FR-AG-003 — Artifact Import Packages

Go to Crucible Air-Gapped Operations Requirements

Statement

Crucible SHALL import identified Artifacts from a Transfer Bundle into a destination environment.

Source Statement

The system shall support artifact import packages.

Source

Crucible System Requirements Specification, Version 1.1 Draft, Functional Requirements, FR-AG-003.

Assessment

The source statement identifies a required import package but does not provide a fully testable formulation.

The following Specification Discipline and Authoring findings apply:

The system does not use the defined system nameshall does not follow the established uppercase normative conventionSupport is a weak verb that does not identify the required behaviorArtifact import packages does not identify whether Crucible creates, verifies, stores, transfers, or imports the package contentsArtifact import packages does not use the defined Transfer Bundle conceptThe source statement does not identify the Artifacts imported from the packageThe source statement does not identify the destination environmentThe source statement does not prescribe a package format, archive technology, storage medium, repository implementation, transfer mechanism, or integrity mechanismThe normalized Statement:

Replaces The system with CrucibleReplaces support with the direct behavior importUses the defined Transfer Bundle conceptIdentifies the Artifacts as the imported subjectsIdentifies a destination environmentPreserves one Transfer Bundle identity across export, transfer, receipt, and importPreserves implementation independenceRetains one primary required behaviorThe normalized Statement does not create a separate Artifact Import Package concept. The package consumed during import is the same Transfer Bundle created for export.

Separate requirements govern:

Transfer across a Transfer BoundaryVerification of Transfer Bundle IntegrityApproval or promotion of imported ArtifactsDeployment of imported Artifacts

Rationale

A Transfer Bundle is a controlled package prepared for transfer between environments.

The same Transfer Bundle may participate in the following sequence:

creates the Transfer Bundle in a source environmentAn authorized process transfers the Transfer Bundle across a Transfer BoundaryA destination environment receives the Transfer BundleAn applicable process verifies Transfer Bundle IntegrityCrucible imports identified Artifacts from the Transfer BundleThe package does not become a different Artifact merely because it moves from an export context to an import context.

Preserving one Transfer Bundle identity maintains continuity among:

The source environmentThe destination environmentThe included ArtifactsThe applicable Transfer AuthorizationThe transfer operationThe import operationThe resulting EvidenceProvenanceTraceabilityThe import operation may process:

Deployment configurationsSoftware packagesDependenciesCompliance EvidenceDigital SignaturesContent digestsManifestsProvenance recordsTraceability recordsImport instructionsThe import operation may use Transfer Bundle information to identify:

The Transfer Bundle identifierThe Transfer Bundle RevisionThe included ArtifactsArtifact identifiersArtifact RevisionsArtifact content digestsThe source environmentThe destination environmentThe applicable Transfer AuthorizationTransfer Bundle Integrity informationThe creating actor or processThe creation timeThe applicable BaselineFR-AG-003 requires import of identified Artifacts from a Transfer Bundle. It does not independently authorize those Artifacts for operation, promotion, or deployment.

Applies To

This requirement applies to:

Package manifestsArtifact identifiersArtifact RevisionsContent digestsDigital SignaturesTransfer informationDestination environmentsLocal Artifact repositoriesEvidenceProvenanceTraceabilityTransfer BoundariesTransfer AuthorizationsTransfer Bundle IntegrityConnected EnvironmentsDisconnected Environments

Verification

Verification SHALL identify the Transfer Bundle selected for importVerification SHALL identify the Artifacts selected for import from the Transfer BundleVerification SHALL identify the destination environmentVerification SHALL confirm that Crucible imports the identified Artifacts from the Transfer Bundle into the destination environmentVerification SHALL confirm that the imported Artifacts correspond to the identified Artifacts contained in the Transfer BundleVerification may include:

Transfer Bundle import testingTransfer Bundle content inspectionManifest inspectionArtifact identifier comparisonArtifact Revision comparisonContent digest comparisonDestination repository inspectionProvenance inspectionTraceability inspectionImport log inspectionThe verification record SHALL identify:

The imported Transfer BundleThe Transfer Bundle identifierThe Transfer Bundle RevisionThe imported ArtifactsThe Artifact identifiersThe Artifact RevisionsThe package manifestThe destination environmentThe destination repositoryThe import resultThe generated Evidence

Outgoing Traceability

This requirement realizes:

This requirement relates to:

Referenced By

The wiki Backlinks function provides the current list of pages that reference FR-AG-003.

Incoming Traceability should be derived dynamically from backlinks rather than maintained as a duplicate manual list.

Backlinks identify incoming references but do not define the semantics of each relationship. Referencing pages should identify whether the relationship represents realization, refinement, verification, dependency, or another defined traceability relationship.

ConOps Relationship

The Crucible Concept of Operations describes a connected-to-disconnected supply chain in which Artifacts and Dependencies are packaged within a Transfer Bundle, transferred from a Connected Environment, and imported into a Disconnected Environment.

FR-AG-003 establishes the required behavior for importing identified Artifacts from the Transfer Bundle into the destination environment.

The Transfer Bundle retains the same controlled identity through export, transfer, receipt, integrity verification, and import.

Delivery Phase

Phase 1

Implementation Status

Not Assessed

Implementation status requires verification that Crucible imports identified Artifacts from a Transfer Bundle into a destination environment.

Requirement Status

Draft

The source System Requirements Specification identifies Version 1.1 as a draft.

Notes for Editors

This requirement page should retain the stable requirement identifier FR-AG-003.

Changes to the Statement SHALL preserve the approved intent of the source requirement.

The Source Statement should preserve the original visible wording from the controlling System Requirements Specification while linking applicable words and phrases to the controlling Terms and Definitions entries.

The source phrase artifact import packages maps to the defined Transfer Bundle concept.

The Statement should remain limited to importing identified Artifacts from a Transfer Bundle into a destination environment.

The requirement should not introduce separate Artifact Export Package and Artifact Import Package artifact types unless the controlling architecture later defines different package structures or identities.

Requirements for Transfer Authorization, transfer across a Transfer Boundary, verification of Transfer Bundle Integrity, Artifact approval, Image Promotion, and deployment should remain in their applicable requirement pages.

Verification criteria should test only the behavior stated in the normalized Statement and should not introduce additional normative obligations.

Incoming Traceability should use the wiki Backlinks function rather than a manually maintained list.

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:03-functional-requirements:03-05-air-gap-operations:fr-ag-003#Statement&noheader&nofooter&noeditbtn}}

Do not rename this page after an external citation unless a redirect or move plan is in place.

© 2026 Dido Solutions, Inc. and Jackrabbit Consulting, Inc.