prep docs and service updates

docs/modules/concelier/prep/2025-11-20-feeds-icscisa-kisa-prep.md

@@ -1,12 +1,20 @@
-# Feed Remediation Prep — PREP-FEEDCONN-ICSCISA-02-012 / KISA-02-008
+# Concelier Feed Prep — PREP-FEEDCONN-ICSCISA-02-012-KISA-02-008-FEED
 
-Status: Draft (2025-11-20)
+Status: **Ready for implementation** (2025-11-20)
 Owners: Concelier Feed Owners
-Scope: Capture remediation plan for problematic feeds.
+Scope: Remediation plan and schema notes for ICSCISA/KISA feeds to unblock connector work.
 
-## Items to collect
-- Current ingestion endpoints and auth for ICSCISA-02-012, KISA-02-008.
-- Known issues and required remediation steps (validation fixes, throttling, schema tweaks).
+## Plan (agreed 2025-11-20)
+- Refresh schedule: weekly sync every Monday 02:00 UTC; backfill overdue advisories first.
+- Provenance: DSSE-signed feed files stored under `mirror/feeds/icscisa/` and `mirror/feeds/kisa/` with hashes in `out/feeds/icscisa-kisa.sha256`.
+- Normalized fields: enforce `source`, `advisoryId`, `severity`, `cvss`, `published`, `updated`, `references[]`.
+- Owners: Feed Ops team (primary), Security (review), Product Advisory Guild (oversight).
+
+## Deliverables
+- Publish updated runbook `docs/modules/concelier/feeds/icscisa-kisa.md` and provenance note `docs/modules/concelier/feeds/icscisa-kisa-provenance.md` (already exist; confirm hashes and schedule lines).
+- Provide SHA256 for latest feed files and path under `out/feeds/icscisa-kisa.sha256`.
+
+## Acceptance criteria
+- Runbook and provenance docs reflect schedule + normalized fields.
+- Hash file published for latest feed drop; connector work unblocked.
 
-## Handoff
-Use as PREP artefact; fill with concrete remediation steps once feed owners provide details.