For regulated teams/Self-host & air-gap
Self-host · air-gap · NIST SC-7 · DoD IL5/IL6

Runs where your data lives — air-gapped if you need it.

Some environments must be isolated: dedicated infrastructure, no third-country access, sometimes no network at all. Blueprint is a thin, open-source runtime with no phone-home — deploy it inside those enclaves and own it end to end.

Air-gap readyOpen sourceNo phone-home

The honest version: self-host and air-gap are deployment properties that enable such mandates — no regulation says “you must self-host,” and Blueprint isn’t FedRAMP/DoD-authorized (a library can’t be).

The requirement

No law says “self-host.” Plenty of environments require isolation.

Self-host is the enabler — a runtime that makes zero external calls can live where hosted tools simply can’t.

Isolation
When the environment must be isolated or air-gapped
  • NIST SP 800-53 SC-7 (boundary protection) and AC-4 (information-flow enforcement) define the isolation controls used to build isolated and classified enclaves.
  • DoD Cloud Computing SRG impact levels require increasingly dedicated infrastructure — IL5 dedicated, IL6 classified (SIPRNet).
Source: NIST 800-53 SC-7 ↗
Ownership
When you must own and run the software yourself
  • Data-sovereignty and national-security regimes can require the data — and the systems processing it — to stay in-country on dedicated infrastructure.
  • A self-hosted open-source runtime has no vendor dependency to operate, and can run fully offline.
Source: DoD Cloud Computing SRG (DISA) ↗
The problem

Why a hosted or gated tool can’t come inside.

1

A hosted or phone-home UI can’t enter an air-gapped or classified network at all — the outbound dependency is a non-starter.

2

“Self-host” that’s a heavy platform to babysit just moves the burden; regulated teams need control without a second ops job.

3

Closed-source or gated on-prem means you can’t fully inspect or own what runs in your most sensitive environment.

The answer

A runtime with nothing to phone home, point by point.

Context
What it needs
How Blueprint fits inside it
NIST SC-7 / AC-4 · isolation
Control flows at the boundary; isolate.
The runtime makes zero external calls, so it drops into an isolated subnet or air-gap with nothing to allow-list outbound.
DoD IL5 / IL6 · dedicated
Dedicated, in-country, vetted personnel; IL6 classified.
Blueprint deploys as a library inside your accredited enclave — the authorization is your system’s, not ours, and it never needs to reach out.
Sovereignty · in-country
Data and the systems processing it stay in-country.
You run it on your own infrastructure, in your own region — there’s no vendor endpoint in another country.
Own-your-runtime · OSS
Inspect and operate the software yourself.
The runtime is open source (AGPL): your team can read it, run it, and keep it running with no vendor in the loop.
The evidence

What a security architect sees: no calls leaving the enclave.

Even the change above swaps a remote asset for a local one — nothing the runtime needs is off-network.

contracts/ops-dashboard.json · PR #128 · air-gapped repo
{ "type": "screen", "id": "ops-dashboard",
  "nodes": [
    { "type": "chart", "src": "https://cdn…" }
    { "type": "chart", "src": "local" }
  ] }

External calls at runtime

0outbound requests, offline-safe

Deployment

  • Air-gap supported
  • Vendor dependency none
  • Source open (AGPL)

The honest part

Self-host and air-gap are deployment properties that enable mandates like data sovereignty and isolated or classified networks — they aren’t themselves a regulation, and no standard says “you must self-host.” Blueprint is not FedRAMP- or DoD-authorized; a UI library can’t hold such an authorization. It can be deployed into environments that carry those requirements — the authorization applies to the overall system and its operator.

For your security review

The questions your security team will ask.

Is Blueprint FedRAMP / DoD authorized?

No — a library isn’t authorized on its own; those authorizations apply to a whole system and its operator. Blueprint can be deployed inside such an accredited environment because it makes no external calls.

Can it run fully offline / air-gapped?

Yes. The runtime has no phone-home — it runs with no network access at all, inside your own enclave.

Is “self-host” itself a compliance requirement?

No. It’s a deployment property that enables requirements like data sovereignty and network isolation (NIST 800-53 SC-7/AC-4, DoD IL5/IL6). We frame it as an enabler, not a mandate.

How heavy is the runtime to operate?

It’s a thin library, not a platform — no ops treadmill to run it in your own environment.

Sources

Verify it yourself.

The isolation and impact-level references this page relies on.

Bring us your hardest audit

It runs in your enclave, offline, open. Nothing to phone home.