# Air-gapped deployment (/docs/air-gapped-deployment)



Air-gapped deployment means the runtime makes no outbound TCP calls to
public LLM endpoints, ships no telemetry beyond the network perimeter,
and installs from a private registry or vendored snapshot. This page is
for regulated-environment evaluators — defense contractors, FedRAMP-bound
integrators, healthcare system operators, and financial-services teams
with on-prem mandates.

**Air-gapped deployment is a v2+ roadmap item.** The v1 runtime still
has three code paths that call `openrouter.ai` directly (in the memory
consolidation, fact extraction, and context summarizer paths). These are
call-site gaps, not architectural ones, and are documented in the source
repo at `packages/core/docs/air-gapped-architecture.md`. What v1 does
ship is the substrate posture that makes the v2 path buildable without
rearchitecting the runtime.

## What v1 ships today [#what-v1-ships-today]

**Bring-your-own provider.** The `AgentProvider` interface is the only
boundary between the runtime and an LLM call. Point it at a
private-endpoint URL and no inference traffic leaves the perimeter.
`AnthropicSdkProvider` exposes a `baseURL` field for this; any
OpenAI-compatible in-perimeter gateway works via `AiSdkProvider`.

**Custom provider implementations.** The `AgentProvider` contract is
stable and documented. A host that runs an in-perimeter model endpoint
can implement it directly — the runtime does not require a bundled
provider.

**No implicit telemetry.** `@pleach/core` contains no analytics SDK,
no crash reporter, and no usage callback to a third-party SaaS
endpoint. The only outbound calls the runtime makes are the ones the
host configures via the provider interface.

**Configurable observability destinations.** `@pleach/observe` ships
data where the host configures it to ship. For contained deployments,
the destination is a private SIEM or log aggregator inside the
perimeter.

**Plugin interception surface.** The `HarnessPlugin` contract lets a
host inject logic at every major runtime boundary — including tool calls
that would otherwise reach external endpoints. This is the extension
point for perimeter enforcement before v2's network-policy validator
lands.

**PII scrubbing before persistence.** `@pleach/compliance` runs
scrubbers on the persistence boundary so classified or regulated
identifiers don't reach storage. Scrubbers are configurable per
environment; the four bundled scrubbers (SSN, Luhn, US-DL,
`KeyedRegex`) cover common regulated-domain patterns.

## What changes in v2+ [#what-changes-in-v2]

**Dependency vendoring.** A documented, reproducible `node_modules`
snapshot or private-registry recipe so the runtime installs without
reaching the public npm registry.

**SBOM.** A CycloneDX software bill of materials generated at publish
time, covering every direct and transitive runtime dependency. This is
the artifact supply-chain risk management (SCRM) reviews require.

**Signed artifacts.** Sigstore signing for published packages, with
SLSA Level 2 provenance attestation. The consumer verifies the bundle
before install.

**Network-policy validator.** A runnable script that enumerates every
outbound call the runtime can make and reports which calls have been
rerouted to in-perimeter destinations. The output is the evidence
artifact a compliance reviewer signs off on.

**Hardcoded-endpoint closure.** The three remaining `openrouter.ai`
call sites are replaced with DI-injected provider calls, closing the
last gaps that prevent strict perimeter enforcement.

## Where to go next [#where-to-go-next]

<Cards>
  <Card title="Compliance" href="/docs/compliance" description="PII scrubbing, tenant scoping, and the CI audit gates that regulated deployments inherit from @pleach/compliance." />

  <Card title="Regulated-domain agent" href="/docs/regulated-domain-agent" description="End-to-end pattern for deploying a fully audited, tenant-scoped agent in a regulated environment." />
</Cards>

The GitHub roadmap tracks the v2+ items listed above. Follow the
`@pleach/core` repository at `github.com/pleachhq/core` and filter
by the `air-gapped` label.