Technical Documentation

GAIA — Architecture & Security Model

Version 1.0 · air-gapped code security scanner · SoundByGAIA

1. Overview

GAIA is an on-premise static analysis tool that detects exposed secrets and insecure patterns in source code. It is designed for environments where sending source code to a third-party cloud service is unacceptable: regulated FinTech, healthcare, defense, and any air-gapped pipeline.

The tool is a single native binary (Linux x86-64). It has no runtime dependencies, no installer, and no configuration server.

2. Security model — zero egress

GAIA performs no network activity at any point — not during scanning, not during license verification. This is not a policy setting; it is a property of the build.

Source: the codebase contains no networking, HTTP, or socket code.
Binary: no TLS or networking libraries are linked (only the C runtime).
Runtime: executed under strace -e trace=network, GAIA produces zero network syscalls.

# Verify it yourself: $ strace -f -e trace=network gaia ./src → 0 socket/connect calls. Your code, findings and license never leave the host.

3. Architecture

Two languages, each doing what it is best at:

Layer	Language	Responsibility
Parsing & I/O	Rust (safe)	Directory traversal, pattern extraction, report generation. Memory-safe, no manual allocation.
Rule & risk core	Ada / SPARK	Severity classification and financial-risk scoring, compiled statically into the binary (FFI). Formally verified with SPARK (gnatprove): proven free of runtime errors — no overflow, no range violation, guaranteed termination. The scoring IP is not shipped as readable source.

Detection is fully deterministic — the same input always yields the same output. There is no AI, no model, no probabilistic component. Results are reproducible and auditable.

The Ada rule core carries SPARK contracts (preconditions, postconditions) and passes gnatprove with all checks proved — a machine-checked mathematical guarantee that the risk-scoring logic cannot crash or overflow on any input.

4. Offline license verification

Licenses are Ed25519-signed tokens. Each key carries a product, tier and identifier, signed with a private key held only by the vendor. The binary embeds the corresponding public key and verifies signatures locally.

No activation server, no phone-home, no internet required.
Forged keys fail signature verification and are rejected.
Keys are product-scoped: a key for one product does not unlock another.

export GAIA_LICENSE="GAIA_ENT_…" # delivered by e-mail after purchase gaia ./src # full report unlocked, verified offline

5. Assurance & hardening

Before release, GAIA is validated beyond unit tests:

Real-world corpus: executed against 4,000+ files from real production repositories (multiple languages, including minified and generated artifacts) — zero crashes or hangs.
Mutational fuzzing: exercised with 1,000+ adversarial inputs (null bytes, oversized lines, malformed UTF-8, pathological patterns) — zero crashes or hangs.
Automated QA gate: interface and edge-case suite must pass with zero failures before any build ships.

Memory safety is provided by the Rust layer; the Ada rule core is pure, allocation-free arithmetic, which is structurally leak-free.

6. Compliance posture

Because GAIA never transmits data off the host, it introduces no new data-processing surface. It supports data-residency and sovereignty requirements under GDPR and KVKK by keeping all source, findings and telemetry local. GAIA is a tool that aids compliance; it is not itself a certification.

7. Deployment

Drop the binary into a CI/CD stage or run it on a developer workstation:

# CI stage — fail the build on findings - name: Secret scan run: ./gaia ./src --json | tee gaia-report.json

For unlimited-developer, air-gapped, or procurement-based deployments, see Team / Site licensing or contact webacan@gmail.com.