> ## Content Index
> Fetch the complete content index at: https://gridflex.ai/llms.txt
> Use this file to discover other available public pages before exploring further.

# Updating disconnected systems without the public internet
- URL: https://gridflex.ai/articles/updating-disconnected-systems/
- Published: 2026-11-08T06:56:25.000Z
- Updated: 2026-11-08T06:56:25.000Z
- Description: A disconnected system still needs updates. The question is how to deliver them with verified origin, customer approval and a tested way back.
- Author: Angel Beristain
- Tags: Lifecycle

Disconnecting a system removes one kind of risk, but it does not remove the need for updates. Software, dependencies and models change. The proposed GridFlex approach treats each update as a controlled, recorded change with a tested way back.

Proposed concept Updates: approval, verification and recovery

1. **Acquire** Get the release bundle through an approved channel.
2. **Authenticate** Check the signature and manifest. A checksum alone does not prove where a file came from.
3. **Approve** The customer approves, with two approvers where required.
4. **Transfer** Through an approved repository, maintenance gateway or controlled removable media.
5. **Verify on arrival** Check the signature and integrity again at the destination.
6. **Stage** Prepare the release without switching it on.
7. **Activate** Only with customer approval.
8. **Validate** Confirm the system works as expected.
9. **Record** Log versions, approvals and results.

**Recovery:** if validation fails or an installation is interrupted, return to a tested known-good version through an approved recovery path. Model updates must never silently change safety limits or shutdown authority.

## What a release bundle would contain

A release bundle would include the software and its dependencies, model and preprocessing versions, a signed manifest with hashes, compatibility and prerequisite information, a software bill of materials, release notes, evaluation results and recovery instructions.

## Origin matters

A checksum shows that a file has not changed in transit. On its own, it does not prove where the file came from. Signature verification against keys the customer trusts is what links a bundle to its publisher, and it is checked again at the destination.

## Delivery paths

Updates could arrive through a customer repository, an approved maintenance gateway, controlled removable media or other sponsor-authorized distribution. Tactical or operational links are not a default update channel.

## Approval and activation

Approval stays with the customer, with two approvers where required. Staging prepares a release without switching it on; activation happens only with approval; validation confirms the system works as expected before the change is recorded.

## Plan the way back

Recovery is tested before it is needed: a known-good version, handling of interrupted installations and database or configuration compatibility. Model updates must never silently change safety limits or shutdown authority.

More on the proposed [security and lifecycle](https://gridflex.ai/security/) approach.