Does Substrate need the internet?

No. Substrate does not need the internet for anything. It serves models, indexes documents, keeps memory, trains adapters, records operations, and verifies its own integrity entirely on the appliance. There is no feature that degrades without a connection, because the platform was never given one to depend on. The appliance has no default path out and does not make outbound connections on its own behalf.

The rest of this article goes through the places where people expect a dependency to hide and explains why none does.

Serving, retrieval, and adaptation

Inference runs open-weight models loaded onto the Czar. Language, vision, speech, embedding, and vision-language-action models answer calls from the facility network with nothing external consulted. A caller declares a latency budget, the pool meets it or says it cannot, and the caller falls back locally if needed. None of that path touches anything outside the rack.

Retrieval grounds answers in the site's own documents. On an air-gapped site the documents are loaded onto the appliance or read from an isolated store on the same segment. The index is built and held locally. Memory, which keeps agents coherent across sessions, lives on the appliance too.

Adaptation is the service people most often assume needs a cloud. It does not. Fine-tuning an open model on the site's captures happens on the Czar or across the Grid, and the resulting adapter is stored where it was trained. This is often the strongest reason a disconnected site wants Substrate at all: its floor data is exactly the data it cannot send out, and Adaptation lets that data improve the models without going anywhere.

Updates, monitoring, and integrity

Updates arrive as signed bundles. On a connected site the customer downloads a bundle from the portal to their own machine and moves it onto the facility network. On an air-gapped site the bundle is carried in on media. The appliance verifies the signature, loads the release, and keeps the previous one for rollback. At no point does the appliance fetch anything.

Monitoring is read from inside. Health, Evaluation traces, and Watchman's integrity record are exposed on the facility network for the site's own tooling. There is no external dashboard and no telemetry stream. Watchman itself checks the signed image and the enclosure continuously with no outside reference.

Support and the portal

Support lives on the customer portal, which is an authenticated site for the customer's staff. The appliance never connects to it. When a site needs a remote session, the customer requests and opens it. On a sovereign site that requires the customer's attestation that data disks are detached, the network is isolated, the console is supervised, and the requester has authority. The session carries a hard expiry. This is a customer act through a door the customer holds, not a dependency the platform has.

A connected site is not using the internet either. It has declared Local Bridge routes to on-premise systems it already secures, inside the same building. Connected means connected to the warehouse system down the hall, not to anything beyond the perimeter. Posture is a per-site choice on the same platform, and the question of whether Substrate needs the internet has the same answer on every posture. The security overview at /security describes the model in full.