# Nexus One AI Offline Server Payload

This directory defines the payload embedded by `build-iso-offline.sh`. The
offline installer is deliberately separate from the existing online bootstrap
ISO until disconnected clean-install validation is complete.

The agreed bootable release matrix is:

1. Online Universal Server ISO with Server S/M/L/Max selection.
2. Offline Workstation ISO.
3. Offline Server S/M ISO.
4. Offline Server L/Max ISO.

Large models remain separate signed model packs. Signed update bundles patch
installed appliances without an operating-system reinstall, and validated
updates are periodically rolled into refreshed ISO builds.

## Offline Workstation contents

- the exact `aipackage` source revision used for the build
- Ubuntu, Docker, NVIDIA and appliance `.deb` packages
- Python wheels for the backend, RAG, ChromaDB and optional JupyterLab
- Miniconda installer and an offline Python 3.11 environment package
- Ollama runtime with `phi3:mini` and `nomic-embed-text`
- vLLM and web/monitoring container images
- the pinned Phi-3 Hugging Face model snapshot used by vLLM
- K3s, MinIO and `mc` binaries for update/model packs (not enabled by Starter)
- SHA-256 manifests and build provenance

Server L/Max models are intentionally separate signed model packs. Optional external
connectors cannot operate without a customer-approved route to their target.

## Build stages

1. On a connected Ubuntu 22.04 staging host with at least 80 GiB free, run
   `sudo bash autoinstall/offline/build-bundle.sh`.
2. Review `autoinstall/offline-output/manifest/` and sign
   `SHA256SUMS` with the release key.
3. Run `sudo bash autoinstall/build-iso-offline.sh` to inject the verified
   payload into the Ubuntu Server ISO.
4. Validate with all network interfaces disconnected.

The bundle builder fails closed when an expected payload is absent. An ISO must
not be labelled offline merely because the source tree was embedded.