feat: add governed nationwide AOI orchestration and CUDA enforcement

docs/AUDIT_REMEDIATION_ROADMAP.md

@@ -0,0 +1,108 @@
+# Audit remediation roadmap
+
+Status: active, 2026-07-26
+
+## Release outcome
+
+GeoIntel may accept every valid AOI inside the governed Belgium and Belgian
+North Sea scope. It may only call a theme operational where bounded processing,
+source coverage, provenance, resolution and validation evidence support that
+claim. Production AI inference on the server uses its NVIDIA GPU and fails
+closed when CUDA is unavailable; CPU fallback is not an accepted production
+state.
+
+## Wave 0 - Runtime truth and NVIDIA GPU (in progress)
+
+- expose the NVIDIA device to the Unraid container;
+- set `YOLO_DEVICE=cuda:0` and `YOLO_REQUIRE_CUDA=true` in the server runtime;
+- make preflight and model loading reject missing CUDA instead of using CPU;
+- report configured device, CUDA requirement and accelerator readiness;
+- rebuild on Tower and capture `nvidia-smi`, CUDA-enabled PyTorch, preflight and
+  one bounded inference smoke as release evidence.
+
+Exit gate: the live container sees the NVIDIA GPU, `torch.cuda.is_available()`
+is true, preflight is ready, and a persisted smoke run records the configured
+CUDA device. A CPU-only image or unavailable device remains `not_configured` /
+unavailable and cannot run production inference.
+
+## Wave 1 - General AOI orchestration (in progress)
+
+- [x] introduce one persisted parent operation with source-specific partitions;
+- [x] derive partitions from provider side budgets supplied by the governed plan;
+- [x] support queued execution, bounded retries, checkpoints and restart recovery;
+- make partition application idempotent and retain exact request/checksum
+  provenance;
+- [x] reuse source-aware vector deduplication and raster mosaic contracts and
+  aggregate their Dataset identities into one parent result;
+- [x] expose one progress/result contract to the frontend system workspace.
+
+Start with existing orthophoto, GRB and raster partition services; do not create
+a second provider or persistence path. Keep per-source limits internal. A source
+that cannot cover a partition returns explicit partial/not_configured evidence.
+
+Exit gate: interrupted cross-region and coastal golden AOIs resume without
+duplicate rows and finish as one inspectable result.
+
+## Wave 2 - Zone x theme x source coverage truth (implemented; live gate pending)
+
+- [x] materialize the resolver contract for land, regions and legal maritime zones;
+- [x] evaluate partition-union spatial coverage and expose source edition,
+  resolution, time, CRS, attribution, licence and checksum evidence;
+- [x] derive only `operational`, `partial`, `not_configured` or `unsupported`;
+- [x] show missing partitions and limitations in API and map states;
+- [x] prohibit UI wording that implies complete national analysis from selection
+  acceptance alone.
+
+Exit gate: all frozen golden areas have checksum-bound coverage evidence and no
+theme is promoted from file presence or a Mol-only success.
+
+## Wave 3 - Source completion
+
+- resolve North Sea bathymetry through a TLS-valid, authority-approved endpoint
+  or reviewed bounded operator acquisition; never bypass TLS;
+- close configured orthophoto/nature/soil gaps for Wallonia where authoritative
+  machine access permits;
+- close Brussels orthophoto gaps and retain unsupported statuses where no
+  source-appropriate analytical contract exists;
+- add explicit external-catalog review evidence for the six source families
+  currently requiring review.
+
+Exit gate: every required theme/zone cell has current evidence and honest status;
+vertical datums remain separate and water volume remains unavailable without a
+governed compatible model.
+
+## Wave 4 - Model portfolio and validation (current active model gated)
+
+- [x] inventory model assets without treating presence as configuration;
+- [x] bind the current active model to persisted Mol/Kempen Area evidence;
+- [x] retain building-only semantics for the current active detector;
+- add segmentation only with a configured model, georeferencing tests and
+  persisted polygon/mask evidence;
+- [x] require a model/region pair to pass reproducible holdout, hard-negative and
+  QA gates pass.
+
+Exit gate: UI and API operational labels are derived from validation evidence,
+not run counts; no claim that PyTorch itself is trained on themes.
+
+## Wave 5 - Release proof
+
+- run Mol/Kempen plus Walloon, Brussels, language-boundary, coastal and maritime
+  golden workflows;
+- test fresh install, upgrade, rollback, restart/resume and sustained runtime;
+- audit OpenAPI envelopes, CRS/units, provenance, exports and frontend
+  loading/empty/error states;
+- publish exact checksums, source editions, model evidence and known limitations.
+
+Exit gate: `docs/DEFINITION_OF_DONE.md` and the RC freeze are satisfied. The
+product claim remains location-complete at source-native resolution, never
+literal centimetre-resolution.
+
+## Execution order
+
+1. Finish Wave 0 and verify it live on Tower.
+2. Implement the parent/partition state machine and one GRB/orthophoto vertical
+   slice from Wave 1.
+3. Generalize that slice across compatible raster/vector providers.
+4. Deliver Wave 2 before promoting additional source cells.
+5. Run Waves 3 and 4 in parallel only where their evidence is independent.
+6. Close with Wave 5; do not advertise the audited guarantee before its gate.