tests fixes and sprints work

docs/modules/airgap/README.md

@@ -39,6 +39,7 @@ Key settings:
 - `subject`: sha256 (+ optional sha512) digest of the bundle target.
 - `timestamps`: RFC3161/eIDAS timestamp entries with TSA chain/OCSP/CRL refs.
 - `rekorProofs`: entry body/inclusion proof paths plus signed entry timestamp for offline verification.
+- Inline artifacts (no `path`) are capped at 4 MiB; larger artifacts are written under `artifacts/`.
 
 ## Dependencies
 
@@ -55,6 +56,63 @@ Key settings:
 - Mirror: `../mirror/`
 - ExportCenter: `../export-center/`
 
+## Evidence Bundles for Air-Gapped Verification
+
+The AirGap module supports golden corpus evidence bundles for offline verification of patch provenance. These bundles enable auditors to verify security patch status without network access.
+
+### Bundle Contents
+
+Evidence bundles follow the OCI format and contain:
+- Pre/post binaries with debug symbols
+- Canonical SBOM for each binary
+- DSSE delta-sig predicate proving patch status
+- Build provenance (if available from buildinfo)
+- RFC 3161 timestamps for each signed artifact
+- Validation run results and KPIs
+
+### Bundle Export
+
+```bash
+stella groundtruth bundle export \
+  --packages openssl,zlib,glibc \
+  --distros debian,fedora \
+  --output symbol-bundle.tar.gz \
+  --sign-with cosign
+```
+
+### Bundle Import and Verification
+
+```bash
+stella groundtruth bundle import \
+  --input symbol-bundle.tar.gz \
+  --verify-signature \
+  --trusted-keys /etc/stellaops/trusted-keys.pub \
+  --output verification-report.md
+```
+
+### Standalone Verifier
+
+For air-gapped environments without the full Stella Ops stack, use the standalone verifier:
+
+```bash
+stella-verifier verify \
+  --bundle evidence-bundle.oci.tar \
+  --trusted-keys trusted-keys.pub \
+  --trust-profile eu-eidas.trustprofile.json \
+  --output report.json
+```
+
+Exit codes:
+- `0`: All verifications passed
+- `1`: One or more verifications failed
+- `2`: Invalid input or configuration error
+
+### Related Documentation
+
+- [Golden Corpus Layout](../binary-index/golden-corpus-layout.md)
+- [Golden Corpus Maintenance](../binary-index/golden-corpus-maintenance.md)
+- [Golden Corpus Operations Runbook](../../runbooks/golden-corpus-operations.md)
+
 ## Current Status
 
 Implemented with Controller for snapshot export and Importer for secure ingestion. Staleness policies enforce time-bound validity. Integrated with ExportCenter for bundle packaging and all data modules for content export/import.