There is a kind of deployment where the security review does not end with a firewall rule. It ends with a wall. The machines that will run your pipelines and train your models sit in a room with no route to the internet, and the cable is not misplaced or pending: it is unplugged by policy, and it will stay that way. Most AutoML tooling quietly assumes the opposite. It expects a package registry one request away, model weights on a CDN, license checks against a vendor server, and a telemetry endpoint receiving usage events nobody reads.

You cannot bolt an air gap onto that design after the fact. The disconnected case has to be the primary case. That is how we build 0plus for these rooms: every mechanism that normally leans on the network (updates, models, monitoring, promotion) is designed to work from artifacts that walk in through a controlled door and never ask to leave.

Updates arrive as signed bundles

An offline update is not an installer that fails gracefully without a connection. It is one self-contained bundle: container images, dependency archives, database migrations, configuration schemas, and a manifest listing the hash of every file inside. The bundle is signed when it is built, and the signature is verified at the transfer station against public keys placed in the room at commissioning. If a byte changed in transit, the bundle does not install. If the manifest lists something the bundle does not carry, it does not install either.

  • One artifact per release: images, dependencies, migrations, and manifest travel together, so there is no partial state.
  • Signatures verify offline against keys already inside the room. No certificate chain ever fetches from the network.
  • Every bundle carries its rollback: the previous version restores from the same media, with no second import.
  • The installer has no network code path at all, so a misconfigured proxy cannot become a quiet egress channel.

The change process is the one your governance team already runs. A bundle enters through the same review, approval, and logging that any artifact crossing the boundary receives, and the audit log records which bundle, which signature, which operator, and which hour.

Model packs on a deliberate cadence

Models are the update that matters most, so they get their own artifact: the model pack. A pack carries the weights for Arabic and English language models, the AutoML search spaces and tokenizers that depend on them, and the evaluation suite we used to accept the pack before it shipped. Nothing in a pack requires a download at install time, because a pack is not a pointer to weights. It is the weights.

The evaluation suite is the part teams underestimate. Inside the room, you re-run the acceptance tests on your own hardware before anything is promoted: Arabic document understanding, SQL generation, retrieval quality. The pack does not ask you to trust our lab. It hands you the harness and lets your numbers decide.

Drift monitoring without call-home

Hosted AutoML products answer the drift question with telemetry: your feature distributions stream to the vendor, and a dashboard streams back. In an air-gapped room that trade is not available, and it was never a good trade. Drift is a property of your data, so the monitoring belongs where the data lives. In 0plus, drift metrics are computed in the room and stored as governed tables in the lakehouse, under the same lineage and access controls as every other table.

-- nightly drift check. computed and stored in the room.
INSERT INTO ops.feature_drift
SELECT feature_name,
       psi(train_dist, live_dist) AS psi,
       CURRENT_DATE AS run_date
FROM   ops.feature_snapshots
WHERE  snapshot_date = CURRENT_DATE;
-- psi above 0.2 opens a review task. nothing calls home.

Alerts route to review workflows inside the perimeter: a threshold crossing opens a task, the task points at the exact tables and model version involved, and the audit log records who looked and what they decided. When an auditor asks how you watch your models, the answer is a set of tables they can query, not a vendor portal they cannot see.

If a monitoring signal has to leave the room to be useful, it is not monitoring. It is egress with a dashboard attached.

Staged promotion inside the room

A new model never replaces a serving model just because it installed cleanly. Promotion is staged entirely inside the perimeter. The candidate scores shadow traffic next to the champion, its predictions land in comparison tables nobody acts on, and the two are evaluated on the same governed data over a window your policy defines. Business owners see the comparison in the workspace. Approval is a recorded decision, not a deploy script someone ran.

The promotion record

When the candidate wins, the lineage graph ties the whole story together: the bundle that delivered the pack, the signature that admitted it, the evaluation run that qualified it, the approval that promoted it, and the first production prediction it served. One question gets answered from inside the room: why does this model run in production, and who said so.

The cable stays unplugged

The honest cost of this discipline is cadence. A room like this will not run this week's frontier model this week, and updates land on the rhythm of your change board, not our release calendar. For some teams that is the wrong trade. For a ministry, a bank, or a hospital group, the kinds of organizations these rooms are built for, it is the only acceptable one: every capability the platform gains is a signed, reviewed, reversible event.

AutoML in an air-gapped room is not a degraded version of AutoML on the internet. It is the same assembly line (connect, prepare, analyze, decide, govern), with one property made absolute: nothing about operating it, updating it, or watching it requires a packet to cross the wall. The cable is unplugged by policy. The platform is built so it never notices.