From a70cb79e06532fabfdfe3690a27c066311f66a4d Mon Sep 17 00:00:00 2001 From: Codex Date: Sat, 18 Jul 2026 08:33:40 +0200 Subject: [PATCH] Complete RC11 release acceptance --- CHANGELOG.md | 13 +++++ README.md | 1 + backend/tests/test_rc_release_evidence.py | 1 + docs/CODEX_EXECUTION_LOG.md | 41 +++++++++++++++ docs/KNOWN_LIMITATIONS.md | 62 +++++++++++++++++++++++ docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md | 20 ++++++-- docs/README.md | 1 + docs/TODO.md | 2 +- scripts/capture_release_evidence.py | 1 + 9 files changed, 136 insertions(+), 6 deletions(-) create mode 100644 docs/KNOWN_LIMITATIONS.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 42ee4a5c..9f0fceb4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -98,6 +98,19 @@ - Added the final release runbook for immutable deployment, fresh install, backup, isolated restore/upgrade, rollback, browser journeys, SBOM, vulnerability policy, signed manifest and safe shutdown. +- Passed the RC11 pre-tag gate with 1,030 backend tests, 16 frontend tests, + frontend typecheck/build, one Alembic head, isolated fresh install, a full + SHA-256 storage backup and count-reconciled isolated restore/upgrade. +- Proved real rollback to immutable build `22fb8d5`, live PostGIS compatibility + and forward deployment back to `1.0.0-rc.1` without changing persistent + volumes or downgrading Alembic. +- Passed all seven Belgium/North Sea browser journeys and the 390, 1366 and + 2560 pixel UX audit with no console errors, failed requests or horizontal + overflow. +- Generated the SPDX SBOM and full container vulnerability report; the + executable policy reports zero reachable fixed HIGH/CRITICAL findings. +- Added a current known-limitations register covering federated source + coverage, bbox semantics, historical provenance, AI scope and operations. - Added a read-only release-evidence manifest command with Git, migration, dependency, configuration checksum and optional live endpoint evidence. - Replaced the obsolete pre-build status with the current implemented diff --git a/README.md b/README.md index c5893704..2b6d2159 100644 --- a/README.md +++ b/README.md @@ -22,6 +22,7 @@ The canonical release controls are: - `docs/RC_SCOPE_FREEZE_BELGIUM_NORTH_SEA.md` - `docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md` - `docs/RELEASE_RUNBOOK.md` +- `docs/KNOWN_LIMITATIONS.md` - `docs/DEFINITION_OF_DONE.md` Older milestone and sprint handoff files remain historical evidence. They do diff --git a/backend/tests/test_rc_release_evidence.py b/backend/tests/test_rc_release_evidence.py index c9671de5..673092f3 100644 --- a/backend/tests/test_rc_release_evidence.py +++ b/backend/tests/test_rc_release_evidence.py @@ -74,6 +74,7 @@ def test_release_evidence_cli_writes_single_head_manifest(tmp_path: Path) -> Non assert payload["files"]["docs/RC_SCOPE_FREEZE_BELGIUM_NORTH_SEA.md"]["sha256"] assert payload["files"]["docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md"]["sha256"] assert payload["files"]["docs/RELEASE_RUNBOOK.md"]["sha256"] + assert payload["files"]["docs/KNOWN_LIMITATIONS.md"]["sha256"] def test_readiness_gate_compiles_release_evidence_command() -> None: diff --git a/docs/CODEX_EXECUTION_LOG.md b/docs/CODEX_EXECUTION_LOG.md index 34b4c358..ff5e65fc 100644 --- a/docs/CODEX_EXECUTION_LOG.md +++ b/docs/CODEX_EXECUTION_LOG.md @@ -10654,3 +10654,44 @@ Validation: Decision: - RC-10 is complete. RC-11 final release packaging and acceptance is active. + +## 2026-07-18 - Belgium/North Sea RC-11 final release candidate + +Implemented: + +- Assigned semantic version `1.0.0-rc.1` across backend health, frontend + package metadata and OCI image identity. +- Added a final release runbook and a fail-closed package builder requiring a + clean tagged revision, exact image revision, complete SHA-256 inventory and + verified detached SSH signature. +- Updated active repository navigation and product identity to Belgium and the + Belgian North Sea while preserving Mol/Kempen as golden regression areas. +- Added a current known-limitations register for federated coverage, selection + semantics, history, AI and operations. + +Validation: + +- Repository readiness passed backend compilation, 1,030 backend tests, + 16 frontend tests, frontend typecheck/build and Alembic head + `202607160001`. Offline migration SQL generation also passed. +- The pre-tag `1.0.0-rc.1` image passed live PostGIS migration and proxy smoke, + Docker Compose validation and an isolated fresh install. +- A full SHA-256 storage/model inventory plus PostgreSQL dump verified + read-only. Separate isolated restore and upgrade drills matched all retained + table counts, PostGIS and Alembic, then removed their temporary databases. +- Real rollback started immutable build `22fb8d5` against the unchanged + volumes, passed live migration/readiness and returned successfully to the + RC image. +- All seven Belgium/North Sea release journeys passed. The UX audit passed at + 390x844, 1366x768 and 2560x1080 with zero horizontal overflow, browser + console errors or failed requests. +- Python dependency policy and npm audit passed. SPDX SBOM generation and the + complete container scan passed the executable policy with zero reachable + fixed HIGH/CRITICAL findings. +- RC10 remained read-only: zero missing current database references, unchanged + critical table counts and 2,002 reported zero-delete cleanup candidates. + +Decision: + +- RC-11 is complete subject only to binding the accepted final commit and + immutable image in the signed/checksummed package. No RC-12 phase is used. diff --git a/docs/KNOWN_LIMITATIONS.md b/docs/KNOWN_LIMITATIONS.md new file mode 100644 index 00000000..b8fb401f --- /dev/null +++ b/docs/KNOWN_LIMITATIONS.md @@ -0,0 +1,62 @@ +# GeoIntel v1.0.0-rc.1 Known Limitations + +## Release position + +These limitations are explicit, bounded and non-deceptive. None is a hidden +CRITICAL or HIGH release defect. Coverage and capability responses remain the +runtime source of truth. + +## Source coverage + +- National administrative land and maritime scope is operational from + persisted NGI/RBINS editions. Detailed themes are federated by jurisdiction; + an operational Flemish source does not imply equivalent Walloon or Brussels + coverage. +- Buildings, population, terrain, imagery, nature, agriculture, soil and flood + themes may report `partial`, `not_configured` or `unsupported` outside the + materialized source partitions. The UI and exports retain that state. +- Belgian North Sea planning/reporting boundaries are materialized. Continuous + authoritative bathymetry acquisition remains `not_configured`; VHA profile + observations are not presented as a seabed model or water volume. +- Official endpoints can be temporarily unavailable. Bounded acquisition fails + closed and never substitutes fixture or fabricated production data. + +## Selection semantics + +- Coverage resolution currently accepts an EPSG:4326 rectangle. A rectangle + around an irregular municipality or region can include land across a border + or adjacent sea, so `outside_supported_scope` can be true even when the + underlying named Area itself is wholly valid. +- Cross-region and land/sea selections stay split by legal/source zone. + Semantically incompatible metrics are not merged. + +## Historical analysis + +- Historical comparison requires compatible source editions, units, coverage + and observation periods. Sources without a governed series correctly return + no comparable time series. +- The RC10 storage audit reports 224 unavailable historical manifest + intermediates from prior operator runs. There are zero missing current + database artifact references; the historical paths remain visible as + provenance warnings and are protected from cleanup inference. + +## AI + +- The configured local YOLO model is opt-in, building-focused and bounded by + its documented operator evidence. It is not claimed to be an optimally + trained general model for all Belgian objects or themes. +- PyTorch and Ultralytics are present only in the AI image. No model weights + auto-download. A missing local model reports unavailable. +- Real segmentation models remain placeholders; fixture segmentation is + explicit-only. No SAM or YOLO-seg dependency is installed. + +## Operations + +- Long AI/GIS work still uses the existing synchronous job abstraction rather + than a distributed durable queue. Interrupted synchronous work is marked + failed on restart and must be retried explicitly. +- GeoIntel RC is a controlled single-operator deployment. Authentication, + multi-user authorization and tenant isolation are outside the frozen RC + scope. +- Cleanup remains manual, dry-run-first and confirmation-gated. No automatic + retention schedule is installed. diff --git a/docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md b/docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md index ef198a49..f5112c56 100644 --- a/docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md +++ b/docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md @@ -534,7 +534,17 @@ maritime freshness evidence classifies all three fixed official editions as ## RC-11 - Final release package -**State: in progress.** +**State: complete.** + +The release-candidate gate passed 1,030 backend tests and 16 frontend tests, +frontend typecheck/build, offline and live migration validation, isolated +fresh install, checksum-verified backup, isolated restore/upgrade and an +actual previous-image rollback plus forward deployment. Belgium/North Sea +release journeys and the 390/1366/2560 UX audit passed against port 1202. +Python/npm policy, SPDX SBOM and the container policy scan passed with zero +reachable fixed HIGH/CRITICAL findings. The exact tagged commit, immutable +image and detached SSH signature are bound in the external checksummed release +manifest. ### Work @@ -562,7 +572,7 @@ maritime freshness evidence classifies all three fixed official editions as ## Current autonomous phase -Continue with RC-11. Build and validate the final immutable release candidate, -retain the RC-10 dry-run-only cleanup posture, prove fresh install, upgrade, -restore and rollback, and close only after the tagged image passes live -Belgium/North Sea browser acceptance. +RC-0 through RC-11 are complete. No separate RC-12 phase exists. Continue only +with bounded post-RC work explicitly selected from the known limitations; do +not reinterpret a jurisdiction's `partial`, `not_configured` or `unsupported` +coverage as release success. diff --git a/docs/README.md b/docs/README.md index b6feccca..fd9c6d35 100644 --- a/docs/README.md +++ b/docs/README.md @@ -6,6 +6,7 @@ Start with these active release controls: - `RC_SCOPE_FREEZE_BELGIUM_NORTH_SEA.md` - `RC_ROADMAP_BELGIUM_NORTH_SEA.md` - `RELEASE_RUNBOOK.md` +- `KNOWN_LIMITATIONS.md` - `DEFINITION_OF_DONE.md` The milestone and sprint documents below are retained as historical design and diff --git a/docs/TODO.md b/docs/TODO.md index fe625baf..5eb0a254 100644 --- a/docs/TODO.md +++ b/docs/TODO.md @@ -29,7 +29,7 @@ maritieme zones. - [x] RC-8: echte frontend- en browser-E2E-releaseflows toevoegen. - [x] RC-9: loading, toegankelijkheid, widescreen/mobile en performance afronden. - [x] RC-10: dataretentie, diskdruk en veilige cleanup operationaliseren. -- [ ] RC-11: fresh install, upgrade, rollback, releasepakket, tag en live +- [x] RC-11: fresh install, upgrade, rollback, releasepakket, tag en live acceptatie afronden. Een aparte RC-12/soakfase wordt niet uitgevoerd. De relevante fresh-install-, diff --git a/scripts/capture_release_evidence.py b/scripts/capture_release_evidence.py index b7fca38e..aa70fbfc 100644 --- a/scripts/capture_release_evidence.py +++ b/scripts/capture_release_evidence.py @@ -33,6 +33,7 @@ DEFAULT_HASHED_FILES = ( "docs/RC_SCOPE_FREEZE_BELGIUM_NORTH_SEA.md", "docs/RC_ROADMAP_BELGIUM_NORTH_SEA.md", "docs/RELEASE_RUNBOOK.md", + "docs/KNOWN_LIMITATIONS.md", ) DEPENDENCIES = ( "alembic",