Disconnecting a system removes one kind of risk, but it does not remove the need for updates. Software, dependencies and models change. The proposed GridFlex approach treats each update as a controlled, recorded change with a tested way back.
- Acquire Get the release bundle through an approved channel.
- Authenticate Check the signature and manifest. A checksum alone does not prove where a file came from.
- Approve The customer approves, with two approvers where required.
- Transfer Through an approved repository, maintenance gateway or controlled removable media.
- Verify on arrival Check the signature and integrity again at the destination.
- Stage Prepare the release without switching it on.
- Activate Only with customer approval.
- Validate Confirm the system works as expected.
- Record Log versions, approvals and results.
Recovery: if validation fails or an installation is interrupted, return to a tested known-good version through an approved recovery path. Model updates must never silently change safety limits or shutdown authority.
What a release bundle would contain
A release bundle would include the software and its dependencies, model and preprocessing versions, a signed manifest with hashes, compatibility and prerequisite information, a software bill of materials, release notes, evaluation results and recovery instructions.
Origin matters
A checksum shows that a file has not changed in transit. On its own, it does not prove where the file came from. Signature verification against keys the customer trusts is what links a bundle to its publisher, and it is checked again at the destination.
Delivery paths
Updates could arrive through a customer repository, an approved maintenance gateway, controlled removable media or other sponsor-authorized distribution. Tactical or operational links are not a default update channel.
Approval and activation
Approval stays with the customer, with two approvers where required. Staging prepares a release without switching it on; activation happens only with approval; validation confirms the system works as expected before the change is recorded.
Plan the way back
Recovery is tested before it is needed: a known-good version, handling of interrupted installations and database or configuration compatibility. Model updates must never silently change safety limits or shutdown authority.
More on the proposed security and lifecycle approach.