Attacks · By business pattern
Mint and enforce without a network path out. Twin and local validation still deny forgery and replay when the estate cannot phone home for every check.
~5 min readDeep-link: Forgery
Air-gapped attackers still try conversion: smuggle ambient keys across the gap, replay captured envelopes later, or forge formats that offline verifiers might accept. Isolation does not erase ambient credential logic if the gap still runs on long-lived secrets.
Ambient air-gap practice often means “sneakernet the key list” and hope copies stay synchronized. That recreates vault and revocation-bypass families inside the isolated estate.
Foundry mint plus local twin validation keep one-shot envelopes enforceable without a path out. Replay burn and forgery validate still apply. Deep-link forgery, replay, and vault for dual plates — the pattern is offline enforcement, not a new cryptosystem.
Ops still matters: protect mint ceremonies and twin material — without turning them into ambient API keys for every call.
Mint authority without the path
How to read: forge tray left; weak-MAC ambient win. Takeaway: format familiarity is mistaken for authority.
Ambient air-gap failure is the sneaker-net key list that still converts into callers.
Twins must validate
How to read: handmade-envelope myths fail; twin validate rejects forge. Takeaway: no mint without the authorized path.
Local twin validate plus burn keep mint-without-path and replay from paying offline.