Air-gapped software testing: scope and prerequisites
Separate local verification from a fully air-gapped installation, and define the runtime, evidence and approval requirements for a restricted environment.
Platform and security teams evaluating software verification for restricted networks, on-premises systems or environments without public internet access.
What Zof does
Local verification available today
The released Zof CLI performs local static checks without a Zof account or source upload. CI Evidence normalizes supported local reports. These capabilities can help assess code and review existing test results inside an approved environment.
A deployment needs its own acceptance test
Zof’s platform positioning is an independent verification and control layer between AI and production. A secure-enclave deployment must establish where planning, execution, evidence and approvals operate. Public local releases do not establish that the full platform installs or operates with no network access.
From a change to a review decision
- 01
Define the boundary
List permitted connections, application access, identity services, model use and evidence destinations. Distinguish a restricted segment with approved transfers from an environment with no external connection.
- 02
Prepare dependencies
Inventory runtimes, packages, browser binaries where needed, OS libraries and updates. Agree how approved artifacts enter the environment, how integrity is checked and how credentials are provisioned.
- 03
Test the full lifecycle
Validate installation and a representative verification run with external access blocked. Check restart, failure handling, evidence review, export policy and upgrades. Record remaining network dependencies before accepting an air-gapped design.
What evidence you get
Local verification results
Zof’s local tools produce structured static findings or normalized test results with explicit execution status. Missing and incomplete evidence remain non-passing. Static checks do not establish that application behavior was tested.
Deployment acceptance evidence
Require an approved dependency inventory, network observations, installation records and representative run results. Agree local storage, retention, access and export controls. These are evaluation requirements, not artifacts automatically supplied by the public CLI.
Prerequisites and limits
- Offline execution is different from offline installation. Public npm installation and source bootstrap instructions download dependencies. An offline installation needs a separately prepared and tested dependency set.
- Local file operations require Node.js 22 or 24, Linux or macOS, and Python 3.10 or newer. Git is required for revision analysis. Browser tests need their own binaries, OS dependencies and reachable application.
- A CLI command that executes configured tests requires explicit --allow-exec and runs trusted commands; it is not a sandbox. The test command and application can have their own network dependencies.
- The public local releases do not verify a fully air-gapped Zof platform installation, signed test capsules, a transfer gateway or model isolation. Confirm implementation and acceptance criteria with Zof before relying on them.
Scope a secure deployment review
Bring your network policy, target application, approved runtimes, artifact-transfer process and evidence-retention requirements. Agree what must be demonstrated inside your boundary.