hygiene: finalize GeoIntel public release

.gitea/workflows/managed-validation.yml

@@ -23,6 +23,8 @@ jobs:
     # Gitea Actions does not consistently evaluate the GitHub-style `||`
     # expression for pull-request runs without workflow inputs.
     name: Managed repository validation
+    # Public fork code must never execute automatically on the private runner.
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:

.gitea/workflows/release-gates.yml

@@ -19,6 +19,8 @@ concurrency:
 jobs:
   quality:
     name: Compile, test, contracts and builds
+    # Public fork code must never execute automatically on the private runner.
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
@@ -74,6 +76,7 @@ jobs:
 
   dependency-audit:
     name: Python and npm vulnerability policy
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
@@ -112,6 +115,7 @@ jobs:
 
   container:
     name: Production AI image, SBOM and container scan
+    if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
     runs-on: ubuntu-latest
     timeout-minutes: 120
     steps:

README.md

@@ -257,6 +257,9 @@ originele campagnebeelden staan in
 WebP-varianten worden door de applicatie gebruikt; de PNG-bronnen blijven
 beschikbaar voor drukwerk en portfolio-opmaak.
 
+Herkomst en hergebruik van deze bestanden zijn vastgelegd in
+[Asset provenance and redistribution](docs/ASSET_PROVENANCE.md).
+
 Actuele rasterassets:
 
 | Asset | Gebruik |

SECURITY.md

@@ -8,7 +8,7 @@ explicitly documented otherwise.
 
 ## Reporting vulnerabilities
 
-Report suspected security issues privately to the repository owner. Do not put
+Report suspected security issues privately to `security@itworx.tech`. Do not put
 credentials, access tokens, private infrastructure, precise sensitive
 locations, proprietary imagery or datasets, model artifacts, production
 database contents, personal data or exploit-sensitive evidence in a public

docs/ASSET_PROVENANCE.md

@@ -0,0 +1,32 @@
+# Asset provenance and redistribution
+
+The visual files distributed with GeoIntel were created for this project and
+are released by the repository owner with the source under Apache-2.0. They do
+not include private operator data, proprietary model weights, unpublished
+imagery, or a bundled third-party geospatial dataset.
+
+## Project artwork
+
+The original PNG masters in `frontend/design-assets/portfolio/` and their
+optimized WebP derivatives in `frontend/public/portfolio/` are project artwork.
+The WebP files are mechanical resizes of the corresponding masters; the
+reproduction command is documented in `frontend/design-assets/README.md`.
+
+## Product captures and generated documents
+
+Files in `docs/assets/portfolio/` are captures or diagrams of the GeoIntel
+public-demo interface using synthetic/public demonstration content. The case
+study at `output/pdf/geointel-case-study.pdf` is generated from repository
+sources by `scripts/create_portfolio_case_study.py`.
+
+Any provider name, logo, map attribution, or dataset title visible inside a
+capture remains the property of its respective owner and is included only to
+identify the source or reproduce the application's attribution UI. This
+repository does not relicense or redistribute the underlying provider data.
+
+## Integrity
+
+Release review verifies these paths through the repository's normal Git object
+hashes and the public-release gate. Regenerated derivatives must come from a
+tracked master or reproducible repository source; do not replace them with
+unlicensed stock material, private screenshots, or local operator exports.

docs/CODEX_EXECUTION_LOG.md

@@ -4,6 +4,19 @@ This public log records release-relevant repository work only. Machine-specific
 paths, production database state, deployment addresses, model outputs and
 generated evidence remain in controlled local storage.
 
+## 2026-09-02 — public-release handoff
+
+- Added an explicit monitored reporting address to `SECURITY.md`.
+- Documented ownership, redistribution boundaries and regeneration of the
+  retained portfolio assets.
+- Confirmed the existing Linux/CUDA/Ultralytics lock is platform-specific,
+  version-pinned and SHA-256 hashed.
+- Prevented pull requests from external public forks from executing code on
+  the private validation runners; push and maintainer-dispatch gates remain.
+- Re-ran repository hygiene and full-history secret scanning successfully.
+- The complete backend, frontend, migration and container gate remains the
+  required exact-commit check before changing repository visibility.
+
 ## 2026-08-31 — public-release readiness
 
 - Confirmed Apache-2.0 as the repository license.

docs/TODO.md

@@ -5,10 +5,10 @@
 - [ ] Pass the complete backend, frontend, migration and container release gate.
 - [ ] Verify the clean-root publication candidate and local all-ref recovery
   bundle.
-- [ ] Confirm redistribution/provenance for the retained portfolio screenshots.
-- [ ] Configure a monitored private security-reporting address or Gitea security
+- [x] Confirm redistribution/provenance for the retained portfolio screenshots.
+- [x] Configure a monitored private security-reporting address or Gitea security
   channel in `SECURITY.md`.
-- [ ] Finish a fully hashed, platform-specific lock for optional CUDA/Ultralytics
+- [x] Finish a fully hashed, platform-specific lock for optional CUDA/Ultralytics
   packages; base container images are already digest-pinned.
 
 ## Product work