feat(provenance): govern source snapshots and data inputs

backend/tests/test_model_asset_catalog.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+from hashlib import sha256
 import json
 from pathlib import Path
 from uuid import uuid4
@@ -10,9 +11,10 @@ from fastapi.testclient import TestClient
 from app.core.config import Settings
 from app.core.errors import AppError
 from app.main import app
-from app.models import AnalysisRun, Dataset, Detection, Job, Project
+from app.models import AnalysisRun, Dataset, Detection, Job, Project, SourceRegistry, SourceSnapshot
 from app.services.detection_service import DetectionService
 from app.services.model_asset_catalog_service import ModelAssetCatalogService
+from app.services.runtime_model_provenance_service import RuntimeModelProvenanceService
 
 
 class FakeSession:
@@ -63,15 +65,47 @@ class MockYoloAdapter:
 def _project_and_raster_dataset():
     project_id = uuid4()
     dataset_id = uuid4()
+    source_registry_id = uuid4()
+    source_snapshot_id = uuid4()
+    checksum = "a" * 64
     project = Project(id=project_id, name="Geel")
+    source_registry = SourceRegistry(
+        id=source_registry_id,
+        source_key="test-derived-raster",
+        display_name="Governed test-derived raster",
+        classification="derived",
+        authority_name="GeoIntel test fixture",
+        usage_policy_json={"ground_truth_allowed": False},
+    )
+    source_snapshot = SourceSnapshot(
+        id=source_snapshot_id,
+        source_registry_id=source_registry_id,
+        snapshot_key="test-derived-raster-v1",
+        checksum_sha256=checksum,
+        freshness_status="current",
+        ingest_status="ingested",
+    )
     dataset = Dataset(
         id=dataset_id,
         project_id=project_id,
         name="source.tif",
         dataset_type="raster",
-        source="user_upload",
+        source="test-derived-raster",
+        source_name="test-derived-raster",
         storage_path="storage/uploads/source.tif",
+        checksum_sha256=checksum,
+        source_registry_id=source_registry_id,
+        source_snapshot_id=source_snapshot_id,
+        data_contract_key="geointel.raster.geotiff",
+        data_contract_version="1.0.0",
+        validation_status="passed",
+        provenance_status="complete",
+        lineage_status="not_applicable",
+        quarantine_status="not_quarantined",
+        status="ready",
     )
+    dataset.source_registry = source_registry
+    dataset.source_snapshot = source_snapshot
     db = FakeSession(objects={(Project, project_id): project, (Dataset, dataset_id): dataset})
     return db, project_id, dataset_id
 
@@ -101,6 +135,72 @@ def _manifest(tmp_path: Path) -> Path:
     return manifest_path
 
 
+def _write_model_sidecar(
+    model_path: Path,
+    settings: Settings,
+    *,
+    db: FakeSession | None = None,
+) -> None:
+    model_sha256 = sha256(model_path.read_bytes()).hexdigest()
+    source_registry_id = uuid4()
+    source_snapshot_id = uuid4()
+    source_version = settings.yolo_model_version or "test-v1"
+    if db is not None:
+        source_registry = SourceRegistry(
+            id=source_registry_id,
+            source_key="model",
+            display_name="Governed test model artifact",
+            classification="experimental",
+            authority_name="GeoIntel test fixture",
+            freshness_status="current",
+            ingest_status="configured",
+        )
+        source_snapshot = SourceSnapshot(
+            id=source_snapshot_id,
+            source_registry_id=source_registry_id,
+            snapshot_key=f"model-{source_version}",
+            source_version=source_version,
+            checksum_sha256=model_sha256,
+            freshness_status="current",
+            ingest_status="ingested",
+        )
+        db.objects[(SourceRegistry, source_registry_id)] = source_registry
+        db.objects[(SourceSnapshot, source_snapshot_id)] = source_snapshot
+    payload = {
+        "schema_version": RuntimeModelProvenanceService.MANIFEST_SCHEMA_VERSION,
+        "data_contract": {"key": "geointel.model.pytorch", "version": "1.0.0"},
+        "model": {
+            "model_id": settings.yolo_model_id,
+            "task_type": "object_detection",
+            "sha256": model_sha256,
+            "model_format": "pytorch",
+            "framework": "ultralytics/pytorch",
+            "class_mapping": {"0": "building"},
+            "source_version": source_version,
+        },
+        "source": {
+            "source_registry_id": str(source_registry_id),
+            "source_snapshot_id": str(source_snapshot_id),
+            "source_registry_key": "model",
+            "source_snapshot_checksum_sha256": model_sha256,
+        },
+        "lineage": {
+            "upstream_asset_ids": ["test-training-corpus"],
+            "upstream_checksums_sha256": ["a" * 64],
+            "transformations": [
+                {"name": "test-training", "version": "1.0.0", "checksum_sha256": "b" * 64}
+            ],
+        },
+        "metadata": {"training_manifest_sha256": "c" * 64},
+        "imported_at": "2026-08-01T10:00:00+00:00",
+    }
+    payload["metadata"]["runtime_manifest_sha256"] = RuntimeModelProvenanceService.manifest_self_checksum(payload)
+    RuntimeModelProvenanceService.manifest_path_for_model(model_path).write_text(
+        json.dumps(payload, sort_keys=True),
+        encoding="utf-8",
+    )
+
+
 def test_model_asset_catalog_lists_supported_local_model_files(tmp_path: Path) -> None:
     model_file = tmp_path / "building-detector.pt"
     model_file.write_bytes(b"local model")
@@ -190,6 +290,7 @@ def test_detection_run_persists_selected_model_asset_parameters(tmp_path: Path)
         yolo_models_dir=str(tmp_path),
         yolo_max_tiles=4,
     )
+    _write_model_sidecar(model_file, settings, db=db)
 
     result = DetectionService.run_detection(
         db=db,