FR-AG-002 — Artifact Export Packages

Go to Crucible Air-Gapped Operations Requirements

Statement

Crucible SHALL create a Transfer Bundle for identified Artifacts.

Source Statement

The system shall support artifact export packages.

Source

Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-AG-002.

Assessment

The source statement identifies a required export package but does not provide a fully testable formulation.

The following Specification Discipline and Authoring findings apply:

The system does not use the defined system nameshall does not follow the established uppercase normative conventionSupport is a weak verb that does not identify the required behaviorArtifact export packages does not identify whether Crucible creates, verifies, transfers, or imports the packageArtifact export packages does not use the defined Transfer Bundle conceptThe source statement does not identify the Artifacts included in the packageThe source statement does not prescribe a package format, archive technology, storage medium, transfer mechanism, or cryptographic mechanismThe normalized Statement:

Replaces The system with CrucibleReplaces support with the direct behavior createUses the defined Transfer Bundle conceptIdentifies the Artifacts for which the Transfer Bundle is createdPreserves one Transfer Bundle identity across export, transfer, and importPreserves implementation independenceRetains one primary required behaviorThe normalized Statement does not create a separate Artifact Export Package concept. The package created for export is a Transfer Bundle.

Separate requirements govern:

Transfer across a Transfer BoundaryVerification of Transfer Bundle IntegrityImport of the Transfer BundleApproval or promotion of imported ArtifactsDeployment of imported Artifacts

Rationale

A Transfer Bundle is the controlled package prepared for transfer between environments.

The same Transfer Bundle may participate in the following sequence:

Crucible creates the Transfer Bundle in a source environmentAn authorized process transfers the Transfer Bundle across a Transfer BoundaryA destination environment receives the Transfer BundleCrucible verifies Transfer Bundle IntegrityCrucible imports accepted Artifacts from the Transfer BundleThe package does not become a different artifact merely because it moves from an export context to an import context.

Preserving one Transfer Bundle identity maintains continuity among:

The source environmentThe destination environmentThe included ArtifactsThe applicable Transfer AuthorizationThe transfer operationThe import operationThe resulting EvidenceProvenanceTraceabilityA Transfer Bundle may contain:

Deployment configurationsSoftware packagesDependenciesCompliance EvidenceDigital SignaturesContent digestsManifestsProvenance recordsTraceability recordsImport instructionsTransfer Bundle information may identify:

The Transfer Bundle identifierThe Transfer Bundle RevisionThe included ArtifactsArtifact identifiersArtifact RevisionsArtifact content digestsThe source environmentThe intended destination environmentThe applicable Transfer AuthorizationTransfer Bundle Integrity informationThe creating actor or processThe creation timeThe applicable BaselineFR-AG-002 requires creation of the Transfer Bundle. It does not independently require transfer, import, deployment, or approval of the included Artifacts.

Applies To

This requirement applies to:

Package manifestsArtifact identifiersArtifact RevisionsContent digestsDigital SignaturesTransfer informationEvidenceProvenanceTraceabilityTransfer BoundariesTransfer AuthorizationsTransfer Bundle IntegrityConnected EnvironmentsDisconnected Environments

Verification

Verification SHALL identify the Artifacts selected for inclusionVerification SHALL confirm that Crucible creates a Transfer Bundle for the identified ArtifactsVerification SHALL confirm that the created Transfer Bundle contains the identified ArtifactsVerification SHALL confirm that the created package satisfies the definition of a Transfer BundleVerification may include:

Transfer Bundle creation testingTransfer Bundle content inspectionManifest inspectionArtifact identifier comparisonArtifact Revision comparisonContent digest comparisonTransfer information inspectionProvenance inspectionTraceability inspectionThe verification record SHALL identify:

The created Transfer BundleThe Transfer Bundle identifierThe Transfer Bundle RevisionThe included ArtifactsThe Artifact identifiersThe Artifact RevisionsThe package manifestThe associated transfer informationThe creation resultThe generated Evidence

Outgoing Traceability

This requirement realizes:

This requirement relates to:

Referenced By

The wiki Backlinks function provides the current list of pages that reference FR-AG-002.

Incoming Traceability should be derived dynamically from backlinks rather than maintained as a duplicate manual list.

Backlinks identify incoming references but do not define the semantics of each relationship. Referencing pages should identify whether the relationship represents realization, refinement, verification, dependency, or another defined traceability relationship.

ConOps Relationship

The Crucible Concept of Operations describes a connected-to-disconnected supply chain in which Artifacts and Dependencies are collected within a Connected Environment and packaged for controlled transfer to a Disconnected Environment.

FR-AG-002 establishes the required behavior for creating the Transfer Bundle used by that supply chain.

The Transfer Bundle retains the same controlled identity through export, transfer, receipt, integrity verification, and import.

Delivery Phase

Phase 1

Implementation Status

Not Assessed

Implementation status requires verification that Crucible creates a Transfer Bundle for identified Artifacts.

Requirement Status

Draft

The source System Requirements Specification identifies Version 1.1 as a draft.

Notes for Editors

This requirement page should retain the stable requirement identifier FR-AG-002.

Changes to the Statement SHALL preserve the approved intent of the source requirement.

The Source Statement should preserve the original visible wording from the controlling System Requirements Specification while linking applicable words and phrases to the controlling Terms and Definitions entries.

The source phrase artifact export packages maps to the defined Transfer Bundle concept.

The Statement should remain limited to creation of a Transfer Bundle for identified Artifacts.

The requirement should not introduce separate Artifact Export Package and Artifact Import Package artifact types unless the controlling architecture later defines different package structures or identities.

Requirements for Transfer Authorization, transfer across a Transfer Boundary, verification of Transfer Bundle Integrity, import, approval, and deployment should remain in their applicable requirement pages.

Verification criteria should test only the behavior stated in the normalized Statement and should not introduce additional normative obligations.

Incoming Traceability should use the wiki Backlinks function rather than a manually maintained list.

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-05-air-gap-operations:fr-ag-002#Statement&noheader&nofooter&noeditbtn}}

Do not rename this page after an external citation unless a redirect or move plan is in place.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.