Running compliance-atlas air-gapped: snapshot the feed cache over sneakernet

[cognis-digital]

A few people have asked how the OSCAL + ATT&CK enrichment works without internet access. Here is the actual flow, now shipped as a runnable demo (demos/08_airgap_snapshot_roundtrip.py):

1. On a connected host, fetch + cache the feeds and export them to one archive:

   python -m atlas feeds update
   python -c "import datafeeds; datafeeds.snapshot_export('feeds.tar.gz')"

2. Carry feeds.tar.gz across to the air-gapped enclave (USB, one-way diode, whatever your policy allows).
3. Inside the enclave, point the cache somewhere local and import:

   export COGNIS_FEEDS_CACHE=/opt/atlas/feedcache
   python -c "import datafeeds; datafeeds.snapshot_import('feeds.tar.gz')"
   python -m atlas assess posture.json --framework 800-53 --enrich --offline

--offline guarantees the tool never touches the network — it serves entirely from the imported cache. The committed tests/fixtures/cache is a trimmed copy of exactly this, which is why the whole test + demo suite runs with zero network.

Curious how others are deploying this — CI runner with a pre-seeded cache? Periodic snapshot refresh job? Share your setup.