Identical guarantees offline
Same queue, same resolver, same audit trail.
Defense · Deployment · Whitepaper
No cloud. No exception path.
A no-cloud mode that is a different code path is a different product with different bugs. NavTrax exports its operation log as a signed bundle and imports it through the same ingest, resolver and audit path as a cellular sync — so the guarantees do not vary with the transport.
01 / Problem statement
What we are designing against.
Air-gapped deployment usually fails in one of three ways.
The offline mode is a second implementation. Vendors ship a connected product and then an air-gapped variant. The variant has a different sync path, a different conflict behavior and a separate defect population, and the accreditation covers whichever one was tested.
Installation assumes egress. Container pulls, license checks, font CDNs and telemetry beacons are discovered during installation on a disconnected network, which is the worst possible time.
Provenance is unverifiable. Software arriving on removable media with no signature and no bill of materials cannot be accepted on a network that takes its own policy seriously.
02 / Mechanism
The design, stated so it can be evaluated.
- One ingest path
- A signed bundle from removable media is applied through the identical ingest, conflict resolver and audit logger as a cellular sync. There is no second implementation to certify separately.
- Signed bundles
- The export carries the operations, the per-device digests and the originating device signatures. A relaying courier cannot alter content, only carry it.
- No egress at runtime
- Fonts, tiles, models and scripts are local. There is no CDN dependency, no license call-home and no telemetry beacon. The absence is the feature.
- Bill of materials
- An SBOM ships with the bundle, so the receiving authority can assess what is being introduced rather than take a version number on trust.
- Hardened baselines
- Container and host baselines aligned to STIG guidance, delivered as configuration rather than as instructions in a PDF.
- Fast node provisioning
- A signed image boots to a configured node without touching a network — the model proven by air-gap delivery tooling elsewhere in the industry, applied here.
- On-device inference
- Classification and app-level reasoning run locally on Jetson-class hardware, so the intelligence layer has no external dependency either.
03 / Capabilities
What is actually delivered.
Signed, verifiable delivery
Signatures and an SBOM with every bundle.
Zero runtime egress
No CDN, no license check, no telemetry.
Sneaker-net region transfer
Offline map regions move on removable media.
Edge inference
On-device models, no inference API.
Hardened configuration
STIG-aligned baselines as shipped config.
Auditable import
Every applied operation logged with its origin device and signature.
04 / Reference
| Dependency | Connected | Air-gapped |
|---|---|---|
| Map tiles | Proxy or direct | Pre-staged regions |
| Fonts | Local | Local |
| AI inference | On-device, cloud optional | On-device only |
| Knowledge base | Bundled | Bundled |
| License validation | None | None |
| Telemetry | None | None |
| Sync transport | Cellular, mesh, satellite | Signed bundle on media |
| Updates | Signed package | Signed package on media |
05 / Process
Traced, node by node.
One code path. Both postures.
Air-gapped deployment, SBOM delivery and hardened baselines are Enterprise.