ADR-003: Concelier Export Center Air-Gap Alignment

Status: Accepted Date: 2026-05-16 Sprint: SPRINT_20260513_001_Concelier_airgap_export_pipeline_gaps

This record fixes the ownership boundary between Concelier’s tactical exporters and the strategic Export Center, and sets the readiness order for the air-gap advisory-transport surfaces. Read it before touching any Concelier export path or claiming an air-gap transport in roadmap or release reporting.

Context

Concelier currently ships tactical in-module exporters for advisory JSON, Trivy DB materialization, and federation bundles. Export Center is the strategic owner for durable export profiles and transport surfaces, while the Mirror Thin Bundle Assembler owns the long-term thin-bundle shape for compact air-gap media.

The May 2026 air-gap export gap review found that the PostgreSQL COPY based stellaops-mirror-seed-v1 path is too heavy for routine update transport. It remains useful for disaster recovery and replica bootstrap, but routine operator flows need smaller profile-compatible artifacts.

Decision

  1. Tactical Concelier exporters must stay lift-and-shift compatible with Export Center profile semantics:
    • JSON output aligns to json:raw and json:policy data-family contracts.
    • Trivy DB output aligns to trivy:db and must not introduce Concelier-only profile names.
    • Federation bundles remain a Concelier synchronization path, but manifests, signatures, hashes, and cursor semantics must be representable by Export Center run metadata when ownership moves.
  2. stellaops-mirror-seed-v1 is officially disaster-recovery and replication only. It is not the default routine air-gap update transport.
  3. Routine air-gap advisory transport should be steered by readiness:
    • feedser-bundle/1.0 federation bundles are the preferred routine path once live full-scale export/import evidence is green.
    • json:raw / json:policy exports are suitable for evidence escrow and downstream normalization when the JSON exporter proof is green.
    • trivy:db remains scanner-feed transport only after the Trivy DB streaming/memory proof is green.
    • Thin bundles remain the strategic removable-media path owned by the Mirror Thin Bundle Assembler.
  4. The first end-to-end “bundle on USB -> air-gap import in under five minutes” demo is not yet documented. The closest documented evidence is SPRINT_20260514_001_AirGap_federation_e2e_tiers, which proves the federation live E2E path in under five minutes but does not exercise USB media. A PM follow-up sprint must name the USB demo before the roadmap can claim it.

Consequences