Air-Gapped AI Code Verification

NIST SP 800-53 Rev. 5.1, checked 17 July 2026, treats boundary protection and network disconnect as explicit security controls; it does not treat disconnection as a complete security result. The SC-7 and SC-10 controls restrict communication paths. Verification still needs declared criteria, available inputs, selected checks, result interpretation, residual-risk review, and a named decision owner.

The hardware side of the third row is covered in local LLM code review. Hardware is only one dependency. NIST SP 800-161 Rev. 1 Update 1, updated November 2024 and checked 17 July 2026, treats provenance, acquisition, integration, and maintenance as continuing supply-chain risks. An internal mirror or allowlist can reject names outside its policy, but it can be stale, misconfigured, or contain a compromised legitimate artifact; isolation does not eliminate that residual risk.

1. Precise written tasks. A written task gives generation and verification a declared reference, while assumptions and exclusions keep its coverage visible. It does not compensate automatically for a missing or weaker tool. The checkable form is the same as everywhere.
2. Small changes, verified each. Bounded diffs can make review scope easier to inspect. They do not prove that the selected tests cover the change.
3. Deterministic layer first, model second. Run locally available deterministic checks and record what each covered or skipped. Optional model findings remain non-deterministic evidence requiring review.
4. Evidence with the code. Store results, inputs, versions, omissions, and open risks locally when policy requires it. A record is an evidence artifact, not an audit conclusion or approval.

The ANSSI/BSI recommendations published 4 October 2024 describe security risks and controls for AI coding assistants across deployment models. The joint recommendations are guidance, not certification of this architecture or evidence that an air gap makes generated code safe.

Network isolation restricts communication paths. Local processing says where computation occurs. Offline operation describes a measured runtime state. Secrets handling governs access and transfer. Verification compares selected evidence with declared criteria. None implies the others.

Residual risks include removable media, transfer stations, insiders, vulnerable endpoints, stale dependencies and rules, compromised provisioned artifacts, weak credentials, incomplete tests, and incorrect human interpretation. Teams need a threat model and accountable approval for their actual environment; local processing without the gap addresses a different architecture and must be evaluated separately.

Reality Graph can store declared tasks, selected check results, and evidence files in a locally controlled environment when deployed and configured that way. The evidence reports can remain with the code. Operators must still verify actual network calls, dependencies, telemetry, model endpoints, secrets, transfer paths, access, and retention; the product's own side of that question, what Reality Graph itself transmits, is stated separately. Reality Graph does not make an environment air-gapped and does not guarantee privacy, security, correctness, compliance, evidence integrity, or approval quality.