FR-AG-003 — Artifact Import Packages

Go to Crucible Air-Gapped Operations Requirements

Statement

Crucible SHALL import the identified Artifacts contained in an authorized Artifact Import Package after verifying the package integrity.

Source Statement

The system shall support artifact import packages.

Source

Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-AG-003.

Assessment

The source statement identifies a required package type but does not state the required import behavior.

The following Specification Discipline and Authoring findings apply:

The system does not use the defined system nameshall does not follow the established uppercase normative conventionSupport is a weak verbArtifact import packages does not identify whether Crucible creates, validates, stores, or consumes the packageThe source statement does not identify whether the package must be authorizedThe source statement does not identify whether package integrity must be verified before importThe source statement does not prescribe a package format, archive technology, storage medium, or integrity mechanismThe normalized Statement:

Replaces The system with CrucibleReplaces support with the direct behavior importIdentifies the Artifacts as the imported subjectsRequires package authorizationRequires package-integrity verification before importPreserves implementation independenceThis normalization relies on the established concepts of Transfer Authorization and Transfer Bundle Integrity.

Artifact Import Package should receive a glossary definition. It may be the destination-environment role of the same transferable package created as an Artifact Export Package rather than a structurally different package type.

Rationale

An Artifact Import Package supplies Artifacts and metadata to a destination environment after controlled transfer.

The import process may:

Read the package manifestIdentify the included ArtifactsVerify package integrityVerify Artifact content digestsVerify Digital SignaturesConfirm Transfer AuthorizationReject unauthorized or invalid contentPlace accepted Artifacts into local repositoriesRegister Artifact identifiers and revisionsPreserve provenance and traceability recordsA package created as an Artifact Export Package may become an Artifact Import Package when the destination environment receives and processes it.

FR-AG-003 does not independently authorize the imported Artifacts for deployment or operation. Separate approval, promotion, compliance, and deployment requirements govern those decisions.

Applies To

This requirement applies to:

Artifact Import PackagesArtifactsPackage manifestsArtifact identifiersArtifact revisionsContent digestsDigital signaturesTransfer AuthorizationsTransfer Bundle IntegrityLocal Artifact repositoriesDisconnected Environments

Verification

Verification SHALL confirm that the Artifact Import Package is authorizedVerification SHALL confirm that Crucible verifies the package integrity before importing its contentsVerification SHALL confirm that Crucible imports the identified Artifacts contained in a valid authorized packageVerification SHALL confirm that Crucible does not import the tested package when authorization or package-integrity verification failsVerification may include:

Authorized-package import testingUnauthorized-package testingModified-package testingManifest inspectionContent-digest comparisonDigital-signature verificationLocal repository inspectionImport-log inspectionThe verification record SHALL identify:

The Artifact Import PackageThe included ArtifactsThe Transfer AuthorizationThe package-integrity verification resultThe imported Artifact identifiersThe imported Artifact revisionsThe destination repositoryThe import resultThe generated Evidence

Outgoing Traceability

This requirement realizes:

This requirement relates to:

Referenced By

The wiki Backlinks function provides the current list of pages that reference FR-AG-003.

Incoming Traceability should be derived dynamically from backlinks rather than maintained as a duplicate manual list.

ConOps Relationship

The Crucible Concept of Operations describes receipt, integrity verification, and import of transferred Artifacts into a Disconnected Environment.

FR-AG-003 establishes the required import behavior for authorized Artifact packages.

Delivery Phase

Phase 1

Implementation Status

Not Assessed

Requirement Status

Draft

Notes for Editors

This requirement page should retain the stable requirement identifier FR-AG-003.

Changes to the Statement SHALL preserve the approved intent of the source requirement.

The Statement should remain limited to importing identified Artifacts from an authorized package after package-integrity verification.

Requirements for package creation, physical transfer, Artifact approval, Image Promotion, and deployment should remain separate.

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-05-air-gap-operations:fr-ag-003#Statement&noheader&nofooter&noeditbtn}}

Do not rename this page after an external citation unless a redirect or move plan is in place.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.