Air-gapped and classified

Sovereign and classified estates cannot depend on a SaaS control plane for minting or revocation. Foundry mints offline, Model A validates locally at Gate, and self-hosted Control keeps identity lifecycle inside the boundary. Recommended stack: Sovereign.

Air-gapped Foundry+Control

Classified air-gapped Foundry plus Control island topology

Foundry minting

Air-gapped minting appliance producing cohort binaries and twin circuits

What you retire

Vendor-cloud dependency for minting, activation, or revocation of request authority
Outbound network paths from Gate to a public control plane for every validate
Reusable credentials that authorize across the air gap once copied onto approved media

Recommended stack

Public
Cloud
Sovereign
Agent
Institutional
OEM

Sovereign - Foundry licensed for air-gapped circuit manufacturing; self-hosted Control for registry and durable nonce ledger; Gate with Model A local validate-proof so enforcement does not require a path to ENI6MA cloud. Scope: same envelope contract as connected deployments; only the ops topology changes. No invented compliance badges - auditors see mechanism parity under a different deployment shape.

One-minute capability description

Classified and sovereign estates cannot depend on a vendor cloud for minting or revocation. ENI6MA's Sovereign packaging licenses Foundry (the minting appliance that manufactures per-identity circuit binaries) for air-gapped manufacturing, ships Control for a self-hosted registry and durable nonce ledger, and supports Model A local verification at Gate. Artifacts move via your approved media process. Revocation remains a handle state change inside your Control instance. The envelope (one-time cryptographic authorization for a single request) is identical to connected deployments: Gate still checks binding and burn-before-validate; Control still spends nonces before proof check.

What this solution claims

Foundry minting and Model A local verification can run without a network path to ENI6MA cloud services.ValidatedAir-gappable Foundry license path and local validate-proof acquisition.

Model A (local validate-proof) and Model B (registry validate-proof) are security-equivalent at the envelope layer.ValidatedThe client assembles the same envelope either way; only verifier acquisition differs.