Air-gapped, or connected only to what the site secures

Every facility pool has to answer one question before the first robot asks it anything: what, if anything, is this node allowed to talk to beyond the building. Element 31 gives two answers, and a site picks one per installation. Neither answer requires a different machine.

The first answer is nothing. The second is only what the site already secures. This article describes what each looks like on an ordinary day, and how a facility with more than one building can hold both at once.

Two postures, one appliance

An air-gapped Czar has no path out. It serves the robots over the facility's own network, stores captures and records on its own disks, adapts models on its own pool, and never opens a route beyond the walls. Updates reach it as signed bundles carried in on media and verified before they are applied.

A connected Czar has routes, but only the ones the site declared. Local Bridge in Substrate carries that declaration. A route to the robot vendors' fleet software, to the warehouse system, to the PLCs on the line: each exists because someone at the site wrote it down. Everything else is denied by default.

The node underneath is identical. Same sealed enclosure, same sealed and signed read-only image, same attestation before joining a Grid, same provenance record. Posture is configuration of the Grid, not a model number. A reader who wants the properties themselves can start with Sovereign by property, not by market.

What air-gapped means in practice

The practical consequence of no path out is that every movement of software or data into the node is a physical act. Someone downloads a signed bundle from the customer portal on a machine outside the air gap, carries it in on media, and applies it at the node. The node verifies the signature before anything changes. The site's own procedure says who may carry it and when.

The other consequence is that support cannot reach in. Customer appliances never connect to the portal in any posture, but on a sovereign site a remote session also requires an uplink window, and that window opens only after the customer attests that data disks are detached, the network is isolated, the console is supervised, and the person requesting it has the authority. The window has a hard expiry. When it closes, the gap is back.

What does not change is the floor. Robots still ask the pool for perception, decisions, and language, and still fall back to their on-board model when the pool cannot answer in time. The air gap faces outward.

What connected means, and what it does not

Connected is easy to misread as open. It is not. A connected Czar reaches exactly the systems in its declaration and nothing else, and the declaration is short because the systems a robot floor needs are few. The fleet software from each robot vendor already on site. The warehouse system that issues work. The PLCs that run the fixed automation. Nothing the site did not name.

Each of those systems is one the site already secures, which is the point of the phrase. The pool does not introduce a new perimeter or a new trust relationship. It joins the ones that exist, on terms the site wrote, with default-deny behind them.

Connected also does not mean data leaves. Camera feeds, captures, task records, adapted weights, and the decision record remain on the operator's hardware in the connected posture just as in the air-gapped one. A declared route to fleet software lets the pool coordinate with the fleet; it does not export the floor. See What leaves the building: nothing for the inventory.

Mixed estates

Operators rarely have one kind of building. A ports operator may run a terminal that must stay closed and an inland depot that already shares a network with its trucking partners. A manufacturer may have a plant with sensitive tooling and a distribution center that does not. The posture decision is made per site, so each building gets the answer that fits it.

A mixed estate runs air-gapped Czars in some buildings and connected Czars in others, all under one subscription for the configured Grid. Operations staff learn one appliance and one serving system. The difference between buildings is a declaration file and an update procedure, not a second product line.

Choosing per site

The question to ask for each building is not whether it is sensitive in the abstract but which outside systems, if any, the pool must reach to do its job. If the honest answer is none, the site is air-gapped and updates travel by media. If the answer is a short list of systems the site already runs and secures, the site is connected to those and denied everything else.

Either way, the choice is written down, and the record shows which posture a node has and which routes it holds. For the mechanics of declaring a route, continue to A connection is a decision, not a default. For the appliance underneath both postures, see Czar and Technology.