FR-AG-002 — Artifact Export Packages

Go to Crucible Air-Gapped Operations Requirements

Crucible SHALL create a Transfer Bundle for identified Artifacts.

The system shall support artifact export packages.

Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-AG-002.

The source statement identifies a required export package but does not provide a fully testable formulation.

The following Specification Discipline and Authoring findings apply:

• The system does not use the defined system name
• shall does not follow the established uppercase normative convention
• Support is a weak verb that does not identify the required behavior
• Artifact export packages does not identify whether Crucible creates, verifies, transfers, or imports the package
• Artifact export packages does not use the defined Transfer Bundle concept
• The source statement does not identify the Artifacts included in the package
• The source statement does not prescribe a package format, archive technology, storage medium, transfer mechanism, or cryptographic mechanism

The normalized Statement:

• Replaces The system with Crucible
• Replaces support with the direct behavior create
• Uses the defined Transfer Bundle concept
• Identifies the Artifacts for which the Transfer Bundle is created
• Preserves one Transfer Bundle identity across export, transfer, and import
• Preserves implementation independence
• Retains one primary required behavior

The normalized Statement does not create a separate Artifact Export Package concept. The package created for export is a Transfer Bundle.

Separate requirements govern:

• Transfer Authorization
• Transfer across a Transfer Boundary
• Verification of Transfer Bundle Integrity
• Import of the Transfer Bundle
• Approval or promotion of imported Artifacts
• Deployment of imported Artifacts

A Transfer Bundle is the controlled package prepared for transfer between environments.

The same Transfer Bundle may participate in the following sequence:

• Crucible creates the Transfer Bundle in a source environment
• An authorized process transfers the Transfer Bundle across a Transfer Boundary
• A destination environment receives the Transfer Bundle
• Crucible verifies Transfer Bundle Integrity
• Crucible imports accepted Artifacts from the Transfer Bundle

The package does not become a different artifact merely because it moves from an export context to an import context.

Preserving one Transfer Bundle identity maintains continuity among:

• The source environment
• The destination environment
• The included Artifacts
• The applicable Transfer Authorization
• The transfer operation
• The import operation
• The resulting Evidence
• Provenance
• Traceability

A Transfer Bundle may contain:

• Machine Images
• Container Images
• Infrastructure Configurations
• Baselines
• Deployment configurations
• Software packages
• Dependencies
• Compliance Evidence
• Digital Signatures
• Content digests
• Manifests
• Provenance records
• Traceability records
• Import instructions

Transfer Bundle information may identify:

• The Transfer Bundle identifier
• The Transfer Bundle Revision
• The included Artifacts
• Artifact identifiers
• Artifact Revisions
• Artifact content digests
• The source environment
• The intended destination environment
• The applicable Transfer Authorization
• Transfer Bundle Integrity information
• The creating actor or process
• The creation time
• The applicable Baseline

FR-AG-002 requires creation of the Transfer Bundle. It does not independently require transfer, import, deployment, or approval of the included Artifacts.

This requirement applies to:

• Crucible
• Transfer Bundles
• Artifacts
• Dependencies
• Package manifests
• Artifact identifiers
• Artifact Revisions
• Content digests
• Digital Signatures
• Transfer information
• Evidence
• Provenance
• Traceability
• Transfer Boundaries
• Transfer Authorizations
• Transfer Bundle Integrity
• Connected Environments
• Disconnected Environments

1. Verification SHALL identify the Artifacts selected for inclusion
2. Verification SHALL confirm that Crucible creates a Transfer Bundle for the identified Artifacts
3. Verification SHALL confirm that the created Transfer Bundle contains the identified Artifacts
4. Verification SHALL confirm that the created package satisfies the definition of a Transfer Bundle

Verification may include:

• Transfer Bundle creation testing
• Transfer Bundle content inspection
• Manifest inspection
• Artifact identifier comparison
• Artifact Revision comparison
• Content digest comparison
• Transfer information inspection
• Provenance inspection
• Traceability inspection

The verification record SHALL identify:

1. The created Transfer Bundle
2. The Transfer Bundle identifier
3. The Transfer Bundle Revision
4. The included Artifacts
5. The Artifact identifiers
6. The Artifact Revisions
7. The package manifest
8. The associated transfer information
9. The creation result
10. The generated Evidence

This requirement realizes:

• MO-004
• MO-006

This requirement relates to:

• FR-AG-001 — Disconnected Deployment Operations
• FR-AG-003 — Artifact Import Packages
• FR-AG-004 — Baseline Synchronization
• FR-AG-005 — Deployment Traceability Across Disconnected Environments
• C.3.10 Dependency Capture and Offline Transfer
• 8. Dependencies and Air Gap Operations
• 10. Reproducibility, Provenance, and Traceability

The wiki Backlinks function provides the current list of pages that reference FR-AG-002.

Incoming Traceability should be derived dynamically from backlinks rather than maintained as a duplicate manual list.

Backlinks identify incoming references but do not define the semantics of each relationship. Referencing pages should identify whether the relationship represents realization, refinement, verification, dependency, or another defined traceability relationship.

The Crucible Concept of Operations describes a connected-to-disconnected supply chain in which Artifacts and Dependencies are collected within a Connected Environment and packaged for controlled transfer to a Disconnected Environment.

FR-AG-002 establishes the required behavior for creating the Transfer Bundle used by that supply chain.

The Transfer Bundle retains the same controlled identity through export, transfer, receipt, integrity verification, and import.

Phase 1

Not Assessed

Implementation status requires verification that Crucible creates a Transfer Bundle for identified Artifacts.

Draft

The source System Requirements Specification identifies Version 1.1 as a draft.

This requirement page should retain the stable requirement identifier FR-AG-002.

Changes to the Statement SHALL preserve the approved intent of the source requirement.

The Source Statement should preserve the original visible wording from the controlling System Requirements Specification while linking applicable words and phrases to the controlling Terms and Definitions entries.

The source phrase artifact export packages maps to the defined Transfer Bundle concept.

The Statement should remain limited to creation of a Transfer Bundle for identified Artifacts.

The requirement should not introduce separate Artifact Export Package and Artifact Import Package artifact types unless the controlling architecture later defines different package structures or identities.

Requirements for Transfer Authorization, transfer across a Transfer Boundary, verification of Transfer Bundle Integrity, import, approval, and deployment should remain in their applicable requirement pages.

Verification criteria should test only the behavior stated in the normalized Statement and should not introduce additional normative obligations.

Incoming Traceability should use the wiki Backlinks function rather than a manually maintained list.

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-05-air-gap-operations:fr-ag-002#Statement&noheader&nofooter&noeditbtn}}

Do not rename this page after an external citation unless a redirect or move plan is in place.