MO-001c — Reproducibility

Go to MO-001 — Repeatable, Compliant, and Secure Infrastructure Environments

Crucible SHALL produce equivalent Infrastructure Environments from equivalent Controlled Inputs according to the applicable comparison criteria.

This requirement derives from:

• MO-001 — Repeatable, Compliant, and Secure Infrastructure Environments

The Original Requirement states:

Crucible SHALL enable rapid creation of repeatable, compliant, and secure infrastructure environments.[C1]

MO-001c preserves the portion of the Original Requirement that characterizes Infrastructure Environment creation as repeatable.

The separate requirements derived from MO-001 address:

• MO-001a — Infrastructure Environment Creation
• MO-001b — Deployment Duration
• MO-001d — Security Baseline Conformance
• MO-001e — Compliance Baseline Conformance

The Original Requirement uses repeatable without identifying:

• The inputs that remain controlled between executions
• The criteria used to determine whether inputs are equivalent
• The criteria used to determine whether resulting Infrastructure Environments are equivalent
• The characteristics included in the comparison
• The characteristics excluded from the comparison
• The operational conditions under which the comparison occurs

The term repeatable therefore does not support objective verification.

MO-001c:

• Replaces repeatable with the defined concept Reproducibility
• Identifies Crucible as the responsible actor
• Identifies equivalent Controlled Inputs as the basis for repeated execution
• Identifies equivalent Infrastructure Environments as the required outcome
• Requires the equivalence determination to use applicable comparison criteria
• Separates Reproducibility from environment creation, deployment duration, security, and compliance outcomes

Reproducibility enables an organization to recreate an Infrastructure Environment without relying on undocumented manual actions, uncontrolled inputs, or individual operator knowledge.

Equivalent Controlled Inputs provide a stable basis for repeated execution. Controlled Inputs include identified versions and representations of the descriptions, baselines, configurations, packages, Machine Images, Image Layers, and other Artifacts required to create the Infrastructure Environment.

The applicable comparison criteria determine whether two Infrastructure Environments are equivalent. The comparison criteria identify the characteristics that require equality or permitted equivalence, including applicable:

• Infrastructure resources
• Installed software
• Software versions
• Configuration values
• Security settings
• Network settings
• Enabled services
• Environment state
• Artifact identifiers and revisions
• Cryptographic digests
• Deployment outputs

Some characteristics can differ without preventing equivalence when the comparison criteria explicitly permit the difference. Examples include generated identifiers, timestamps, assigned network addresses, hardware-specific values, and environment-specific secrets.

This requirement does not require every bit or runtime value in two Infrastructure Environments to be identical. It requires equivalence according to identified and applicable comparison criteria.

Separating Reproducibility from MO-001a permits Crucible to create an Infrastructure Environment successfully while independently passing or failing the Reproducibility requirement.

This requirement applies to:

• Crucible
• Reproducibility
• Infrastructure Environments
• Controlled Inputs
• Declarative Descriptions
• Crucible Descriptions
• Baselines
• Baseline Composition
• Image Layers
• Infrastructure Baselines
• Machine Images
• Infrastructure Configurations
• Infrastructure Deployments
• Provisioning
• Artifacts
• Provenance
• Traceability
• Evidence

Verification confirms that:

1. Two or more executions use equivalent Controlled Inputs
2. Each execution creates an Infrastructure Environment
3. The applicable comparison criteria identify the characteristics included in the equivalence determination
4. The applicable comparison criteria identify any permitted differences
5. The resulting Infrastructure Environments satisfy the applicable comparison criteria

Verification includes:

• Controlled Input comparison
• Input identifier and revision inspection
• Artifact Representation comparison
• Cryptographic digest inspection
• Repeated Machine Image build tests
• Repeated Infrastructure Deployment tests
• Infrastructure state comparison
• Software inventory comparison
• Configuration comparison
• Service-state comparison
• Security-setting comparison
• Network-configuration comparison
• Deployment-output comparison
• Provenance inspection
• Traceability inspection

The verification record identifies:

1. Each execution
2. The Controlled Inputs used for each execution
3. The input identifiers and revisions
4. The applicable Artifact Representations
5. The comparison criteria
6. The characteristics included in the comparison
7. The permitted differences
8. The resulting Infrastructure Environments
9. The comparison results
10. The observed result
11. The generated Evidence

This requirement is realized by:

• OR-002 — Deployment Environments
• OR-003 — Classified and Unclassified Environments
• OR-004 — Concurrent Environment Management
• OR-005 — Distributed Environment Management
• FR-CFG-001 through FR-CFG-005
• FR-IMG-001 through FR-IMG-006
• FR-DEP-001 through FR-DEP-007
• FR-DSO-001 through FR-DSO-006
• FR-BAS-001 through FR-BAS-004
• FR-DEPC-001 through FR-DEPC-005
• KVP-003 — Improve Deployment Repeatability
• KVP-005 — Reduce Configuration Drift

• 5. Descriptions, Composition, and Baselines
• 6. Machine Images and Image Layers
• 7. Infrastructure and Deployment
• 8. Dependencies and Air Gap Operations
• 10. Reproducibility, Provenance, and Traceability

The following pages reference this requirement:

Phase 1 and subsequent phases

Not Assessed

Implementation status requires repeated execution of the current Crucible implementation and comparison of the resulting Infrastructure Environments according to the applicable comparison criteria.

Draft

This requirement derives from MO-001 in the Crucible System Requirements Specification, Version 1.1 Draft.

This requirement page should retain the stable requirement identifier MO-001c.

This page is a leaf requirement page and omits a trailing :start from its namespace.

Changes to the Statement SHALL preserve the Reproducibility intent derived from MO-001.

The applicable comparison criteria should identify:

• The Controlled Inputs subject to comparison
• The required input equivalence
• The Infrastructure Environment characteristics subject to comparison
• The required result equivalence
• Permitted differences
• Comparison methods
• Acceptance thresholds
• Required Evidence

Material changes should receive review and should update the related verification criteria, requirements realization, related architecture sections, and source records.

To reference this requirement Statement from another wiki page, insert:

{{section>dido:02-crusible:99-annexes:annex-c-requirements:01-mission-objectives:mo-001:mo-001c#Statement&noheader&nofooter&noeditbtn}}

Do not rename this page after an external citation unless a redirect or move plan is in place.