Install it with the network cable out.
How a site will install Kernwall OS on a box it already owns, from a USB stick to the first audited request, without the machine ever reaching the internet. This is the outline of the first release's install guide.
Before you start
What the install needs, and what it doesn't.
Everything happens inside your building. The only thing that crosses the gap is a signed file, the way your site already moves files.
- A Kernwall Desk-class box, or a server from the planned compatibility list
- Removable media your site allows, or a one-way data diode
- An import station: a workstation inside the wall that runs the offline verifier
- Your directory (Active Directory or LDAP), so people sign in with the accounts they have
- An internet connection, during the install or at any point after it
- A licence server, activation key or phone-home check
- A cloud account of any kind
Choosing the box: three ways to get one, or size it for your users.
Install guide · outline
Six steps from USB stick to first request.
Each step shows the session an operator would see. Commands and output follow the first-release design; the exact flags may change before it ships.
Check the image inside the wall
Copy the release onto media and check it on the import station, not on the laptop that downloaded it. The signature is verified offline, then the installer is written out with your site's trust root on it.
Boot from USB, cable out
On a server that trusts only Microsoft's keys, a signed shim starts the installer and asks someone at the console to enrol the release key, once. Pre-built appliances skip this: their keys are enrolled at the factory.
Written to slot A, read-only
The installer writes the signed image to slot A and keeps slot B free for the first update. GPU kernel modules arrive already signed for this kernel, so lockdown stays on.
Site key, sealed disk, your directory
One command creates the site signing key, seals the data volume to the measured boot, links your directory and arms the egress audit.
Import a model, then serve it
Models cross the same way the installer did: a signed bundle, verified and scanned on import. Only safetensors or GGUF get in; pickle files and remote code are refused.
First request, first audit record
Any OpenAI-compatible client works: point it at the appliance with a token from your directory. Each request is recorded with the user, the model digest and hashes of the prompt and the reply.
Architecture overview
Five layers and a loop on top.
What you just installed, top to bottom. Each layer has its spec table, sources and figures on the platform page; the threat model is on the trust page.
Own Your Intelligence loop
Your evals and data are the asset. Base models are replaceable.
Layer detailsAccreditation engine
Kernwall writes your evidence as it runs, not a consultant afterwards.
Layer detailsCross-gap delivery
One signed bundle carries OS, drivers, models and evidence across the gap.
Layer detailsImmutable OS
A read-only, image-based host with signed A/B updates and automatic rollback.
Layer detailsHardware root of trust
Your appliance proves what it booted before it unseals your data.
Layer detailsNot published yet
What this page will link to.
Until these exist, a design-partner pilot is the way to run the install: on your hardware, inside your wall, with us on site.
- The Community ISO and its detached signature
- The full install and operations guide this page outlines
- A signed changelog for each release
- The public source repositories