Skip to content
Trust • Air‑gapped kit

# Air‑gapped verifier kit.

A self‑contained, offline‑complete verifier bundle for Security & Counsel: run /verify‑assurance, /verify‑diligence, and /verify‑trust in an isolated environment — with printer‑friendly audit summaries, QR re‑verification, and ticket binding.

No uploads No network connect‑src 'none' Offline‑verifiable PASS / FAIL / HOLD
Download kit ZIP Download kit signature (DSSE) Verify kit signature Attachment bundle export Release commitments Supply‑chain governance

### How to run (air‑gapped)

1. Download the kit ZIP and move it to the review machine (USB / secure transfer).
2. Verify integrity (recommended): open /verify-airgap-kit and verify the ZIP against the DSSE signature.
3. Unzip, then serve locally (loopback only). Example:

    # macOS / Linux (python3)
    cd MVG_Airgapped_Verifier_Kit_PUBLIC_v1.0.2
    python3 -m http.server 8000 --bind 127.0.0.1

    # then open:
    # http://127.0.0.1:8000/

Note: many browsers require a secure context for WebCrypto. If you open files via `file://`, verification may show HOLD. Using a local server (loopback) is the recommended review path.

## What’s inside

- Assurance Pack verifier: DSSE + keyring snapshot + key transparency log; produces audit summary + approval receipt.
- Licensing diligence verifier: pack ZIP + private receipt DSSE + (optional) blinded public commitment verification.
- Trust verifier: site trust pack and pinned trust anchors for independent review.
- Receipt workflows: countersign, org keyring, threshold policy evaluation, and ticket binding.

## Where it fits in a Big Tech flow

1. Security reviews the pack offline and prints the audit summary.
2. Reviewers countersign (optional) and bind to a JIRA/ServiceNow ticket.
3. The ticket attachment becomes a signed internal approval artifact.

Design principle: verifiable artifacts, not email threads.

## Download set

Public‑safe release (format + verifier). Production releases and keys can be provided under agreement.

File | Type | Action
--- | --- | ---
`MVG_Airgapped_Verifier_Kit_PUBLIC_v1.0.2.zip` | ZIP | Download
`MVG_Airgapped_Verifier_Kit_PUBLIC_v1.0.2.dsse.json` | DSSE | Download
`MVG_Airgapped_Verifier_Kit_Keyring_TrustAnchors_PUBLIC_v1.0.1.json` | JSON | Download
`MVG_Airgapped_Verifier_Kit_Keyring_PUBLIC_v1.0.1.dsse.json` | DSSE | Download
`MVG_Airgapped_Verifier_Kit_Keyring_PUBLIC_v1.0.1.json` | JSON | Download
`MVG_Airgapped_Verifier_Kit_KeyRotation_Policy_Spec_v1.0.0.md` | MD | Download
`MVG_Attachment_Naming_Convention_Spec_v1.0.0.md` | MD | Download
`SHA256SUMS_AIRGAP_PUBLIC_v1.0.2.txt` | TXT | Download

ZIP SHA‑256: bd2f90214777b5f1674bae9144d0b2c6e51d880a998fec6b9c798bfd9b1d2a16 ZIP bytes: 5259310 Keyring root keyid: ta.mvg.airgapped.kit.root.2026-02-12.v2.demo.19a29d194d (prev: ta.mvg.airgapped.kit.root.2026-02-12.v1.demo.d9f8e47adc)

### Release commitments (public log)

Optional supply‑chain layer: MVG publishes a blinded commitment log + a DSSE‑signed head. Reviewers verify inclusion offline using a private nonce (a public‑safe sample receipt is provided here).

Open commitments

File | Type | Action
--- | --- | ---
`MVG_Airgapped_Verifier_Kit_CommitmentLog_PUBLIC_v1.0.2.json` | JSON | Download
`MVG_Airgapped_Verifier_Kit_CommitmentLogHead_PUBLIC_v1.0.2.dsse.json` | DSSE | Download
`MVG_Airgapped_Verifier_Kit_Keyring_PUBLIC_v1.0.1.dsse.json` | JSON | Download
`MVG_Airgapped_Verifier_Kit_CommitmentHeadChain_PUBLIC_v1.0.2.json` | JSON | Download
`MVG_Airgapped_Verifier_Kit_CommitmentHeadChainHead_PUBLIC_v1.0.2.dsse.json` | DSSE | Download
`MVG_Airgapped_Verifier_Kit_ReleaseReceipt_SAMPLE_v1.0.2.dsse.json` | DSSE | Download
`SHA256SUMS_AIRGAP_COMMITMENTS_PUBLIC_v1.0.2.txt` | TXT | Download
`MVG_Airgapped_Verifier_Kit_ReleaseCommitments_Spec_v1.0.2.md` | MD | Download

Commitment log SHA‑256: f0786fa1feebc322c436500b48b10e290e6a4bb491e10593db77395759d5cc7b Log head entry SHA‑256: 98dda2cf07ecfe753b4db7bbd6ad98c222b6db2c8a89a10b733e9fef21ab35d2 Entry count: 1 Log signer keyid: mvg.airgap.kit.commitments.signer.2026-02-12.v1.demo.f8e6acc97f Headchain signer keyid: mvg.airgap.kit.headchain.signer.2026-02-12.v1.demo.46caf40306 Keyring root keyid: ta.mvg.airgapped.kit.root.2026-02-12.v2.demo.19a29d194d (prev: ta.mvg.airgapped.kit.root.2026-02-12.v1.demo.d9f8e47adc)

### Boundary language (procurement‑grade)

- Non‑binding unless signed. Binding terms exist only in a fully executed agreement.
- No patent license by publication. Public materials are informational only.
- Not a certification. This kit is a verification tool and evidence format — not a compliance stamp.
- Fail closed. Unsupported crypto / missing evidence / invalid signatures → HOLD.