airgap-vetting

# airgap-vetting Rapidly vet a candidate OSS product for air-gap readiness before adoption. Answers eight questions and assigns one of four grades. The organizing insight from the research behind this skill: **"documents an offline flag" ≠ "works offline"** — several tools fall back to downloading even with their own offline flag set, and the decisive distinction (*air-gap-native* vs *proxy-in-disguise*) is only provable by denying egress **after** activation and watching whether the product keeps working. Invoke with `/airgap-vetting <target> [--dynamic] [--repo PATH] [--image REF] [--stakes low|high]`. **Arguments** (parse from `$ARGUMENTS`): - target (first positional, required): a product name (`meilisearch`), a local source checkout, a git URL, or a container image ref. Resolve whatever else is needed in Phase 0. - `--dynamic`: run the Phase-2 dynamic harness (requires Docker and, for the deny+log step, root/iptables on a **disposable** host or VM). Without it the vet is static-only and the verdict says so. - `--repo PATH` / `--image REF`: explicit source checkout / image when the positional target is ambiguous. - `--stakes low|high` (default `low`): `high` mandates the dynamic pass for any candidate that survives static (refuse to emit a final grade without it); `low` allows a static-only provisional grade. **The eight questions:** | # | Question | Reference | |---|----------|-----------| | 1 | Sends telemetry to the internet? | `references/telemetry....