Complete RC6 supply chain gates

docs/CI_SUPPLY_CHAIN.md

@@ -0,0 +1,119 @@
+# CI and supply-chain release gates
+
+GeoIntel uses the same release gates in Gitea Actions and GitHub Actions:
+
+- `.gitea/workflows/release-gates.yml`
+- `.github/workflows/release-gates.yml`
+
+Gitea is the operational source-control platform. The GitHub workflow is kept
+equivalent so a mirror or external review does not receive a weaker gate.
+
+## Runner requirements
+
+The `ubuntu-latest` runner must provide:
+
+- outbound HTTPS access to PyPI, npm, Docker Hub and vulnerability databases;
+- Python 3.11 and Node 20 through the official setup actions;
+- Bash and Docker with Compose v2;
+- permission to build images and mount `/var/run/docker.sock`;
+- sufficient disk for the all-in-one GIS image and scanner databases.
+
+The container job builds the GIS release variant only. PyTorch and
+Ultralytics remain in the optional `ai` extra and in the explicit AI image
+variant; CI does not silently make them base dependencies.
+
+## Quality gate
+
+The quality job installs:
+
+```bash
+python -m pip install --require-hashes -r backend/requirements-ci.lock
+python -m pip install --no-deps -e backend
+cd frontend && npm ci
+```
+
+It then validates the lock policy and runs the complete readiness script. The
+readiness script covers backend compile/tests, contract audits, Alembic
+single-head, frontend typecheck/build and release-script syntax. CI also
+renders offline migration SQL and resolved Compose configuration as retained
+evidence.
+
+## Reproducible Python lock
+
+`backend/requirements-runtime.lock` and `backend/requirements-ci.lock` are
+generated in a digest-pinned Linux Python 3.11 container. The runtime lock
+contains base and GIS packages used by the release image. The CI lock adds
+developer/test dependencies. Both use package hashes and deliberately exclude
+the optional AI dependency group.
+
+Regenerate after changing relevant `pyproject.toml` dependencies:
+
+```bash
+bash scripts/generate_python_lock.sh
+python scripts/verify_python_lock.py
+```
+
+The all-in-one frontend build uses `npm ci`; the non-AI runtime installs the
+hashed runtime lock. The optional AI image additionally uses explicit
+PyTorch, torchvision and Ultralytics build-argument versions.
+
+Do not hand-edit dependency versions or hashes in either generated lock.
+`verify_python_lock.py` rejects a stale input fingerprint, another Python
+generation version, unhashed packages, missing direct dependencies and AI
+packages leaking into the standard CI environment.
+
+## Vulnerability policy
+
+The dependency job:
+
+- fails on any non-excepted vulnerability reported by `pip-audit` for the
+  complete exact lock without platform-specific re-resolution;
+- fails when `npm audit --audit-level=high` finds a high or critical frontend
+  dependency vulnerability;
+- publishes both unfiltered and policy-filtered Python JSON reports plus the
+  npm JSON report, including on failure.
+
+The only current Python exceptions are the Starlette 2026 advisories recorded
+in `security/pip-audit-exceptions.json`. FastAPI 0.139.2 still constrains
+Starlette below 0.53 while patched releases begin at 1.x. GeoIntel applies
+request-target, form-content, route-class and Linux-runtime compensating
+controls. The exception file has a mandatory review date; readiness and CI
+fail automatically after it expires. New advisories are never auto-ignored.
+
+The container job builds a non-AI all-in-one image and uses digest-pinned
+scanner images:
+
+- Syft 1.44.0 generates an SPDX JSON SBOM;
+- Trivy 0.70.0 generates a complete JSON vulnerability report;
+- fixed high or critical image vulnerabilities fail the gate;
+- unfixed findings remain in the full report and require explicit release
+  review, but do not make a rebuild impossible when no patched package exists.
+
+Run these controls on a Docker-enabled workstation:
+
+```bash
+docker build \
+  -f deploy/unraid/Dockerfile.all-in-one \
+  --build-arg GEOINTEL_INSTALL_AI=false \
+  --build-arg GEOINTEL_BUILD_SHA=local \
+  --build-arg GEOINTEL_BUILD_TIME=local \
+  -t geointel-ci:local .
+bash scripts/generate_container_sbom.sh geointel-ci:local
+bash scripts/scan_container_image.sh geointel-ci:local
+```
+
+Outputs are written below ignored `artifacts/`; scanner cache is written below
+ignored `.cache/trivy/`.
+
+## Published evidence
+
+Every workflow run retains:
+
+- offline Alembic upgrade SQL;
+- resolved Docker Compose configuration;
+- pip-audit and npm-audit JSON;
+- image inspection metadata;
+- SPDX JSON SBOM;
+- complete Trivy JSON report.
+
+No secret or plaintext database credential belongs in these artefacts.

docs/CODEX_EXECUTION_LOG.md

@@ -56,6 +56,11 @@
 - Added an explicit release upgrade verifier that composes the checksum-backed
   isolated restore drill with the deployed image's Alembic chain and destroys
   only the generated verification database.
+- Tower release `944269c25b1d7647c2ef468df75e195d045d8c0c` completed that
+  isolated upgrade proof against backup
+  `rc-belgium-north-sea-fc42ea9-secure`: checksums and retained counts matched,
+  PostGIS 3.6 and Alembic `202607160001` passed, the temporary database was
+  removed and the evidence records the production database as untouched.
 
 - Froze the RC geography as all Belgian land plus the separately labelled
   territorial sea, EEZ and continental shelf.

docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md

@@ -147,9 +147,9 @@ editions and licences must still pass source-specific probes before activation.
 | RC-1 | complete | backup, restore and data safety |
 | RC-2 | complete | health, capabilities and stale-runtime correctness |
 | RC-3 | complete | temporal detection/QA correctness and observability |
-| RC-4 | in progress | national/maritime scope and provider coverage contracts |
-| RC-5 | pending | deployment, secrets, configuration, fresh install and rollback |
-| RC-6 | pending | complete CI, dependency and supply-chain gates |
+| RC-4 | complete | national/maritime scope and provider coverage contracts |
+| RC-5 | complete | deployment, secrets, configuration, fresh install and rollback |
+| RC-6 | in progress | complete CI, dependency and supply-chain gates |
 | RC-7 | pending | critical API envelope typing and contract validation |
 | RC-8 | pending | frontend and browser E2E release journeys |
 | RC-9 | pending | loading, accessibility and performance hardening |
@@ -291,10 +291,13 @@ errors.
 
 ## RC-4 - Belgium and North Sea coverage foundation
 
-**State: in progress.** The national coverage registry, canonical
-catalog/resolve API, explicit NGI/RBINS operator, frontend selection matrix and
-focused safety tests are implemented. Local readiness is green. Tower
-fetch-only, persistence, live API and browser acceptance remain the phase exit.
+**State: complete.** Tower persists one idempotent national workspace with
+eight distinct land/maritime areas and six ready authoritative datasets
+containing 685 features. The coverage catalog and resolver report operational,
+partial, not-configured and unsupported states honestly for Belgium, all three
+regions and the Belgian maritime zones. Live browser acceptance proved the
+national default context, coverage-only selection and responsive 390/1920 px
+layouts while unavailable detailed regional themes remain explicit.
 
 ### Work
 
@@ -342,6 +345,15 @@ fetch-only, persistence, live API and browser acceptance remain the phase exit.
 
 ## RC-5 - Production deployment and rollback
 
+**State: complete.** Tower runs a commit-plus-AI-profile immutable image with
+OCI revision/build labels. Repeated deploys reuse the exact image and preserve
+the actual prior release. A fresh install passed on isolated volumes, manual
+rollback passed against retained production mounts, and the release image
+upgraded a checksum-verified 1.4 GiB backup in a generated temporary database
+at PostGIS 3.6/Alembic `202607160001` before removing it. Production startup is
+fail-closed for default secrets and invalid upload limits, nginx/backend limits
+are aligned, and all operator-owned settings are editable in Unraid.
+
 ### Work
 
 - align backend, nginx and proxy upload/time limits;

docs/TODO.md

@@ -18,11 +18,11 @@ maritieme zones.
   het vaste Sprint 7-providerregister te wijzigen.
 - [x] RC-4: expliciete NGI/RBINS-operator en selectiegebonden coverage-API
   implementeren en lokaal valideren.
-- [ ] RC-4: Tower fetch-only, canonieke persistence en live browseracceptatie
+- [x] RC-4: Tower fetch-only, canonieke persistence en live browseracceptatie
   bewijzen.
-- [ ] RC-4: nationale basisdekking, Wallonie, Brussel en Belgische Noordzee via
-  beheerde providers en golden areas operationaliseren.
-- [ ] RC-5: secrets/configuratie/uploadlimieten/immutable deploy en rollback
+- [x] RC-4: nationale basisdekking en expliciete coverage-contracten voor
+  Wallonie, Brussel en de Belgische Noordzee via golden areas operationaliseren.
+- [x] RC-5: secrets/configuratie/uploadlimieten/immutable deploy en rollback
   bewijzen.
 - [ ] RC-6: volledige CI, dependency-audit, containerscan en SBOM toevoegen.
 - [ ] RC-7: kritieke API-routes concrete responsemodellen geven.