fix(ai): bind model scope to immutable geometry

deploy/unraid/Dockerfile.all-in-one

@@ -113,6 +113,7 @@ COPY scripts/provision_buildings_addresses_register.py /app/scripts/provision_bu
 COPY scripts/provision_regional_timeseries.py /app/scripts/provision_regional_timeseries.py
 COPY scripts/geographic_scopes.py /app/scripts/geographic_scopes.py
 COPY scripts/provision_geographic_scope.py /app/scripts/provision_geographic_scope.py
+COPY scripts/build_model_validation_scope_manifest.py /app/scripts/build_model_validation_scope_manifest.py
 COPY scripts/provision_belgium_north_sea_scope.py /app/scripts/provision_belgium_north_sea_scope.py
 COPY scripts/provision_release_golden_areas.py /app/scripts/provision_release_golden_areas.py
 COPY scripts/provision_regional_grb_buildings.py /app/scripts/provision_regional_grb_buildings.py

deploy/unraid/geointel-unraid-template.xml

@@ -137,8 +137,10 @@
   <Config Name="YOLO Device" Target="YOLO_DEVICE" Default="cuda:0" Mode="" Description="Required NVIDIA CUDA inference device." Type="Variable" Display="advanced" Required="true" Mask="false">cuda:0</Config>
   <Config Name="Require CUDA" Target="YOLO_REQUIRE_CUDA" Default="true" Mode="" Description="Fail closed instead of silently falling back to CPU when NVIDIA CUDA is unavailable." Type="Variable" Display="advanced" Required="true" Mask="false">true</Config>
   <Config Name="YOLO Classes" Target="YOLO_MODEL_CLASSES" Default="building" Mode="" Description="Comma-separated classes proven for the active model; the current promoted model is building-only." Type="Variable" Display="advanced" Required="true" Mask="false">building</Config>
-  <Config Name="Enforce YOLO Scope" Target="YOLO_ENFORCE_VALIDATION_SCOPE" Default="true" Mode="" Description="Reject inference outside persisted validated Areas." Type="Variable" Display="advanced" Required="true" Mask="false">true</Config>
-  <Config Name="Validated YOLO Areas" Target="YOLO_VALIDATED_AREA_NAMES" Default="Mol,Kempen" Mode="" Description="Persisted Area name tokens with promotion evidence for the active model." Type="Variable" Display="advanced" Required="true" Mask="false">Mol,Kempen</Config>
+  <Config Name="Enforce YOLO Scope" Target="YOLO_ENFORCE_VALIDATION_SCOPE" Default="true" Mode="" Description="Reject inference outside the checksum-bound model validation geometry." Type="Variable" Display="advanced" Required="true" Mask="false">true</Config>
+  <Config Name="YOLO Scope Manifest" Target="YOLO_VALIDATION_SCOPE_MANIFEST_PATH" Default="/app/storage/operator-data/model-validation-scopes/active-building-model.json" Mode="" Description="Immutable model-bound EPSG:4326 validation-scope manifest." Type="Variable" Display="advanced" Required="true" Mask="false">/app/storage/operator-data/model-validation-scopes/active-building-model.json</Config>
+  <Config Name="YOLO Scope Manifest SHA256" Target="YOLO_VALIDATION_SCOPE_MANIFEST_SHA256" Default="" Mode="" Description="Exact lowercase SHA-256 of the validation-scope manifest." Type="Variable" Display="advanced" Required="true" Mask="false"></Config>
+  <Config Name="Validated YOLO Areas (Display Only)" Target="YOLO_VALIDATED_AREA_NAMES" Default="Mol,Kempen" Mode="" Description="Deprecated display metadata; never authorizes inference." Type="Variable" Display="advanced" Required="false" Mask="false">Mol,Kempen</Config>
   <Config Name="YOLO Image Size" Target="YOLO_IMAGE_SIZE" Default="640" Mode="" Description="Inference image size in pixels." Type="Variable" Display="advanced" Required="true" Mask="false">640</Config>
   <Config Name="YOLO Maximum Tiles" Target="YOLO_MAX_TILES" Default="100" Mode="" Description="Hard tile limit per detection run." Type="Variable" Display="advanced" Required="true" Mask="false">100</Config>
   <Config Name="YOLO Maximum Detections" Target="YOLO_MAX_DETECTIONS" Default="1000" Mode="" Description="Hard persisted detection limit per run." Type="Variable" Display="advanced" Required="true" Mask="false">1000</Config>

deploy/unraid/geointel.env.example

@@ -166,6 +166,9 @@ YOLO_DEVICE=cuda:0
 YOLO_REQUIRE_CUDA=true
 YOLO_MODEL_CLASSES=building
 YOLO_ENFORCE_VALIDATION_SCOPE=true
+YOLO_VALIDATION_SCOPE_MANIFEST_PATH=/app/storage/operator-data/model-validation-scopes/active-building-model.json
+YOLO_VALIDATION_SCOPE_MANIFEST_SHA256=
+# Deprecated display metadata; never used as an inference authorization gate.
 YOLO_VALIDATED_AREA_NAMES=Mol,Kempen
 YOLO_IMAGE_SIZE=640
 YOLO_MAX_TILES=100

deploy/unraid/run-dockerman-container.sh

@@ -136,6 +136,8 @@ YOLO_MODEL_DISPLAY_NAME="${YOLO_MODEL_DISPLAY_NAME:-Configured YOLO detector}"
 YOLO_MODEL_VERSION="${YOLO_MODEL_VERSION:-}"
 YOLO_MODEL_CLASSES="${YOLO_MODEL_CLASSES:-building}"
 YOLO_ENFORCE_VALIDATION_SCOPE="${YOLO_ENFORCE_VALIDATION_SCOPE:-true}"
+YOLO_VALIDATION_SCOPE_MANIFEST_PATH="${YOLO_VALIDATION_SCOPE_MANIFEST_PATH:-}"
+YOLO_VALIDATION_SCOPE_MANIFEST_SHA256="${YOLO_VALIDATION_SCOPE_MANIFEST_SHA256:-}"
 YOLO_VALIDATED_AREA_NAMES="${YOLO_VALIDATED_AREA_NAMES:-Mol,Kempen}"
 YOLO_CONFIG_DIR="${YOLO_CONFIG_DIR:-/app/storage/ultralytics}"
 YOLO_DEVICE="${YOLO_DEVICE:-cuda:0}"
@@ -413,6 +415,8 @@ docker run -d \
   -e YOLO_MODEL_VERSION="$YOLO_MODEL_VERSION" \
   -e YOLO_MODEL_CLASSES="$YOLO_MODEL_CLASSES" \
   -e YOLO_ENFORCE_VALIDATION_SCOPE="$YOLO_ENFORCE_VALIDATION_SCOPE" \
+  -e YOLO_VALIDATION_SCOPE_MANIFEST_PATH="$YOLO_VALIDATION_SCOPE_MANIFEST_PATH" \
+  -e YOLO_VALIDATION_SCOPE_MANIFEST_SHA256="$YOLO_VALIDATION_SCOPE_MANIFEST_SHA256" \
   -e YOLO_VALIDATED_AREA_NAMES="$YOLO_VALIDATED_AREA_NAMES" \
   -e YOLO_CONFIG_DIR="$YOLO_CONFIG_DIR" \
   -e YOLO_DEVICE="$YOLO_DEVICE" \