practices, supply-chain tiers\nevidence label: VERIFIED_SPEC\nrelation: context"
    },
    {
      "heading": "FINDINGS",
      "text": "- Air-gapped AIの本体はoffline inferenceではなく `controlled import → verify → quarantine/stage → approve → internal registry/repository → deploy → audit → rollback` の更新supply chain。\n- Red Hat OpenShift 4.20はfully disconnected環境でmirror-to-disk、physical transfer、disk-to-mirrorという更新経路を公式に実装している。AI専用機能ではないが、container/runtime/operator供給線の実装根拠になる。\n- Hugging Face Transformersはpre-downloaded artifact、HF_HUB_OFFLINE、local_files_onlyでoffline executionを明示的にsupportする。これは「モデルをofflineでloadできる」証拠であり、安全なair-gap更新手順の証明ではない。\n- physical mediaはair gapを越える更新channelになるため、air gapは攻撃面をゼロにしない。NISTはremovable mediaのowner、use restriction、procedural/physical/technical controlsを要求・推奨している。\n- model weightsだけでなく tokenizer, config, code, Python wheels, container images, CUDA/driver/runtime, vector DB, embedding/reranker, RAG corpus, vulnerability/advisory metadata, license/SBOMを同じartifact governanceへ入れる必要がある。"
    },
    {
      "heading": "LIMITS / COUNTEREVIDENCE / FAILURE ENVELOPE",
      "text": "- `HF_HUB_OFFLINE=1` はnetwork callを防ぐlibrary behaviorであり、artifact integrity、malware-free、license approval、model safetyを保証しない。\n- disconnected mirrorは外部dependencyを内部へ複製する仕組みであり、source compromiseを自動的に除去しない。hash/signature/SBOM/provenanceとreviewが別途必要。\n- removable mediaは更新を可能にする一方、air-gap boundaryを跨ぐattack vectorでもある。\n- 完全offlineではonline license validation、hosted moderation、cloud telemetry、managed vulnerability feed等に依存するcomponentが機能しない可能性がある。製品ごとにoffline license/telemetry dependencyを確認する。\n- stale model/security patchと「接続しない安全性」のtrade-offを明示する。未更新を安全とは呼ばない。"
    },
    {
      "heading": "AVAILABILITY_GATES",
      "text": "model/license permits offline storage/use; all dependencies obtainable and mirrorable; offline package/container registry; internal DNS/time/PKI/KMS/identity; approved transfer mechanism; malware scanning/quarantine; artifact signatures/hashes/SBOM; sufficient storage; offline observability/log retention; update cadence; rollback artifacts; vulnerability intelligence import; RAG corpus export/import policy."
    },
    {
      "heading": "IMPLEMENTATION_STATE",
      "text": "VERIFIED_SPECとしてOpenShift disconnected mirroringとTransformers offline loadingを確認。NIST guidanceでmedia/supply-chain controlsを固定。認証済みtenant・実air-gap環境への操作は未実施。"
    },
    {
      "heading": "BENCHMARK_OR_EVAL",
      "text": "Future TEST_PROFILE: synthetic isolated network with outbound deny; cold install from approved offline bundle; inference/RAG query; model update N→N+1; dependency update; rejected/tampered artifact; expired certificate; stale vulnerability feed; rollback; restore from backup; audit reconstruction. Measure zero unintended egress, artifact verification coverage, install/update time, rollback success, missing-dependency rate, RAG freshness lag, audit completeness, recovery time, storage growth."
    },
    {
      "heading": "SECURITY / PRIVACY / AUDIT / COST / OPERABILITY",
      "text": "Security: boundary crossing media/import station is high-risk control point; deny-by-default egress does not replace supply-chain validation. Privacy: external transmission can be structurally reduced, but insider/removable-media/log leakage remains. Audit: every imported artifact requires source/provenance/hash/signature/SBOM/scanner result/approver/import time/deployer. Cost: duplicated registries/storage/scanning infrastructure and manual transfer labor; delayed patching has risk cost. Operability: time sync, certificate renewal, license files, package dependency closure, backup/restore and vulnerability-feed freshness are recurring burdens。"
    },
    {
      "heading": "SAFE_WORDING_FOR_FUTURE_BOOK",
      "text": "「Air-gapped AIは、モデルを一度持ち込んでネットワークを切れば完成するものではない。閉域内で推論・RAGを実行できることに加え、モデル、コンテナ、依存package、データ、脆弱性情報を検証付きで持ち込み、内部repositoryから更新・rollback・監査できる供給線が必要である。物理mediaは更新経路であると同時にattack surfaceでもある。」"
    },
    {
      "heading": "UPDATE_WORK_HANDOFF",
      "text": "Core候補 `AIR_GAPPED_AI_SUPPLY_CONTRACT`: artifact_type; source/vendor; source revision; download time; license; hash/signature; SBOM; vulnerability scan/feed date; transfer media ID/owner; quarantine result; approval; internal registry URI; deployment target; model/runtime/RAG corpus version; offline dependency manifest; egress policy test; audit log; backup; rollback artifact; retirement/sanitization. EA-087 PRIVATE_AI_DEPLOYMENT_CONTRACTおよびEA-089 LOCAL_AI_CLUSTER_CONTRACTと接続する。"
    },
    {
      "heading": "OPEN_UNKNOWN",
      "text": "major commercial model licensesのoffline redistribution/deployment条件; NVIDIA/AMD/Apple各runtimeのfully disconnected update matrix; offline license activation requirements; model provenance/signature ecosystemのcurrent best practice; independent air-gapped LLM operations case studies; RAG corpus differential updateの安全な標準形。Stop condition for this run: offline execution、disconnected update supply chain、media risk、test profileまでboundedに確立。\n\n---"
    }
  ],
  "human_url": "/tools/ea-090-air-gapped-ai",
  "markdown_url": "/agent/article.md?path=%2Ftools%2Fea-090-air-gapped-ai",
  "json_url": "/agent/article.json?path=%2Ftools%2Fea-090-air-gapped-ai"
}