From 3969a35d7af57e4d2c3b83df2328fdc931bf61cd Mon Sep 17 00:00:00 2001
From: NuklearRabbit <145918611+NuklearRabbit@users.noreply.github.com>
Date: Wed, 2 Sep 2026 23:43:03 +0200
Subject: [PATCH] hygiene: finalize GeoIntel public release

---
 .gitea/workflows/managed-validation.yml |  2 ++
 .gitea/workflows/release-gates.yml      |  4 ++++
 README.md                               |  3 +++
 SECURITY.md                             |  2 +-
 docs/ASSET_PROVENANCE.md                | 32 +++++++++++++++++++++++++
 docs/CODEX_EXECUTION_LOG.md             | 13 ++++++++++
 docs/TODO.md                            |  6 ++---
 7 files changed, 58 insertions(+), 4 deletions(-)
 create mode 100644 docs/ASSET_PROVENANCE.md

diff --git a/.gitea/workflows/managed-validation.yml b/.gitea/workflows/managed-validation.yml
index dcb89481..6f22b94c 100644
--- a/.gitea/workflows/managed-validation.yml
+++ b/.gitea/workflows/managed-validation.yml
@@ -23,6 +23,8 @@ jobs:
     # Gitea Actions does not consistently evaluate the GitHub-style `||`
     # expression for pull-request runs without workflow inputs.
     name: Managed repository validation
+    # Public fork code must never execute automatically on the private runner.
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
diff --git a/.gitea/workflows/release-gates.yml b/.gitea/workflows/release-gates.yml
index 16f5dd8a..32c60748 100644
--- a/.gitea/workflows/release-gates.yml
+++ b/.gitea/workflows/release-gates.yml
@@ -19,6 +19,8 @@ concurrency:
 jobs:
   quality:
     name: Compile, test, contracts and builds
+    # Public fork code must never execute automatically on the private runner.
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
@@ -74,6 +76,7 @@ jobs:
 
   dependency-audit:
     name: Python and npm vulnerability policy
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
@@ -112,6 +115,7 @@ jobs:
 
   container:
     name: Production AI image, SBOM and container scan
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 120
     steps:
diff --git a/README.md b/README.md
index a4de9f90..36f58660 100644
--- a/README.md
+++ b/README.md
@@ -257,6 +257,9 @@ originele campagnebeelden staan in
 WebP-varianten worden door de applicatie gebruikt; de PNG-bronnen blijven
 beschikbaar voor drukwerk en portfolio-opmaak.
 
+Herkomst en hergebruik van deze bestanden zijn vastgelegd in
+[Asset provenance and redistribution](docs/ASSET_PROVENANCE.md).
+
 Actuele rasterassets:
 
 | Asset | Gebruik |
diff --git a/SECURITY.md b/SECURITY.md
index a63d0d86..b443667f 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -8,7 +8,7 @@ explicitly documented otherwise.
 
 ## Reporting vulnerabilities
 
-Report suspected security issues privately to the repository owner. Do not put
+Report suspected security issues privately to `security@itworx.tech`. Do not put
 credentials, access tokens, private infrastructure, precise sensitive
 locations, proprietary imagery or datasets, model artifacts, production
 database contents, personal data or exploit-sensitive evidence in a public
diff --git a/docs/ASSET_PROVENANCE.md b/docs/ASSET_PROVENANCE.md
new file mode 100644
index 00000000..16dcd5a5
--- /dev/null
+++ b/docs/ASSET_PROVENANCE.md
@@ -0,0 +1,32 @@
+# Asset provenance and redistribution
+
+The visual files distributed with GeoIntel were created for this project and
+are released by the repository owner with the source under Apache-2.0. They do
+not include private operator data, proprietary model weights, unpublished
+imagery, or a bundled third-party geospatial dataset.
+
+## Project artwork
+
+The original PNG masters in `frontend/design-assets/portfolio/` and their
+optimized WebP derivatives in `frontend/public/portfolio/` are project artwork.
+The WebP files are mechanical resizes of the corresponding masters; the
+reproduction command is documented in `frontend/design-assets/README.md`.
+
+## Product captures and generated documents
+
+Files in `docs/assets/portfolio/` are captures or diagrams of the GeoIntel
+public-demo interface using synthetic/public demonstration content. The case
+study at `output/pdf/geointel-case-study.pdf` is generated from repository
+sources by `scripts/create_portfolio_case_study.py`.
+
+Any provider name, logo, map attribution, or dataset title visible inside a
+capture remains the property of its respective owner and is included only to
+identify the source or reproduce the application's attribution UI. This
+repository does not relicense or redistribute the underlying provider data.
+
+## Integrity
+
+Release review verifies these paths through the repository's normal Git object
+hashes and the public-release gate. Regenerated derivatives must come from a
+tracked master or reproducible repository source; do not replace them with
+unlicensed stock material, private screenshots, or local operator exports.
diff --git a/docs/CODEX_EXECUTION_LOG.md b/docs/CODEX_EXECUTION_LOG.md
index 89a9657b..5f6f1639 100644
--- a/docs/CODEX_EXECUTION_LOG.md
+++ b/docs/CODEX_EXECUTION_LOG.md
@@ -4,6 +4,19 @@ This public log records release-relevant repository work only. Machine-specific
 paths, production database state, deployment addresses, model outputs and
 generated evidence remain in controlled local storage.
 
+## 2026-09-02 — public-release handoff
+
+- Added an explicit monitored reporting address to `SECURITY.md`.
+- Documented ownership, redistribution boundaries and regeneration of the
+  retained portfolio assets.
+- Confirmed the existing Linux/CUDA/Ultralytics lock is platform-specific,
+  version-pinned and SHA-256 hashed.
+- Prevented pull requests from external public forks from executing code on
+  the private validation runners; push and maintainer-dispatch gates remain.
+- Re-ran repository hygiene and full-history secret scanning successfully.
+- The complete backend, frontend, migration and container gate remains the
+  required exact-commit check before changing repository visibility.
+
 ## 2026-08-31 — public-release readiness
 
 - Confirmed Apache-2.0 as the repository license.
diff --git a/docs/TODO.md b/docs/TODO.md
index e052bdf1..8cd2e715 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -5,10 +5,10 @@
 - [ ] Pass the complete backend, frontend, migration and container release gate.
 - [ ] Verify the clean-root publication candidate and local all-ref recovery
   bundle.
-- [ ] Confirm redistribution/provenance for the retained portfolio screenshots.
-- [ ] Configure a monitored private security-reporting address or Gitea security
+- [x] Confirm redistribution/provenance for the retained portfolio screenshots.
+- [x] Configure a monitored private security-reporting address or Gitea security
   channel in `SECURITY.md`.
-- [ ] Finish a fully hashed, platform-specific lock for optional CUDA/Ultralytics
+- [x] Finish a fully hashed, platform-specific lock for optional CUDA/Ultralytics
   packages; base container images are already digest-pinned.
 
 ## Product work