.nornir/assets/airgap-flow.svg
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 430" font-family="'DejaVu Sans', 'Segoe UI', sans-serif">
<defs>
<linearGradient id="ag-board" x1="0" y1="0" x2="0" y2="1">
<stop offset="0" stop-color="#0b1c2e"/><stop offset="1" stop-color="#06111d"/>
</linearGradient>
<linearGradient id="ag-chip" x1="0" y1="0" x2="0" y2="1">
<stop offset="0" stop-color="#14384f"/><stop offset="1" stop-color="#0e2a3e"/>
</linearGradient>
<linearGradient id="ag-rail" x1="0" y1="0" x2="0" y2="1">
<stop offset="0" stop-color="#173d57"/><stop offset="1" stop-color="#0c2438"/>
</linearGradient>
<linearGradient id="ag-slot" x1="0" y1="0" x2="0" y2="1">
<stop offset="0" stop-color="#123448"/><stop offset="1" stop-color="#0a2032"/>
</linearGradient>
<linearGradient id="ag-gap" x1="0" y1="0" x2="1" y2="0">
<stop offset="0" stop-color="#3a1220"/><stop offset="1" stop-color="#2a0d18"/>
</linearGradient>
<marker id="ag-arr" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
<path d="M0 0 L10 5 L0 10 z" fill="#6fd3f5"/>
</marker>
<marker id="ag-arrg" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
<path d="M0 0 L10 5 L0 10 z" fill="#7CFFB2"/>
</marker>
</defs>
<rect x="0" y="0" width="1200" height="430" fill="url(#ag-board)"/>
<g stroke="#143a52" stroke-width="1"><line x1="0" y1="70" x2="1200" y2="70"/><line x1="0" y1="392" x2="1200" y2="392"/></g>
<text x="40" y="38" fill="#eaf6ff" font-size="22" font-weight="700">Skíðblaðnir — seal · carry · import</text>
<text x="40" y="58" fill="#9fc9e0" font-size="14">pack → archive → fetch ‖AIR GAP‖ → verify → unpack → install → start(ordered) · zero network on the far side</text>
<!-- CONNECTED BOX -->
<rect x="36" y="96" width="330" height="264" rx="12" fill="url(#ag-chip)" stroke="#5aa6cf" stroke-width="2"/>
<text x="201" y="124" fill="#eaf6ff" font-size="15" font-weight="700" text-anchor="middle">connected build host</text>
<text x="201" y="143" fill="#9fc9e0" font-size="10.5" text-anchor="middle">internet OK · deps captured here, never on target</text>
<g font-family="'DejaVu Sans Mono', monospace">
<rect x="58" y="160" width="286" height="30" rx="5" fill="url(#ag-slot)" stroke="#7CFFB2" stroke-width="1.3"/>
<text x="201" y="180" fill="#7CFFB2" font-size="11" text-anchor="middle">pack → Staging tree</text>
<rect x="58" y="198" width="286" height="30" rx="5" fill="url(#ag-slot)" stroke="#6fd3f5" stroke-width="1.3"/>
<text x="201" y="218" fill="#bfe6ff" font-size="11" text-anchor="middle">archive::TarZstd::pack</text>
<rect x="58" y="236" width="286" height="30" rx="5" fill="url(#ag-slot)" stroke="#6fd3f5" stroke-width="1.3"/>
<text x="201" y="256" fill="#bfe6ff" font-size="11" text-anchor="middle">PodmanBuild (target-alike deps)</text>
</g>
<text x="201" y="292" fill="#86b3cc" font-size="10" text-anchor="middle" font-family="'DejaVu Sans', sans-serif">nornir airgap pack ./stage --out lake.tar.zst</text>
<text x="201" y="310" fill="#7fa8c4" font-size="9.5" text-anchor="middle" font-family="'DejaVu Sans', sans-serif">writes lake.tar.zst + .manifest.json + VERSION</text>
<text x="201" y="334" fill="#a9d8ee" font-size="9.5" text-anchor="middle" font-family="'DejaVu Sans Mono', monospace">100% Rust · no shell · no *_up.sh</text>
<!-- pack arrow to bundle -->
<line x1="366" y1="228" x2="404" y2="228" stroke="#7CFFB2" stroke-width="3" marker-end="url(#ag-arrg)"/>
<!-- SEALED BUNDLE -->
<rect x="410" y="150" width="176" height="156" rx="12" fill="url(#ag-rail)" stroke="#7CFFB2" stroke-width="2.5"/>
<text x="498" y="176" fill="#eaf6ff" font-size="13.5" font-weight="700" text-anchor="middle">sealed bundle</text>
<rect x="428" y="190" width="140" height="26" rx="5" fill="url(#ag-slot)" stroke="#7CFFB2" stroke-width="1.2"/>
<text x="498" y="207" fill="#bfe6ff" font-size="9.5" text-anchor="middle" font-family="'DejaVu Sans Mono', monospace">lake.tar.zst</text>
<rect x="428" y="222" width="140" height="26" rx="5" fill="url(#ag-slot)" stroke="#6fd3f5" stroke-width="1.2"/>
<text x="498" y="239" fill="#bfe6ff" font-size="9.5" text-anchor="middle" font-family="'DejaVu Sans Mono', monospace">.manifest.json</text>
<rect x="428" y="254" width="140" height="26" rx="5" fill="url(#ag-slot)" stroke="#6fd3f5" stroke-width="1.2"/>
<text x="498" y="271" fill="#bfe6ff" font-size="9.5" text-anchor="middle" font-family="'DejaVu Sans Mono', monospace">VERSION (outside)</text>
<text x="498" y="296" fill="#7fa8c4" font-size="9" text-anchor="middle">root sha256 signs every entry</text>
<!-- AIR GAP barrier -->
<rect x="606" y="86" width="118" height="306" rx="10" fill="url(#ag-gap)" stroke="#e06a86" stroke-width="2" stroke-dasharray="6 5"/>
<text x="665" y="150" fill="#ffd7e0" font-size="16" font-weight="700" text-anchor="middle" transform="rotate(90 665 228)">☍ AIR GAP ☍</text>
<text x="632" y="360" fill="#f2b8c6" font-size="9.5" text-anchor="middle">USB</text>
<text x="665" y="374" fill="#f2b8c6" font-size="9.5" text-anchor="middle">courier / age</text>
<text x="698" y="360" fill="#f2b8c6" font-size="9.5" text-anchor="middle">relay</text>
<!-- carry arrow -->
<line x1="586" y1="228" x2="612" y2="228" stroke="#e06a86" stroke-width="3" marker-end="url(#ag-arrg)"/>
<line x1="718" y1="228" x2="756" y2="228" stroke="#6fd3f5" stroke-width="3" marker-end="url(#ag-arr)"/>
<!-- SEALED TARGET -->
<rect x="762" y="96" width="402" height="264" rx="12" fill="url(#ag-chip)" stroke="#7fc8ea" stroke-width="2"/>
<text x="963" y="124" fill="#eaf6ff" font-size="15" font-weight="700" text-anchor="middle">sealed target · ZERO network</text>
<text x="963" y="143" fill="#9fc9e0" font-size="10.5" text-anchor="middle">verify before trusting a byte · nothing reaches out</text>
<g font-family="'DejaVu Sans Mono', monospace">
<rect x="784" y="158" width="176" height="30" rx="5" fill="url(#ag-slot)" stroke="#6fd3f5" stroke-width="1.3"/>
<text x="872" y="178" fill="#bfe6ff" font-size="10.5" text-anchor="middle">fetch::verify_on_receipt</text>
<rect x="966" y="158" width="176" height="30" rx="5" fill="url(#ag-slot)" stroke="#6fd3f5" stroke-width="1.3"/>
<text x="1054" y="178" fill="#bfe6ff" font-size="10.5" text-anchor="middle">platform::unpack</text>
<rect x="784" y="196" width="176" height="30" rx="5" fill="url(#ag-slot)" stroke="#6fd3f5" stroke-width="1.3"/>
<text x="872" y="216" fill="#bfe6ff" font-size="10.5" text-anchor="middle">pki::SelfGenerated</text>
<rect x="966" y="196" width="176" height="30" rx="5" fill="url(#ag-slot)" stroke="#6fd3f5" stroke-width="1.3"/>
<text x="1054" y="216" fill="#bfe6ff" font-size="10.5" text-anchor="middle">Layout: version-dated</text>
<rect x="784" y="234" width="358" height="30" rx="5" fill="url(#ag-slot)" stroke="#7CFFB2" stroke-width="1.4"/>
<text x="963" y="254" fill="#7CFFB2" font-size="10.5" text-anchor="middle">SystemdInstaller::install · open ports · activate current</text>
</g>
<!-- ordered start -->
<rect x="784" y="278" width="358" height="62" rx="10" fill="url(#ag-rail)" stroke="#7CFFB2" stroke-width="2"/>
<text x="963" y="300" fill="#eaf6ff" font-size="12.5" font-weight="700" text-anchor="middle">start(ordered) → offline nornir lake</text>
<text x="963" y="319" fill="#bfe6ff" font-size="9.5" text-anchor="middle" font-family="'DejaVu Sans Mono', monospace">holger → nornir-server → tunnr · orchestrate::start_waves</text>
<text x="963" y="334" fill="#7fa8c4" font-size="9" text-anchor="middle">bring-up DAG → airgap_events (warehouse)</text>
<!-- ground -->
<rect x="36" y="404" width="1128" height="20" rx="6" fill="url(#ag-rail)" stroke="#7fc8ea" stroke-width="1.5"/>
<text x="52" y="418" fill="#bcd9ec" font-size="10">One archive folds the whole stack; the gap is crossed once; the far side installs, configures and starts every product in dependency order — no network, no shell.</text>
</svg>