Prepare GeoIntel 1.0.0 release candidate
This commit is contained in:
Codex
+23
-21
@@ -5,13 +5,18 @@ Older handoff files are historical. If documents conflict, follow the precedence
|
||||
|
||||
## Current milestone
|
||||
|
||||
**M14 — Build Launch Package**
|
||||
**v1.0.0-rc.1 - Belgium/North Sea release candidate**
|
||||
|
||||
The repository is no longer only a documentation bundle. It is now a specification-controlled engineering repo for building GeoIntel Kempen as a GeoAI Workbench.
|
||||
The implementation is in final release-candidate acceptance for Belgium and
|
||||
the Belgian North Sea. Mol and the Kempen remain golden regression areas, not
|
||||
the product boundary.
|
||||
|
||||
## Product one-liner
|
||||
|
||||
GeoIntel Kempen is a GeoAI Workbench for the Belgian Kempen that processes raster data, vector data and AI outputs into geospatially correct detections, segmentations, QA/QC metrics and exports.
|
||||
GeoIntel is a map-first GeoAI Workbench for Belgium and the Belgian North Sea
|
||||
that processes governed raster data, vector data and AI outputs into
|
||||
geospatially correct analysis, detections, segmentations, QA/QC metrics and
|
||||
exports.
|
||||
|
||||
## Non-negotiable product identity
|
||||
|
||||
@@ -35,21 +40,18 @@ GeoIntel is not primarily:
|
||||
Read these files in order before coding:
|
||||
|
||||
1. `docs/00-start/START_HERE.md`
|
||||
2. `docs/governance/GEOINTEL_CONSTITUTION.md`
|
||||
3. `docs/governance/ARCHITECTURE_INVARIANTS.md`
|
||||
4. `docs/governance/FORBIDDEN_DECISIONS.md`
|
||||
5. `docs/governance/DECISION_PRECEDENCE.md`
|
||||
6. `docs/specs/CANONICAL_DOMAIN_MODELS.md`
|
||||
7. `docs/specs/GIS_STANDARDS.md`
|
||||
8. `docs/specs/RASTER_STANDARDS.md`
|
||||
9. `docs/specs/STATE_MACHINES.md`
|
||||
10. `docs/workflows/GOLDEN_PATHS.md`
|
||||
11. `docs/build/BUILD_ORDER_DEPENDENCY_GRAPH.md`
|
||||
12. `docs/build/CODEX_OPERATING_SYSTEM.md`
|
||||
13. `docs/40-build-launch/SPRINT_1_SCOPE_FREEZE.md`
|
||||
14. `docs/40-build-launch/BUILD_SUCCESS_DEFINITION.md`
|
||||
15. `docs/40-build-launch/CODEX_STOP_RULES.md`
|
||||
16. `prompts/codex/m14/CODEX_FIRST_DAY_MASTER_PROMPT.md`
|
||||
2. `docs/RC_SCOPE_FREEZE_BELGIUM_NORTH_SEA.md`
|
||||
3. `docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md`
|
||||
4. `docs/governance/GEOINTEL_CONSTITUTION.md`
|
||||
5. `docs/governance/ARCHITECTURE_INVARIANTS.md`
|
||||
6. `docs/governance/FORBIDDEN_DECISIONS.md`
|
||||
7. `docs/API_CONTRACTS.md`
|
||||
8. `docs/DATABASE_IMPLEMENTATION_PLAN.md`
|
||||
9. `docs/DATA_SPECIFICATION.md`
|
||||
10. `docs/DATA_SOURCES.md`
|
||||
11. `docs/STORAGE_ARCHITECTURE.md`
|
||||
12. `docs/DEFINITION_OF_DONE.md`
|
||||
13. `docs/RELEASE_RUNBOOK.md`
|
||||
|
||||
## Canonical first implementation target
|
||||
|
||||
@@ -99,15 +101,15 @@ Codex may not change:
|
||||
|
||||
## Conflict resolution
|
||||
|
||||
If any older document conflicts with this M14 launch layer, follow this order:
|
||||
If any older document conflicts with the active RC layer, follow this order:
|
||||
|
||||
1. Constitution and architecture invariants.
|
||||
2. Forbidden decisions.
|
||||
3. State machines and canonical models.
|
||||
4. API/database contracts.
|
||||
5. Build order dependency graph.
|
||||
6. M14 build-launch docs for first-run scope and stop rules.
|
||||
7. Older milestone handoff documents.
|
||||
6. Belgium/North Sea scope freeze and RC roadmap.
|
||||
7. Older milestone and sprint handoff documents.
|
||||
|
||||
## Required pass ending
|
||||
|
||||
|
||||
@@ -55,7 +55,7 @@ Returns process liveness only. It never queries PostgreSQL.
|
||||
{
|
||||
"status": "ok",
|
||||
"service": "geointel-backend",
|
||||
"version": "0.1.0",
|
||||
"version": "1.0.0-rc.1",
|
||||
"build_sha": null,
|
||||
"build_time": null
|
||||
}
|
||||
@@ -75,7 +75,7 @@ degraded. Docker uses `/health/ready`.
|
||||
{
|
||||
"status": "ok",
|
||||
"service": "geointel-backend",
|
||||
"version": "0.1.0",
|
||||
"version": "1.0.0-rc.1",
|
||||
"database": "ok",
|
||||
"postgis": "ok:3.x",
|
||||
"migration": "ok:202607160001",
|
||||
@@ -105,7 +105,7 @@ envelope. PostGIS and configured YOLO state are derived at runtime.
|
||||
"sam": false,
|
||||
"grb": "bounded",
|
||||
"sentinel": "planned",
|
||||
"version": "0.1.0",
|
||||
"version": "1.0.0-rc.1",
|
||||
"build_sha": null,
|
||||
"providers": []
|
||||
}
|
||||
|
||||
@@ -21,7 +21,7 @@
|
||||
"redis": "ok",
|
||||
"storage": "ok"
|
||||
},
|
||||
"version": "0.1.0"
|
||||
"version": "1.0.0-rc.1"
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
@@ -1,6 +1,9 @@
|
||||
# Codex Bootstrap Prompt — GeoIntel Kempen
|
||||
# Codex Bootstrap Prompt - GeoIntel Belgium and the Belgian North Sea
|
||||
|
||||
You are building GeoIntel Kempen, a GeoAI Workbench for the Belgian Kempen region. The repository already contains the specification set. Read these documents before editing code:
|
||||
You are building GeoIntel, a GeoAI Workbench for Belgium and the Belgian North
|
||||
Sea. Mol and the Kempen are golden regression areas, not the product boundary.
|
||||
The repository already contains the specification set. Read these documents
|
||||
before editing code:
|
||||
|
||||
1. `docs/SPECIFICATION_FREEZE_M0.md`
|
||||
2. `docs/V1_SCOPE_FREEZE.md`
|
||||
|
||||
@@ -20,7 +20,7 @@ backward-compatible alias.
|
||||
{
|
||||
"status": "ok",
|
||||
"service": "geointel-backend",
|
||||
"version": "0.1.0",
|
||||
"version": "1.0.0-rc.1",
|
||||
"database": "ok",
|
||||
"postgis": "ok:3.x",
|
||||
"migration": "ok:202607160001",
|
||||
|
||||
+14
-5
@@ -1,6 +1,7 @@
|
||||
# Product Vision
|
||||
|
||||
GeoIntel Kempen bestaat om open en lokale geospatiale data om te zetten in bruikbare, controleerbare GeoAI-resultaten.
|
||||
GeoIntel bestaat om open en officiele geospatiale data voor Belgie en de
|
||||
Belgische Noordzee om te zetten in bruikbare, controleerbare GeoAI-resultaten.
|
||||
|
||||
## Geen klassieke GIS-viewer
|
||||
|
||||
@@ -28,19 +29,27 @@ GeoIntel moet bewijzen dat de ontwikkelaar de volledige keten begrijpt:
|
||||
8. kwaliteit meten
|
||||
9. resultaten exporteren
|
||||
|
||||
## Regionale identiteit
|
||||
## Geografische identiteit
|
||||
|
||||
De Kempen vormen de afgebakende regio. Dit maakt het project concreet, realistisch en demo-baar. Voorbeelden:
|
||||
De productscope omvat heel Belgie en de juridisch correct gelabelde Belgische
|
||||
maritieme zones. De dekking is een federatie van nationale, Vlaamse, Waalse,
|
||||
Brusselse en maritieme broncontracten; ontbrekende of gedeeltelijke dekking
|
||||
blijft zichtbaar. Voorbeelden:
|
||||
|
||||
- gebouwdetectie en infrastructuuranalyse in Mol
|
||||
- vergelijkende validatie in Geel
|
||||
- verstedelijking rond Turnhout
|
||||
- natuurfragmentatie rond Kasterlee of Retie
|
||||
|
||||
Mol is de primaire operationele focus. De standaardkaart, nieuwe AOI-context en operator-volgorde vertrekken daarom vanuit Mol. De bredere Kempen blijft bewust onderdeel van de productscope voor onafhankelijke validatie, overdraagbaarheid en regionale vergelijking.
|
||||
Mol en de Kempen blijven gouden regressiegebieden voor diepgaande validatie,
|
||||
modelkwaliteit en historische vergelijkbaarheid. Ze zijn niet langer de
|
||||
productgrens. Nieuwe kaartselecties kunnen overal binnen Belgie en de
|
||||
Belgische Noordzee liggen en behouden hun eigen bronautoriteit en beperkingen.
|
||||
|
||||
## Richting
|
||||
|
||||
De definitieve richting is:
|
||||
|
||||
> GeoIntel Kempen is een GeoAI Workbench waarmee je open geodata, luchtfoto's en satellietbeelden verwerkt tot detecties, segmentaties, veranderingen en controleerbare GIS-lagen.
|
||||
> GeoIntel is een GeoAI Workbench voor Belgie en de Belgische Noordzee waarmee
|
||||
> je open geodata, luchtfoto's en satellietbeelden verwerkt tot analyse,
|
||||
> detecties, segmentaties, veranderingen en controleerbare GIS-lagen.
|
||||
|
||||
@@ -534,6 +534,8 @@ maritime freshness evidence classifies all three fixed official editions as
|
||||
|
||||
## RC-11 - Final release package
|
||||
|
||||
**State: in progress.**
|
||||
|
||||
### Work
|
||||
|
||||
- rerun fresh-install and upgrade proof using the release image;
|
||||
|
||||
+13
-3
@@ -1,6 +1,16 @@
|
||||
# GeoIntel Docs Index
|
||||
|
||||
Start here when preparing an implementation pass.
|
||||
Start with these active release controls:
|
||||
|
||||
- `00-start/START_HERE.md`
|
||||
- `RC_SCOPE_FREEZE_BELGIUM_NORTH_SEA.md`
|
||||
- `RC_ROADMAP_BELGIUM_NORTH_SEA.md`
|
||||
- `RELEASE_RUNBOOK.md`
|
||||
- `DEFINITION_OF_DONE.md`
|
||||
|
||||
The milestone and sprint documents below are retained as historical design and
|
||||
implementation evidence. `TODO.md` is an implementation archive, not the
|
||||
active release board.
|
||||
|
||||
## Product foundation
|
||||
- PRODUCT_VISION.md
|
||||
@@ -37,13 +47,13 @@ Start here when preparing an implementation pass.
|
||||
- UI_PAGE_SPECIFICATIONS.md
|
||||
- COMPONENT_BREAKDOWN.md
|
||||
|
||||
## Execution
|
||||
## Historical execution
|
||||
- CODEX_MASTER_PROMPT.md
|
||||
- CODEX_EXECUTION_PLAN.md
|
||||
- CODEX_BUILD_PLAN.md
|
||||
- CODEX_EXECUTION_LOG.md
|
||||
- ACCEPTANCE_CRITERIA.md
|
||||
- TODO.md
|
||||
- TODO.md (historical implementation archive)
|
||||
- IMPLEMENTATION_BACKLOG.md
|
||||
- DEVELOPMENT_RULES.md
|
||||
- AGENTS.md
|
||||
|
||||
@@ -0,0 +1,182 @@
|
||||
# GeoIntel Release Runbook
|
||||
|
||||
## Scope
|
||||
|
||||
This runbook releases GeoIntel for Belgium and the Belgian North Sea. Mol and
|
||||
the Kempen remain regression references. A successful release never implies
|
||||
that every theme is operational in every jurisdiction; the coverage API and
|
||||
source provenance remain authoritative.
|
||||
|
||||
The repository version is stored in `VERSION`. The current release candidate
|
||||
is `v1.0.0-rc.1`.
|
||||
|
||||
## Mandatory preconditions
|
||||
|
||||
- clean `main` worktree at the commit being released;
|
||||
- secure non-default PostGIS password in the Tower `.env`;
|
||||
- existing local AI model only when the AI image is enabled;
|
||||
- recent checksum-verified backup with SHA-256 storage inventory;
|
||||
- Docker, `ssh-keygen`, Python 3.11, Node 20 and Bash available;
|
||||
- one Alembic head and no unsupported metric represented as successful.
|
||||
|
||||
No command in this runbook downloads AI weights or implicitly deletes
|
||||
application data.
|
||||
|
||||
## Repository gate
|
||||
|
||||
```bash
|
||||
python -m compileall backend/app
|
||||
cd backend && python -m pytest
|
||||
cd ../frontend && npm run test:unit && npm run typecheck && npm run build
|
||||
cd ..
|
||||
bash scripts/run_readiness_check.sh
|
||||
cd backend && python -m alembic heads
|
||||
python -m alembic upgrade head --sql
|
||||
cd ..
|
||||
bash -n scripts/live_migration_smoke.sh
|
||||
docker compose config
|
||||
```
|
||||
|
||||
## Immutable deployment
|
||||
|
||||
On the Codex workstation:
|
||||
|
||||
```powershell
|
||||
.\scripts\deploy_tower.ps1
|
||||
```
|
||||
|
||||
On Tower:
|
||||
|
||||
```bash
|
||||
cd /mnt/user/appdata/geointel
|
||||
docker inspect --format \
|
||||
'{{index .Config.Labels "org.opencontainers.image.version"}} {{index .Config.Labels "org.opencontainers.image.revision"}}' \
|
||||
geointel
|
||||
curl -fsS http://127.0.0.1:1202/health/ready
|
||||
bash scripts/live_migration_smoke.sh
|
||||
```
|
||||
|
||||
## Backup and recovery proof
|
||||
|
||||
Create an immutable backup. The SHA-256 inventory can take several minutes on
|
||||
large storage:
|
||||
|
||||
```bash
|
||||
bash scripts/backup_release_state.sh \
|
||||
--container geointel \
|
||||
--output-root /mnt/user/appdata/geointel/backups \
|
||||
--release-id v1.0.0-rc.1 \
|
||||
--storage-path /mnt/user/appdata/geointel/storage \
|
||||
--models-path /mnt/user/appdata/geointel/models \
|
||||
--inventory-mode sha256
|
||||
```
|
||||
|
||||
Verify and restore only into an automatically generated temporary database:
|
||||
|
||||
```bash
|
||||
bash scripts/verify_release_backup.sh \
|
||||
--backup-dir /mnt/user/appdata/geointel/backups/v1.0.0-rc.1 \
|
||||
--container geointel
|
||||
bash scripts/restore_release_backup_smoke.sh \
|
||||
--backup-dir /mnt/user/appdata/geointel/backups/v1.0.0-rc.1 \
|
||||
--container geointel \
|
||||
--confirm-isolated-restore
|
||||
bash scripts/verify_release_upgrade_smoke.sh \
|
||||
--backup-dir /mnt/user/appdata/geointel/backups/v1.0.0-rc.1 \
|
||||
--container geointel \
|
||||
--confirm-isolated-upgrade
|
||||
```
|
||||
|
||||
The restore and upgrade scripts refuse the production database name and remove
|
||||
their generated verification database.
|
||||
|
||||
## Fresh install, browser and data operations
|
||||
|
||||
```bash
|
||||
bash scripts/verify_release_fresh_install.sh \
|
||||
geointel-all-in-one:<release-commit>-ai
|
||||
bash scripts/run_rc8_release_journeys.sh \
|
||||
http://127.0.0.1:1202 artifacts/releases/v1.0.0-rc.1/rc8
|
||||
bash scripts/run_rc9_ux_audit.sh \
|
||||
http://127.0.0.1:1202 artifacts/releases/v1.0.0-rc.1/rc9
|
||||
bash scripts/run_rc10_data_operations_audit.sh \
|
||||
artifacts/releases/v1.0.0-rc.1/rc10
|
||||
```
|
||||
|
||||
The RC10 command is read-only and runs cleanup in dry-run mode only.
|
||||
|
||||
## Supply-chain evidence
|
||||
|
||||
```bash
|
||||
bash scripts/audit_python_dependencies.sh
|
||||
cd frontend && npm audit --audit-level=high
|
||||
cd ..
|
||||
bash scripts/generate_container_sbom.sh \
|
||||
geointel-all-in-one:<release-commit>-ai \
|
||||
artifacts/releases/v1.0.0-rc.1/geointel-sbom.spdx.json
|
||||
bash scripts/scan_container_image.sh \
|
||||
geointel-all-in-one:<release-commit>-ai \
|
||||
artifacts/releases/v1.0.0-rc.1/container-vulnerabilities.json
|
||||
```
|
||||
|
||||
The complete vulnerability report remains evidence. The executable policy
|
||||
gate fails on reachable fixed HIGH/CRITICAL findings.
|
||||
|
||||
## Rollback proof
|
||||
|
||||
The rollback command reuses persistent paths and never downgrades Alembic:
|
||||
|
||||
```bash
|
||||
bash deploy/unraid/rollback-dockerman-container.sh
|
||||
curl -fsS http://127.0.0.1:1202/health/ready
|
||||
bash deploy/unraid/deploy-release.sh
|
||||
curl -fsS http://127.0.0.1:1202/health/ready
|
||||
```
|
||||
|
||||
For a future backward-incompatible migration, restore the verified pre-release
|
||||
backup instead of running an older image against a newer schema.
|
||||
|
||||
## Tag and signed package
|
||||
|
||||
Create an SSH-signed Git tag at the accepted clean commit. Use a configured
|
||||
release key; never add the private key to the repository:
|
||||
|
||||
```bash
|
||||
git -c gpg.format=ssh \
|
||||
-c user.signingkey=/secure/path/release-key \
|
||||
tag -s v1.0.0-rc.1 -m "GeoIntel v1.0.0-rc.1"
|
||||
git push origin v1.0.0-rc.1
|
||||
```
|
||||
|
||||
Place the collected evidence files in an ignored package directory and create
|
||||
the detached SSH signature plus complete checksum inventory:
|
||||
|
||||
```bash
|
||||
python scripts/build_release_package.py build \
|
||||
--output-dir artifacts/releases/v1.0.0-rc.1 \
|
||||
--release-id v1.0.0-rc.1 \
|
||||
--image-name geointel-all-in-one:<release-commit>-ai \
|
||||
--image-id sha256:<image-id> \
|
||||
--image-revision <release-commit> \
|
||||
--signing-key /secure/path/release-key
|
||||
python scripts/build_release_package.py verify \
|
||||
--package-dir artifacts/releases/v1.0.0-rc.1
|
||||
```
|
||||
|
||||
The builder refuses a dirty worktree, a tag not pointing at `HEAD`, a mismatched
|
||||
image revision, missing evidence, symlinks, checksum drift or an invalid
|
||||
signature.
|
||||
|
||||
## Safe cleanup and shutdown
|
||||
|
||||
Stop only the temporary smoke container by its generated name; normal scripts
|
||||
already clean it automatically. To stop GeoIntel without deleting persistent
|
||||
data:
|
||||
|
||||
```bash
|
||||
docker stop geointel
|
||||
```
|
||||
|
||||
Do not use broad Docker volume pruning. Application cleanup remains dry-run by
|
||||
default and requires the exact confirmation, recent backup and delete ceiling
|
||||
documented in `DATA_OPERATIONS_RUNBOOK.md`.
|
||||
Reference in New Issue
Block a user