Add governed orthophoto release promotion
This commit is contained in:
Codex
@@ -476,6 +476,17 @@ containment, sampled flight dates/years, local comparison state and
|
||||
`staging_permitted`. It performs no pixel request, upload, Job, Dataset write
|
||||
or legacy metadata rewrite. This operator script adds no public API contract.
|
||||
|
||||
Governed pixel promotion remains outside the HTTP request cycle in
|
||||
`scripts/manage_orthophoto_release.py`. `plan` reruns that read-only preflight;
|
||||
`stage` makes exactly one allowlisted bounded `Ortho` GetMap request and writes
|
||||
only checksummed source/raster/preview evidence; `review` requires a named
|
||||
approval; and `apply` requires the exact plan/review SHA-256 values. Apply
|
||||
revalidates the remote identity and local comparison state, then delegates to
|
||||
the existing `POST .../datasets/upload` contract with `dataset_type=raster`,
|
||||
`source_name=digitaal_vlaanderen_orthophoto`, the official `YYYY.NN`
|
||||
`source_version` and complete source/provenance metadata. No release endpoint,
|
||||
provider URL parameter, Job type or alternate response envelope is added.
|
||||
|
||||
The endpoint accepts no arbitrary URL, feature query, area or layer. It does
|
||||
not fetch vector features, raster pixels or models, create jobs/datasets, write
|
||||
to PostGIS or trigger an import. The normal `source-freshness` endpoint remains
|
||||
|
||||
@@ -9767,3 +9767,35 @@ Boundary:
|
||||
backfill existing orthophotos. A future stage/review/apply coordinator must
|
||||
revalidate and retain the exact preflight identity before creating a new
|
||||
immutable raster Dataset with official `YYYY.NN` source version.
|
||||
|
||||
## Sprint 231 - Governed orthophoto release promotion (2026-07-17)
|
||||
|
||||
Implemented:
|
||||
- Added `scripts/manage_orthophoto_release.py` with separate `plan`, `stage`,
|
||||
named `review` and checksum-confirmed `apply` actions for one bounded current
|
||||
orthophoto selection. No action is scheduled or browser-triggered.
|
||||
- Reused the complete Sprint 230 preflight identity. Stage performs exactly one
|
||||
allowlisted WMS `Ortho` GetMap, retains the exact source response, creates a
|
||||
three-band EPSG:31370 GeoTIFF plus PNG preview and mutates no Dataset.
|
||||
- Bound remote catalog/WMS/WCS/flight evidence, request identity, all staged
|
||||
file hashes, reviewer and the final Dataset checksum into atomic persistent
|
||||
evidence. Host/path drift, oversize responses, modified bytes, stale local
|
||||
state and missing exact confirmations fail closed.
|
||||
- Added a double-confirmed first official baseline transition for legacy
|
||||
`most_recent_at_*` markers. Apply retains every legacy raster and uses only
|
||||
the existing canonical upload/DatasetService transaction.
|
||||
- Made the latest official `YYYY.NN` Dataset authoritative for source-catalog
|
||||
comparison even when a newer-imported rolling marker also exists. No API,
|
||||
migration, release table, Job type or frontend behavior changed.
|
||||
|
||||
Validation so far:
|
||||
- 38 focused Sprint 222/230/231 tests pass with deprecations treated as errors.
|
||||
Coverage includes official-edition ordering, first-baseline authorization,
|
||||
GetMap allowlisting/limits, RGB/CRS normalization, preview generation,
|
||||
tampering, preflight drift, named review, loopback-only apply and complete
|
||||
upload provenance.
|
||||
|
||||
Next:
|
||||
- Run complete readiness, deploy the packaged operator to Tower, inspect the
|
||||
live bounded Mol review preview and only then apply the first official
|
||||
`2025.04` immutable baseline with explicit review evidence.
|
||||
|
||||
@@ -291,13 +291,15 @@ annual Dataset, DatasetVersion and vector_features records with
|
||||
`source_version=<year>-definitive`. Earlier annual snapshots are retained and
|
||||
provisional v1/v2 publications cannot create rows.
|
||||
|
||||
The current-orthophoto release preflight likewise adds no lifecycle table or
|
||||
migration. It is read-only and creates neither Dataset nor Job. It compares the
|
||||
existing local `source_version` with the official `YYYY.NN` catalog edition
|
||||
and verifies WMS/WCS/flight-day evidence for one bounded selection. A later
|
||||
governed pixel apply must still create an immutable raster Dataset plus
|
||||
DatasetVersion through DatasetService and retain that exact edition/evidence;
|
||||
direct metadata backfill of legacy `most_recent_at_*` rows is prohibited.
|
||||
Current-orthophoto release management likewise adds no lifecycle table or
|
||||
migration. Preflight is read-only; stage and named review are filesystem-only.
|
||||
Approved apply uploads the exact checksummed EPSG:31370 GeoTIFF through the
|
||||
existing dataset endpoint and DatasetService transaction, creating one normal
|
||||
immutable raster Dataset and DatasetVersion with official `YYYY.NN`
|
||||
`source_version`, temporal flight-date evidence and release provenance.
|
||||
Official editions take precedence over legacy rolling markers in catalog
|
||||
comparison, but direct metadata backfill, update or deletion of those legacy
|
||||
rows remains prohibited.
|
||||
|
||||
## Geometry normalization
|
||||
|
||||
|
||||
+13
-2
@@ -24,7 +24,7 @@ aanvraag. GeoIntel verzint geen historische pixelopnamedatum. Bronnen:
|
||||
- https://www.vlaanderen.be/datavindplaats/catalogus/orthofotomozaiek-middenschalig-winteropnamen-kleur-meest-recent-vlaanderen
|
||||
- https://www.vlaanderen.be/digitaal-vlaanderen/onze-diensten-en-platformen/luchtopnamen/gebruik-orthofotomozaieken
|
||||
|
||||
Voor een toekomstige rolling-releasebeslissing gebruikt
|
||||
Voor een rolling-releasebeslissing gebruikt
|
||||
`scripts/orthophoto_release_preflight.py` uitsluitend metadata. Het bindt de
|
||||
lokale `most_recent`-productvariant aan de officiële ISO-editie en exacte WMS-
|
||||
capabilitieshash, controleert het EPSG:31370/15 cm/driebanden-rasterdomein via
|
||||
@@ -39,6 +39,17 @@ union. Een selectie met ontbrekende contourpunten, meerdere/afwijkende
|
||||
vluchtjaren, gewijzigde service-identiteit of een niet-vergelijkbare lokale
|
||||
`most_recent_at_*` marker is niet stagebaar.
|
||||
|
||||
`scripts/manage_orthophoto_release.py` voert daarna uitsluitend op expliciet
|
||||
operatorverzoek `plan`, `stage`, `review` en `apply` uit. Stage haalt exact een
|
||||
begrensde `Ortho`-GetMap op, bewaart bronresponse, genormaliseerde RGB-GeoTIFF
|
||||
en review-PNG met checksums, maar schrijft geen Dataset. Review koppelt een
|
||||
benoemde goedkeuring aan exact die bytes. Apply valideert preflight, plan,
|
||||
review en lokale bronstaat opnieuw en gebruikt vervolgens de bestaande
|
||||
Dataset-uploadroute. De nieuwe Dataset krijgt de officiële `YYYY.NN`-editie;
|
||||
oude `most_recent_at_*` rasters blijven onveranderd bewaard. De eerste overgang
|
||||
vereist een aparte baselinevlag plus de exacte oude marker. Er is geen
|
||||
scheduler, browserfetch of automatische vervanging.
|
||||
|
||||
Dit document verzamelt concrete databronnen voor GeoIntel Kempen.
|
||||
|
||||
## Cross-domain official area profile
|
||||
@@ -189,7 +200,7 @@ gebeurd.
|
||||
| GRB gebouwen/wegen/water/percelen | operationele, expliciete plan-stage-apply refresh met onveranderlijke snapshots | alleen een nieuw officieel gedateerd cataloguseditie na operatorbevestiging ophalen |
|
||||
| Statbel bevolking | jaarlijkse, expliciete edities in één tijdreeks; officiële DCAT-releaseprobe | een nieuwe publicatie alleen na schema-, sectorgeometrie- en totalencontrole toevoegen |
|
||||
| ALZ landbouwgebruikspercelen | definitieve jaarlijkse edities 2008-2025; expliciete publicatieprobe en plan-stage-review-apply promotie; metricvergelijking zonder objectlineage | alleen een nieuwere definitieve v3-editie na gestagede schema-/codelijst-/scopecontrole en benoemde review toevoegen |
|
||||
| orthofoto | vaste lokale opname per expliciete analysezone; read-only releasepreflight voor variant, officiële editie, exact WCS-domein en begrensd vluchtjaarbewijs | eerst officiële lokale editieprovenance vastleggen; daarna pas een afzonderlijke menselijke pixel-stage/apply-flow bouwen |
|
||||
| orthofoto | vaste lokale analyseopnamen plus operationele preflight en benoemde plan-stage-review-apply-promotie voor een officiële `YYYY.NN`-editie | alleen een nieuwere officiële editie als afzonderlijke immutable Dataset promoveren na verse evidence en review |
|
||||
| landgebruik, thematische rasters, DHMV en VMM-scenario's | vaste product-/scenario-edities, geen rolling snapshot | alleen een nieuwe gedocumenteerde producteditie als afzonderlijke Dataset verwerven |
|
||||
| bodemkaart en historische kaarten | historische referentie-editie | niet als verouderde actuele bron labelen; alleen vervangen bij een officiële inhoudelijke heruitgave |
|
||||
| BWK/Natura 2000 en gebouwen-/adressenregister | expliciete actuele snapshot met eigen methodologische betekenis | eerst een stabiele officiële editieprobe en bron-specifieke reconciliatiecontrole toevoegen |
|
||||
|
||||
@@ -274,12 +274,16 @@ layer, observation label, `observed_at`, optional `valid_from`/`valid_to`,
|
||||
temporal granularity, request/spatial hash, attribution and a limitation that
|
||||
states whether the product is annual, multi-year or merely most recent.
|
||||
|
||||
A future rolling `most_recent` import must also retain the exact official
|
||||
A governed rolling `most_recent` release import must also retain the exact official
|
||||
`YYYY.NN` edition and the preflight identities for WMS capabilities, WCS
|
||||
coverage description, selected EPSG:31370 domain and sampled flight year. A
|
||||
legacy `most_recent_at_<date>` value is acquisition timing, not an official
|
||||
edition, and cannot be promoted or compared as if it were one. The read-only
|
||||
preflight creates no Dataset and does not retroactively rewrite that evidence.
|
||||
edition, and cannot be compared as if it were one. The read-only preflight
|
||||
creates no Dataset. Stage retains the exact source response, normalized
|
||||
three-band EPSG:31370 GeoTIFF and review preview. Apply requires exact plan and
|
||||
review hashes, persists sampled official flight dates as the temporal evidence
|
||||
range and creates a new Dataset/DatasetVersion through DatasetService. It does
|
||||
not retroactively rewrite or delete legacy rows.
|
||||
|
||||
### Hydrological station observations
|
||||
|
||||
|
||||
@@ -148,12 +148,27 @@ in source/provenance metadata. Browser PNG rendering is derived on request and
|
||||
does not replace the stored GeoTIFF.
|
||||
|
||||
The orthophoto release preflight writes no source file, raster or database row.
|
||||
Its JSON stdout may be retained by an operator as review evidence, but it is
|
||||
not itself staging authorization. The report binds official WMS and WCS XML
|
||||
hashes, the exact selected domain and hashed flight-day sample evidence. A
|
||||
future pixel stage must persist and revalidate that identity separately before
|
||||
DatasetService is called; existing `most_recent_at_*` raster metadata is not
|
||||
silently rewritten.
|
||||
Its JSON stdout is not staging authorization. Governed release evidence is
|
||||
retained separately per scope, official edition and exact selection hash:
|
||||
|
||||
```text
|
||||
storage/operator-evidence/orthophoto-release/{scope}/{YYYY.NN}/{selection-hash}/
|
||||
official-wms-response.tif
|
||||
orthophoto_{YYYY.NN}_{selection-hash}.tif
|
||||
review-preview.png
|
||||
staged-manifest.json
|
||||
staged-plan.json
|
||||
review-evidence.json
|
||||
applied-evidence.json
|
||||
```
|
||||
|
||||
The manifest binds the one bounded source response, normalized three-band
|
||||
EPSG:31370 GeoTIFF and PNG preview. The plan also binds WMS/WCS/catalog and
|
||||
flight-day preflight identities; review binds a named approval; applied
|
||||
evidence binds both to the immutable Dataset id and checksum. Paths outside
|
||||
this root, changed files and changed provider/local state fail closed. Only the
|
||||
normalized GeoTIFF enters ordinary Dataset storage through DatasetService.
|
||||
Existing `most_recent_at_*` raster metadata is never rewritten.
|
||||
|
||||
DHMV II DTM/DSM outputs are also normal raster Dataset files. The provider WCS
|
||||
returns multipart coverage data; GeoIntel retains response and extracted
|
||||
|
||||
+3
-3
@@ -692,6 +692,6 @@ This file now starts with the current implementation status. Older preparation/b
|
||||
campaign-snapshot and definitive-archive publication contract.
|
||||
- [x] Add a read-only orthophoto preflight for product variant, official
|
||||
edition, exact WCS selected-area domain and deterministic flight-year points.
|
||||
- [ ] Keep orthophoto pixel refresh manual and blocked until a separate
|
||||
plan-stage-review-apply flow can retain the passed preflight identity and
|
||||
create a new immutable Dataset with official `YYYY.NN` source version.
|
||||
- [x] Keep orthophoto pixel refresh manual through a separate
|
||||
plan-stage-review-apply flow that retains the passed preflight identity and
|
||||
creates a new immutable Dataset with official `YYYY.NN` source version.
|
||||
|
||||
Reference in New Issue
Block a user