## Lesson — Maintain air-gapped enforcement invariant

**Tags:** security, architecture
**Scope:** README.md

The core enforcement layer must remain network-independent to ensure it can run natively in air-gapped environments without source code exfiltration.
