hygiene: finalize GeoIntel public release

2026-09-02 23:43:03 +02:00
parent faeb58ef6d
commit 3969a35d7a
7 changed files with 58 additions and 4 deletions
@@ -0,0 +1,32 @@
+# Asset provenance and redistribution
+
+The visual files distributed with GeoIntel were created for this project and
+are released by the repository owner with the source under Apache-2.0. They do
+not include private operator data, proprietary model weights, unpublished
+imagery, or a bundled third-party geospatial dataset.
+
+## Project artwork
+
+The original PNG masters in `frontend/design-assets/portfolio/` and their
+optimized WebP derivatives in `frontend/public/portfolio/` are project artwork.
+The WebP files are mechanical resizes of the corresponding masters; the
+reproduction command is documented in `frontend/design-assets/README.md`.
+
+## Product captures and generated documents
+
+Files in `docs/assets/portfolio/` are captures or diagrams of the GeoIntel
+public-demo interface using synthetic/public demonstration content. The case
+study at `output/pdf/geointel-case-study.pdf` is generated from repository
+sources by `scripts/create_portfolio_case_study.py`.
+
+Any provider name, logo, map attribution, or dataset title visible inside a
+capture remains the property of its respective owner and is included only to
+identify the source or reproduce the application's attribution UI. This
+repository does not relicense or redistribute the underlying provider data.
+
+## Integrity
+
+Release review verifies these paths through the repository's normal Git object
+hashes and the public-release gate. Regenerated derivatives must come from a
+tracked master or reproducible repository source; do not replace them with
+unlicensed stock material, private screenshots, or local operator exports.
@@ -4,6 +4,19 @@ This public log records release-relevant repository work only. Machine-specific
 paths, production database state, deployment addresses, model outputs and
 generated evidence remain in controlled local storage.

+## 2026-09-02 — public-release handoff
+
+- Added an explicit monitored reporting address to `SECURITY.md`.
+- Documented ownership, redistribution boundaries and regeneration of the
+  retained portfolio assets.
+- Confirmed the existing Linux/CUDA/Ultralytics lock is platform-specific,
+  version-pinned and SHA-256 hashed.
+- Prevented pull requests from external public forks from executing code on
+  the private validation runners; push and maintainer-dispatch gates remain.
+- Re-ran repository hygiene and full-history secret scanning successfully.
+- The complete backend, frontend, migration and container gate remains the
+  required exact-commit check before changing repository visibility.
+
 ## 2026-08-31 — public-release readiness

 - Confirmed Apache-2.0 as the repository license.
@@ -5,10 +5,10 @@
 - [ ] Pass the complete backend, frontend, migration and container release gate.
 - [ ] Verify the clean-root publication candidate and local all-ref recovery
  bundle.
- [ ] Confirm redistribution/provenance for the retained portfolio screenshots.
- [ ] Configure a monitored private security-reporting address or Gitea security
+- [x] Confirm redistribution/provenance for the retained portfolio screenshots.
+- [x] Configure a monitored private security-reporting address or Gitea security
  channel in `SECURITY.md`.
- [ ] Finish a fully hashed, platform-specific lock for optional CUDA/Ultralytics
+- [x] Finish a fully hashed, platform-specific lock for optional CUDA/Ultralytics
  packages; base container images are already digest-pinned.

 ## Product work