docs: correct air-gapped and MySQL-egress overclaims (backend#1186)

[LukasWodka]

What this fixes

The factual-correction half of tracebloc/backend#1186 (RFC-0003 §9 messaging alignment). Two customer-facing claims in the docs were factually wrong — this PR corrects only those. Positioning/voice work is deferred to Lukas (see below).

Scope: docs repo only. No website copy, no terminology source-of-truth rewrite.

1. FAQ: "Do you support air-gapped clusters? Yes" — factually wrong

tools-help/faqs.mdx answered yes to air-gapped support. The environment is outbound-only and requires outbound HTTPS to the tracebloc platform (api.tracebloc.io + Service Bus) to run experiments — with no backend egress, experiments never leave Pending. A fully air-gapped cluster can't operate, so "yes" is an overclaim. (The linked INSTALL.md covers an offline chart install and proxy routing — not disconnected operation.)

• Before:"Do you support air-gapped clusters? — Yes, see the packaged-chart install path… for the offline flow."
• After: reframed to the capability we actually ship — offline packaged-chart install + corporate egress-proxy routing (HTTP_PROXY/HTTPS_PROXY) — and states plainly that the environment is outbound-only and not fully air-gapped. Uses the decided RFC-0003 §1 framing: defined, auditable ingress and egress; raw data never leaves your infrastructure; only the results and weights you choose to share are sent out.

Verified against tracebloc/client/docs/INSTALL.md (packaged-chart §2 + corporate-proxy note) and the outbound-host list.

2. Security page: training pods "can't reach MySQL" — factually wrong (it's the opposite)

environment-setup/security.mdx claimed training pods "are denied data egress — they can't reach MySQL, other pods, or the Kubernetes API." Training pods read their dataset from the in-cluster MySQL — the chart's NetworkPolicy (client/client/templates/network-policy-training.yaml, rule 3) explicitly permits TCP/3306 to the mysql-client pod; the template comment notes that without it the job CrashLoopBackOffs before the first batch. Separately, "denied data egress" isn't enforced by default today: networkPolicy.training.allowExternalHttps defaults true (values.yaml:188), so direct outbound HTTPS is currently allowed — the stricter lockdown ships with the chart but is off until an operator enables it (RFC-0003 §3.5 / D6, client-runtime#199).

• Before:"Training pods are denied data egress — they can't reach MySQL, other pods, or the Kubernetes API."
• After: accurately describes today's policy — all inbound denied; arbitrary pod-to-pod and the Kubernetes API blocked; the in-cluster MySQL (dataset) and the result/FLOPs proxy reachable; direct outbound HTTPS still allowed by default with a stricter gateway-routed lockdown available per cluster; enforcement requires a NetworkPolicy-honoring CNI.

Verified against the chart's NetworkPolicy template, values.yaml, and client/docs/SECURITY.md §4.2.

Deferred to Lukas (positioning / voice — intentionally NOT in this PR)

• Terminology source-of-truth definition — adding the channel-list ("three ingress, one egress, nothing sideways") as the quotable definition of "secure environment" in TERMINOLOGY.md.
• The workspace → secure environment rename across environment-setup/overview.mdx and security.mdx (e.g. "workspace ↔ platform traffic", "Your workspace needs outbound HTTPS…"). Terminology drift, not a factual error — left untouched here.
• Approved/banned phrasing table adoption (the draft's §(b)) — a voice decision, not applied.
• All tracebloc-website marketing copy — the draft flags several website hits (posts/tracebloc-engineer-guide.mdx, src/config/seo.config.ts keywords, "zero data movement", etc.); out of scope for this docs-only PR.
• Heading/anchor note: the FAQ heading changed from "Do you support air-gapped clusters?" to "Can I install offline or run behind an egress proxy?" (anchor changes accordingly). No internal links referenced the old anchor (swept). The word "air-gapped" is kept only in the negation ("not fully air-gapped") so searchers still land on the correction — Lukas can strip it entirely if he prefers.

Refs tracebloc/backend#1186.

🤖 Generated with Claude Code

---

Note

Low Risk
Documentation-only factual corrections with no runtime, auth, or data-path code changes.

Overview
Fixes two factually incorrect customer-facing claims in the security FAQ and setup docs (RFC-0003 §9 alignment).

environment-setup/security.mdx — Replaces the bullet that said training pods cannot reach MySQL with an accurate description of the chart’s NetworkPolicy: inbound denied, arbitrary pod-to-pod and Kubernetes API blocked, in-cluster MySQL and the result/FLOPs proxy allowed, default direct outbound HTTPS still on, optional stricter egress gateway, and CNI requirement linked to the EKS guide.

tools-help/faqs.mdx — Drops the “Do you support air-gapped clusters? Yes” answer in favor of “Can I install offline or run behind an egress proxy?”, covering packaged-chart install and HTTP_PROXY/HTTPS_PROXY, and stating plainly that operation is outbound-only and not fully air-gapped while describing defined ingress/egress and what may leave the infrastructure.

^{Reviewed by Cursor Bugbot for commit 454d5d6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
tracebloc	🟢 Ready	View Preview	Jul 23, 2026, 3:38 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
tracebloc	🟡 Building	–	Jul 23, 2026, 3:37 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.