Prepare GeoIntel for public release

backend/tests/test_accuracy_phase4_evaluation.py

@@ -1182,7 +1182,7 @@ def test_one_workflow_is_byte_reproducible_complete_and_fail_closed(
     )
     assert input_manifest["product_baseline"]["validation_status"] == "not_evaluable"
     assert input_manifest["product_baseline"]["artifacts"] == []
-    assert "docs/accuracy-program/status.json" not in {
+    assert "fixtures/accuracy/readiness/status.json" not in {
         item["path"] for item in input_manifest["inputs"]
     }
     assert input_manifest["readiness_snapshot"]["source_paths"][
@@ -1199,11 +1199,11 @@ def test_one_workflow_is_byte_reproducible_complete_and_fail_closed(
 def test_readiness_snapshot_ignores_phase4_bookkeeping_but_binds_active_model(
     tmp_path: Path,
 ) -> None:
-    status_path = tmp_path / "docs/accuracy-program/status.json"
-    scan_path = tmp_path / "artifacts/evidence/accuracy/P3/full-scan-manifest.json"
-    leakage_path = tmp_path / "artifacts/evidence/accuracy/P3/leakage-report.json"
+    status_path = tmp_path / "fixtures/accuracy/readiness/status.json"
+    scan_path = tmp_path / "fixtures/accuracy/readiness/full-scan-manifest.json"
+    leakage_path = tmp_path / "fixtures/accuracy/readiness/leakage-report.json"
     status_path.parent.mkdir(parents=True)
-    scan_path.parent.mkdir(parents=True)
+    scan_path.parent.mkdir(parents=True, exist_ok=True)
     status = {
         "generated_at": "2026-08-02T00:00:00+02:00",
         "documents": ["old.md"],

backend/tests/test_auth.py

@@ -7,6 +7,7 @@ from uuid import UUID, uuid4
 from fastapi.testclient import TestClient
 
 from app.core.config import get_settings
+from app.core.public_demo import PUBLIC_DEMO_PROJECT_ID
 from app.db.session import get_db
 from app.main import create_app
 from app.schemas.demo import DemoWorkflowResponse
@@ -172,7 +173,7 @@ def test_operator_login_can_require_https(monkeypatch) -> None:
 
 
 def test_guest_login_exposes_models_but_rejects_management_and_cross_project_requests(monkeypatch) -> None:
-    project_id = UUID("00000000-0000-0000-0000-000000000123")
+    project_id = PUBLIC_DEMO_PROJECT_ID
     demo = DemoWorkflowResponse(
         project_id=project_id,
         area_id=UUID("00000000-0000-0000-0000-000000000124"),
@@ -252,7 +253,7 @@ def test_guest_login_exposes_models_but_rejects_management_and_cross_project_req
 
 
 def test_guest_change_detection_binds_both_datasets_to_signed_demo_project(monkeypatch) -> None:
-    project_id = UUID("00000000-0000-0000-0000-000000000123")
+    project_id = PUBLIC_DEMO_PROJECT_ID
     other_project_id = UUID("00000000-0000-0000-0000-000000000999")
     source_dataset_id = UUID("00000000-0000-0000-0000-000000000125")
     target_dataset_id = UUID("00000000-0000-0000-0000-000000000126")
@@ -342,7 +343,7 @@ def test_guest_change_detection_binds_both_datasets_to_signed_demo_project(monke
 
 
 def test_guest_can_prepare_tiles_and_queue_project_scoped_detection(monkeypatch) -> None:
-    project_id = UUID("00000000-0000-0000-0000-000000000123")
+    project_id = PUBLIC_DEMO_PROJECT_ID
     raster_dataset_id = UUID("00000000-0000-0000-0000-000000000127")
     manifest_path = "/app/storage/tiles/demo/manifest.json"
     demo = DemoWorkflowResponse(

backend/tests/test_docker_runtime_config.py

@@ -48,11 +48,14 @@ def test_all_in_one_dockerfile_can_opt_into_ai_dependencies_without_base_install
     assert "ARG GEOINTEL_INSTALL_AI=false" in dockerfile
     assert "COPY backend/pyproject.toml /app/" in dockerfile
     assert "COPY backend/requirements-runtime.lock /app/" in dockerfile
+    assert "COPY backend/requirements-ai-linux.lock /app/" in dockerfile
+    assert "COPY backend/requirements-build-tools.lock /app/" in dockerfile
     assert "COPY backend/pyproject.toml backend/README.md /app/" not in dockerfile
     assert "GeoIntel backend package metadata" in dockerfile
     assert "--require-hashes -r requirements-runtime.lock" in dockerfile
-    assert "ARG GEOINTEL_ULTRALYTICS_VERSION=" in dockerfile
-    assert '"ultralytics==$GEOINTEL_ULTRALYTICS_VERSION"' in dockerfile
+    assert "--require-hashes" in dockerfile
+    assert "-r requirements-ai-linux.lock" in dockerfile
+    assert "-r requirements-build-tools.lock" in dockerfile
     assert "python scripts/gis_import_smoke.py" in dockerfile
     assert "yolo_preflight.py" in dockerfile
     assert "libxcb1" in dockerfile
@@ -472,9 +475,10 @@ def test_all_in_one_dockerfile_caches_dependencies_and_pins_driver_compatible_cu
 
     assert metadata_copy_index < placeholder_readme_index < dependency_install_index < backend_copy_index < smoke_index
     assert "GEOINTEL_TORCH_INDEX_URL=https://download.pytorch.org/whl/cu128" in dockerfile
-    assert "GEOINTEL_TORCH_VERSION=2.11.0" in dockerfile
-    assert "GEOINTEL_TORCHVISION_VERSION=0.26.0" in dockerfile
-    assert '--index-url "$GEOINTEL_TORCH_INDEX_URL"' in dockerfile
+    assert '--extra-index-url "$GEOINTEL_TORCH_INDEX_URL"' in dockerfile
+    ai_lock = (ROOT / "backend" / "requirements-ai-linux.lock").read_text(encoding="utf-8")
+    assert "torch==2.11.0+cu128 --hash=sha256:" in ai_lock
+    assert "torchvision==0.26.0+cu128 --hash=sha256:" in ai_lock
 
 
 def test_unraid_deploy_passes_ai_build_arg_and_yolo_runtime_env() -> None:

backend/tests/test_guest_resource_scope.py

@@ -7,6 +7,7 @@ import pytest
 from fastapi.testclient import TestClient
 
 from app.core.config import get_settings
+from app.core.public_demo import PUBLIC_DEMO_PROJECT_ID
 from app.db.session import get_db
 from app.main import create_app
 from app.models import AnalysisRun, Dataset, Detection, Export, Job, Segmentation
@@ -21,7 +22,7 @@ from app.services.detection_service import DetectionService
 from app.services.segmentation_service import SegmentationService
 
 
-GUEST_PROJECT_ID = UUID("00000000-0000-0000-0000-000000000123")
+GUEST_PROJECT_ID = PUBLIC_DEMO_PROJECT_ID
 OTHER_PROJECT_ID = UUID("00000000-0000-0000-0000-000000000999")
 DATASET_ID = UUID("00000000-0000-0000-0000-000000000201")
 DETECTION_RUN_ID = UUID("00000000-0000-0000-0000-000000000202")

backend/tests/test_rc6_supply_chain.py

@@ -175,11 +175,14 @@ def test_release_image_uses_locked_non_ai_dependencies_and_npm_ci() -> None:
 
     assert "RUN npm ci" in dockerfile
     assert "COPY backend/requirements-runtime.lock /app/" in dockerfile
+    assert "COPY backend/requirements-ai-linux.lock /app/" in dockerfile
+    assert "COPY backend/requirements-build-tools.lock /app/" in dockerfile
     assert "pip install --no-cache-dir --require-hashes -r requirements-runtime.lock" in dockerfile
-    assert "ARG GEOINTEL_ULTRALYTICS_VERSION=8.4.99" in dockerfile
-    assert '"ultralytics==$GEOINTEL_ULTRALYTICS_VERSION"' in dockerfile
-    assert "ARG GEOINTEL_SETUPTOOLS_VERSION=81.0.0" in dockerfile
-    assert "ARG GEOINTEL_WHEEL_VERSION=0.47.0" in dockerfile
+    assert "-r requirements-ai-linux.lock" in dockerfile
+    assert "-r requirements-build-tools.lock" in dockerfile
+    assert "--require-hashes" in dockerfile
+    assert "ultralytics==8.4.99 --hash=sha256:" in read("backend/requirements-ai-linux.lock")
+    assert "torch==2.11.0+cu128 --hash=sha256:" in read("backend/requirements-ai-linux.lock")
     assert "COPY deploy/unraid/gosu-setpriv /usr/local/bin/gosu" in dockerfile
     assert "&& pip check" in dockerfile
 

backend/tests/test_sprint137_browser_calibration_summary_evidence_script.py

@@ -21,5 +21,5 @@ def test_evidence_bundle_script_accepts_browser_calibration_summary_export() ->
     assert "root_project_id = summary.get(\"project_id\")" in script
     assert "quality_check_ids" in script
     assert "Browser Detection Lab calibration summary" in readme
-    assert "bash scripts/export_detection_calibration_evidence.sh http://192.168.123.45:1202 ./detection-calibration-summary.json" in readme
+    assert "bash scripts/export_detection_calibration_evidence.sh http://192.0.2.10:1202 ./detection-calibration-summary.json" in readme
     assert "[x] Allow the evidence bundle script to consume Detection Lab calibration summary exports" in todo

backend/tests/test_sprint13_yolo_preflight.py

@@ -206,6 +206,7 @@ def test_yolo_preflight_can_explicitly_smoke_load_local_model(tmp_path: Path) ->
         tile_manifest_path=str(manifest_path),
         yolo_adapter_class=AvailableAdapter,
         check_model_load=True,
+        allow_offline_model_load=True,
     )
 
     assert result["status"] == "ready"
@@ -231,6 +232,7 @@ def test_yolo_preflight_reports_explicit_model_load_failure(tmp_path: Path) -> N
         tile_manifest_path=str(_manifest(tmp_path)),
         yolo_adapter_class=FailingLoadAdapter,
         check_model_load=True,
+        allow_offline_model_load=True,
     )
 
     assert result["status"] == "model_load_failed"

backend/tests/test_sprint15_demo_workflow.py

@@ -74,13 +74,13 @@ def test_demo_workflow_service_supports_container_fixture_mount() -> None:
     assert "_quality_check_matches_expected" in service
 
 
-def test_demo_workflow_prefers_complete_existing_demo_project() -> None:
+def test_demo_workflow_uses_reserved_server_owned_project_identity() -> None:
     service = (DemoWorkflowService._repo_root() / "backend" / "app" / "services" / "demo_workflow_service.py").read_text(encoding="utf-8")
 
-    assert "_has_complete_demo_state" in service
-    assert "order_by(Project.created_at.asc())" in service
-    assert "if DemoWorkflowService._has_complete_demo_state(db, project.id):" in service
-    assert "return projects[0] if projects else None" in service
+    assert "db.get(Project, DemoWorkflowService.PROJECT_ID)" in service
+    assert "PUBLIC_DEMO_PROJECT_MARKER" in service
+    assert "PUBLIC_DEMO_IDENTITY_CONFLICT" in service
+    assert "id=DemoWorkflowService.PROJECT_ID" in service
 
 
 def test_explicit_demo_seed_reactivates_an_archived_fixture_project() -> None:

backend/tests/test_sprint31_unraid_template.py

@@ -100,7 +100,7 @@ def test_unraid_all_in_one_runtime_starts_embedded_postgis_backend_and_nginx() -
     nginx_config = (ROOT / "deploy" / "unraid" / "nginx-all-in-one.conf").read_text(encoding="utf-8")
     dockerignore = (ROOT / ".dockerignore").read_text(encoding="utf-8")
 
-    assert "FROM postgres:16-bookworm AS runtime" in dockerfile
+    assert "FROM postgres:16-bookworm@sha256:" in dockerfile
     assert "postgresql-16-postgis-3" in dockerfile
     assert "postgresql-16-postgis-3-scripts" in dockerfile
     assert "ln -sf /usr/bin/python3.11 /usr/local/bin/python3" in dockerfile

backend/tests/test_sprint66_live_workspace_smoke_polish.py

@@ -13,9 +13,9 @@ def test_export_handoff_cards_use_width_aware_grid() -> None:
     assert "repeat(auto-fit, minmax(7.5rem, 1fr))" in css
 
 
-def test_live_workspace_smoke_artifacts_are_documented() -> None:
-    execution_log = (ROOT / "docs" / "CODEX_EXECUTION_LOG.md").read_text(encoding="utf-8")
+def test_public_readme_documents_desktop_and_mobile_workspace() -> None:
+    readme = (ROOT / "README.md").read_text(encoding="utf-8")
 
-    assert "Sprint 66 Live workspace smoke polish" in execution_log
-    assert "desktop and mobile screenshots" in execution_log
-    assert "no console warnings/errors" in execution_log
+    assert "geointel-workbench-wide.png" in readme
+    assert "geointel-workbench-mobile.png" in readme
+    assert "Mobiele werkruimte" in readme