Add governed source freshness audit

2026-07-16 15:05:42 +02:00
parent 2723043e3d
commit 1e0e7b6499
22 changed files with 1148 additions and 0 deletions
@@ -1688,6 +1688,26 @@ for an explicit source refetch.
 operators use canonical APIs and persistent operator-evidence storage. They do
 not run on application startup.

+## Read-only source freshness audit
+
+Inspect the persisted publication, version and storage evidence for one
+project without contacting an external provider:
+
+```bash
+docker exec geointel python /app/scripts/audit_source_freshness.py \
+  --project-id 82a85913-c522-45d7-84a1-02b393d89e55 \
+  --api-url http://127.0.0.1/api/v1 \
+  --fail-on integrity
+```
+
+Add `--output /app/storage/operator-evidence/source-freshness/latest.json` for
+a persistent JSON evidence copy. `--fail-on integrity` exits non-zero only for
+missing versions/checksum/file/size evidence; `due` also gates planned source
+reviews and `attention` additionally gates unclassified sources. This command
+uses one canonical `GET`, changes no application data and performs no source
+download. It can therefore be scheduled explicitly through Unraid cron without
+turning GeoIntel into a real-time monitoring system.
+
 ## Tower deployment

 Push the local branch to Gitea, then rebuild the Unraid/Tower Docker runtime: