3.1 Connectivity Conditions

Go to 3. Operational Environment

Crucible operates under connectivity conditions that determine which repositories, services, dependencies, providers, and external resources are available during a lifecycle activity.

The principal connectivity conditions are:

• Connected Environments
• Disconnected Environments
• Air-Gapped Environments

These conditions affect how Crucible obtains inputs, resolves dependencies, performs assessments, transfers artifacts, deploys environments, and preserves Provenance, Traceability, and Evidence.

A Connected Environment permits authorized access to external resources required by a selected lifecycle activity.

Depending on the approved configuration and applicable access controls, these resources can include:

• Source-code repositories
• Baseline repositories
• Package repositories
• Container registries
• Machine-image repositories
• Compliance-content repositories
• Cloud and infrastructure provider interfaces
• Identity, logging, and assessment services

Connectivity does not imply unrestricted access. Crucible uses only the resources authorized for the environment and lifecycle activity.

Connected operation can support direct retrieval of identified and version-controlled inputs. Crucible records the information needed to establish the origin, version, integrity, and use of those inputs.

A Disconnected Environment cannot rely on continuous access to resources outside its operational boundary.

Before executing a lifecycle activity in a Disconnected Environment, the required software, dependencies, images, Baselines, compliance content, configuration, and supporting records must be available within the boundary.

Crucible supports disconnected operation by using locally available resources such as:

• Dependency Stores
• Offline Repositories
• Local image repositories
• Local source and Baseline repositories
• Imported Transfer Bundles
• Locally available compliance criteria and assessment content

A disconnected lifecycle activity must not depend on an unauthorized or unavailable external resource. The required inputs must be identified, preserved, transferred, and made available before execution.

An Air-Gapped Environment is a Disconnected Environment that applies stronger physical, logical, procedural, or administrative separation from external networks and resources.

Movement into or out of an Air-Gapped Environment occurs through an authorized transfer process. The process can include:

• Selection of permitted artifacts
• Construction of a Transfer Bundle
• Integrity-value generation
• Malware and policy assessment
• Export authorization
• Physical or controlled electronic transfer
• Import validation
• Population of local repositories
• Recording of transfer and import Evidence

Crucible does not bypass the controls governing an Air-Gapped Environment. The responsible organization determines the permitted transfer mechanisms, review procedures, handling rules, and approval authorities.

Crucible must be able to perform the selected disconnected lifecycle activities without relying on resources outside the applicable boundary.

External resource independence requires the organization to identify and preserve all inputs needed for the activity, including direct and transitive Build Dependencies.

A missing dependency, inaccessible service, unresolved reference, or unauthorized external call can prevent reproduction of the intended result. Crucible therefore records dependency information and supports preparation of the local repositories required for disconnected execution.

External resource independence does not require every possible resource to exist inside the boundary. It requires the resources needed for the selected and approved lifecycle activities to be available within the boundary.

The connectivity conditions describe resource availability and boundary restrictions rather than different Crucible products.

A lifecycle activity can begin in a Connected Environment, produce a controlled set of artifacts and dependencies, transfer those artifacts across an authorized boundary, and continue in a Disconnected or Air-Gapped Environment.

The operational relationship can be summarized as:

1. Identify the lifecycle activity and required inputs
2. Obtain and preserve the required inputs in a Connected Environment
3. Record versions, integrity values, Provenance, and dependency relationships
4. Package the permitted content for transfer
5. Transfer the content through an authorized process
6. Import and validate the content within the receiving environment
7. Populate local repositories
8. Execute the lifecycle activity without unauthorized external dependencies
9. Preserve Traceability between the connected and disconnected results

Detailed connected workflows appear in Section 6: Connected Operations. Detailed disconnected and air-gapped workflows appear in Section 7: Disconnected and Air-Gapped Operations.

—-