Idea
The data-feed layer already tracks per-feed freshness (datafeeds.cached_age_hours) and feeds list prints Nh old. But when --enrich/resolve_titles=True serves control titles from the cache — especially --offline in an air-gap — the analyze/SSP output gives no indication of how old the OSCAL 800-53 catalog behind those titles is.
For a compliance artifact, provenance matters: a title resolved from a catalog cached 14 months ago should be visibly distinguishable from a fresh one.
Proposed behavior
- When
resolve_titles=True, add to the summary a small provenance block, e.g.:
"feed_provenance": {
"feed_id": "oscal-800-53-rev5-catalog",
"age_hours": 312.4,
"offline": true
}
- The table renderer can print
Control titles resolved from NIST OSCAL 800-53 rev5 (cache 13.0d old).
- Optionally warn (non-fatal) when the cache exceeds a configurable staleness threshold.
Why it's real
analyze_boundary currently reports only a boolean feed_available. The age is already computable from the existing datafeeds API, so this is additive and cheap, and it makes the enrichment auditable — which is the whole point of pinning to the authoritative NIST catalog.
Idea
The data-feed layer already tracks per-feed freshness (
datafeeds.cached_age_hours) andfeeds listprintsNh old. But when--enrich/resolve_titles=Trueserves control titles from the cache — especially--offlinein an air-gap — the analyze/SSP output gives no indication of how old the OSCAL 800-53 catalog behind those titles is.For a compliance artifact, provenance matters: a title resolved from a catalog cached 14 months ago should be visibly distinguishable from a fresh one.
Proposed behavior
resolve_titles=True, add to the summary a small provenance block, e.g.:Control titles resolved from NIST OSCAL 800-53 rev5 (cache 13.0d old).Why it's real
analyze_boundarycurrently reports only a booleanfeed_available. The age is already computable from the existingdatafeedsAPI, so this is additive and cheap, and it makes the enrichment auditable — which is the whole point of pinning to the authoritative NIST catalog.